joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4873e0
Capabilities:
Check os version

Disassembly:
mov ecx, dword [0x654e14]
cmp ecx, 0xffffffff
jne 0x4874d7
push esi
xor esi, esi
cmp dword [0x654e18], ecx
jne 0x4874d6
cmp dword [0x665130], esi
jne 0x48742c
push 0x665130
mov dword [0x665130], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call fcn.00590b90
add esp, 4
test eax, eax
je 0x4874da
mov edx, dword [0x665134]
mov eax, dword [0x665138]
push edi
movzx edi, word [0x665244]
cmp edx, 0xa
jg 0x4874a3
jne 0x487451
test eax, eax
jns 0x4874a3
mov esi, 6
jmp 0x4874a8
cmp edx, 6
jg 0x48744a
jne 0x487480
cmp eax, 3
jge 0x48744a
cmp eax, 2
jge 0x487479
cmp eax, 1
jge 0x487472
test eax, eax
js 0x48749c
mov esi, 3
jmp 0x4874a8
mov esi, 4
jmp 0x4874a8
mov esi, 5
jmp 0x4874a8
cmp edx, 5
jg 0x48749c
jne 0x4874a8
cmp eax, 2
jge 0x48749c
cmp eax, 1
jge 0x48749c
test eax, eax
js 0x4874a8
mov esi, 1
jmp 0x4874a8
mov esi, 2
jmp 0x4874a8
mov esi, 7
mov dword [0x654e1c], eax
mov ecx, esi
mov eax, dword [0x66513c]
mov dword [0x654e20], eax
mov eax, dword [0x665140]
mov dword [0x654e28], edi
mov dword [0x654e14], ecx
mov dword [0x654e18], edx
mov dword [0x654e24], eax
pop edi
pop esi
mov eax, ecx
ret
push str.GetVersionEx_failed__m
push 0x55
call fcn.00475dd0
int3

Function at 0x4875f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x654e18]
push ebx
push esi
xor esi, esi
push edi
cmp ecx, 0xffffffff
je 0x487629
mov edx, dword [0x654e20]
mov esi, dword [0x654e14]
mov eax, dword [0x654e1c]
mov ebx, dword [0x654e24]
mov edi, dword [0x654e28]
mov dword [ebp - 4], edx
jmp 0x487704
cmp dword [0x665130], esi
jne 0x487657
push 0x665130
mov dword [0x665130], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call fcn.00590b90
add esp, 4
test eax, eax
je 0x487744
mov ecx, dword [0x665134]
mov edx, dword [0x66513c]
mov eax, dword [0x665138]
mov ebx, dword [0x665140]
movzx edi, word [0x665244]
mov dword [ebp - 4], edx
cmp ecx, 0xa
jg 0x4876dc
jne 0x48768a
test eax, eax
jns 0x4876dc
mov esi, 6
jmp 0x4876e1
cmp ecx, 6
jg 0x487683
jne 0x4876b9
cmp eax, 3
jge 0x487683
cmp eax, 2
jge 0x4876b2
cmp eax, 1
jge 0x4876ab
test eax, eax
js 0x4876d5
mov esi, 3
jmp 0x4876e1
mov esi, 4
jmp 0x4876e1
mov esi, 5
jmp 0x4876e1
cmp ecx, 5
jg 0x4876d5
jne 0x4876e1
cmp eax, 2
jge 0x4876d5
cmp eax, 1
jge 0x4876d5
test eax, eax
js 0x4876e1
mov esi, 1
jmp 0x4876e1
mov esi, 2
jmp 0x4876e1
mov esi, 7
mov dword [0x654e14], esi
mov dword [0x654e18], ecx
mov dword [0x654e1c], eax
mov dword [0x654e20], edx
mov dword [0x654e24], ebx
mov dword [0x654e28], edi
mov edx, dword [ebp + 8]
test edx, edx
je 0x48770d
mov dword [edx], esi
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x487716
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x48771f
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x48772b
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x487734
mov dword [eax], ebx
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x48773d
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.GetVersionEx_failed__m
push 0x55
call fcn.00475dd0
int3
Function at 0x487760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push 0x4878a0
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00475ff0
mov edi, eax
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push 0x104
push eax
or ebx, 0xffffffff
call fcn.00477aa0
add esp, 0x14
cmp dword [ebp + 0x10], 0
je 0x4877e6
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
push eax
call fcn.00590b90
add esp, 4
test eax, eax
jne 0x4877e6
push str.failed_get_token_for_active_user__m
push edi
call fcn.004770b0
push dword [edi]
push 0x550003
call fcn.00479a10
add esp, 0x10
jmp 0x487877
push dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
push 0
push dword [ebp - 8]
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x48781e
push ebx
push str.failed_get_path_for_cid__d
push edi
call fcn.00477140
push dword [edi]
push 0x550003
call fcn.00479a10
add esp, 0x14
or ebx, 0xffffffff
jmp 0x487877
push esi
push dword [ebp - 4]
mov esi, dword [ebp + 8]
push esi
call fcn.00477210
mov edx, dword [esi]
add esp, 8
test edx, edx
je 0x487858
cmp byte [edx], 0
je 0x487858
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x487840
sub ecx, esi
cmp byte [edx + ecx - 1], 0x5c
jne 0x487854
mov byte [edx + ecx - 1], al
xor ebx, ebx
jmp 0x487876
push ebx
push str.got_empty_path_for__d
push edi
call fcn.00477140
push dword [edi]
push 0x550003
call fcn.00479a10
add esp, 0x14
or ebx, 0xffffffff
pop esi
cmp dword [ebp + 0x10], 0
je 0x487889
lea eax, [ebp - 8]
push eax
call fcn.00498940
add esp, 4
lea eax, [ebp - 4]
push eax
call fcn.00477a10
add esp, 4
mov eax, ebx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x488570
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x3d
push edi
call fcn.00594b30
mov ecx, dword [ebp + 0xc]
add ecx, edi
test eax, eax
mov dword [ebp + 0xc], ecx
cmove eax, ecx
sub eax, 3
mov si, word [eax]
mov bl, byte [eax + 2]
sub eax, edi
push eax
lea eax, [edi + 3]
push edi
push eax
call fcn.00595530
mov eax, dword [ebp + 0x14]
add esp, 0x14
mov ecx, dword [ebp + 0x10]
add eax, ecx
mov word [edi], si
mov byte [edi + 2], bl
mov ebx, ecx
cmp byte [edi], 0
mov dword [ebp - 4], eax
je 0x488687
lea eax, [ecx + 3]
mov dword [ebp + 8], eax
nop word [eax + eax]
cmp edi, dword [ebp + 0xc]
jae 0x488684
mov al, byte [edi]
cmp al, 0x3d
je 0x4885ef
movzx eax, al
cmp byte [eax + 0x654e78], 0xff
je 0x488684
mov edx, edi
xor esi, esi
xor eax, eax
lea ecx, [edx + 1]
mov dword [ebp + 0x14], ecx
nop dword [eax + eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x488600
sub edx, dword [ebp + 0x14]
cmp edx, 4
jb 0x488695
xor edx, edx
mov cl, byte [edx + edi]
shl eax, 6
cmp cl, 0x3d
jne 0x488623
inc esi
jmp 0x488633
test esi, esi
jne 0x488695
movzx ecx, cl
movsx ecx, byte [ecx + 0x654e78]
add eax, ecx
inc edx
cmp edx, 4
jl 0x488615
cmp esi, 2
ja 0x488695
cmp eax, 0xffffffff
je 0x488695
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add ecx, esi
cmp edx, ecx
ja 0x488695
mov ecx, eax
inc edx
shr ecx, 0x10
mov byte [ebx], cl
inc ebx
mov dword [ebp + 8], edx
cmp esi, 2
jae 0x48866c
mov ecx, eax
shr ecx, 8
mov byte [ebx], cl
inc ebx
inc edx
mov dword [ebp + 8], edx
cmp esi, 1
jae 0x488678
mov byte [ebx], al
inc ebx
inc edx
mov dword [ebp + 8], edx
add edi, 4
cmp byte [edi], 0
jne 0x4885d0
mov ecx, dword [ebp + 0x10]
mov byte [ebx], 0
sub ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4886a0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4886b1
mov ebx, dword [ebp + 8]
sub esi, ecx
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
lea eax, [eax + eax*2]
push eax
push ebx
mov dword [ebp + 0xc], eax
call fcn.00477260
mov eax, dword [ebx]
push 0x3d
push edi
mov dword [ebp - 4], eax
call fcn.00594b30
add esp, 0x10
test eax, eax
jne 0x4886f1
lea eax, [esi + edi]
mov dword [ebp - 8], eax
jmp 0x4886f7
lea ecx, [esi + edi]
mov dword [ebp - 8], ecx
mov si, word [eax - 3]
sub eax, 3
mov bl, byte [eax + 2]
sub eax, edi
push eax
lea eax, [edi + 3]
push edi
push eax
call fcn.00595530
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov ecx, dword [ebp - 4]
add eax, ecx
mov word [edi], si
mov byte [edi + 2], bl
mov ebx, ecx
cmp byte [edi], 0
mov dword [ebp - 0x10], eax
je 0x4887e3
lea eax, [ecx + 3]
mov dword [ebp + 0xc], eax
cmp edi, dword [ebp - 8]
jae 0x4887e0
mov al, byte [edi]
cmp al, 0x3d
je 0x488752
movzx eax, al
cmp byte [eax + 0x654e78], 0xff
je 0x4887e0
mov edx, edi
xor esi, esi
xor eax, eax
lea ecx, [edx + 1]
mov dword [ebp - 0xc], ecx
nop
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x488760
sub edx, dword [ebp - 0xc]
cmp edx, 4
jb 0x4887ed
xor edx, edx
mov cl, byte [edx + edi]
shl eax, 6
cmp cl, 0x3d
jne 0x48877f
inc esi
jmp 0x48878f
test esi, esi
jne 0x4887ed
movzx ecx, cl
movsx ecx, byte [ecx + 0x654e78]
add eax, ecx
inc edx
cmp edx, 4
jl 0x488771
cmp esi, 2
ja 0x4887ed
cmp eax, 0xffffffff
je 0x4887ed
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
add ecx, esi
cmp edx, ecx
ja 0x4887ed
mov ecx, eax
inc edx
shr ecx, 0x10
mov byte [ebx], cl
inc ebx
mov dword [ebp + 0xc], edx
cmp esi, 2
jae 0x4887c8
mov ecx, eax
shr ecx, 8
mov byte [ebx], cl
inc ebx
inc edx
mov dword [ebp + 0xc], edx
cmp esi, 1
jae 0x4887d4
mov byte [ebx], al
inc ebx
inc edx
mov dword [ebp + 0xc], edx
add edi, 4
cmp byte [edi], 0
jne 0x488733
mov ecx, dword [ebp - 4]
mov byte [ebx], 0
sub ebx, ecx
cmp ebx, 0xffffffff
jne 0x48880e
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx]
test ecx, ecx
je 0x488805
push ecx
call fcn.00596eae
add esp, 4
mov dword [ebx], 0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x488840
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
add edi, esi
cmp esi, edi
jae 0x488920
mov ecx, dword [ebp + 0x14]
mov edx, eax
add edx, 0xfffffffc
add ecx, edx
lea edx, [esi + 1]
mov dword [ebp - 4], ecx
lea ecx, [esi + 2]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
cmp edx, edi
jb 0x48887d
xor bh, bh
jmp 0x48887f
mov bh, byte [edx]
cmp ecx, edi
jb 0x488887
xor bl, bl
jmp 0x488889
mov bl, byte [ecx]
cmp eax, dword [ebp - 4]
jae 0x48893d
movzx ecx, byte [esi]
shr ecx, 2
movzx ecx, byte [ecx + 0x654e30]
mov byte [eax], cl
movsx edx, byte [esi]
inc esi
and edx, 3
movzx ecx, bh
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + 0x654e30]
mov byte [eax + 1], cl
lea ecx, [eax + 3]
mov dword [ebp - 8], ecx
mov byte [ecx], 0x3d
mov byte [eax + 2], 0x3d
mov byte [eax + 4], 0
cmp esi, edi
je 0x48892d
movsx edx, byte [esi]
inc esi
and edx, 0xf
movzx ecx, bl
shl edx, 2
shr ecx, 6
or edx, ecx
mov cl, byte [edx + 0x654e30]
mov edx, dword [ebp - 8]
mov byte [eax + 2], cl
lea eax, [edx + 1]
cmp esi, edi
je 0x488920
movsx ecx, byte [esi]
inc esi
and ecx, 0x3f
mov cl, byte [ecx + 0x654e30]
mov byte [edx], cl
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add edx, 3
add ecx, 3
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], ecx
cmp esi, edi
jb 0x488875
pop edi
pop esi
mov byte [eax], 0
sub eax, dword [ebp + 0x10]
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 4
pop edi
pop esi
pop ebx
mov byte [eax], 0
sub eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x489180
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x48e270
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00475ff0
add esp, 0xc
mov dword [ebp - 4], eax
push dword [0x6652f4]
call fcn.00591170
push eax
push str..pipehola__d__d
push dword [ebp - 4]
call fcn.00477140
inc dword [0x6652f4]
mov ecx, 7
mov edi, dword [ebp + 0x10]
mov eax, 1
push 0
push 0xffffffffffffffff
push 0x1000
push 0x1000
test edi, edi
push 0xff
cmovne eax, ecx
push eax
mov eax, dword [ebp - 4]
push 0x40000003
push dword [eax]
call fcn.004989c0
mov ebx, eax
add esp, 0x30
test ebx, ebx
je 0x4892ab
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp dword [ebp + 0xc], 1
mov ecx, 0xc0000000
push 0
push 0x40000000
push 3
push 0
mov eax, 0x40000000
cmove eax, ecx
push 0
push eax
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.00498970
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x4892ba
mov eax, edi
neg eax
push 0
sbb eax, eax
and eax, 2
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push eax
call fcn.00590b90
add esp, 4
test eax, eax
je 0x4892c9
cmp dword [ebp + 0x10], 0
mov eax, 0x44
mov edi, 0x24
cmovne edi, eax
lea eax, [ebp + 0x10]
push eax
push edi
push 0
push 0
push esi
call fcn.00488990
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
lea eax, [ebp + 0x10]
push eax
push edi
push 0
push 0
push ebx
call fcn.00488990
add esp, 0x28
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.CreateNamedPipe_failed:__m
push 0x360000
call fcn.00479f70
push str.CreateFile_failed:__m
push 0x360000
call fcn.00479f70
push str.SetNamedPipeHandleState_failed:__m
push 0x360000
call fcn.00479f70
int3
Function at 0x4892e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x668d74], 0
push ebx
mov ebx, dword fs:[0x2c]
push esi
push edi
mov edi, dword [ebp + 8]
je 0x489347
mov eax, dword [ebx]
cmp dword [eax + 0x21cc], 0
jne 0x489347
push 0x668d40
call fcn.0047e9d0
mov eax, dword [0x668d6c]
push 0x668d40
mov esi, dword [eax + edi*4]
call fcn.0047e9e0
add esp, 8
test dword [esi + 0x58], 0x10000000
jne 0x489347
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00489460
add esp, 0x18
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x668d40
call fcn.0047e9d0
mov eax, dword [0x668d6c]
push 0x668d40
mov esi, dword [eax + edi*4]
call fcn.0047e9e0
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
je 0x489442
cmp dword [esi + 0x3c], 0
je 0x4893a1
cmp dword [esi + 0xc], 2
jne 0x4893a1
cmp word [esi + 0x5c], 0
je 0x4893a1
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0048f470
add esp, 0x18
mov esi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
test eax, reloc.WS2_32.dll_connect
je 0x4893c3
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0048f270
add esp, 0x14
mov esi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
test al, 1
je 0x48941c
push dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_recv]
push eax
call fcn.00590b90
mov esi, eax
add esp, 4
test esi, esi
jns 0x48943b
mov eax, dword [ebx]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x4893fa
call fcn.00596e90
cmp dword [eax], 0x2738
jne 0x48943b
push edi
push str.buf_to_small___d__for_packet_recv
push 0x360003
call fcn.00479a10
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
push eax
push str.invalid_type:__d
push 0x75c
push str.vsock_recv
push 0x360202
call fcn.00479d80
add esp, 0x14
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
push str.recv_from_non_packet_socket
push 0x360000
call fcn.00479f70
int3
Function at 0x48bc20
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
push 0x48e270
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00475ff0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edi, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 0x38], 0x5d675c
mov dword [ebp - 0x34], 0x5d6764
mov dword [ebp - 0x30], str.except
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0
movq qword [ebp - 0x40], xmm0
test edi, edi
je 0x48bd95
xor esi, esi
mov eax, edi
mov dword [ebp - 0xc], esi
xor ebx, ebx
cmp dword [eax], ebx
jbe 0x48bd80
xor ecx, ecx
lea edx, [ebp - 0x144]
cmp eax, dword [ebp + 0x14]
cmovne edx, ecx
cmp eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x18], edx
cmovne ecx, ebx
cmp eax, edi
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x144]
cmovne ecx, ebx
add eax, 4
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], eax
mov edi, dword [eax]
lea eax, [ebp - 0x40]
push eax
push edx
push dword [ebp - 0x10]
mov dword [ebp - 0x140], edi
push dword [ebp - 0x14]
mov dword [ebp - 0x144], 1
push 1
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.00590b90
add esp, 4
test eax, eax
jns 0x48bd64
push 0x668d40
call fcn.0047e9d0
mov ecx, dword [0x668d5c]
add esp, 4
mov edx, dword [0x668d6c]
xor esi, esi
test ecx, ecx
jle 0x48bd33
mov eax, dword [edx + esi*4]
test eax, eax
je 0x48bd33
cmp dword [eax + 0x60], edi
je 0x48bd33
inc esi
cmp esi, ecx
jl 0x48bd22
cmp esi, ecx
je 0x48bd3d
cmp dword [edx + esi*4], 0
jne 0x48bd40
or esi, 0xffffffff
push 0x668d40
call fcn.0047e9e0
push esi
mov esi, dword [ebp - 0xc]
push edi
push ebx
push dword [ebp + esi - 0x38]
push str._s__d__osfd_d_vfd_d_
push dword [ebp - 8]
call fcn.00476df0
add esp, 0x1c
mov ecx, dword [ebp + esi - 0x28]
inc ebx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
add eax, 4
mov dword [ebp - 4], eax
cmp ebx, dword [ecx]
jb 0x48bcd1
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + esi - 0x24]
add esi, 4
mov dword [ebp - 0xc], esi
test eax, eax
jne 0x48bc93
mov eax, dword [ebp - 8]
push 0x5d678c
push eax
call fcn.004776a0
mov eax, dword [ebp - 8]
add esp, 8
push dword [eax]
push str.vsock_select__:_a_member_of_fd_set_was_invalid:__s
push 0x360000
call fcn.00479f70
int3
Function at 0x48be80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [edi + 0x28f0]
test eax, eax
jne 0x48bea0
call fcn.00596e90
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0xe0]
lea ebx, [esi + 0xd4]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov eax, dword [esi + 0xe0]
mov dword [eax + 0x10], esi
lock inc dword [ebx]
push dword [esi + 0x6c]
or dword [esi + 0x58], 0x400
call fcn.0049d780
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x6c]
call fcn.0049d6e0
push esi
call fcn.00490290
add esp, 0x18
push 0x48a440
push dword [esi + 0xe0]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
push eax
call fcn.00590b90
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
jne 0x48bff9
mov eax, dword [edi + 0x28f0]
test eax, eax
jne 0x48bf36
call fcn.00596e90
push 0x15
push 6
push 0xe8
push 1
push 4
push dword [eax]
call fcn.00488c00
add esp, 0x18
test eax, eax
je 0x48c01c
push 0x668d40
call fcn.0047e9d0
mov ecx, dword [esi + 0xbc]
add esp, 4
cmp esi, dword [0x668d0c]
jne 0x48bf78
mov dword [0x668d0c], ecx
jmp 0x48bf8a
mov eax, dword [esi + 0xc0]
mov dword [eax + 0xbc], ecx
mov ecx, dword [0x668d0c]
mov edx, dword [esi + 0xbc]
test edx, edx
je 0x48bfa2
mov eax, dword [esi + 0xc0]
mov dword [edx + 0xc0], eax
jmp 0x48bfb2
test ecx, ecx
je 0x48bfb2
mov eax, dword [esi + 0xc0]
mov dword [ecx + 0xc0], eax
push 0x668d40
mov dword [esi + 0xbc], 0
mov dword [esi + 0xc0], 0
call fcn.0047e9e0
or dword [esi + 0x58], 0x4100000
push esi
call fcn.00490320
and dword [esi + 0x58], 0xfffffbff
add esp, 8
or eax, 0xffffffff
lock xadd dword [ebx], eax
jne 0x48bff9
push esi
call fcn.00489be0
add esp, 4
mov eax, dword [edi + 0x28f0]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x48c00b
call fcn.00596e90
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
xor eax, eax
cmp dword [ebp + 8], eax
sete al
mov esp, ebp
pop ebp
ret
push str.cant_read_from_handle:__m
push 0x360000
call fcn.00479f70
int3
Function at 0x48c030
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edi
mov eax, dword [esi + 0xe0]
lea ebx, [esi + 0xd4]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov eax, dword [esi + 0xe0]
mov dword [eax + 0x10], esi
lock inc dword [ebx]
or dword [esi + 0x58], 0x400
push esi
call fcn.00490290
add esp, 4
lea eax, [esi + 0x100]
push 0x48a440
push dword [esi + 0xe0]
push 1
push eax
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
mov edi, eax
push edi
call fcn.00590b90
add esp, 4
test eax, eax
jne 0x48c0cf
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x28f0]
test eax, eax
jne 0x48c0b2
call fcn.00596e90
push 6
push 0x6d
push 0xe8
push 3
push dword [eax]
call fcn.00488c00
add esp, 0x14
test eax, eax
je 0x48c183
test edi, edi
jne 0x48c17e
push 0x668d40
call fcn.0047e9d0
mov ecx, dword [esi + 0xbc]
add esp, 4
cmp esi, dword [0x668d0c]
jne 0x48c0fa
mov dword [0x668d0c], ecx
jmp 0x48c10c
mov eax, dword [esi + 0xc0]
mov dword [eax + 0xbc], ecx
mov ecx, dword [0x668d0c]
mov edx, dword [esi + 0xbc]
test edx, edx
je 0x48c124
mov eax, dword [esi + 0xc0]
mov dword [edx + 0xc0], eax
jmp 0x48c134
test ecx, ecx
je 0x48c134
mov eax, dword [esi + 0xc0]
mov dword [ecx + 0xc0], eax
push 0x668d40
mov dword [esi + 0xbc], 0
mov dword [esi + 0xc0], 0
call fcn.0047e9e0
and dword [esi + 0x58], 0xfffffbff
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx], eax
jne 0x48c16e
push esi
call fcn.00489be0
add esp, 4
or dword [esi + 0x58], 0x100000
push esi
call fcn.00490320
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
push str.cant_read_from_handle:__m
push 0x360000
call fcn.00479f70
int3
Function at 0x48c820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
test dword [esi + 0x58], 0x2000
je 0x48c83d
call sub.ntdll.dll_NtTestAlert
pop esi
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x70]
call fcn.0049dad0
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x48c9cb
mov eax, dword [esi + 0xe4]
xorps xmm0, xmm0
or dword [esi + 0x58], 0x2000
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov eax, dword [esi + 0xe4]
mov dword [eax + 0x10], esi
lea eax, [esi + 0xd4]
lock inc dword [eax]
push esi
call fcn.00490400
add esp, 4
push 0x48a550
push dword [esi + 0xe4]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
push eax
call fcn.00590b90
mov ebx, dword fs:[0x2c]
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
jne 0x48c9a8
push edi
mov edi, dword [ebx]
mov eax, dword [edi + 0x28f0]
test eax, eax
jne 0x48c8d7
call fcn.00596e90
cmp dword [eax], 0xe8
jne 0x48c9e0
mov eax, dword [edi + 0x28f0]
pop edi
test eax, eax
jne 0x48c8f3
call fcn.00596e90
cmp dword [eax], 0xe8
jne 0x48c9a5
push 0x668d40
call fcn.0047e9d0
mov ecx, dword [esi + 0xb4]
add esp, 4
cmp esi, dword [0x668d10]
jne 0x48c922
mov dword [0x668d10], ecx
jmp 0x48c934
mov eax, dword [esi + 0xb8]
mov dword [eax + 0xb4], ecx
mov ecx, dword [0x668d10]
mov edx, dword [esi + 0xb4]
test edx, edx
je 0x48c94c
mov eax, dword [esi + 0xb8]
mov dword [edx + 0xb8], eax
jmp 0x48c95c
test ecx, ecx
je 0x48c95c
mov eax, dword [esi + 0xb8]
mov dword [ecx + 0xb8], eax
push 0x668d40
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
call fcn.0047e9e0
mov eax, dword [esi + 0x58]
lea ecx, [esi + 0xd4]
and eax, 0xffffdfff
add esp, 4
or eax, 0x4000000
mov dword [esi + 0x58], eax
or eax, 0xffffffff
lock xadd dword [ecx], eax
jne 0x48c9a5
push esi
call fcn.00489be0
add esp, 4
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], 0
je 0x48c9cb
test eax, eax
jne 0x48c9da
mov eax, dword [ebx]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x48c9c3
call fcn.00596e90
cmp dword [eax], 0xe8
jne 0x48c9da
mov eax, dword [esi + 0x58]
test al, 0x10
jne 0x48c9da
and eax, 0xffffdfff
mov dword [esi + 0x58], eax
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push str.WriteFileEx_failed:__m
push 0x360000
call fcn.00479f70
int3