joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42aff0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
cmp esi, dword [eax]
jne 0x42b01f
cmp ecx, eax
jne 0x42b01f
mov ecx, ebx
call fcn.0042a0f0
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 0xc
cmp esi, ecx
je 0x42b0fd
push edi
mov edx, dword [esi]
mov dword [ebp + 0xc], edx
mov edx, dword [esi + 8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42b035
sub eax, edi
add eax, edx
mov ecx, 0x811c9dc5
cmp edx, eax
je 0x42b060
lea esp, [esp]
movsx edi, byte [edx]
imul ecx, ecx, 0x1000193
inc edx
xor ecx, edi
cmp edx, eax
jne 0x42b050
and ecx, 0x7fffffff
push 0x1f31d
push ecx
call fcn.00468aa9
imul edx, edx, 0x41a7
imul eax, eax, 0xb14
add esp, 8
sub edx, eax
jns 0x42b08a
add edx, 0x7fffffff
mov ecx, dword [ebx + 0x20]
mov eax, ecx
and eax, edx
cmp dword [ebx + 0x24], eax
ja 0x42b09f
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + eax*8 + 4], esi
lea ecx, [ecx + eax*8]
jne 0x42b0c8
cmp dword [ecx], esi
jne 0x42b0c0
mov edx, dword [ebx + 4]
mov dword [ecx], edx
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 4]
mov dword [ecx + eax*8 + 4], edx
jmp 0x42b0d0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x42b0d0
cmp dword [ecx], esi
jne 0x42b0d0
mov edx, dword [esi]
mov dword [ecx], edx
cmp esi, dword [ebx + 4]
je 0x42b0f0
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [esi + 4]
push esi
mov dword [edx + 4], eax
call fcn.0041149f
add esp, 4
dec dword [ebx + 8]
mov esi, dword [ebp + 0xc]
cmp esi, dword [ebp + 0x10]
jne 0x42b028
pop edi
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x445850
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4735b3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4872e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x38
call fcn.00411e4b
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x4458d5
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
mov dword [esi], vtable.google::protobuf::SourceCodeInfo_Location.0
call fcn.00441cc0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov eax, section..data
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x446610
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470fd8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4872e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], vtable.google::protobuf::FileDescriptorProto.0
call fcn.00441cc0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov eax, section..data
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x80], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x84], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x446a90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470fd8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4872e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], vtable.google::protobuf::DescriptorProto.0
call fcn.00441cc0
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], edi
mov dword [esi + 8], 0x487000
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x448a90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470fd8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4872e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
call fcn.00441cc0
fldz
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
fstp qword [esi + 0x30]
mov eax, section..data
mov dword [esi + 0x18], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x44], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x448be0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4735b3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4872e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x48
call fcn.00411e4b
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x448c73
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
call fcn.00441cc0
fldz
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
fstp qword [esi + 0x30]
mov eax, section..data
mov dword [esi + 0x18], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x44], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x469ae0
Capabilities:
Hide graphical window

Disassembly:
cmp byte [ecx + 0x1d], 0
je 0x469af3
mov eax, dword [ecx + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
cmp dword [ecx + 0x24], 0
je 0x469b25
lea edx, [ecx - 0x18]
test edx, edx
je 0x469b05
lea edx, [ecx - 0x14]
jmp 0x469b07
xor edx, edx
mov eax, dword [ecx + 0x24]
push esi
mov esi, dword [eax]
push edi
lea edi, [ecx + 0xc]
mov ecx, dword [ecx + 8]
push edi
push ecx
push 0
push edx
mov edx, dword [esi + 0x2c]
push 0
push 0xfffffffffffffffd
push eax
call edx
pop edi
pop esi
ret

Function at 0x46a7e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x472de4
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], vtable.MessageFilter.0
mov dword [esi + 0x18], vtable.WebBrowser.0
xor eax, eax
mov dword [ebp - 4], eax
mov dword [esi], vtable.IeBrowser.0
mov dword [esi + 4], vtable.IeBrowser.1.0
mov dword [esi + 8], vtable.IeBrowser.2.0
mov dword [esi + 0xc], vtable.IeBrowser.3.0
mov dword [esi + 0x10], vtable.IeBrowser.4.0
mov dword [esi + 0x14], vtable.IeBrowser.5.0
mov dword [esi + 0x18], vtable.IeBrowser.6.0
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov word [esi + 0x34], ax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], eax
call fcn.004032b0
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x48], eax
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46afc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472db2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], ecx
mov ecx, dword [edx]
cmp ecx, edx
je 0x46b134
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [ecx + 0x10], esi
je 0x46b04a
cmp byte [ecx + 0x15], bl
jne 0x46b034
mov eax, dword [ecx + 8]
cmp byte [eax + 0x15], bl
jne 0x46b01b
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], bl
jne 0x46b034
lea ecx, [ecx]
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], bl
je 0x46b010
jmp 0x46b034
mov eax, dword [ecx + 4]
cmp byte [eax + 0x15], bl
jne 0x46b032
cmp ecx, dword [eax + 8]
jne 0x46b032
mov ecx, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], bl
je 0x46b023
mov ecx, eax
cmp ecx, edx
jne 0x46aff2
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ecx + 0xc]
cmp esi, 0xffffffff
je 0x46b132
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], vtable.PBUIWebInterface::WEB_MSG_RESP.0
call fcn.00441cc0
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
xor eax, eax
or eax, 1
mov dword [ebp - 4], 1
or eax, 2
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x70], 0x16
mov dword [ebp - 0x6c], esi
call fcn.0040eab0
mov eax, dword [ebp - 0x2c]
mov esi, 0x10
cmp dword [ebp - 0x18], esi
jae 0x46b0ca
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
push ebx
lea ecx, [ebp + 8]
push ecx
push edx
push eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
push ecx
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x18], esi
jb 0x46b0f5
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0041149f
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x78], vtable.PBUIWebInterface::WEB_MSG_RESP.0
lea esi, [ebp - 0x78]
mov dword [ebp - 4], 3
call fcn.0040c4c0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.00442070
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0041eee0
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x46b330
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472e21
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], ecx
mov ecx, dword [edx]
cmp ecx, edx
je 0x46b4f5
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [ecx + 0x10], esi
je 0x46b3ba
cmp byte [ecx + 0x15], bl
jne 0x46b3a4
mov eax, dword [ecx + 8]
cmp byte [eax + 0x15], bl
jne 0x46b38b
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], bl
jne 0x46b3a4
lea ecx, [ecx]
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], bl
je 0x46b380
jmp 0x46b3a4
mov eax, dword [ecx + 4]
cmp byte [eax + 0x15], bl
jne 0x46b3a2
cmp ecx, dword [eax + 8]
jne 0x46b3a2
mov ecx, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], bl
je 0x46b393
mov ecx, eax
cmp ecx, edx
jne 0x46b362
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ecx + 0xc]
cmp esi, 0xffffffff
je 0x46b4f3
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], vtable.PBUIWebInterface::WEB_MSG_RESP.0
call fcn.00441cc0
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
xor ecx, ecx
or ecx, 1
or ecx, 2
mov dword [ebp - 4], 1
or ecx, 0x800
mov dword [ebp - 0x70], 5
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x30], ecx
cmp eax, ebx
jne 0x46b465
push 0x14
call fcn.00411e4b
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
cmp esi, ebx
je 0x46b45c
mov byte [ebp - 4], 3
lea ecx, [esi + 4]
mov dword [esi], vtable.PBUIWebInterface::WEB_MSG_RESP_navigate_error.0
call fcn.00441cc0
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov eax, esi
jmp 0x46b45e
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp + 0xc]
or dword [eax + 0x10], 1
lea edx, [ebp - 0x2c]
mov dword [eax + 8], ecx
push edx
lea ecx, [ebp - 0x78]
call fcn.0040eab0
mov eax, dword [ebp - 0x2c]
mov esi, 0x10
cmp dword [ebp - 0x18], esi
jae 0x46b48b
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
push ebx
lea ecx, [ebp + 8]
push ecx
push edx
push eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
push ecx
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x18], esi
jb 0x46b4b6
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0041149f
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x78], vtable.PBUIWebInterface::WEB_MSG_RESP.0
lea esi, [ebp - 0x78]
mov dword [ebp - 4], 5
call fcn.0040c4c0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 4
call fcn.00442070
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0041eee0
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x46b510
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472e5e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], ecx
mov ecx, dword [edx]
cmp ecx, edx
je 0x46b6d2
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [ecx + 0x10], esi
je 0x46b59a
cmp byte [ecx + 0x15], bl
jne 0x46b584
mov eax, dword [ecx + 8]
cmp byte [eax + 0x15], bl
jne 0x46b56b
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], bl
jne 0x46b584
lea ecx, [ecx]
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], bl
je 0x46b560
jmp 0x46b584
mov eax, dword [ecx + 4]
cmp byte [eax + 0x15], bl
jne 0x46b582
cmp ecx, dword [eax + 8]
jne 0x46b582
mov ecx, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], bl
je 0x46b573
mov ecx, eax
cmp ecx, edx
jne 0x46b542
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ecx + 0xc]
cmp esi, 0xffffffff
je 0x46b6d0
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], vtable.PBUIWebInterface::WEB_MSG_RESP.0
call fcn.00441cc0
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
xor ecx, ecx
or ecx, 1
or ecx, 2
mov dword [ebp - 4], 1
or ecx, 0x20
mov dword [ebp - 0x70], 0x13
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x30], ecx
cmp eax, ebx
jne 0x46b642
push 0x14
call fcn.00411e4b
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
cmp esi, ebx
je 0x46b639
mov byte [ebp - 4], 3
lea ecx, [esi + 4]
mov dword [esi], vtable.PBUIWebInterface::WEB_MSG_RESP_logout.0
call fcn.00441cc0
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov eax, esi
jmp 0x46b63b
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp + 0xc]
or dword [eax + 0x10], 1
lea edx, [ebp - 0x2c]
mov dword [eax + 8], ecx
push edx
lea ecx, [ebp - 0x78]
call fcn.0040eab0
mov eax, dword [ebp - 0x2c]
mov esi, 0x10
cmp dword [ebp - 0x18], esi
jae 0x46b668
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
push ebx
lea ecx, [ebp + 8]
push ecx
push edx
push eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
push ecx
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x18], esi
jb 0x46b693
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0041149f
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x78], vtable.PBUIWebInterface::WEB_MSG_RESP.0
lea esi, [ebp - 0x78]
mov dword [ebp - 4], 5
call fcn.0040c4c0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 4
call fcn.00442070
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0041eee0
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x46b6f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472e9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], ecx
mov ecx, dword [edx]
cmp ecx, edx
je 0x46b8b2
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [ecx + 0x10], esi
je 0x46b77a
cmp byte [ecx + 0x15], bl
jne 0x46b764
mov eax, dword [ecx + 8]
cmp byte [eax + 0x15], bl
jne 0x46b74b
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], bl
jne 0x46b764
lea ecx, [ecx]
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], bl
je 0x46b740
jmp 0x46b764
mov eax, dword [ecx + 4]
cmp byte [eax + 0x15], bl
jne 0x46b762
cmp ecx, dword [eax + 8]
jne 0x46b762
mov ecx, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], bl
je 0x46b753
mov ecx, eax
cmp ecx, edx
jne 0x46b722
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ecx + 0xc]
cmp esi, 0xffffffff
je 0x46b8b0
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], vtable.PBUIWebInterface::WEB_MSG_RESP.0
call fcn.00441cc0
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
xor ecx, ecx
or ecx, 1
or ecx, 2
mov dword [ebp - 4], 1
or ecx, 0x10
mov dword [ebp - 0x70], 0x12
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x30], ecx
cmp eax, ebx
jne 0x46b822
push 0x14
call fcn.00411e4b
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
cmp esi, ebx
je 0x46b819
mov byte [ebp - 4], 3
lea ecx, [esi + 4]
mov dword [esi], vtable.PBUIWebInterface::WEB_MSG_RESP_login.0
call fcn.00441cc0
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov eax, esi
jmp 0x46b81b
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp + 0xc]
or dword [eax + 0x10], 1
lea edx, [ebp - 0x2c]
mov dword [eax + 8], ecx
push edx
lea ecx, [ebp - 0x78]
call fcn.0040eab0
mov eax, dword [ebp - 0x2c]
mov esi, 0x10
cmp dword [ebp - 0x18], esi
jae 0x46b848
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
push ebx
lea ecx, [ebp + 8]
push ecx
push edx
push eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
push ecx
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x18], esi
jb 0x46b873
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0041149f
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x78], vtable.PBUIWebInterface::WEB_MSG_RESP.0
lea esi, [ebp - 0x78]
mov dword [ebp - 4], 5
call fcn.0040c4c0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 4
call fcn.00442070
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0041eee0
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8