joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452570
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, eax
mov eax, dword [esp + 0x20]
mov esi, ecx
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 4]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x20]
push ecx
push 0
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x45269b
test ebx, ebx
je 0x452647
cmp word [ebx], 0
je 0x452647
cmp byte [esi + 0x128], 0
je 0x4525d9
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x4525e0
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.00447720
mov esi, eax
call fcn.00447a60
mov ecx, ebp
call fcn.00447720
push 0x4e4ef0
mov esi, eax
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
mov ecx, dword [esp + 0x28]
add ecx, 4
push ecx
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
push 0x4d6528
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
push ebx
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
add esp, 0x20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x452656
mov ebx, dword [esi + 0x14]
mov ecx, ebp
call fcn.00447720
mov esi, eax
call fcn.00447a60
mov ecx, ebp
call fcn.00447720
mov esi, eax
push 0x4e4ef0
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
add ebx, 4
push ebx
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x24]
je 0x452735
test ebx, ebx
je 0x4526ed
cmp word [ebx], 0
je 0x4526ed
cmp byte [esi + 0x128], 0
je 0x4526c5
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x4526cc
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.00447720
xor edi, edi
mov esi, eax
call fcn.00447a60
mov ecx, ebp
call fcn.00447720
push 0x4e4f00
jmp 0x4525fa
cmp byte [esi + 0x128], 0
je 0x4526fb
add esi, 0x18
jmp 0x4526fe
mov esi, dword [esi + 0x14]
mov ecx, ebp
call fcn.00447720
mov edi, eax
push 0x4e4f00
push 0x4d65ac
mov edx, edi
call fcn.00448ff0
add esi, 4
push esi
push 0x4d65ac
mov edx, edi
call fcn.00448ff0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov al, 1
pop ebx
pop ecx
ret 0x10
Function at 0x4527e0
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4bc6cb
mov eax, dword fs:[0]
push eax
sub esp, 0x35c
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x354], eax
push ebp
push esi
push edi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x36c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x37c]
lea esi, [esp + 0x14]
mov edi, ecx
call fcn.00447d80
xor esi, esi
mov dword [esp + 0x374], esi
cmp byte [edi + 0x11c], 0
lea eax, [edi + 0xc]
jne 0x452844
mov eax, dword [edi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push edi
push ebx
lea eax, [esp + 0x20]
push eax
call fcn.004435c0
test al, al
jne 0x452890
mov dword [esp + 0x374], 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], vtable.t_fileWrite.0
mov dword [esp + method.t_byteStreamWrite.virtual_0], vtable.t_byteStreamWrite.0
call fcn.004434f0
xor al, al
jmp 0x452906
push 2
push 0x4e49d8
push ebx
lea ecx, [esp + 0x36c]
call fcn.00447e80
test al, al
je 0x452865
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 4]
push ecx
push edx
push ebx
lea ecx, [esp + 0x36c]
call fcn.00447e80
test al, al
je 0x452865
lea edi, [esp + 0x14]
call fcn.004437f0
mov eax, dword [ebp + 4]
push eax
call fcn.00498f5b
mov dword [esp + 0x378], 0xffffffff
add esp, 4
mov ecx, edi
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
mov dword [esp + 0x14], vtable.t_fileWrite.0
mov dword [esp + method.t_byteStreamWrite.virtual_0], vtable.t_byteStreamWrite.0
call fcn.004434f0
mov al, 1
mov ecx, dword [esp + 0x36c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x354]
xor ecx, esp
call fcn.00497c58
add esp, 0x368
ret 4
Function at 0x454aa0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4bd15f
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x138], eax
push ebx
push esi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x148]
mov dword fs:[0], eax
mov ecx, edi
mov dword [esp + 0x18], edi
call fcn.00448930
xor ebx, ebx
mov dword [esp + 0x150], ebx
lea ecx, [esp + 0x1c]
mov dword [edi + 0x124], ebx
call fcn.00448930
mov byte [esp + 0x10], bl
mov dword [esp + 0xc], ebx
lea eax, [esp + 0x1c]
lea esi, [esp + 0xc]
mov byte [esp + 0x150], 2
call fcn.0044e2c0
test al, al
jne 0x454b48
mov ecx, esi
call fcn.004476c0
mov dword [esp + 0x1c], vtable.t_str.0
cmp byte [esp + 0x138], bl
jne 0x454c0b
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
cmp eax, ecx
jmp 0x454c00
lea eax, [esp + 0x28]
cmp byte [esp + 0x138], bl
jne 0x454b59
mov eax, dword [esp + 0x24]
add eax, 4
mov edx, edi
call fcn.00448b50
push 0x4d6528
push 0x4d65ac
mov edx, edi
call fcn.00448ff0
push str.verify.ini
push 0x4d65ac
mov edx, edi
call fcn.00448ff0
push 0x230
call fcn.00498bee
add esp, 0x14
mov dword [esp + 0x14], eax
mov byte [esp + 0x150], 3
cmp eax, ebx
je 0x454baf
push eax
mov edx, str.Localcs_logsignature
call fcn.00450e60
jmp 0x454bb1
xor eax, eax
mov dword [edi + 0x128], eax
cmp byte [0x4fe13a], bl
jne 0x454bdc
cmp byte [0x4fe13d], bl
je 0x454bdc
push edi
push ebx
push 0x4550a0
call fcn.0049e20e
add esp, 0xc
mov dword [edi + 0x124], eax
lea ecx, [esp + 0xc]
call fcn.004476c0
mov dword [esp + 0x1c], vtable.t_str.0
cmp byte [esp + 0x138], bl
jne 0x454c0b
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x28]
cmp eax, edx
je 0x454c0b
push eax
call fcn.00498f5b
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x148]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x138]
xor ecx, esp
call fcn.00497c58
add esp, 0x148
ret

Function at 0x457390
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b99b8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], str.item
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.00499078
mov dword [eax + 0x24], fcn.0049b4da
mov dword [eax + 0x28], fcn.00498f5b
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configRuntimeFile::t_item_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8
Function at 0x457530
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
push 0
push eax
push ecx
push edi
call fcn.004435c0
test al, al
jne 0x457547
pop esi
add esp, 8
ret
mov eax, dword [edi + 4]
lea edx, [esp + 8]
push edx
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x457571
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x457571
xor esi, esi
mov dword [edi + 0x350], esi
mov al, 1
pop esi
add esp, 8
ret
Function at 0x458900
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, ebx
call fcn.004583d0
test eax, eax
jl 0x458b38
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x45896d
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea esp, [esp]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x458930
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x458b34
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x4d6eb8]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4d6eb8]
and esi, 0xff
mov esi, dword [esi*4 + 0x4d7ab8]
and edi, 0xff
xor esi, dword [edi*4 + 0x4d82b8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4d6eb8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4d86b8]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x4d6eb8]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4d7eb8]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x4d6eb8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4d6eb8]
and esi, 0xff
mov esi, dword [esi*4 + 0x4d7ab8]
and edi, 0xff
xor esi, dword [edi*4 + 0x4d82b8]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x4d6eb8]
and edi, 0xff
xor esi, dword [edi*4 + 0x4d7eb8]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4d6eb8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4d86b8]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x4d6eb8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4d6eb8]
and esi, 0xff
mov esi, dword [esi*4 + 0x4d7ab8]
and edi, 0xff
xor esi, dword [edi*4 + 0x4d82b8]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x4d6eb8]
and edi, 0xff
xor esi, dword [edi*4 + 0x4d7eb8]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4d6eb8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4d86b8]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x4d6eb8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4d6eb8]
and esi, 0xff
mov esi, dword [esi*4 + 0x4d7ab8]
and edi, 0xff
xor esi, dword [edi*4 + 0x4d82b8]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x4d6eb8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4d6eb8]
and edi, 0xff
xor esi, dword [edi*4 + 0x4d7eb8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4d86b8]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x458981
pop edi
xor eax, eax
pop esi
ret
Function at 0x459680
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
mov edi, eax
cmp edi, 3
mov esi, edx
jl 0x459705
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub edi, eax
push ebx
lea ebx, [ebx]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + 0x4d69e0]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + 0x4d69e0]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
inc ecx
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + 0x4d69e0]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + 0x4d69e0]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edx, 1
jne 0x4596a0
pop ebx
test edi, edi
jle 0x459765
movzx edx, byte [esi]
shr edx, 2
movzx eax, byte [edx + 0x4d69e0]
mov byte [ecx], al
mov al, byte [esi]
and al, 3
inc ecx
shl al, 4
cmp edi, 1
jle 0x45972d
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
mov dl, byte [eax + 0x4d69e0]
mov byte [ecx], dl
inc ecx
cmp edi, 2
jge 0x45974f
mov eax, 0x3d
mov byte [ecx], al
inc ecx
mov byte [ecx], al
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret
movzx eax, byte [esi + 1]
and eax, 0xf
movsx eax, byte [eax*4 + 0x4d69e0]
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret

Function at 0x4598e0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
push ebx
push esi
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x4598f2
mov esi, 0x4fd5b8
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00457980
add esp, 4
lea ebx, [esp + 8]
mov eax, esi
call fcn.00457c20
mov eax, esi
pop esi
pop ebx
add esp, 0x5c
ret
Function at 0x45b380
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b99b8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x18]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.00499078
mov dword [eax + 0x24], fcn.0049b4da
mov dword [eax + 0x28], fcn.00498f5b
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configSignatureFile::t_signature_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 0xc

Function at 0x45cb80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
xor eax, eax
push 0x1fe
mov esi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.0049ca10
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0x20019
push 0
push str.SoftWareSogouInput
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x45cbf1
xor al, al
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00497c58
add esp, 0x210
ret
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push esi
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x45cbd9
lea eax, [esp + 0x10]
mov edx, edi
call fcn.00448b50
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
mov al, 1
call fcn.00497c58
add esp, 0x210
ret
Function at 0x45d130
Capabilities:
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x4bdd56
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push esi
push edi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x26c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x27c]
mov esi, ecx
xor bl, bl
push eax
lea ecx, [esp + 0x144]
mov byte [esp + 0x17], bl
call fcn.00448a70
lea ecx, [esp + 0x18]
call fcn.00448930
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
test esi, esi
je 0x45d266
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea eax, [esp + 0x18]
push eax
push 2
push esi
mov dword [esp + 0x24], 0xbb8
call edi
push 4
lea ecx, [esp + 0x18]
push ecx
push 5
push esi
call edi
push 4
lea edx, [esp + 0x18]
push edx
push 6
push esi
call edi
push 4
lea eax, [esp + 0x18]
push eax
push 8
push esi
call edi
mov ecx, dword [esp + 0x144]
mov eax, 0x800
test ecx, ecx
jbe 0x45d225
cmp ecx, eax
jae 0x45d1fc
mov eax, ecx
cmp byte [esp + 0x25c], 0
lea ecx, [esp + 0x14c]
jne 0x45d214
mov ecx, dword [esp + 0x148]
add ecx, 4
push ecx
lea ebx, [esp + 0x1c]
call fcn.00448bb0
mov bl, byte [esp + 0x13]
cmp byte [esp + 0x134], 0
lea eax, [esp + 0x24]
jne 0x45d237
mov eax, dword [esp + 0x20]
push 0
push 0x84200000
push 0
push 0
add eax, 4
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x45d263
push eax
mov byte [esp + 0x17], 1
call edi
mov bl, byte [esp + 0x13]
push esi
call edi
cmp byte [esp + 0x134], 0
mov esi, vtable.t_str.0
mov dword [esp + 0x18], esi
jne 0x45d28e
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
cmp eax, ecx
je 0x45d28e
push eax
call fcn.00498f5b
add esp, 4
cmp byte [esp + 0x25c], 0
mov dword [esp + 0x140], esi
jne 0x45d2ba
mov eax, dword [esp + 0x148]
lea edx, [esp + 0x14c]
cmp eax, edx
je 0x45d2ba
push eax
call fcn.00498f5b
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x26c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.00497c58
add esp, 0x268
ret
Function at 0x45d2f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b9f23
mov eax, dword fs:[0]
push eax
push ebp
push esi
push edi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
mov dword [edi + 4], 1
mov dword [edi + 8], 1
mov dword [edi + 0xc], 0xffffffff
xor ebp, ebp
mov dword [esp + 0x18], ebp
lea esi, [edi + 0x30]
mov dword [edi], vtable.t_taskMsgDownloadSoDA.0
mov dword [edi + 0x10], ebp
mov dword [edi + 0x14], ebp
mov dword [edi + 0x18], ebp
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebp
mov word [esi + 4], ax
push ebp
mov eax, 0x4d6464
call fcn.00405e30
lea esi, [edi + 0x4c]
mov byte [esp + 0x18], 1
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebp
push ebp
mov eax, 0x4d6464
mov word [esi + 4], cx
call fcn.00405e30
xor eax, eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 4
Function at 0x45fdf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b9eee
mov eax, dword fs:[0]
push eax
push ebp
push esi
push edi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
mov dword [edi + 4], 1
mov dword [edi + 8], 2
mov dword [edi + 0xc], 0xffffffff
xor ebp, ebp
mov dword [esp + 0x18], ebp
lea esi, [edi + 0x30]
mov dword [edi], vtable.t_taskMsgDownloadHttp.0
mov dword [edi + 0x10], ebp
mov dword [edi + 0x14], ebp
mov dword [edi + 0x18], ebp
mov dword [edi + 0x1c], ebp
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebp
mov word [esi + 4], ax
push ebp
mov eax, 0x4d6464
call fcn.00405e30
lea esi, [edi + 0x4c]
mov byte [esp + 0x18], 1
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebp
push ebp
mov eax, 0x4d6464
mov word [esi + 4], cx
call fcn.00405e30
lea esi, [edi + 0x68]
mov byte [esp + 0x18], 2
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebp
push ebp
mov eax, 0x4d6464
mov word [esi + 4], dx
call fcn.00405e30
xor eax, eax
mov dword [edi + 0x84], ebp
mov dword [edi + 0x88], ebp
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 4
Function at 0x46741f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x467444
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x46745c
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x46748b
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x4674ca
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x46759e
sub edx, 0x10000
js 0x46759e
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x4674b0
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x4674b0
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x467521
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x46751e
add edx, 8
jne 0x467505
jmp 0x46758f
add edx, 4
test eax, 0xffff
jne 0x46752e
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x46758f
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x467562
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x4674b0
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x46759e
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x4674b0
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x4675af
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret