joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a1b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, 0x2820
call fcn.0047c8c0
mov eax, dword [esp + 0x2830]
mov edx, dword [0x489228]
push ebp
mov dword [esp + 8], 0
mov cl, byte [eax]
mov dword [esp + 0xc], 0
mov byte [esp + 4], cl
mov dword [esp + 0x10], 0
mov ecx, dword [edx]
push esi
push edi
push ecx
push 0
push eax
lea ecx, [esp + 0x18]
call dword [0x489220]
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
test edi, edi
jne 0x45a20a
mov edi, dword [0x48923c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x2c]
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x2838]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov word [esp + 0x20], 2
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
call dword [0x48969c]
mov word [esp + 0x1e], ax
mov eax, dword [esp + 0x2834]
lea ecx, [esp + 0x1c]
push 0x10
push ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2838]
push 0
lea edx, [esp + 0x38]
push ebp
push edx
push eax
call dword [0x4896f8]
mov ecx, dword [esp + 0x10]
mov esi, eax
test ecx, ecx
je 0x45a2af
mov al, byte [ecx - 1]
test al, al
je 0x45a2a5
cmp al, 0xff
je 0x45a2a5
dec al
pop edi
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebp
add esp, 0x2820
ret
dec ecx
push ecx
call fcn.0047ab00
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x2820
ret
Function at 0x45a720
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x486bc7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0xc], esi
push ebx
mov byte [esi], al
call dword [0x489244]
mov dl, byte [esp + 0xb]
lea ecx, [esi + 0x10]
push ebx
mov dword [esp + 0x1c], ebx
mov byte [ecx], dl
call dword [0x489244]
mov al, byte [esp + 0xb]
mov dword [esi + 0x24], ebx
mov byte [esi + 0x20], al
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dl, byte [esp + 0xb]
lea ecx, [esi + 0x30]
push ebx
mov byte [esp + 0x1c], 2
mov byte [ecx], dl
call dword [0x489244]
mov al, byte [esp + 0xb]
mov dword [esi + 0x44], ebx
mov byte [esi + 0x40], al
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dl, byte [esp + 0xb]
lea ecx, [esi + 0x50]
push ebx
mov byte [esp + 0x1c], 4
mov byte [ecx], dl
call dword [0x489244]
mov al, byte [esp + 0xb]
mov cl, byte [esp + 0xb]
mov dl, byte [esp + 0xb]
mov byte [esi + 0x60], al
mov al, byte [esp + 0xb]
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], 1
push ebx
mov byte [esi + 0x74], cl
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
push ebx
mov byte [esi + 0x84], dl
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
push ebx
mov byte [esi + 0x94], al
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
push ebx
mov dword [esi + 0xa8], ebx
mov word [esi + 0xa4], bx
mov byte [esi + 0xa6], bl
call dword [0x489154]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xa8], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x45e400
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x487198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push esi
push edi
lea eax, [ebp - 0x138]
mov dword [ebp - 0x10], esp
mov esi, ecx
push 0x100
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
call dword [0x4896dc]
test eax, eax
jne 0x45e5a4
lea ecx, [ebp - 0x138]
push ecx
call dword [0x4896d4]
mov edi, eax
test edi, edi
je 0x45e53a
cmp word [edi + 0xa], 4
jne 0x45e53a
mov edx, dword [edi + 0xc]
cmp dword [edx], 0
je 0x45e53a
mov al, byte [ebp - 0x19]
push 0
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x30], al
call dword [0x489244]
mov ecx, dword [edi + 0xc]
mov byte [ebp - 4], 1
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
mov dword [ebp - 0x14], eax
call dword [0x4896b0]
mov esi, eax
mov eax, dword [ebp - 0x18]
mov edi, esi
or ecx, 0xffffffff
lea ebx, [eax + 0x84]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov edi, ecx
mov ecx, ebx
push edi
mov dword [ebp - 0x20], edi
call dword [0x48922c]
test al, al
je 0x45e4e8
mov ecx, edi
mov edi, dword [ebx + 4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 4]
mov dword [ebx + 8], eax
mov byte [ecx + eax], 0
mov edx, dword [ebp - 0x18]
mov ax, word [ebp - 0x14]
mov word [edx + 0xa4], ax
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x45e50f
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x45e520
cmp al, 0xff
je 0x45e520
dec al
mov byte [ecx], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
call fcn.0047ab00
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 0x4a3de4
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esi + 0x84]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov edi, ecx
mov ecx, ebx
push edi
mov dword [ebp - 0x14], edi
call dword [0x48922c]
test al, al
je 0x45e58a
mov ecx, edi
mov edi, dword [ebx + 4]
mov edx, ecx
mov esi, 0x4a3de4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 4]
mov esi, dword [ebp - 0x18]
mov dword [ebx + 8], eax
mov byte [ecx + eax], 0
mov ecx, dword [ebp - 0xc]
mov word [esi + 0xa4], 0
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 0x4a3de4
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esi + 0x84]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov edi, ecx
mov ecx, ebx
push edi
mov dword [ebp - 0x14], edi
call dword [0x48922c]
test al, al
je 0x45e58a
mov ecx, edi
mov edi, dword [ebx + 4]
mov edx, ecx
mov esi, 0x4a3de4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x45e57d
Function at 0x45fc40
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x45fc58
push eax
call dword [0x489708]
or eax, 0xffffffff
pop esi
ret 0xc
mov ecx, esi
call fcn.0045ff90
test eax, eax
jne 0x45fc75
push 0x2736
call dword [0x489708]
or eax, 0xffffffff
pop esi
ret 0xc
mov ecx, esi
call fcn.0045ff90
cmp eax, 1
je 0x45fcda
mov ecx, esi
call fcn.0045ff90
cmp eax, 2
je 0x45fcda
mov ecx, esi
call fcn.0045ff90
cmp eax, 3
je 0x45fcda
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne 0x45fcc2
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
mov ecx, dword [esi + 4]
push edx
call fcn.00445f30
push eax
call dword [0x4896d0]
pop esi
ret 0xc
mov edx, dword [esp + 0x10]
mov eax, dword [ecx]
push edx
mov edx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push edx
call dword [eax + 0x38]
pop esi
ret 0xc
push 0x2749
call dword [0x489708]
or eax, 0xffffffff
pop esi
ret 0xc

Function at 0x45fcf0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x45fd08
push eax
call dword [0x489708]
or eax, 0xffffffff
pop esi
ret 0xc
mov ecx, esi
call fcn.0045ff90
test eax, eax
jne 0x45fd25
push 0x2736
call dword [0x489708]
or eax, 0xffffffff
pop esi
ret 0xc
mov ecx, esi
call fcn.0045ff90
cmp eax, 1
je 0x45fd8a
mov ecx, esi
call fcn.0045ff90
cmp eax, 2
je 0x45fd8a
mov ecx, esi
call fcn.0045ff90
cmp eax, 3
je 0x45fd8a
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne 0x45fd72
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
mov ecx, dword [esi + 4]
push edx
call fcn.00445f30
push eax
call dword [0x4896a4]
pop esi
ret 0xc
mov edx, dword [esp + 0x10]
mov eax, dword [ecx]
push edx
mov edx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push edx
call dword [eax + 0x34]
pop esi
ret 0xc
push 0x2749
call dword [0x489708]
or eax, 0xffffffff
pop esi
ret 0xc
Function at 0x45fda0
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x45fdc9
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx]
push edx
mov edx, dword [ebp + 8]
push edx
call dword [eax + 0x24]
mov esi, eax
jmp 0x45fe78
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
test ebx, ebx
mov dword [ebp - 8], eax
jne 0x45fde2
xor esi, esi
jmp 0x45fe14
push ebx
call dword [0x4891e0]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.0047c8c0
mov esi, esp
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0
mov byte [esi], 0
call dword [0x489138]
mov edi, dword [ebp - 4]
push esi
mov word [ebp - 0x14], 2
call dword [0x4896ac]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x45fe4b
push esi
call dword [0x4896d4]
test eax, eax
je 0x45fe40
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
jmp 0x45fe4b
push 0x2726
call dword [0x489708]
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x48969c]
mov ecx, dword [edi + 4]
lea edx, [ebp - 0x14]
push 0x10
push edx
mov word [ebp - 0x12], ax
call fcn.00445f30
push eax
call dword [0x4896c0]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
test esi, esi
jne 0x45fe89
call dword [0x4896d8]
cmp eax, 0x2733
jne 0x45fe92
push 2
mov ecx, edi
call fcn.004601f0
lea esp, [ebp - 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45fea0
Capabilities:
Connect socket

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x45febe
mov edx, dword [esp + 0x10]
mov eax, dword [ecx]
push edx
mov edx, dword [esp + 0x10]
push edx
call dword [eax + 0x20]
mov esi, eax
jmp 0x45fee1
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov ecx, dword [edi + 4]
call fcn.00445f30
push eax
call dword [0x4896c0]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov esi, edx
test esi, esi
jne 0x45fef2
call dword [0x4896d8]
cmp eax, 0x2733
jne 0x45fefb
push 2
mov ecx, edi
call fcn.004601f0
mov eax, esi
pop edi
pop esi
ret 8
Function at 0x460110
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x46014a
mov edx, dword [esp + 0x18]
mov eax, dword [ecx]
push edx
mov edx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push edx
call dword [eax + 0x28]
mov edi, eax
test edi, edi
je 0x460143
push 1
mov ecx, esi
call fcn.004601f0
mov eax, edi
pop edi
pop esi
ret 0x10
mov eax, dword [esp + 0x10]
push 0
push eax
push 2
call dword [0x4896bc]
mov ecx, dword [esi + 4]
push eax
mov dword [ecx + 4], eax
mov ecx, dword [esi + 4]
call fcn.00445030
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 4]
push edx
call fcn.00445e20
test eax, eax
jne 0x460181
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x24]
test eax, eax
je 0x4601b6
mov edx, dword [ecx + 8]
push 0x3f
add edx, 0x402
push edx
call fcn.00445f40
push eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push ecx
call dword [0x48970c]
test eax, eax
je 0x4601b6
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 4]
push 0x10
push eax
call fcn.00444fd0
test eax, eax
jne 0x4601d1
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
call dword [edx + 8]
mov edi, 1
mov ecx, esi
push edi
call fcn.004601f0
mov eax, edi
pop edi
pop esi
ret 0x10

Function at 0x4603f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48724e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00444d00
xor edi, edi
mov dword [esi + 0x2c], 0x489e50
mov dword [esp + 0x14], edi
mov al, byte [esp + 0x1c]
mov dword [esi + 0x30], 0x489f98
mov dword [esi + 0x34], edi
mov byte [esi + 0x68], al
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov cl, byte [esp + 0x1c]
push 0x1c
mov byte [esp + 0x18], 2
mov byte [esi + 0xac], cl
call fcn.0047c85e
mov edx, dword [esp + 0x20]
mov dword [eax], eax
mov dword [eax + 4], eax
add esp, 4
mov dword [esi + 0xb0], eax
lea ecx, [esi + 0x44]
mov dword [esi + 0xb4], edi
xor eax, eax
mov dword [esi], 0x48a0d8
mov dword [esi + 0x2c], 0x48a0ac
mov dword [esi + 0x30], 0x48a09c
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], edi
mov word [esi + 0x40], di
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x90], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x58], 1
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x46d760
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4877e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
push esi
push edi
mov edi, dword [esp + 0x48]
xor ebx, ebx
mov esi, ecx
push edi
mov byte [esp + 0x18], al
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [0x489450]
add esp, 4
lea ecx, [esp + 0x14]
push eax
push edi
call dword [0x4892a4]
mov cl, byte [esp + 0x14]
push ebx
mov byte [esp + 0x28], cl
lea ecx, [esp + 0x28]
mov dword [esp + 0x44], ebx
call dword [0x489300]
mov edx, dword [0x48926c]
lea ecx, [esp + 0x14]
mov eax, dword [edx]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call dword [0x489270]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x34], edx
lea eax, [esp + 0x24]
lea ecx, [esp + 0xc]
push eax
push ecx
lea ecx, [esi + 0x5d68]
mov byte [esp + 0x48], 1
call fcn.0046eb00
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x46d825
mov al, byte [ecx - 1]
cmp al, bl
je 0x46d819
cmp al, 0xff
je 0x46d819
dec al
mov byte [ecx - 1], al
jmp 0x46d825
add ecx, 0xfffffffe
push ecx
call fcn.0047ab00
add esp, 4
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], ebx
cmp ecx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x46d869
mov al, byte [ecx - 1]
cmp al, bl
je 0x46d85d
cmp al, 0xff
je 0x46d85d
dec al
pop edi
pop esi
mov byte [ecx - 1], al
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret 8
add ecx, 0xfffffffe
push ecx
call fcn.0047ab00
add esp, 4
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x476670
Capabilities:
Get outbound credentials handle via credssp

Disassembly:
sub esp, 0x81c
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x58]
lea ebx, [esi + 0x58]
test eax, eax
jne 0x47668c
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x47669c
push ebx
call dword [0x489500]
mov ecx, ebx
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov ecx, 7
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x28]
mov ecx, dword [0x48923c]
test eax, eax
mov dword [esp + 0x14], ecx
je 0x4766be
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x2c]
test eax, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], ecx
je 0x4766d4
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x40]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x4766ea
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x50]
test eax, eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 1
jne 0x476702
mov eax, ecx
lea edi, [esi + 0x60]
lea ecx, [esp + 0xc]
push edi
push ebx
push 0
push 0
push ecx
push 0
push 2
push eax
push 0
call fcn.00482936
test eax, eax
je 0x47672c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x81c
ret
lea ecx, [esi + 0x70]
lea eax, [esi + 0x7c]
lea edx, [esp + 0x28]
mov dword [esi + 0x74], 1
mov dword [ecx], 0
mov dword [esi + 0x78], eax
mov dword [eax], 0x800
mov dword [esi + 0x80], 2
mov dword [esi + 0x84], edx
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x476768
mov eax, dword [0x48923c]
lea edx, [esi + 0x88]
push edi
push edx
add esi, 0x68
push ecx
push esi
push 0
push 0
push 0
push 0
push 0x10
push eax
push 0
push ebx
call fcn.00482930
xor ecx, ecx
pop edi
test eax, eax
setge cl
pop esi
mov eax, ecx
pop ebx
add esp, 0x81c
ret
Function at 0x477290
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x150
push ebx
push esi
mov esi, dword [esp + 0x168]
cmp esi, 0x40
jle 0x4772e7
lea eax, [esp + 0xfc]
push eax
call fcn.00481040
mov ecx, dword [esp + 0x168]
push esi
lea edx, [esp + 0x104]
push ecx
push edx
call fcn.00480c30
lea eax, [esp + 0x10c]
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00480f00
add esp, 0x18
lea ebx, [esp + 8]
mov esi, 0x10
jmp 0x4772ee
mov ebx, dword [esp + 0x164]
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0xbc]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x78]
push esi
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, dword [0x489344]
lea edx, [esp + 0xc0]
push ebx
push edx
call edi
push esi
lea eax, [esp + 0x88]
push ebx
push eax
call edi
add esp, 0x18
xor eax, eax
pop edi
mov cl, byte [esp + eax + 0xb8]
mov bl, byte [esp + eax + 0x74]
xor cl, 0x36
xor bl, 0x5c
mov byte [esp + eax + 0xb8], cl
mov byte [esp + eax + 0x74], bl
inc eax
cmp eax, 0x40
jl 0x477332
lea ecx, [esp + 0x18]
push ecx
call fcn.00481040
lea edx, [esp + 0xbc]
push 0x40
lea eax, [esp + 0x20]
push edx
push eax
call fcn.00480c30
mov ecx, dword [esp + 0x170]
mov edx, dword [esp + 0x16c]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.00480c30
mov esi, dword [esp + 0x188]
lea ecx, [esp + 0x34]
push ecx
push esi
call fcn.00480f00
lea edx, [esp + 0x3c]
push edx
call fcn.00481040
lea eax, [esp + 0x9c]
push 0x40
lea ecx, [esp + 0x44]
push eax
push ecx
call fcn.00480c30
push 0x10
lea edx, [esp + 0x50]
push esi
push edx
call fcn.00480c30
add esp, 0x40
lea eax, [esp + 0x18]
push eax
push esi
call fcn.00480f00
add esp, 8
pop esi
pop ebx
add esp, 0x150
ret

Function at 0x478000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x487f89
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [str.HTTP_]
mov dl, byte [esp + 0x30]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], eax
mov cx, word [0x4a2f54]
xor eax, eax
push edi
mov word [esp + 0x14], cx
mov dword [esp + 0xc], eax
mov byte [esp + 0x18], dl
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x30], eax
cmp edi, 9
jae 0x47806d
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x10]
push 5
push eax
push ebx
call dword [0x4893dc]
add esp, 0xc
test eax, eax
je 0x47809c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
lea ecx, [esi + 0x10]
lea edx, [esi + 0xc]
push ecx
add esi, 8
push edx
lea eax, [esp + 0x14]
push esi
push eax
push 1
push edi
push ebx
call fcn.004780d0
mov ecx, dword [esp + 0x44]
add esp, 0x1c
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret 8
Function at 0x47a8d0
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esp + 4]
push ebp
test edx, edx
je 0x47aa22
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x47aa22
mov ebp, dword [esp + 0xc]
test ebp, ebp
jl 0x47aa22
xor eax, eax
test ebp, ebp
jle 0x47aa24
push ebx
push esi
push edi
cmp ebp, 3
jl 0x47a985
mov bl, byte [edx]
inc edx
mov byte [esp + 0x14], bl
mov esi, dword [esp + 0x14]
mov bl, byte [edx]
and esi, 0xff
inc edx
mov edi, esi
mov byte [esp + 0x1c], bl
mov bl, byte [edx]
and esi, 3
shr edi, 2
mov byte [esp + 0x18], bl
inc edx
mov bl, byte [edi + 0x4a2f60]
mov edi, dword [esp + 0x1c]
and edi, 0xff
mov byte [ecx], bl
mov ebx, edi
inc ecx
shr ebx, 4
shl esi, 4
or ebx, esi
mov esi, dword [esp + 0x18]
and esi, 0xff
and edi, 0xf
mov bl, byte [ebx + 0x4a2f60]
mov byte [ecx], bl
mov ebx, esi
shr ebx, 6
shl edi, 2
or ebx, edi
inc ecx
inc ecx
and esi, 0x3f
mov bl, byte [ebx + 0x4a2f60]
mov byte [ecx - 1], bl
mov bl, byte [esi + 0x4a2f60]
mov byte [ecx], bl
jmp 0x47aa0e
mov bl, byte [edx]
cmp ebp, 2
mov byte [esp + 0x14], bl
jne 0x47a9e0
mov esi, dword [esp + 0x14]
mov bl, byte [edx + 1]
and esi, 0xff
inc edx
mov edi, esi
mov byte [esp + 0x1c], bl
shr edi, 2
and esi, 3
inc ecx
mov bl, byte [edi + 0x4a2f60]
mov edi, dword [esp + 0x1c]
and edi, 0xff
mov byte [ecx - 1], bl
mov ebx, edi
shr ebx, 4
shl esi, 4
or ebx, esi
inc ecx
and edi, 0xf
mov bl, byte [ebx + 0x4a2f60]
mov byte [ecx - 1], bl
mov bl, byte [edi*4 + 0x4a2f60]
mov byte [ecx], bl
jmp 0x47aa0a
mov esi, dword [esp + 0x14]
and esi, 0xff
mov edi, esi
and esi, 3
shr edi, 2
shl esi, 4
mov bl, byte [edi + 0x4a2f60]
mov byte [ecx], bl
mov bl, byte [esi + 0x4a2f60]
inc ecx
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
sub ebp, 3
inc ecx
add eax, 4
test ebp, ebp
jg 0x47a902
pop edi
pop esi
pop ebx
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x47aa30
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov ecx, dword [esp + 4]
push esi
test ecx, ecx
je 0x47aaee
mov esi, dword [esp + 0x10]
test esi, esi
je 0x47aaee
mov eax, dword [esp + 0xc]
test eax, eax
jl 0x47aaee
mov edx, eax
and edx, 0x80000003
jns 0x47aa64
dec edx
or edx, 0xfffffffc
inc edx
jne 0x47aaee
push edi
xor edi, edi
test eax, eax
jle 0x47aae9
add eax, 3
push ebx
shr eax, 2
push ebp
mov dword [esp + 0x14], eax
movsx ebp, byte [ecx]
movsx eax, byte [ecx + 1]
inc ecx
mov edx, dword [ebp*4 + 0x4a2fa0]
mov eax, dword [eax*4 + 0x4a2fa0]
inc ecx
mov ebx, eax
shl dl, 2
shr ebx, 4
or dl, bl
mov byte [esi], dl
inc esi
movsx edx, byte [ecx]
inc edi
inc ecx
cmp edx, 0x3d
je 0x47aadb
mov edx, dword [edx*4 + 0x4a2fa0]
mov ebx, edx
shr ebx, 2
shl al, 4
or bl, al
mov byte [esi], bl
inc esi
movsx ebp, byte [ecx]
inc edi
inc ecx
cmp ebp, 0x3d
je 0x47aadc
mov eax, dword [ebp*4 + 0x4a2fa0]
shl dl, 6
or al, dl
mov byte [esi], al
inc esi
inc edi
jmp 0x47aadc
inc ecx
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x47aa7d
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x47ab70
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4
Function at 0x481040
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret