joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457bc0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4f4fee
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0xec]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xfc]
xor ebx, ebx
cmp ebp, ebx
je 0x457cab
lea ecx, [esp + 0x34]
call fcn.004537d0
push ebp
lea ecx, [esp + 0x38]
mov dword [esp + 0xf8], ebx
call fcn.00453ac0
mov esi, dword [esp + 0x108]
push esi
lea eax, [esp + 0x38]
push eax
push 0x34
call fcn.004565a0
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
jne 0x457cb2
cmp esi, ebx
je 0x457c97
lea ecx, [esp + 0x90]
call fcn.004537d0
push ebp
lea ecx, [esp + 0x94]
mov byte [esp + 0xf8], 1
call fcn.00453ac0
mov edi, dword [esi]
lea ecx, [esp + 0x90]
call fcn.00454170
mov edx, dword [edi + 0x28]
push eax
push str.utf8Filename
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push str.Failed_to_write_complete_file__6_
mov ecx, esi
call edx
lea ecx, [esp + 0x90]
mov byte [esp + 0xf4], bl
call fcn.00453880
lea ecx, [esp + 0x34]
mov dword [esp + 0xf4], 0xffffffff
call fcn.00453880
xor al, al
jmp 0x457d63
mov eax, dword [esp + 0x100]
cmp eax, ebx
je 0x457d43
mov ebp, dword [esp + 0x104]
cmp ebp, ebx
je 0x457d43
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
push edi
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x14], ebp
je 0x457d43
cmp esi, ebx
je 0x457d34
lea ecx, [esp + 0x18]
call fcn.00451c20
lea ecx, [esp + 0x18]
mov byte [esp + 0xf4], 2
call fcn.00453240
mov ebp, dword [esi]
lea ecx, [esp + 0x18]
call fcn.004c06c0
mov edx, dword [ebp + 0x10]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push str.Failed_to_write_complete_file__3_
mov ecx, esi
call edx
lea ecx, [esp + 0x18]
mov byte [esp + 0xf4], bl
call fcn.00451e70
push ebx
push edi
call fcn.004661e0
add esp, 8
jmp 0x457c97
push ebx
push edi
call fcn.004661e0
add esp, 8
lea ecx, [esp + 0x34]
mov dword [esp + 0xf4], 0xffffffff
call fcn.00453880
mov al, 1
mov ecx, dword [esp + 0xec]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe4
ret
Function at 0x457d80
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4f5023
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
mov esi, dword [esp + 0xa4]
xor ebx, ebx
cmp esi, ebx
je 0x457ebc
cmp byte [esi], bl
je 0x457ebc
lea ecx, [esp + 0x1c]
call fcn.00451c20
lea ecx, [esp + 0x38]
mov dword [esp + 0x9c], ebx
call fcn.004537d0
push esi
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa0], 1
call fcn.00453a00
mov esi, dword [esp + 0xb8]
push esi
lea eax, [esp + 0x3c]
push eax
push 0x36
call fcn.004565a0
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x457e98
mov eax, dword [esp + 0xa8]
cmp eax, ebx
je 0x457ec3
mov ebp, dword [esp + 0xac]
cmp ebp, ebx
je 0x457ec3
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
push edi
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x14], ebp
je 0x457ec3
cmp esi, ebx
je 0x457e8e
lea ecx, [esp + 0x1c]
call fcn.00453240
mov eax, dword [esp + 0xa4]
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
push eax
push str.filename
mov ecx, esi
call edx
mov ebp, dword [esi]
lea ecx, [esp + 0x1c]
call fcn.004c06c0
push eax
mov eax, dword [ebp + 0x10]
mov ecx, esi
call eax
push str.Failed_to_write_complete_file__4_
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
push ebx
push edi
call fcn.004661e0
add esp, 8
lea ecx, [esp + 0x38]
mov byte [esp + 0x9c], bl
call fcn.00453880
lea ecx, [esp + 0x1c]
mov dword [esp + 0x9c], 0xffffffff
call fcn.00451e70
xor al, al
jmp 0x457f62
mov eax, dword [esp + 0xb0]
cmp eax, ebx
je 0x457f32
mov ebp, dword [esp + 0xb4]
cmp ebp, ebx
je 0x457f32
push ebx
lea ecx, [esp + 0x1c]
push ecx
push ebp
push eax
push edi
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x18], ebp
je 0x457f32
cmp esi, ebx
je 0x457e8e
lea ecx, [esp + 0x1c]
call fcn.00453240
mov eax, dword [esp + 0xa4]
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
push eax
push str.filename
mov ecx, esi
call edx
mov ebp, dword [esi]
lea ecx, [esp + 0x1c]
call fcn.004c06c0
push eax
mov eax, dword [ebp + 0x10]
mov ecx, esi
call eax
push str.Failed_to_write_complete_file__5_
jmp 0x457e85
push ebx
push edi
call fcn.004661e0
add esp, 8
lea ecx, [esp + 0x38]
mov byte [esp + 0x9c], bl
call fcn.00453880
lea ecx, [esp + 0x1c]
mov dword [esp + 0x9c], 0xffffffff
call fcn.00451e70
mov al, 1
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret
Function at 0x4592b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f5298
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [0x5e6616], 0
jne 0x45930f
mov eax, dword [esi + 4]
mov edx, dword [eax + 0x10]
add esi, 4
push str.Component_is_locked.
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov ecx, esi
call edx
xor al, al
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x6c
ret
cmp byte [0x5dcda8], 0
je 0x4593ee
lea ecx, [esp + 0x30]
call fcn.0046e8c0
push str.ChilkatHttp
lea ecx, [esp + 0x34]
mov dword [esp + 0x78], 0
call fcn.0046ed20
lea ecx, [esp + 0x30]
call fcn.0046fa60
test al, al
jne 0x4593dd
lea ecx, [esp + 0x14]
call fcn.00451c20
lea ecx, [esp + 0xc]
mov byte [esp + 0x74], 1
call fcn.0045b180
mov eax, dword [str.VHJpYWwgcGVyaW9kIGhhcyBleHBpcmVkLg]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x7c], 2
call fcn.0045cbe0
mov edi, dword [esi + 4]
add esi, 4
lea ecx, [esp + 0x14]
call fcn.004c06c0
mov edx, dword [edi + 0x10]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov byte [esp + 0x74], 1
call fcn.0045b190
lea ecx, [esp + 0x14]
mov byte [esp + 0x74], 0
call fcn.00451e70
lea ecx, [esp + 0x30]
mov dword [esp + 0x74], 0xffffffff
call fcn.0046e950
xor al, al
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x6c
ret
lea ecx, [esp + 0x30]
mov dword [esp + 0x74], 0xffffffff
call fcn.0046e950
mov al, 1
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x6c
ret
Function at 0x45a3a0
Capabilities:
Delete file
Move file

Disassembly:
mov eax, ecx
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x45a3ae
xor al, al
ret 0xc
lea edx, [eax + 8]
mov eax, dword [eax + 4]
push edx
push eax
call fcn.004705d0
test eax, eax
je 0x45a3a9
mov ecx, eax
jmp 0x4731c0
push 0xffffffffffffffff
push 0x4f7138
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [ebp + 4]
mov edx, dword [eax + 0x1c]
lea esi, [ebp + 4]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
push 1
push str.AddEmbedded
mov ecx, esi
call edx
mov ecx, ebp
mov byte [esp + 0x17], 0
call fcn.00471020
test al, al
jne 0x473226
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov ecx, esi
call edx
xor al, al
jmp 0x473379
mov ebx, dword [esp + 0x44]
push esi
mov ecx, ebx
call fcn.00454170
push eax
call fcn.004a0670
mov edi, eax
add esp, 8
test edi, edi
je 0x47336c
mov ecx, dword [esp + 0x4c]
push esi
call fcn.00454170
mov ecx, dword [esp + 0x4c]
push eax
call fcn.00453f00
push eax
mov ecx, edi
call fcn.004a0580
lea ecx, [esp + 0x18]
call fcn.00451c20
lea eax, [esp + 0x18]
push eax
lea ecx, [ebp + 0x174]
mov dword [esp + 0x40], 0
call fcn.004c06c0
push eax
push str.ckZ.dat
call fcn.004587d0
add esp, 0xc
push esi
push 0
lea ecx, [esp + 0x20]
call fcn.004c06c0
push eax
mov ecx, edi
call fcn.0049fea0
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
push esi
mov ecx, ebx
call fcn.00454170
push eax
call fcn.00458240
add esp, 8
test al, al
je 0x47335b
push esi
mov ecx, ebx
call fcn.00454170
push eax
call fcn.00458370
add esp, 8
test al, al
jne 0x4732ec
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push str.Failed_to_delete_existing_EXE_file
mov ecx, esi
call eax
jmp 0x47335b
mov ecx, ebx
call fcn.00454170
push eax
lea ecx, [esp + 0x1c]
call fcn.004c06c0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x473356
lea ecx, [esp + 0x18]
call fcn.004c06c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [esi]
lea ecx, [esp + 0x18]
call fcn.004c06c0
mov edx, dword [edi + 0x28]
push eax
push str.fromFilename
mov ecx, esi
call edx
mov edi, dword [esi]
mov ecx, ebx
call fcn.00454170
push eax
mov eax, dword [edi + 0x28]
push str.toFilename
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push str.Failed_to_move_EXE_file
mov ecx, esi
call eax
jmp 0x47335b
mov byte [esp + 0x17], 1
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 0xffffffff
call fcn.00451e70
mov edx, dword [esi]
mov eax, dword [edx + 0x24]
mov ecx, esi
call eax
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
Function at 0x45b1a0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x1c]
lea edx, [ebx + ebx*4 + 0xa]
mov eax, 0x55555556
imul edx
push esi
mov esi, edx
shr esi, 0x1f
add esi, edx
lea eax, [esi + esi]
cdq
idiv dword [ecx + 4]
push edi
mov dword [esp + 0x14], ecx
lea eax, [eax + esi + 3]
mov esi, dword [esp + 0x28]
push eax
mov ecx, esi
call fcn.00451610
xor edi, edi
cmp ebx, edi
je 0x45b3af
mov ecx, dword [esp + 0x20]
cmp ecx, edi
je 0x45b3af
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x18], eax
jle 0x45b2e6
push ebp
mov dword [esp + 0x10], eax
movzx ebx, byte [edi + ecx]
movzx ebp, byte [edi + ecx + 1]
mov eax, dword [0x5dcf10]
add edi, 1
movzx ecx, byte [edi + ecx + 1]
add edi, 1
mov edx, ebx
sar edx, 2
mov dword [esp + 0x14], ecx
and edx, 0x3f
movzx ecx, byte [edx + eax]
push ecx
mov ecx, esi
add edi, 1
call fcn.00451260
mov eax, dword [0x5dcf10]
mov edx, ebp
sar edx, 4
and ebx, 3
and edx, 0xf
shl ebx, 4
or edx, ebx
movzx ecx, byte [edx + eax]
push ecx
mov ecx, esi
call fcn.00451260
mov ebx, dword [esp + 0x14]
mov eax, dword [0x5dcf10]
and ebp, 0xf
mov edx, ebx
sar edx, 6
add ebp, ebp
and edx, 3
add ebp, ebp
or edx, ebp
movzx ecx, byte [edx + eax]
push ecx
mov ecx, esi
call fcn.00451260
mov edx, dword [0x5dcf10]
and ebx, 0x3f
movzx eax, byte [ebx + edx]
push eax
mov ecx, esi
call fcn.00451260
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
add eax, 4
cmp eax, dword [ecx + 4]
mov dword [esp + 0x2c], eax
jl 0x45b2ce
push 0xd
mov ecx, esi
call fcn.00451260
push 0xa
mov ecx, esi
call fcn.00451260
mov dword [esp + 0x2c], 0
sub dword [esp + 0x10], 1
mov ecx, dword [esp + 0x24]
jne 0x45b210
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
pop ebp
lea edx, [eax + eax*2]
sub ebx, edx
sub ebx, 0
je 0x45b39d
sub ebx, 1
je 0x45b356
sub ebx, 1
jne 0x45b3af
movzx ebx, byte [edi + ecx]
movzx edi, byte [edi + ecx + 1]
mov ecx, dword [0x5dcf10]
mov eax, ebx
sar eax, 2
and eax, 0x3f
movzx edx, byte [eax + ecx]
push edx
mov ecx, esi
call fcn.00451260
mov ecx, dword [0x5dcf10]
mov eax, edi
sar eax, 4
and ebx, 3
and eax, 0xf
shl ebx, 4
or eax, ebx
movzx edx, byte [eax + ecx]
push edx
mov ecx, esi
call fcn.00451260
mov eax, dword [0x5dcf10]
and edi, 0xf
movzx ecx, byte [eax + edi*4]
push ecx
jmp 0x45b38d
movzx edi, byte [edi + ecx]
mov eax, dword [0x5dcf10]
mov edx, edi
sar edx, 2
and edx, 0x3f
movzx ecx, byte [edx + eax]
push ecx
mov ecx, esi
call fcn.00451260
mov edx, dword [0x5dcf10]
and edi, 3
shl edi, 4
movzx eax, byte [edi + edx]
push eax
mov ecx, esi
call fcn.00451260
push 0x3d
mov ecx, esi
call fcn.00451260
push 0x3d
mov ecx, esi
call fcn.00451260
push 0xd
mov ecx, esi
call fcn.00451260
push 0xa
mov ecx, esi
call fcn.00451260
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
Function at 0x45b3c0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x45b58e
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x45b58d
lea edx, [ebx + ebx*4 + 0xa]
mov eax, 0x55555556
imul edx
push esi
mov esi, edx
shr esi, 0x1f
add esi, edx
lea eax, [esi + esi]
cdq
idiv dword [ecx + 4]
push edi
mov edi, dword [esp + 0x24]
mov ecx, edi
lea eax, [eax + esi + 3]
push eax
call fcn.00451610
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
xor esi, esi
test eax, eax
mov dword [esp + 0x14], eax
jle 0x45b4dd
mov dword [esp + 0x24], eax
jmp 0x45b430
movzx ebx, byte [esi + ebp]
movzx ebp, byte [esi + ebp + 1]
mov ecx, dword [esp + 0x1c]
add esi, 1
movzx edx, byte [esi + ecx + 1]
mov ecx, dword [0x5dcf14]
add esi, 1
mov eax, ebx
sar eax, 2
and eax, 0x3f
mov dword [esp + 0x10], edx
movzx edx, byte [eax + ecx]
push edx
mov ecx, edi
add esi, 1
call fcn.00451260
mov ecx, dword [0x5dcf14]
mov eax, ebp
sar eax, 4
and ebx, 3
and eax, 0xf
shl ebx, 4
or eax, ebx
movzx edx, byte [eax + ecx]
push edx
mov ecx, edi
call fcn.00451260
mov ebx, dword [esp + 0x10]
mov ecx, dword [0x5dcf14]
and ebp, 0xf
mov eax, ebx
sar eax, 6
add ebp, ebp
and eax, 3
add ebp, ebp
or eax, ebp
movzx edx, byte [eax + ecx]
push edx
mov ecx, edi
call fcn.00451260
mov eax, dword [0x5dcf14]
and ebx, 0x3f
movzx ecx, byte [ebx + eax]
push ecx
mov ecx, edi
call fcn.00451260
sub dword [esp + 0x24], 1
mov ebp, dword [esp + 0x1c]
jne 0x45b430
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
lea edx, [eax + eax*2]
sub ebx, edx
sub ebx, 1
je 0x45b544
sub ebx, 1
jne 0x45b58b
movzx ebx, byte [esi + ebp]
mov ecx, dword [0x5dcf14]
movzx esi, byte [esi + ebp + 1]
mov eax, ebx
sar eax, 2
and eax, 0x3f
movzx edx, byte [eax + ecx]
push edx
mov ecx, edi
call fcn.00451260
mov ecx, dword [0x5dcf14]
mov eax, esi
sar eax, 4
and ebx, 3
and eax, 0xf
shl ebx, 4
or eax, ebx
movzx edx, byte [eax + ecx]
push edx
mov ecx, edi
call fcn.00451260
mov eax, dword [0x5dcf14]
and esi, 0xf
movzx ecx, byte [eax + esi*4]
push ecx
jmp 0x45b57b
movzx esi, byte [esi + ebp]
mov eax, dword [0x5dcf14]
mov edx, esi
sar edx, 2
and edx, 0x3f
movzx ecx, byte [edx + eax]
push ecx
mov ecx, edi
call fcn.00451260
mov edx, dword [0x5dcf14]
and esi, 3
shl esi, 4
movzx eax, byte [esi + edx]
push eax
mov ecx, edi
call fcn.00451260
push 0x3d
mov ecx, edi
call fcn.00451260
push 0x3d
mov ecx, edi
call fcn.00451260
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x45b9d0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x45b9e5
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
mov dword [esi], 0
je 0x45bb6e
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x45bb6e
lea ecx, [ebp + ebp*4]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
lea eax, [edx + eax + 4]
push edi
push eax
mov dword [esi], eax
call fcn.004cabe6
mov esi, eax
mov eax, 0x55555556
imul ebp
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x5dcf18]
add esp, 4
xor edi, edi
xor ecx, ecx
test eax, eax
mov dword [esp + 0x18], eax
jle 0x45bad7
mov dword [esp + 0x10], eax
nop
movzx eax, byte [edi + ebx]
movzx ebp, byte [edi + ebx + 1]
add edi, 1
movzx ebx, byte [edi + ebx + 1]
mov dword [esp + 0x14], ebx
add edi, 1
mov ebx, eax
sar ebx, 2
and ebx, 0x3f
movzx ebx, byte [ebx + edx]
mov byte [ecx + esi], bl
mov ebx, ebp
sar ebx, 4
and ebx, 0xf
and eax, 3
shl eax, 4
or ebx, eax
movzx eax, byte [ebx + edx]
mov byte [ecx + esi + 1], al
mov eax, dword [esp + 0x14]
add ecx, 1
mov ebx, eax
sar ebx, 6
and ebp, 0xf
and ebx, 3
add ebp, ebp
add ebp, ebp
or ebx, ebp
movzx ebx, byte [ebx + edx]
add ecx, 1
mov byte [ecx + esi], bl
mov ebx, dword [esp + 0x20]
and eax, 0x3f
movzx eax, byte [eax + edx]
add ecx, 1
mov byte [ecx + esi], al
add edi, 1
add ecx, 1
sub dword [esp + 0x10], 1
jne 0x45ba50
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
lea eax, [eax + eax*2]
sub ebp, eax
sub ebp, 1
je 0x45bb26
sub ebp, 1
jne 0x45bb58
movzx ebp, byte [edi + ebx]
movzx edi, byte [edi + ebx + 1]
mov eax, ebp
sar eax, 2
and eax, 0x3f
movzx eax, byte [eax + edx]
mov byte [ecx + esi], al
mov eax, edi
sar eax, 4
and ebp, 3
and eax, 0xf
shl ebp, 4
or eax, ebp
movzx eax, byte [eax + edx]
add ecx, 1
mov byte [ecx + esi], al
add ecx, 1
and edi, 0xf
mov dl, byte [edx + edi*4]
mov byte [ecx + esi], dl
jmp 0x45bb4e
movzx edi, byte [edi + ebx]
mov eax, edi
sar eax, 2
and eax, 0x3f
mov al, byte [eax + edx]
mov byte [ecx + esi], al
and edi, 3
shl edi, 4
mov dl, byte [edi + edx]
add ecx, 1
mov byte [ecx + esi], dl
add ecx, 1
mov byte [ecx + esi], 0x3d
add ecx, 1
mov byte [ecx + esi], 0x3d
add ecx, 1
mov eax, dword [esp + 0x28]
pop edi
pop ebp
mov byte [ecx + esi], 0
mov dword [eax], ecx
pop ebx
mov eax, esi
pop esi
add esp, 0xc
ret 0xc
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
Function at 0x464c80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f51e8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00451c20
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.004516b0
lea ecx, [esp + 8]
call fcn.00451070
lea ecx, [esp + 8]
call fcn.004c06c0
mov ecx, dword [esi + 0x3c]
push eax
push 0
call fcn.0047e200
test eax, eax
je 0x464d16
push eax
mov ecx, esi
call fcn.004648d0
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x2c], 0xffffffff
call fcn.00451e70
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 4
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00451e70
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 4

Function at 0x464d40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f51e8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00451c20
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.004516b0
lea ecx, [esp + 8]
call fcn.00451070
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
lea ecx, [esp + 0x10]
call fcn.004c06c0
mov ecx, dword [esi + 0x3c]
push eax
call fcn.0047e150
test eax, eax
je 0x464dde
push eax
mov ecx, esi
call fcn.004648d0
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x2c], 0xffffffff
call fcn.00451e70
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00451e70
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 0xc
Function at 0x46bf40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f659c
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.HttpControl.0
lea ecx, [esi + 0x26c]
mov dword [esp + 0x14], 0xe
call fcn.00451e70
lea ecx, [esi + 0x250]
mov byte [esp + 0x14], 0xd
call fcn.00451e70
lea ecx, [esi + 0x22c]
mov byte [esp + 0x14], 0xc
call fcn.00451e70
lea ecx, [esi + 0x210]
mov byte [esp + 0x14], 0xb
call fcn.00451e70
lea ecx, [esi + 0x1f0]
mov byte [esp + 0x14], 0xa
call fcn.0046d330
lea ecx, [esi + 0x1d4]
mov byte [esp + 0x14], 9
call fcn.00451e70
lea ecx, [esi + 0x1b8]
mov byte [esp + 0x14], 8
call fcn.00451e70
lea ecx, [esi + 0x19c]
mov byte [esp + 0x14], 7
call fcn.00451e70
lea ecx, [esi + 0x180]
mov byte [esp + 0x14], 6
call fcn.00451e70
lea ecx, [esi + 0x164]
mov byte [esp + 0x14], 5
call fcn.00451e70
lea ecx, [esi + 0x148]
mov byte [esp + 0x14], 4
call fcn.00451e70
lea ecx, [esi + 0x12c]
mov byte [esp + 0x14], 3
call fcn.00451e70
lea ecx, [esi + 0x11c]
mov byte [esp + 0x14], 2
call fcn.00468e10
lea ecx, [esi + 0x100]
mov byte [esp + 0x14], 1
call fcn.0046a880
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0
call fcn.00469b50
lea ecx, [esi + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.0048b4d0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x46c0a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f65cb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
lea ecx, [esi + 8]
mov dword [esi], vtable.HttpResult.0
mov byte [esi + 4], bl
call fcn.00451c20
lea ecx, [esi + 0x34]
mov dword [esp + 0x18], ebx
mov byte [esi + 0x24], bl
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
call fcn.0046e420
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x46e830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f6ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.00451c20
mov edi, dword [esp + 0x38]
mov ecx, edi
mov dword [esp + 0x30], 0
call fcn.004c06c0
push eax
mov ecx, edi
call fcn.004c4070
push eax
lea ecx, [esp + 0x14]
call fcn.00451890
lea ecx, [esp + 0xc]
call fcn.004c06c0
push eax
mov ecx, esi
call fcn.0046e680
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00451e70
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4