joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419b90
Capabilities:
Get common file path
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x46d566
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x484
lea ecx, [esp + 8]
call fcn.00417560
mov eax, dword [esp + 0x494]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x490], 0
call fcn.00418210
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.00418410
lea ecx, [esp + 8]
call fcn.00417690
test eax, eax
jne 0x419c16
lea ecx, [esp + 8]
mov dword [esp + 0x48c], 0xffffffff
call fcn.00417620
or eax, 0xffffffff
mov ecx, dword [esp + 0x484]
mov dword fs:[0], ecx
add esp, 0x490
ret
push esi
push edi
lea ecx, [esp + 0x70]
call fcn.00446730
lea ecx, [esp + 0x10]
mov byte [esp + 0x494], 1
call fcn.00417ae0
test al, al
jne 0x419c78
lea ecx, [esp + 0x70]
call fcn.00446780
test al, al
jne 0x419c78
mov edi, dword [esp + 0x4a0]
lea ecx, [esp + 8]
push edi
push ecx
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
lea ecx, [esp + 0x30]
call fcn.00417970
push eax
push 0xfa1
call fcn.0043cbd0
jmp 0x419cab
mov edi, dword [esp + 0x4a0]
lea edx, [esp + 8]
push edi
push edx
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
lea ecx, [esp + 0x30]
call fcn.00417cf0
push eax
push 0xfa0
call fcn.0043ca60
add esp, 0x28
mov esi, eax
test edi, edi
je 0x419d11
cmp esi, 0xffffffff
jne 0x419d16
lea eax, [esp + 0x298]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [edi]
lea eax, [esp + 0x298]
push eax
push str.CurrentDir
mov ecx, edi
call dword [edx + 0x28]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x108]
push ecx
push edx
mov dword [esp + 0x14], 0x190
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [edi]
lea ecx, [esp + 0x108]
push ecx
push str.LoggedOnUser
mov ecx, edi
call dword [eax + 0x28]
jmp 0x419d23
cmp esi, 0xffffffff
je 0x419d23
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x70]
mov byte [esp + 0x494], 0
call fcn.00446770
lea ecx, [esp + 0x10]
mov dword [esp + 0x494], 0xffffffff
call fcn.00417620
mov ecx, dword [esp + 0x48c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x490
ret
Function at 0x419d70
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x46d591
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
push esi
push edi
lea ecx, [esp + 0x28]
call fcn.00417560
mov eax, dword [esp + 0x130]
lea ecx, [esp + 0x28]
push eax
mov dword [esp + 0x12c], 0
call fcn.00418210
push 0x5c
push 0x2f
lea ecx, [esp + 0x30]
call fcn.00418410
lea ecx, [esp + 0x88]
call fcn.00446730
mov bl, 1
lea ecx, [esp + 0x88]
mov byte [esp + 0x128], bl
call fcn.00446780
test al, al
push 0
lea ecx, [esp + 0x2c]
je 0x419dfb
call fcn.00417cf0
push eax
call fcn.0043d140
add esp, 8
jmp 0x419e07
call fcn.00417970
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x419e5c
mov edi, dword [esp + 0x134]
test edi, edi
je 0x419e5a
push ebp
lea ecx, [esp + 0x10]
call fcn.004146b0
lea ecx, [esp + 0x10]
mov byte [esp + 0x12c], 2
call fcn.004159e0
mov ebp, dword [edi]
lea ecx, [esp + 0x10]
call fcn.00443b00
push eax
push str.errorMsg
mov ecx, edi
call dword [ebp + 0x28]
lea ecx, [esp + 0x10]
mov byte [esp + 0x12c], bl
call fcn.004149a0
pop ebp
test esi, esi
lea ecx, [esp + 0x88]
mov byte [esp + 0x128], 0
setne bl
call fcn.00446770
lea ecx, [esp + 0x28]
mov dword [esp + 0x128], 0xffffffff
call fcn.00417620
mov ecx, dword [esp + 0x120]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x120
ret

Function at 0x419eb0
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x46d5b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
lea ecx, [esp]
call fcn.00417560
mov eax, dword [esp + 0x108]
lea ecx, [esp]
push eax
mov dword [esp + 0x104], 0
call fcn.00418210
push 0x5c
push 0x2f
lea ecx, [esp + 8]
call fcn.00418410
lea ecx, [esp + 0x60]
call fcn.00446730
lea ecx, [esp + 0x60]
mov byte [esp + 0x100], 1
call fcn.00446780
test al, al
lea ecx, [esp]
je 0x419f2d
call fcn.00417cf0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x419f39
call fcn.00417970
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
push ebx
lea ecx, [esp + 0x64]
setne bl
mov byte [esp + 0x104], 0
call fcn.00446770
lea ecx, [esp + 4]
mov dword [esp + 0x104], 0xffffffff
call fcn.00417620
mov ecx, dword [esp + 0xfc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x104
ret
Function at 0x419f80
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x46d5d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
lea ecx, [esp]
call fcn.00417560
mov eax, dword [esp + 0x108]
lea ecx, [esp]
push eax
mov dword [esp + 0x104], 0
call fcn.00418210
push 0x5c
push 0x2f
lea ecx, [esp + 8]
call fcn.00418410
lea ecx, [esp + 0x60]
call fcn.00446730
lea ecx, [esp + 0x60]
mov byte [esp + 0x100], 1
call fcn.00446780
test al, al
je 0x41a007
mov ecx, dword [esp + 0x10c]
push ecx
lea ecx, [esp + 4]
call fcn.00417cf0
push eax
call fcn.0043d160
add esp, 8
jmp 0x41a01f
mov edx, dword [esp + 0x10c]
lea ecx, [esp]
push edx
call fcn.00417970
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
push ebx
lea ecx, [esp + 0x64]
setne bl
mov byte [esp + 0x104], 0
call fcn.00446770
lea ecx, [esp + 4]
mov dword [esp + 0x104], 0xffffffff
call fcn.00417620
mov ecx, dword [esp + 0xfc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x104
ret

Function at 0x41a070
Capabilities:
Access peb ldr_data
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x46d5e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov ecx, dword [esp + 0x30]
lea eax, [esp]
push edi
xor edi, edi
push eax
push ecx
mov dword [esp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x41a108
push esi
mov esi, dword [esp + 0x3c]
cmp esi, edi
je 0x41a0f1
lea ecx, [esp + 0xc]
call fcn.004146b0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], edi
call fcn.004159e0
mov edi, dword [esi]
lea ecx, [esp + 0xc]
call fcn.00443b00
push eax
mov ecx, esi
call dword [edi + 0x10]
mov edx, dword [esi]
push str.Failed_to_get_file_size__64_
mov ecx, esi
call dword [edx + 0x10]
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004149a0
or eax, 0xffffffff
pop esi
or edx, 0xffffffff
pop edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov ecx, dword [esp + 4]
push ecx
push eax
call fcn.004409c0
mov ecx, dword [esp + 0x2c]
add esp, 8
mov dword fs:[0], ecx
pop edi
add esp, 0x2c
ret
Function at 0x41a130
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46d613
push eax
mov eax, dword [esp + 0x18]
mov dword fs:[0], esp
sub esp, 0x80
mov byte [eax], 0
push ebx
mov ebx, dword [esp + 0x94]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
jne 0x41a16a
xor eax, eax
jmp 0x41a2d7
cmp byte [ebx], 0
jne 0x41a176
xor eax, eax
jmp 0x41a2d7
lea ecx, [esp + 0x30]
call fcn.00417560
push ebx
lea ecx, [esp + 0x34]
mov dword [esp + 0x9c], ebp
call fcn.00417770
push 0x5c
push 0x2f
lea ecx, [esp + 0x38]
call fcn.00418410
mov esi, dword [esp + 0xa4]
lea ecx, [esp + 0x30]
push esi
push ecx
call fcn.00419490
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x41a1d0
lea ecx, [esp + 0x30]
mov dword [esp + 0x98], eax
call fcn.00417620
xor eax, eax
jmp 0x41a2d7
lea edx, [esp + 0x10]
mov dword [esp + 0x10], ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x41a263
test esi, esi
je 0x41a240
lea ecx, [esp + 0x14]
call fcn.004146b0
lea ecx, [esp + 0x14]
mov byte [esp + 0x98], 1
call fcn.004159e0
mov ebp, dword [esi]
lea ecx, [esp + 0x14]
call fcn.00443b00
push eax
mov ecx, esi
call dword [ebp + 0x10]
mov eax, dword [esi]
push ebx
push str.filename
mov ecx, esi
call dword [eax + 0x28]
mov edx, dword [esi]
push str.Failed_to_get_file_size__ANSI_
mov ecx, esi
call dword [edx + 0x10]
lea ecx, [esp + 0x14]
mov byte [esp + 0x98], 0
call fcn.004149a0
push 0
push edi
call fcn.0043ca40
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0x98], 0xffffffff
call fcn.00417620
xor eax, eax
jmp 0x41a2d7
push 0
push edi
call fcn.0043ca40
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x41a2b7
test esi, esi
je 0x41a29f
mov eax, dword [esi]
push str.File_too_large_for_32_bits
mov ecx, esi
call dword [eax + 0x10]
mov edx, dword [esi]
push ebx
push str.filename
mov ecx, esi
call dword [edx + 0x28]
mov eax, dword [esi]
push str.Failed_to_get_file_size.
mov ecx, esi
call dword [eax + 0x10]
lea ecx, [esp + 0x30]
mov dword [esp + 0x98], 0xffffffff
call fcn.00417620
xor eax, eax
jmp 0x41a2d7
mov ecx, dword [esp + 0xa8]
mov dword [esp + 0x98], 0xffffffff
mov byte [ecx], 1
lea ecx, [esp + 0x30]
call fcn.00417620
mov eax, ebp
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x8c
ret
Function at 0x41a2f0
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46d633
push eax
mov eax, dword [esp + 0x18]
mov dword fs:[0], esp
sub esp, 0x80
mov byte [eax], 0
push ebx
mov ebx, dword [esp + 0x94]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
jne 0x41a32a
xor eax, eax
jmp 0x41a497
cmp word [ebx], bp
jne 0x41a336
xor eax, eax
jmp 0x41a497
lea ecx, [esp + 0x30]
call fcn.00417560
push ebx
lea ecx, [esp + 0x34]
mov dword [esp + 0x9c], ebp
call fcn.00417890
push 0x5c
push 0x2f
lea ecx, [esp + 0x38]
call fcn.00418410
mov esi, dword [esp + 0xa4]
lea ecx, [esp + 0x30]
push esi
push ecx
call fcn.00419490
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x41a390
lea ecx, [esp + 0x30]
mov dword [esp + 0x98], eax
call fcn.00417620
xor eax, eax
jmp 0x41a497
lea edx, [esp + 0x10]
mov dword [esp + 0x10], ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x41a423
test esi, esi
je 0x41a400
lea ecx, [esp + 0x14]
call fcn.004146b0
lea ecx, [esp + 0x14]
mov byte [esp + 0x98], 1
call fcn.004159e0
mov ebp, dword [esi]
lea ecx, [esp + 0x14]
call fcn.00443b00
push eax
mov ecx, esi
call dword [ebp + 0x10]
mov eax, dword [esi]
push ebx
push str.filename
mov ecx, esi
call dword [eax + 0x28]
mov edx, dword [esi]
push str.Failed_to_get_file_size__Unicode_
mov ecx, esi
call dword [edx + 0x10]
lea ecx, [esp + 0x14]
mov byte [esp + 0x98], 0
call fcn.004149a0
push 0
push edi
call fcn.0043ca40
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0x98], 0xffffffff
call fcn.00417620
xor eax, eax
jmp 0x41a497
push 0
push edi
call fcn.0043ca40
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x41a477
test esi, esi
je 0x41a45f
mov eax, dword [esi]
push str.File_too_large_for_32_bits
mov ecx, esi
call dword [eax + 0x10]
mov edx, dword [esi]
push ebx
push str.filename
mov ecx, esi
call dword [edx + 0x28]
mov eax, dword [esi]
push str.Failed_to_get_file_size
mov ecx, esi
call dword [eax + 0x10]
lea ecx, [esp + 0x30]
mov dword [esp + 0x98], 0xffffffff
call fcn.00417620
xor eax, eax
jmp 0x41a497
mov ecx, dword [esp + 0xa8]
mov dword [esp + 0x98], 0xffffffff
mov byte [ecx], 1
lea ecx, [esp + 0x30]
call fcn.00417620
mov eax, ebp
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x8c
ret
Function at 0x41b5c0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46d883
push eax
mov dword fs:[0], esp
sub esp, 0x80
push ebx
mov ebx, dword [esp + 0x94]
push ebp
push esi
test ebx, ebx
push edi
jne 0x41b5f1
xor al, al
jmp 0x41b74a
cmp byte [ebx], 0
jne 0x41b5fd
xor al, al
jmp 0x41b74a
lea ecx, [esp + 0x30]
call fcn.00417560
push ebx
lea ecx, [esp + 0x34]
mov dword [esp + 0x9c], 0
call fcn.00417770
mov esi, dword [esp + 0xac]
lea eax, [esp + 0x30]
push esi
push eax
push 0x33
call fcn.00418db0
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
jne 0x41b671
test esi, esi
je 0x41b656
push ebx
push str.ansiFilename
mov ecx, esi
call fcn.0043f3b0
mov edx, dword [esi]
push str.Failed_to_write_complete_file__7_
mov ecx, esi
call dword [edx + 0x10]
lea ecx, [esp + 0x30]
mov dword [esp + 0x98], 0xffffffff
call fcn.00417620
xor al, al
jmp 0x41b74a
mov eax, dword [esp + 0xa4]
test eax, eax
je 0x41b729
mov ebp, dword [esp + 0xa8]
test ebp, ebp
je 0x41b729
lea ecx, [esp + 0x10]
push 0
push ecx
push ebp
push eax
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x10], ebp
je 0x41b729
test esi, esi
je 0x41b706
lea ecx, [esp + 0x14]
call fcn.004146b0
lea ecx, [esp + 0x14]
mov byte [esp + 0x98], 1
call fcn.004159e0
push ebx
push str.ansiFilename2
mov ecx, esi
call fcn.0043f3b0
mov ebx, dword [esi]
lea ecx, [esp + 0x14]
call fcn.00443b00
push eax
mov ecx, esi
call dword [ebx + 0x10]
mov edx, dword [esi]
push str.Failed_to_write_complete_file__1_
mov ecx, esi
call dword [edx + 0x10]
lea ecx, [esp + 0x14]
mov byte [esp + 0x98], 0
call fcn.004149a0
push 0
push edi
call fcn.0043ca40
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0x98], 0xffffffff
call fcn.00417620
xor al, al
jmp 0x41b74a
push 0
push edi
call fcn.0043ca40
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0x98], 0xffffffff
call fcn.00417620
mov al, 1
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x8c
ret
Function at 0x41b770
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46d8ae
push eax
mov dword fs:[0], esp
sub esp, 0xe0
push ebx
push ebp
mov ebp, dword [esp + 0xf8]
xor ebx, ebx
push esi
cmp ebp, ebx
push edi
jne 0x41b7a3
xor al, al
jmp 0x41b917
lea ecx, [esp + 0x30]
call fcn.00417560
push ebp
lea ecx, [esp + 0x34]
mov dword [esp + 0xfc], ebx
call fcn.00417890
mov esi, dword [esp + 0x10c]
lea eax, [esp + 0x30]
push esi
push eax
push 0x34
call fcn.00418db0
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
jne 0x41b853
cmp esi, ebx
je 0x41b838
lea ecx, [esp + 0x90]
call fcn.00417560
push ebp
lea ecx, [esp + 0x94]
mov byte [esp + 0xfc], 1
call fcn.00417890
lea ecx, [esp + 0x90]
call fcn.00417fe0
push eax
push str.utf8Filename
mov ecx, esi
call fcn.0043f3b0
mov edx, dword [esi]
push str.Failed_to_write_complete_file__6_
mov ecx, esi
call dword [edx + 0x10]
lea ecx, [esp + 0x90]
mov byte [esp + 0xf8], bl
call fcn.00417620
lea ecx, [esp + 0x30]
mov dword [esp + 0xf8], 0xffffffff
call fcn.00417620
xor al, al
jmp 0x41b917
mov eax, dword [esp + 0x104]
cmp eax, ebx
je 0x41b8f7
mov ebp, dword [esp + 0x108]
cmp ebp, ebx
je 0x41b8f7
lea ecx, [esp + 0x10]
push ebx
push ecx
push ebp
push eax
push edi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x10], ebp
je 0x41b8f7
cmp esi, ebx
je 0x41b8d5
lea ecx, [esp + 0x14]
call fcn.004146b0
lea ecx, [esp + 0x14]
mov byte [esp + 0xf8], 2
call fcn.004159e0
mov ebp, dword [esi]
lea ecx, [esp + 0x14]
call fcn.00443b00
push eax
mov ecx, esi
call dword [ebp + 0x10]
mov edx, dword [esi]
push str.Failed_to_write_complete_file__3_
mov ecx, esi
call dword [edx + 0x10]
lea ecx, [esp + 0x14]
mov byte [esp + 0xf8], bl
call fcn.004149a0
push ebx
push edi
call fcn.0043ca40
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0xf8], 0xffffffff
call fcn.00417620
xor al, al
jmp 0x41b917
push ebx
push edi
call fcn.0043ca40
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0xf8], 0xffffffff
call fcn.00417620
mov al, 1
mov ecx, dword [esp + 0xf0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xec
ret
Function at 0x41e6a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46db94
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
lea ecx, [esi + 0xc]
mov byte [esi + 8], bl
call fcn.004146b0
lea ecx, [esi + 0x38]
mov dword [esp + 0x14], ebx
mov byte [esi + 0x28], bl
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
call fcn.00420bd0
lea ecx, [esi + 0xa8]
mov byte [esp + 0x14], 1
call fcn.004146b0
lea ecx, [esi + 0xc4]
mov byte [esp + 0x14], 2
call fcn.004146b0
mov ecx, dword [esp + 0xc]
mov dword [esi], vtable.HttpResult.0
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x41ec10
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46de18
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push edi
mov edi, ecx
lea ebx, [edi + 0x10]
mov ecx, ebx
call fcn.00443b10
test eax, eax
je 0x41ec60
mov ecx, dword [esp + 0x3c]
push ebx
call fcn.004156e0
mov ecx, dword [esp + 0x40]
mov eax, dword [edi + 0xc]
pop edi
pop ebx
mov dword [ecx], eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x14
mov edx, dword [esp + 0x38]
push ebp
push esi
push 5
push str.https
push edx
mov ebp, str.http
call fcn.0045d5d0
add esp, 0xc
test eax, eax
jne 0x41ec84
mov ebp, str.https
lea ecx, [esp + 0x14]
mov byte [esp + 0x10], 0
call fcn.004146b0
mov al, byte [edi + 8]
mov dword [esp + 0x38], 0
test al, al
je 0x41ed8f
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x10]
push esi
lea ecx, [esp + 0x18]
push eax
push ecx
push ebp
call fcn.00446cb0
add esp, 0x10
lea ecx, [esp + 0x14]
call fcn.00443b10
test eax, eax
je 0x41ecfd
cmp dword [esp + 0x50], 0x64
je 0x41ecfd
mov ebp, dword [esi]
lea ecx, [esp + 0x14]
call fcn.00443b00
push eax
push str.IE_Proxy
mov ecx, esi
call dword [ebp + 0x28]
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
and eax, 0xff
mov ecx, esi
push eax
push str.IE_ProxyEnabled
call dword [edx + 0x2c]
mov al, byte [esp + 0x10]
test al, al
jne 0x41ed0e
lea ecx, [esp + 0x14]
call fcn.00413a90
mov al, byte [edi + 8]
test al, al
je 0x41ed8f
mov al, byte [esp + 0x10]
test al, al
je 0x41ed8f
lea ecx, [esp + 0x14]
call fcn.00443b10
test eax, eax
je 0x41ed8f
lea ecx, [esp + 0x14]
call fcn.00443b00
mov edi, eax
push 0x3a
push edi
call fcn.0045d810
mov esi, eax
add esp, 8
test esi, esi
je 0x41ed79
mov eax, dword [esp + 0x48]
inc esi
push eax
push 0x481cf8
push esi
mov dword [eax], 0x50
call fcn.0045d58c
mov ebx, dword [esp + 0x50]
add esp, 0xc
mov ecx, ebx
call fcn.00413a90
sub esi, edi
mov ecx, ebx
dec esi
push esi
push edi
call fcn.00414430
jmp 0x41eda2
mov ecx, dword [esp + 0x44]
push edi
call fcn.00415650
mov ecx, dword [esp + 0x48]
mov dword [ecx], 0x50
jmp 0x41eda2
mov ecx, dword [esp + 0x44]
push ebx
call fcn.004156e0
mov eax, dword [esp + 0x48]
mov edx, dword [edi + 0xc]
mov dword [eax], edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.004149a0
mov ecx, dword [esp + 0x30]
pop esi
pop ebp
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x14
Function at 0x423000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46e3f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0043ba60
lea edi, [esi + 8]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x1c], ebx
call fcn.0044f300
lea ebp, [esi + 0xc]
mov byte [esp + 0x1c], 1
mov ecx, ebp
call fcn.0043fa20
lea ecx, [esi + 0x10]
mov byte [esp + 0x1c], 2
call fcn.004146b0
lea ecx, [esi + 0x38]
mov byte [esp + 0x1c], 3
mov dword [esi + 0x2c], 0x50
mov byte [esi + 0x30], bl
call fcn.00446e20
lea ecx, [esi + 0x140]
mov byte [esp + 0x1c], 4
call fcn.0044d470
lea ecx, [esi + 0x358]
mov byte [esp + 0x1c], 5
call fcn.004146b0
lea ecx, [esi + 0x38c]
mov byte [esp + 0x1c], 6
mov dword [esi + 0x374], ebx
mov dword [esi + 0x378], ebx
mov dword [esi + 0x37c], ebx
mov dword [esi + 0x380], ebx
mov byte [esi + 0x384], bl
mov dword [esi + 0x388], ebx
call fcn.0041c140
mov ecx, dword [esp + 0x14]
mov dword [edi], vtable.HttpClient.1.0
mov dword [esi + 0x3a4], ebx
mov dword [esi + 0x3a8], 0x1e
mov dword [esi], vtable.HttpClient.0
mov eax, esi
pop edi
mov dword [ebp], 0x4729ec
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x429730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46ea28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
push ebp
push esi
mov esi, ecx
push edi
push eax
lea ecx, [esp + 0x10]
call fcn.004145b0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
push ecx
mov ecx, esi
call fcn.004293d0
lea edx, [eax + eax*4]
mov eax, dword [esi + 8]
lea ecx, [eax + edx*4]
call fcn.00443b00
mov ebp, eax
test ebp, ebp
je 0x4297d8
mov ecx, ebp
call fcn.00443840
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.00443b00
mov ecx, edi
mov esi, eax
call fcn.00450140
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4297c2
test cl, cl
je 0x4297be
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4297c2
add eax, 2
add esi, 2
test cl, cl
jne 0x42979e
xor eax, eax
jmp 0x4297c7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4297ff
mov ecx, ebp
call fcn.00450160
mov ebp, eax
test ebp, ebp
jne 0x429783
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004149a0
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004149a0
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov al, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x42aa30
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
test ebx, ebx
push edi
je 0x42abd9
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x42abd9
push ebx
call fcn.0042aa00
mov edi, dword [esp + 0x20]
push eax
mov ecx, edi
call fcn.00414020
mov eax, 0x55555556
xor esi, esi
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
test edx, edx
jle 0x42ab28
mov dword [esp + 0x20], edx
jmp 0x42aa81
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
xor ebx, ebx
mov bl, byte [esi + ebp]
inc esi
xor ecx, ecx
xor edx, edx
mov cl, byte [esi + ebp]
mov dl, byte [esi + eax + 1]
inc esi
mov ebp, ecx
mov ecx, ebx
mov dword [esp + 0x10], edx
mov edx, dword [0x486258]
inc esi
sar ecx, 2
and ecx, 0x3f
mov al, byte [ecx + edx]
mov ecx, edi
push eax
call fcn.00413b00
mov edx, dword [0x486258]
mov ecx, ebp
sar ecx, 4
and ebx, 3
and ecx, 0xf
shl ebx, 4
or ecx, ebx
mov al, byte [ecx + edx]
mov ecx, edi
push eax
call fcn.00413b00
mov ebx, dword [esp + 0x10]
mov edx, dword [0x486258]
mov ecx, ebx
and ebp, 0xf
sar ecx, 6
and ecx, 3
shl ebp, 2
or ecx, ebp
mov al, byte [ecx + edx]
mov ecx, edi
push eax
call fcn.00413b00
mov ecx, dword [0x486258]
and ebx, 0x3f
mov dl, byte [ebx + ecx]
mov ecx, edi
push edx
call fcn.00413b00
mov eax, dword [esp + 0x20]
dec eax
mov dword [esp + 0x20], eax
jne 0x42aa7d
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x42ab91
dec edx
jne 0x42abd9
xor ebx, ebx
mov ecx, dword [0x486258]
mov bl, byte [esi + ebp]
xor edx, edx
mov dl, byte [esi + ebp + 1]
mov eax, ebx
sar eax, 2
and eax, 0x3f
mov esi, edx
mov dl, byte [eax + ecx]
mov ecx, edi
push edx
call fcn.00413b00
mov ecx, dword [0x486258]
mov eax, esi
sar eax, 4
and ebx, 3
and eax, 0xf
shl ebx, 4
or eax, ebx
mov dl, byte [eax + ecx]
mov ecx, edi
push edx
call fcn.00413b00
mov eax, dword [0x486258]
and esi, 0xf
mov cl, byte [eax + esi*4]
push ecx
jmp 0x42abc9
xor edx, edx
mov ecx, dword [0x486258]
mov dl, byte [esi + ebp]
mov esi, edx
mov eax, esi
sar eax, 2
and eax, 0x3f
mov dl, byte [eax + ecx]
mov ecx, edi
push edx
call fcn.00413b00
mov eax, dword [0x486258]
and esi, 3
shl esi, 4
mov cl, byte [esi + eax]
push ecx
mov ecx, edi
call fcn.00413b00
push 0x3d
mov ecx, edi
call fcn.00413b00
push 0x3d
mov ecx, edi
call fcn.00413b00
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc