joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b547
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, ecx
push esi
push edi
mov edi, edx
mov dword [esp + 0x10], edi
test ebx, ebx
je 0x48b69a
cmp ebx, 0x7fffffff
ja 0x48b69a
push dword [ebp + 4]
mov esi, dword [ebp]
mov edx, ebx
mov ecx, edi
call fcn.0048b47c
pop ecx
mov dword [esp + 0x18], eax
cmp dword [esi + 8], eax
jne 0x48b5b2
cmp dword [ebp + 4], 0
jne 0x48b59c
cmp dword [esi + 0x10], ebx
jne 0x48b5b2
push ebx
push edi
push dword [esi + 0xc]
call fcn.006501e0
jmp 0x48b5ab
cmp dword [esi + 0x10], ebx
jne 0x48b5b2
push ebx
push edi
push dword [esi + 0xc]
call fcn.005f0560
add esp, 0xc
test eax, eax
je 0x48b5c0
mov eax, dword [esi]
test eax, eax
je 0x48b5c7
mov esi, eax
mov eax, dword [esp + 0x18]
jmp 0x48b580
mov eax, esi
jmp 0x48b69c
cmp dword [esp + 0x1c], 0
je 0x48b69a
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x48b5f1
push 0x1643
push 0x757c84
push 1
push 0x1c
call fcn.005f5ba0
add esp, 0x10
jmp 0x48b5f9
push 0x1c
pop edx
call fcn.004878c7
mov edi, eax
mov dword [esi], edi
test edi, edi
je 0x48b6a2
xor eax, eax
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [esi]
lea edi, [ebx + 1]
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], esi
mov eax, dword [esi]
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 8]
mov ebp, 0x1647
test ecx, ecx
jne 0x48b63c
push ebp
push 0x757cfc
push 1
push edi
call fcn.005f5ba0
add esp, 0x10
jmp 0x48b643
mov edx, edi
call fcn.004878c7
mov ecx, eax
mov eax, dword [esi]
mov dword [eax + 0xc], ecx
test ecx, ecx
jne 0x48b675
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x757d18
push esi
push ebp
xor ecx, ecx
call fcn.0048f95e
push ebp
push 0x757d34
push 0x757d50
jmp 0x48b6cc
mov ecx, dword [esi]
mov edx, edi
push ebx
push dword [esp + 0x14]
mov ecx, dword [ecx + 0xc]
call section..text
mov eax, dword [esi]
pop ecx
pop ecx
mov eax, dword [eax + 0xc]
mov byte [ebx + eax], 0
mov eax, dword [esi]
mov dword [eax + 0x10], ebx
mov eax, dword [esi]
jmp 0x48b69c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1643
push esi
push edi
mov edx, 0x757ca0
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x757cbc
push 0x757cd8
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d0820
int3
Function at 0x48b7e5
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0x1757
push 0x757e68
xor al, al
mov dword [esp + 0x20], ecx
push 1
push 0xc
mov edi, edx
mov byte [esp + 0x23], al
xor ebx, ebx
xor ebp, ebp
call fcn.005f5ba0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48b998
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
and dword [esi], ebx
and dword [esi + 8], ebx
lea eax, [ecx + edi]
mov dword [esp + 0x14], eax
lea eax, [edi + edx]
mov dword [esp + 0x1c], eax
cmp edi, eax
jae 0x48b925
mov al, byte [esp + 0x13]
test al, al
jne 0x48b878
mov al, byte [edi + ecx]
cmp al, 0x22
jne 0x48b86b
xor ebp, ebp
mov byte [esp + 0x13], al
inc ebp
inc ebx
inc edi
cmp edi, dword [esp + 0x1c]
jae 0x48b925
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
jmp 0x48b83f
cmp al, 0x27
jne 0x48b886
xor ebp, ebp
mov byte [esp + 0x13], al
inc ebp
jmp 0x48b886
cmp byte [edi + ecx], al
jne 0x48b886
xor eax, eax
test ebp, ebp
sete al
mov ebp, eax
test ebp, ebp
jne 0x48b855
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edx
mov edx, edi
call fcn.0048b7ac
add esp, 0xc
test eax, eax
je 0x48b855
push 0x178a
push 0x757ee0
push 1
push 0xc
call fcn.005f5ba0
mov ecx, eax
add esp, 0x10
test ecx, ecx
je 0x48b8f3
mov edx, dword [esp + 0x14]
and dword [ecx + 8], ebp
mov dword [ecx], edx
mov dword [ecx + 4], ebx
cmp dword [esi], ebp
je 0x48b8d5
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x48b8d7
mov dword [esi], ecx
mov eax, dword [esp + 0x2c]
dec edi
inc dword [esi + 8]
add edi, eax
add eax, ebx
mov dword [esi + 4], ecx
add edx, eax
xor ebx, ebx
mov dword [esp + 0x14], edx
jmp 0x48b856
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfd
mov ebx, 0x178a
push esi
push ebx
mov edx, 0x757efc
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push ebx
push 0x757f18
push 0x757f34
jmp 0x48b9c5
mov edi, 0x17b0
push edi
push 0x757f58
push 1
push 0xc
call fcn.005f5ba0
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x48b96c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x757f74
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x757f90
push 0x757fac
jmp 0x48b9c5
mov eax, dword [esp + 0x14]
and dword [ecx + 8], 0
mov dword [ecx], eax
mov dword [ecx + 4], ebx
cmp dword [esi], 0
je 0x48b986
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x48b988
mov dword [esi], ecx
inc dword [esi + 8]
mov eax, esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1757
push esi
push edi
mov edx, 0x757e84
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x757ea0
push 0x757ebc
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d0820
int3
Function at 0x48ba0a
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, edx
xor ebx, ebx
mov ebp, ecx
test edi, edi
je 0x48ba1e
add ebp, edi
xor edi, edi
push 0x17e5
push 0x757fd0
push 1
push 0xc
call fcn.005f5ba0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48bb7a
mov eax, dword [esp + 0x1c]
lea ecx, [edi + ebp]
and dword [esi], ebx
and dword [esi + 8], ebx
mov dword [esp + 0x10], ecx
cmp byte [ecx + eax - 1], bl
lea edx, [eax - 1]
cmovne edx, eax
mov dword [esp + 0x14], edx
jmp 0x48bad2
push dword [esp + 0x24]
mov ecx, ebp
push dword [esp + 0x24]
push edx
mov edx, edi
call fcn.0048b7ac
add esp, 0xc
test eax, eax
je 0x48bacc
push 0x17f8
push 0x758048
push 1
push 0xc
call fcn.005f5ba0
mov ecx, eax
add esp, 0x10
test ecx, ecx
je 0x48bb20
mov edx, dword [esp + 0x10]
and dword [ecx + 8], 0
mov dword [ecx], edx
mov dword [ecx + 4], ebx
cmp dword [esi], 0
je 0x48bab1
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x48bab3
mov dword [esi], ecx
mov eax, dword [esp + 0x24]
dec edi
inc dword [esi + 8]
add edi, eax
add eax, ebx
mov dword [esi + 4], ecx
add edx, eax
xor ebx, ebx
mov dword [esp + 0x10], edx
jmp 0x48bacd
inc ebx
mov edx, dword [esp + 0x14]
inc edi
cmp edi, edx
jb 0x48ba5e
mov edi, 0x181e
push edi
push 0x7580c0
push 1
push 0xc
call fcn.005f5ba0
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x48bb4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x7580dc
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x7580f8
push 0x758114
jmp 0x48bba7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov ebx, 0x17f8
push esi
push ebx
mov edx, 0x758064
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push ebx
push 0x758080
push 0x75809c
jmp 0x48bba7
mov eax, dword [esp + 0x10]
and dword [ecx + 8], 0
mov dword [ecx], eax
mov dword [ecx + 4], ebx
cmp dword [esi], 0
je 0x48bb69
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x48bb6b
mov dword [esi], ecx
inc dword [esi + 8]
mov eax, esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x17e5
push esi
push edi
mov edx, 0x757fec
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x758008
push 0x758024
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d0820
int3
Function at 0x48c27f
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
sub esp, 0xc
mov dword [esp + 0x24], ecx
xor edi, edi
mov ebx, edx
mov ebp, edi
call fcn.0048c25c
push 0x19f5
push 0x758434
push 1
push eax
mov dword [esp + 0x2c], eax
call fcn.005f5ba0
mov esi, eax
add esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], esi
mov dword [eax], esi
test esi, esi
je 0x48c345
mov ecx, ebx
mov dword [esp + 0x2c], ecx
test ebx, ebx
je 0x48c33b
mov eax, 0x320
cmp ecx, ebx
je 0x48c2fd
mov edx, dword [esp + 0x10]
lea ecx, [esi + edi]
push 3
push dword [esp + 0x24]
sub edx, edi
call section..text
pop ecx
pop ecx
mov ecx, dword [esp + 0x2c]
add edi, 3
add ebp, 3
mov eax, 0x320
mov edx, dword [esp + 0x10]
cmp ecx, eax
mov esi, ecx
cmova esi, eax
mov eax, dword [esp + 0x18]
sub eax, ecx
sub edx, edi
mov ecx, dword [esp + 0x14]
add eax, ebx
push esi
push eax
lea ecx, [ecx + edi]
call section..text
pop ecx
pop ecx
mov ecx, dword [esp + 0x2c]
add edi, esi
add ebp, esi
mov eax, 0x320
sub ecx, esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0x2c], ecx
jne 0x48c2d4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x19f5
push esi
push edi
mov edx, 0x758450
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x75846c
push 0x758488
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d0820
int3
Function at 0x48c694
Capabilities:
Set socket configuration
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, ecx
push 0x17
pop ebx
movzx eax, word [edi]
cmp ax, bx
jne 0x48c6db
cmp dword [0x7598f0], 0
jne 0x48c6db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 0x1ab1
mov edx, 0x758560
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
or eax, 0xffffffff
jmp 0x48c760
push dword [ebp + 8]
push edx
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x48c702
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 0x1ab2
mov edx, 0x75857c
jmp 0x48c6c9
cmp word [edi], bx
jne 0x48c71c
push 4
lea eax, [ebp - 4]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x48c767
cmp word [edi], bx
push 0x10
pop eax
push 0x1c
pop ecx
cmove eax, ecx
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x48c75e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 0x1ac6
mov edx, 0x7585b4
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x48c6d3
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1abd
mov edx, 0x758598
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push 0xfd
call fcn.005d0820
int3
Function at 0x48cc7d
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push 0x1b80
push 0x7587f4
push 1
mov edi, 0x88
push edi
call fcn.005f5ba0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48ccd9
push edi
push 0
push esi
call fcn.005c37d0
and dword [esi + 0x10], 0
add esp, 0xc
or dword [esi + 0x34], 0xffffffff
xor ecx, ecx
or dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x24], 0x75886c
mov dword [esi + 0x28], 3
call fcn.0048b447
mov dword [esi + 0x84], eax
mov eax, esi
pop edi
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0xfe
mov esi, 0x1b81
push edi
push esi
mov edx, 0x758810
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push esi
push 0x75882c
push 0x758848
call fcn.00401109
add esp, 0xc
push edi
call fcn.005d0820
int3

Function at 0x48cddb
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, edx
push edi
cmp dword [esi + 0x38], 0
je 0x48cdf5
push 1
push dword [esi + 0x24]
call fcn.005f5a60
pop ecx
pop ecx
mov edi, dword [esp + 0x14]
push 0x1bcd
push 0x758870
push 1
lea ebx, [edi + 1]
mov dword [esi + 0x38], 1
push ebx
call fcn.005f5ba0
add esp, 0x10
mov dword [esi + 0x24], eax
test eax, eax
je 0x48ce38
push edi
push ebp
mov edx, ebx
mov ecx, eax
call section..text
mov eax, dword [esi + 0x24]
pop ecx
pop ecx
mov byte [edi + eax], 0
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1bcd
push esi
push edi
mov edx, 0x75888c
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x7588a8
push 0x7588c4
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d0820
int3

Function at 0x48ce71
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x1c], 0
mov dword [esi + 0x18], edx
je 0x48ce8c
push 1
push dword [esi + 0x1c]
call fcn.005f5a60
pop ecx
pop ecx
mov edi, dword [esp + 0x18]
mov ebp, 0x1bde
push ebp
push 0x7588e8
push 1
lea ebx, [edi + 1]
push ebx
call fcn.005f5ba0
add esp, 0x10
mov dword [esi + 0x1c], eax
test eax, eax
je 0x48cecf
push edi
push dword [esp + 0x18]
mov edx, ebx
mov ecx, eax
call section..text
mov eax, dword [esi + 0x1c]
pop ecx
pop ecx
mov byte [edi + eax], 0
mov dword [esi + 0x20], edi
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x758904
push esi
push ebp
xor ecx, ecx
call fcn.0048f95e
push ebp
push 0x758920
push 0x75893c
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d0820
int3
Function at 0x48cf03
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x10], edx
push edi
mov edi, dword [esp + 0x1c]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x48cf4b
mov ebx, dword [esp + 0x24]
lea eax, [ebx + 2]
add eax, edi
cmp dword [ecx - 0x10], eax
jbe 0x48d028
lea ebp, [edi + 1]
mov edx, ebp
call fcn.004878c7
mov ecx, dword [esi + 0x10]
lea edx, [ebx + 1]
mov dword [esi], eax
call fcn.004878c7
mov dword [esi + 8], eax
jmp 0x48cfed
mov ebx, 0x1bff
lea ebp, [edi + 1]
push ebx
push 0x7589bc
push 1
push ebp
call fcn.005f5ba0
add esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x48cf97
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x7589d8
push esi
push ebx
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push ebx
push 0x7589f4
push 0x758a10
jmp 0x48d055
mov ebx, dword [esp + 0x24]
push 0x1c00
push 0x758a34
push 1
lea eax, [ebx + 1]
push eax
call fcn.005f5ba0
add esp, 0x10
mov dword [esi + 8], eax
test eax, eax
jne 0x48cfe9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1c00
push esi
push edi
mov edx, 0x758a50
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x758a6c
push 0x758a88
jmp 0x48d055
or dword [esi + 0x34], 0xffffffff
mov ecx, dword [esi]
mov edx, ebp
push edi
push dword [esp + 0x18]
call section..text
mov eax, dword [esi]
lea edx, [ebx + 1]
push ebx
push dword [esp + 0x2c]
mov byte [edi + eax], 0
mov ecx, dword [esi + 8]
mov dword [esi + 4], edi
call section..text
mov eax, dword [esi + 8]
add esp, 0x10
pop edi
mov byte [ebx + eax], 0
mov dword [esi + 0x14], ebx
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1bfa
push esi
push edi
mov edx, 0x758960
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x75897c
push 0x758998
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d0820
int3
Function at 0x48d088
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
mov eax, edx
mov dword [esp + 8], eax
push ebp
mov ebp, ecx
push esi
mov esi, 0xff
push edi
test ebx, ebx
je 0x48d0a8
cmp ebx, 0xffffffff
jne 0x48d0bb
test eax, eax
jne 0x48d0b0
xor ebx, ebx
jmp 0x48d0bb
push esi
push eax
call fcn.005f8590
pop ecx
pop ecx
mov ebx, eax
mov edi, dword [esp + 0x24]
test edi, edi
je 0x48d0c8
cmp edi, 0xffffffff
jne 0x48d0e1
cmp dword [esp + 0x20], 0
jne 0x48d0d3
xor edi, edi
jmp 0x48d0e1
push esi
push dword [esp + 0x24]
call fcn.005f8590
pop ecx
pop ecx
mov edi, eax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x48d186
lea edx, [edi + 0x1a]
add edx, ebx
cmp dword [ecx - 0x10], edx
jbe 0x48d252
push 0x18
pop edx
call fcn.004878c7
mov ecx, dword [ebp + 0x10]
lea edx, [ebx + 1]
mov esi, eax
call fcn.004878c7
mov dword [esi], eax
lea edx, [edi + 1]
mov ecx, dword [ebp + 0x10]
call fcn.004878c7
mov dword [esi + 8], eax
mov ecx, dword [esi]
lea edx, [ebx + 1]
push ebx
push dword [esp + 0x18]
call section..text
mov eax, dword [esi]
lea edx, [edi + 1]
push edi
push dword [esp + 0x2c]
mov byte [ebx + eax], 0
mov ecx, dword [esi + 8]
mov dword [esi + 4], ebx
call section..text
mov eax, dword [esi + 8]
add esp, 0x10
mov byte [edi + eax], 0
and dword [esi + 0x14], 0
mov dword [esi + 0xc], edi
mov ecx, dword [ebp + 0x84]
test ecx, ecx
je 0x48d173
mov edx, dword [esi]
push edi
push dword [esi + 8]
push dword [esi + 4]
call fcn.0048b708
add esp, 0xc
mov eax, dword [ebp + 0x44]
test eax, eax
je 0x48d24c
mov dword [eax + 0x14], esi
jmp 0x48d24f
push 0x1c45
push 0x758aac
push 1
push 0x18
call fcn.005f5ba0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48d259
or dword [esi + 0x10], 0xffffffff
lea eax, [ebx + 1]
push 0x1c47
push 0x758b24
push 1
push eax
call fcn.005f5ba0
add esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x48d1fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1c47
push esi
push edi
mov edx, 0x758b40
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x758b5c
push 0x758b78
jmp 0x48d286
push 0x1c48
push 0x758b9c
lea eax, [edi + 1]
push 1
push eax
call fcn.005f5ba0
add esp, 0x10
mov dword [esi + 8], eax
test eax, eax
jne 0x48d11f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1c48
push esi
push edi
mov edx, 0x758bb8
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x758bd4
push 0x758bf0
jmp 0x48d286
mov dword [ebp + 0x40], esi
mov dword [ebp + 0x44], esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1c45
push esi
push edi
mov edx, 0x758ac8
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x758ae4
push 0x758b00
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d0820
int3
Function at 0x48d3c2
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
cmp dword [ebx], 0
mov ebp, edx
push 3
mov edi, ecx
mov dword [esp + 0x18], ebp
pop ecx
jne 0x48d402
mov eax, ebp
shl eax, 2
cdq
idiv ecx
push 0x1cd4
push 0x758c1c
add eax, 5
push 1
push eax
call fcn.005f5ba0
add esp, 0x10
mov dword [ebx], eax
test eax, eax
je 0x48d46e
mov esi, dword [ebx]
mov ecx, edi
test edi, edi
je 0x48d462
test ebp, ebp
je 0x48d462
lea edx, [edi + ebp]
lea eax, [edi + 3]
cmp eax, edx
ja 0x48d43b
lea ebx, [edi + 3]
mov ebp, edx
push 3
mov edx, esi
call fcn.0048d330
pop ecx
mov ecx, ebx
add esi, 4
lea ebx, [ecx + 3]
cmp ebx, ebp
jbe 0x48d41d
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
sub edi, ecx
lea eax, [edi + ebp]
cmp eax, 1
jne 0x48d448
push eax
jmp 0x48d44e
cmp eax, 2
jne 0x48d459
push eax
mov edx, esi
call fcn.0048d330
add esi, 4
pop ecx
mov byte [esi], 0
sub esi, dword [ebx]
mov eax, esi
jmp 0x48d467
and dword [ebx], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1cd4
push esi
push edi
mov edx, 0x758c38
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x758c54
push 0x758c70
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d0820
int3
Function at 0x48d4e2
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
push edi
test esi, esi
je 0x48d60b
test ebx, ebx
je 0x48d60b
mov ebp, dword [esp + 0x20]
cmp dword [ebp], 0
jne 0x48d537
imul eax, ebx, 3
mov edi, 0x1d20
push edi
push 0x758c94
push 1
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, 4
push eax
call fcn.005f5ba0
add esp, 0x10
mov dword [ebp], eax
test eax, eax
je 0x48d61c
and dword [esp + 0x10], 0
add ebx, esi
mov edi, dword [ebp]
jmp 0x48d5f9
xor eax, eax
xor edx, edx
mov dword [esp + 0x14], eax
cmp esi, ebx
ja 0x48d5bd
xor cl, cl
test cl, cl
jne 0x48d58c
mov cl, byte [esi]
inc esi
lea eax, [ecx - 0x2b]
cmp al, 0x4f
ja 0x48d56d
movzx eax, cl
mov cl, byte [eax + 0x6c728d]
jmp 0x48d56f
xor cl, cl
test cl, cl
je 0x48d588
and dword [esp + 0x18], 0
lea eax, [ecx - 0x3d]
cmp cl, 0x24
movzx eax, al
cmove eax, dword [esp + 0x18]
mov cl, al
cmp esi, ebx
jbe 0x48d554
cmp esi, ebx
ja 0x48d5a5
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
test cl, cl
je 0x48d5b7
dec cl
mov byte [esp + edx + 0x10], cl
jmp 0x48d5b7
cmp edx, 4
jae 0x48d64f
mov eax, dword [esp + 0x14]
mov byte [esp + edx + 0x10], 0
inc edx
cmp edx, 4
jl 0x48d54e
test eax, eax
je 0x48d5f9
mov al, byte [esp + 0x11]
mov cl, byte [esp + 0x10]
mov dl, byte [esp + 0x12]
shr al, 4
shl cl, 2
or cl, al
mov al, byte [esp + 0x11]
mov byte [edi], cl
mov cl, dl
shl al, 4
shr cl, 2
or cl, al
shl dl, 6
or dl, byte [esp + 0x13]
mov eax, dword [esp + 0x14]
dec eax
mov byte [edi + 1], cl
mov byte [edi + 2], dl
add edi, eax
cmp esi, ebx
jbe 0x48d546
mov byte [edi], 0
sub edi, dword [ebp]
mov eax, edi
jmp 0x48d614
mov eax, dword [esp + 0x20]
and dword [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x758cb0
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x758ccc
push 0x758ce8
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d0820
call fcn.005c0f10
int3

Function at 0x48dce4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x1f54
mov edi, ecx
push ebx
push 0x758d78
push 1
push 0x48
call fcn.005f5ba0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48dd53
push 0x48
push 0
push esi
call fcn.005c37d0
add esp, 0xc
mov ecx, str.ILibLifeTime
call fcn.004873e9
xor ecx, ecx
mov dword [esi + 0x18], eax
call fcn.0048dec7
xor ecx, ecx
mov dword [esi + 0x38], eax
mov dword [esi], 0x48d8ba
mov dword [esi + 8], 0x48dc87
mov dword [esi + 0x10], edi
call fcn.0048dec7
mov edx, esi
mov dword [esi + 0x34], eax
mov ecx, edi
call fcn.00488084
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x758d94
push esi
push ebx
xor ecx, ecx
call fcn.0048f95e
push ebx
push 0x758db0
push 0x758dcc
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d0820
int3
Function at 0x48e2fc
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, 0x21b7
push edi
push 0x758e38
push 1
push 0xc
call fcn.005f5ba0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48e352
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, dword [esi]
mov dword [esi + 4], 0x48e28a
test ecx, ecx
je 0x48e339
push 0
xor edx, edx
call fcn.0048eb06
pop ecx
push 0
mov edx, 0x48e267
mov ecx, 0x100
call fcn.0048e77c
pop ecx
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x758e54
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x758e70
push 0x758e8c
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d0820
int3

Function at 0x48e4fe
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, 0x223c
mov ebx, edx
push edi
push 0x758eb0
push 1
push 0x18
mov ebp, ecx
call fcn.005f5ba0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48e59a
push 6
xor eax, eax
mov edi, esi
pop ecx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x18]
and dword [esi + 0x14], eax
mov dword [esi + 8], ebp
mov dword [esi + 0x10], edi
test edi, edi
jle 0x48e592
mov ebp, 0x2243
push ebp
push 0x758f28
push 1
push edi
call fcn.005f5ba0
add esp, 0x10
mov dword [esi + 0xc], eax
test eax, eax
jne 0x48e585
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x758f44
push esi
push ebp
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push ebp
push 0x758f60
push 0x758f7c
jmp 0x48e5c2
push edi
push ebx
mov edx, edi
mov ecx, eax
call section..text
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x758ecc
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x758ee8
push 0x758f04
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d0820
int3