joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bdb30
Capabilities:
Terminate process

Disassembly:
sub esp, 0x34
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x44]
push esi
push edi
push pe_nt_image_headers32
mov dword [esp + 0x14], edx
mov edi, ecx
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4bdca6
push pe_nt_image_headers32
push 0
push esi
call fcn.005869c0
add esp, 0xc
lea eax, [esi + 0x4b]
push 8
push eax
call fcn.004e2870
mov eax, dword [edi + 0x204]
mov dword [esi + 0x88], eax
mov dword [esi + 0x78], edi
call fcn.004b4150
push 0xe0
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], edx
call fcn.0058d200
add esp, 0xc
mov dword [esi + 0x14], eax
test eax, eax
je 0x4bdce7
push 0xe0
push 0
push eax
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 1
call fcn.005869c0
add esp, 0xc
mov edx, esi
mov ecx, edi
push 0
push 0
call fcn.004bb710
add esp, 8
test eax, eax
jns 0x4bdc15
push dword [esi + 0x14]
call fcn.0058bf82
add esp, 4
push esi
call fcn.0058bf82
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00584a28
add esp, 0x34
ret
lea ecx, [esp + 0x14]
push ecx
lea edx, [edi + 0x108]
mov ecx, eax
call fcn.004bbad0
add esp, 4
lea eax, [esp + 0x14]
lea ecx, [esi + 0x20]
mov edx, 0x2b
push 0x2b
push eax
call fcn.00401000
movsx eax, byte [esp + 0x1c]
mov edx, 9
push eax
lea eax, [esp + 0x21]
mov ecx, ebx
push eax
call fcn.00401000
movsx ecx, byte [esp + 0x24]
mov edx, 0x21
movsx eax, byte [esp + ecx + 0x25]
push eax
lea eax, [esp + 0x2a]
add eax, ecx
mov ecx, ebp
push eax
call fcn.00401000
movsx eax, byte [esp + 0x2c]
add esp, 0x18
mov edx, dword [esp + 0x10]
mov ecx, esi
mov byte [eax + ebx], 0
movsx eax, byte [esp + eax + 0x15]
mov byte [eax + ebp], 0
call fcn.004bbda0
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00584a28
add esp, 0x34
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0xa26
mov edx, 0x61f3c8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0xa26
push 0x61f3e4
push 0x61f400
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0xa2c
mov edx, 0x61f424
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0xa2c
push 0x61f440
push 0x61f45c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4be070
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
mov ebp, edx
push esi
push edi
mov dword [esp + 0x10], ebp
mov esi, dword [ecx + ebp*4 + 0x148]
mov ecx, dword [esi + 0x64]
test ecx, ecx
jle 0x4be134
cmp dword [esi + 0x88], 0
je 0x4be13a
lea eax, [ecx*8]
sub eax, ecx
shl eax, 2
push eax
call fcn.0058d200
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4be183
mov eax, dword [esi + 0x64]
lea ecx, [eax*8]
sub ecx, eax
shl ecx, 2
push ecx
push 0
push ebx
call fcn.005869c0
xor edi, edi
add esp, 0xc
cmp dword [esi + 0x64], edi
jle 0x4be10f
xor edx, edx
lea ecx, [ebx + 4]
mov ebp, 2
mov word [ecx - 4], bp
lea edx, [edx + 6]
mov eax, dword [esi + 0x5c]
lea ecx, [ecx + 0x1c]
inc edi
mov ax, word [eax + edx - 2]
mov word [ecx - 0x1e], ax
mov eax, dword [esi + 0x5c]
mov eax, dword [edx + eax - 6]
mov dword [ecx - 0x1c], eax
cmp edi, dword [esi + 0x64]
jl 0x4be0e5
mov ebp, dword [esp + 0x10]
mov ecx, dword [esi + 0x78]
mov edx, ebx
push ebp
push 0x4be010
push dword [esi + 0x64]
mov ecx, dword [ecx + 0x1b4]
call fcn.004c5300
add esp, 0xc
push ebx
call fcn.0058bf82
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp dword [esi + 0x6c], 0
mov edi, dword [esi + 0x78]
jne 0x4be175
push ecx
mov ecx, esi
mov dword [esi + 0x10], 1
call fcn.004bd8a0
mov ecx, dword [edi + 0x20]
lea edx, [edi + 1]
add esp, 4
push 0
push 0x4bdd30
push 0xbb8
call fcn.004b2450
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp fcn.004bdef0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0xad7
mov edx, 0x61f480
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0xad7
push 0x61f49c
push 0x61f4b8
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4c2280
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
lea ebp, [ebx + 0xc]
mov dword [esp + 0x10], edx
push ebp
mov edi, ecx
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4c233a
push ebx
mov dword [esi], 3
mov dword [esi + 4], 0
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 8], ax
lea ecx, [esi + 0xc]
push ebx
push dword [esp + 0x1c]
xor eax, eax
mov edx, ebx
mov word [esi + 0xa], ax
call fcn.00401000
mov ebx, dword [esp + 0x18]
mov eax, 0x4000
mov ecx, dword [edi + 0x78]
mov dword [esp + 0x24], 0
mov word [esp + 0x24], ax
push dword [esp + 0x24]
movzx edx, bx
call fcn.004b36e0
add esp, 0xc
cmp dword [edi + 0x70], 2
jne 0x4c232b
push 0xffffffffffffffff
push dword [edi + 0x74]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [edi + 0x38]
mov ecx, dword [edi + 0x2c]
push ebp
push esi
push 0x32
push ebx
call fcn.004bedd0
add esp, 0x10
push 0
push 1
push dword [edi + 0x74]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call fcn.0058bf82
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x153f
mov edx, 0x61f690
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x153f
push 0x61f6ac
push 0x61f6c8
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4c3990
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x210
mov ebx, ecx
call fcn.0058d200
mov edi, eax
add esp, 4
test edi, edi
je 0x4c3b03
push 0x210
push 0
push edi
call fcn.005869c0
add esp, 0xc
mov dword [edi + 0x104], 0xffff
lea eax, [esp + 0x14]
xor edx, edx
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [edx + 0x18]
call fcn.004ae770
mov esi, dword [esp + 0x18]
add esp, 8
mov eax, dword [esp + 0x14]
push 0
push 0x40
push 1
push 0
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
mov eax, 2
mov dword [edi + 0x24], esi
lea esi, [edi + 0x30]
push 0
mov dword [edi + 0x14], str.ILibWebRTC
mov dword [edi + 0x2c], 0x4c7120
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi + 0x32], ax
lea ebp, [edi + 0x40]
mov eax, 0x17
push 0
mov word [ebp], ax
call dword [sym.imp.WS2_32.dll_htons]
push edi
push 0
push fcn.004c2e10
push 0
push esi
mov edx, 0x800
mov word [edi + 0x42], ax
mov ecx, ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], 0x4bb580
call fcn.004ac530
add esp, 0x14
mov dword [edi + 0x18], eax
push edi
test eax, eax
je 0x4c3a89
push 0
push fcn.004c2e10
push 0
push ebp
mov edx, 0x800
mov ecx, ebx
call fcn.004ac530
add esp, 0x14
mov dword [edi + 0x1c], eax
test eax, eax
jne 0x4c3a9b
push edi
call fcn.0058bf82
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, edi
mov ecx, ebx
call fcn.004aee00
mov ecx, dword [edi + 0x18]
call fcn.004ac320
mov ebp, dword [sym.imp.WS2_32.dll_htons]
movzx eax, ax
push eax
call ebp
mov ecx, dword [edi + 0x1c]
mov word [edi + 0x32], ax
call fcn.004ac320
movzx eax, ax
push eax
call ebp
mov word [edi + 0x42], ax
mov eax, dword [ebx + 0x2e4]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x108]
push 0x20
push eax
call fcn.004e2870
push ecx
mov ecx, ebx
call fcn.004c4ac0
add esp, 0xc
mov dword [edi + 0x1b4], eax
mov dword [eax + 0x28], edi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x18e1
mov edx, 0x61f828
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x18e1
push 0x61f844
push 0x61f860
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4c3f90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x40
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
lea eax, [esp + 0x1c]
push esi
push edi
push eax
push ecx
mov ebx, edx
mov esi, ecx
push 8
push ecx
mov edx, ebp
mov dword [esp + 0x20], esi
mov ecx, ebx
xor edi, edi
call fcn.004c3d60
add esp, 0x10
mov dword [esp + 0x20], eax
test eax, eax
je 0x4c4139
push edi
push ecx
push 8
push ecx
mov edx, ebp
mov ecx, ebx
call fcn.004c3d60
add esp, 0x10
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
mov edx, ebp
push eax
push ecx
push 0x8028
push ecx
mov ecx, ebx
call fcn.004c3d60
add esp, 0x10
mov dword [esp + 0x1c], eax
test eax, eax
jle 0x4c4088
push edi
push ecx
push 0x8028
push ecx
mov edx, ebp
mov ecx, ebx
call fcn.004c3d60
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov esi, eax
push dword [ecx]
call dword [sym.imp.WS2_32.dll_ntohl]
mov edi, eax
or ecx, 0xffffffff
xor edi, 0x5354554e
lea eax, [ebx + ebp]
mov edx, eax
test esi, esi
je 0x4c405d
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5f05a8]
sub esi, 1
jne 0x4c4040
lea eax, [ebx + ebp]
not ecx
cmp ecx, edi
jne 0x4c4139
movzx eax, word [eax + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx edi, ax
lea eax, [edi - 8]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov esi, dword [esp + 0x10]
mov word [ebx + ebp + 2], ax
mov edx, dword [esi + 0x50]
lea eax, [esp + 0x28]
mov ecx, dword [esi + 0x30]
push eax
push dword [esi + 0x38]
call fcn.004c3f00
add esp, 8
mov dword [esp + 0x10], 0x14
call fcn.004e60d0
push 0
mov esi, eax
call fcn.004d13c0
push eax
push 0x10
lea eax, [esp + 0x34]
push eax
push esi
call fcn.004e62b0
push dword [esp + 0x2c]
add ebx, ebp
push ebx
push esi
call fcn.004e64c0
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x5c]
push eax
push esi
call fcn.004e6200
push esi
call fcn.004e6060
add esp, 0x30
cmp dword [esp + 0x1c], 0
jle 0x4c40fa
push edi
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebx + 2], ax
cmp dword [esp + 0x20], 0x14
jne 0x4c4139
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x38]
mov esi, 0x10
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4c4139
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4c4110
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00584a28
add esp, 0x40
ret
mov ecx, dword [esp + 0x4c]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00584a28
add esp, 0x40
ret
Function at 0x4c4ac0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x58
mov ebx, ecx
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4c4b85
push 0x58
push 0
push esi
call fcn.005869c0
add esp, 0xc
mov dword [esi + 8], 0x4c3cf0
mov edx, 0x1000
mov ecx, ebx
push 0
push 0
push fcn.00403e30
push 0x4c4aa0
push 0x4c4990
call fcn.004a9f90
add esp, 0x14
mov dword [esi + 0x2c], eax
xor ecx, ecx
mov dword [esi + 0x18], 0x4c3780
mov dword [esi + 0x1c], 0x4c3810
mov dword [esi + 0x20], 0x4c3880
mov dword [esi + 0x24], 0x4c38b0
call fcn.004afcc0
mov dword [esi + 0x40], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], str.ILibWebRTC_TURN_Client
mov edi, dword [ebx + 0x2f0]
mov ecx, edi
call fcn.004b2df0
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], 0
mov ecx, dword [edi + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x4c4b6c
mov dword [ecx + 8], eax
cmp dword [edi + 0xc], 0
mov dword [edi + 0x10], eax
jne 0x4c4b78
mov dword [edi + 0xc], eax
inc dword [edi + 4]
mov eax, esi
pop edi
mov dword [esi + 0xc], ebx
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1b7e
mov edx, 0x61f960
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1b7e
push 0x61f97c
push 0x61f998
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4c4cc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x2c]
push esi
push edi
mov edi, dword [esp + 0x38]
movsx eax, byte [ebp + 1]
sub eax, 1
je 0x4c4db9
sub eax, 1
jne 0x4c4ddf
push 0xc
push ecx
lea edx, [eax + 0xc]
mov dword [esp + 0x14], 0x2112a442
lea ecx, [esp + 0x18]
call fcn.00401000
add esp, 8
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov eax, 0x17
movq qword [edi + 0x10], xmm0
mov dword [edi + 0x18], 0
push 0x10
mov word [edi], ax
call dword [sym.imp.WS2_32.dll_htonl]
cmp eax, 0x10
jne 0x4c4d79
push ebx
lea ecx, [edi + 9]
lea edx, [esp + 0x11]
lea esi, [ebp + 5]
lea ebx, [eax - 0xc]
movzx eax, byte [esi - 1]
lea esi, [esi + 4]
xor al, byte [edx - 1]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [esi - 4]
xor al, byte [edx - 4]
mov byte [ecx - 4], al
movzx eax, byte [esi - 3]
xor al, byte [edx - 3]
mov byte [ecx - 3], al
movzx eax, byte [esi - 2]
xor al, byte [edx - 2]
mov byte [ecx - 2], al
sub ebx, 1
jne 0x4c4d40
pop ebx
jmp 0x4c4ddf
xor ecx, ecx
lea edx, [edi + 0x16]
lea esi, [ebp + 0x12]
mov al, byte [esp + ecx + 0xc]
lea esi, [esi - 4]
xor al, byte [esi + 5]
lea edx, [edx - 4]
mov byte [edx + 5], al
mov al, byte [esp + ecx + 0xd]
xor al, byte [esi + 4]
mov byte [edx + 4], al
mov al, byte [esp + ecx + 0xe]
xor al, byte [esi + 3]
mov byte [edx + 3], al
mov al, byte [esp + ecx + 0xf]
add ecx, 4
xor al, byte [esi + 2]
mov byte [edx + 2], al
cmp ecx, 0x10
jl 0x4c4d81
jmp 0x4c4ddf
push dword [ebp + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
xor eax, 0x2112a442
xorps xmm0, xmm0
mov ecx, 2
movups xmmword [edi], xmm0
push eax
mov word [edi], cx
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [edi + 4], eax
movzx eax, word [ebp + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, 0x2112
xor ax, cx
movzx eax, ax
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x2c]
mov word [edi + 2], ax
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00584a28
add esp, 0x24
ret
Function at 0x4c4e20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, dword [esp + 0x2c]
push esi
mov esi, ecx
push edi
mov edi, edx
movzx eax, word [esi + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, 0x2112
mov byte [edi], 0
xor ax, cx
cmp word [esi], 2
movzx ecx, ax
setne al
inc al
push ecx
mov byte [edi + 1], al
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi + 2], ax
movzx eax, word [esi]
sub eax, 2
je 0x4c4f9b
sub eax, 0x15
je 0x4c4e8e
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00584a28
add esp, 0x24
ret
push 0xc
push ebx
mov edx, 0xc
mov dword [esp + 0x14], 0x2112a442
lea ecx, [esp + 0x18]
call fcn.00401000
add esp, 8
push 0x10
call dword [sym.imp.WS2_32.dll_htonl]
cmp eax, 0x10
jne 0x4c4eee
xor ecx, ecx
nop dword [eax]
movzx eax, byte [esp + ecx + 0xc]
xor byte [esi + ecx + 8], al
movzx eax, byte [esp + ecx + 0xd]
xor byte [esi + ecx + 9], al
movzx eax, byte [esp + ecx + 0xe]
xor byte [esi + ecx + 0xa], al
movzx eax, byte [esp + ecx + 0xf]
xor byte [esi + ecx + 0xb], al
add ecx, 4
cmp ecx, 0x10
jl 0x4c4ec0
jmp 0x4c4f43
xor eax, eax
lea edx, [esi + 0x16]
movzx ecx, byte [esp + eax + 0xc]
lea edx, [edx - 4]
xor cl, byte [edx + 5]
mov byte [esp + eax + 0x1c], cl
movzx ecx, byte [esp + eax + 0xd]
xor cl, byte [edx + 4]
mov byte [esp + eax + 0x1d], cl
movzx ecx, byte [esp + eax + 0xe]
xor cl, byte [edx + 3]
mov byte [esp + eax + 0x1e], cl
movzx ecx, byte [esp + eax + 0xf]
xor cl, byte [edx + 2]
mov byte [esp + eax + 0x1f], cl
add eax, 4
cmp eax, 0x10
jl 0x4c4ef3
xor ecx, ecx
lea edx, [esi + 0x17]
mov al, byte [esp + ecx + 0x1c]
lea edx, [edx - 1]
inc ecx
mov byte [edx + 1], al
cmp ecx, 0x10
jl 0x4c4f33
lea eax, [edi + 4]
add esi, 8
test eax, eax
je 0x4c4f74
test esi, esi
je 0x4c4f6e
movups xmm0, xmmword [esi]
pop edi
pop esi
movups xmmword [eax], xmm0
mov eax, 0x14
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00584a28
add esp, 0x24
ret
xorps xmm0, xmm0
movups xmmword [eax], xmm0
call fcn.0058bd31
mov dword [eax], 0x16
call fcn.0058b90e
pop edi
pop esi
mov eax, 0x14
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00584a28
add esp, 0x24
ret
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
xor eax, 0x2112a442
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [esp + 0x2c]
mov dword [edi + 4], eax
mov eax, 8
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00584a28
add esp, 0x24
ret
Function at 0x4c50d0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x208
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x74]
mov ebp, edx
push 0xc
push eax
mov edi, ecx
call fcn.004e2870
push dword [edi + 0x38]
lea eax, [esp + 0x19c]
push dword [edi + 0x50]
push dword [edi + 0x30]
push 0x61f890
push 0x80
push eax
call fcn.00401140
mov esi, eax
lea eax, [esp + 0x30]
push eax
call fcn.004d5fe0
add esp, 0x24
lea eax, [esp + 0x190]
push esi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004d6040
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x84]
push eax
call fcn.004d5ec0
add esp, 8
push 4
call dword [sym.imp.WS2_32.dll_htons]
push 0x2112a442
mov word [esp + 0x94], ax
call dword [sym.imp.WS2_32.dll_htonl]
push dword [edi + 0x34]
movq xmm0, qword [esp + 0x78]
lea ecx, [esp + 0x94]
push dword [edi + 0x30]
mov dword [esp + 0x9c], eax
mov edx, 0x14
mov eax, dword [esp + 0x84]
push 6
movq qword [esp + 0xa4], xmm0
mov dword [esp + 0xac], eax
call fcn.004c4c40
add esp, 0xc
lea ecx, [esp + 0x90]
lea ebx, [eax + 0x14]
push dword [edi + 0x54]
mov edx, ebx
push dword [edi + 0x50]
push 0x14
call fcn.004c4c40
add esp, 0xc
lea ecx, [esp + 0x90]
add ebx, eax
mov edx, ebx
push dword [edi + 0x4c]
push dword [edi + 0x48]
push 0x15
call fcn.004c4c40
add esp, 0xc
lea ecx, [esp + 0x90]
add ebx, eax
lea eax, [esp + 0x80]
mov edx, ebx
push 0x10
push eax
call fcn.004bbbb0
add esp, 8
lea ecx, [esp + 0x90]
add ebx, eax
mov edx, ebx
call fcn.004bbc30
add ebx, eax
cmp dword [esp + 0x21c], 0
je 0x4c5267
push 8
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4c52bb
mov eax, dword [esp + 0x21c]
lea edx, [esp + 0x74]
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi], ebp
mov dword [esi + 4], eax
mov ecx, dword [edi + 0x40]
push 1
push 0xc
call fcn.004affa0
add esp, 8
test eax, eax
je 0x4c5288
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], 2
jmp 0x4c5288
mov ecx, dword [edi + 0x40]
lea edx, [esp + 0x74]
push 1
push 0xc
call fcn.004affa0
add esp, 8
test eax, eax
je 0x4c5288
mov dword [eax + 0x14], ebp
mov dword [eax + 0x18], 0
push 2
push ebx
lea eax, [esp + 0x98]
push eax
push 1
push 0
push dword [edi + 0x2c]
call fcn.004aa1b0
mov ecx, dword [esp + 0x22c]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00584a28
add esp, 0x208
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4c5850
Capabilities:
Terminate process

Disassembly:
sub esp, 0x30
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x40]
push ebp
push esi
mov dword [esp + 0x14], eax
mov ebp, ecx
lea eax, [ebx + 0x32]
mov dword [esp + 0x10], edx
push edi
push eax
call fcn.0058d200
mov edi, eax
add esp, 4
test edi, edi
je 0x4c591d
lea eax, [esp + 0x1c]
push 0xc
push eax
call fcn.004e2870
lea eax, [esp + 0x24]
mov edx, 0x16
push eax
mov ecx, edi
call fcn.004c4bd0
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x34]
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x1c]
push eax
call fcn.004c4e20
add esp, 4
mov edx, esi
mov ecx, edi
push eax
lea eax, [esp + 0x2c]
push eax
push 0x12
call fcn.004c4c40
add esp, 0xc
add esi, eax
mov edx, esi
mov ecx, edi
push ebx
push dword [esp + 0x1c]
push 0x13
call fcn.004c4c40
add esp, 0xc
add esi, eax
mov edx, esi
mov ecx, edi
call fcn.004bbc30
push 0
add esi, eax
push esi
push edi
push 1
push 0
push dword [ebp + 0x2c]
call fcn.004aa1b0
mov ecx, dword [esp + 0x54]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00584a28
add esp, 0x30
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1c9d
mov edx, 0x61fa8c
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1c9d
push str...microstackILibWebRTC.c
push 0x61fac4
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4c5960
Capabilities:
Terminate process

Disassembly:
sub esp, 0x220
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x230]
lea eax, [esp + 0x74]
push edi
push 0xc
push eax
mov ebp, edx
mov ebx, ecx
call fcn.004e2870
lea eax, [esp + 0x80]
mov ecx, esi
push eax
lea edx, [esp + 0xa0]
call fcn.004c4e20
add esp, 0xc
mov edi, eax
lea eax, [esp + 0x1a8]
push dword [ebx + 0x38]
push dword [ebx + 0x50]
push dword [ebx + 0x30]
push 0x61f890
push 0x80
push eax
call fcn.00401140
mov esi, eax
lea eax, [esp + 0x30]
push eax
call fcn.004d5fe0
add esp, 0x1c
lea eax, [esp + 0x1a8]
push esi
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004d6040
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x88]
push eax
call fcn.004d5ec0
mov esi, dword [sym.imp.WS2_32.dll_htons]
add esp, 8
mov eax, ebp
xor eax, 0x4000
push eax
call esi
mov word [esp + 0x14], ax
xor eax, eax
push 9
mov word [esp + 0x1a], ax
call esi
push 0x2112a442
mov word [esp + 0xac], ax
call dword [sym.imp.WS2_32.dll_htonl]
movq xmm0, qword [esp + 0x78]
lea ecx, [esp + 0xa8]
mov dword [esp + 0xac], eax
mov edx, 0x14
mov eax, dword [esp + 0x80]
mov dword [esp + 0xb8], eax
lea eax, [esp + 0x94]
push edi
push eax
push 0x12
movq qword [esp + 0xbc], xmm0
call fcn.004c4c40
add esp, 0xc
lea edi, [eax + 0x14]
push 0xc
call esi
push 4
mov word [esp + edi + 0xac], ax
call esi
mov word [esp + edi + 0xaa], ax
lea ecx, [esp + 0xac]
push 4
lea eax, [esp + 0x18]
push eax
add ecx, edi
mov edx, 4
call fcn.00401000
push dword [ebx + 0x34]
add edi, 8
lea ecx, [esp + 0xb4]
push dword [ebx + 0x30]
mov edx, edi
push 6
call fcn.004c4c40
add esp, 0x14
lea ecx, [esp + 0xa8]
add edi, eax
mov edx, edi
push dword [ebx + 0x54]
push dword [ebx + 0x50]
push 0x14
call fcn.004c4c40
add esp, 0xc
lea ecx, [esp + 0xa8]
add edi, eax
mov edx, edi
push dword [ebx + 0x4c]
push dword [ebx + 0x48]
push 0x15
call fcn.004c4c40
add esp, 0xc
lea ecx, [esp + 0xa8]
add edi, eax
lea eax, [esp + 0x84]
mov edx, edi
push 0x10
push eax
call fcn.004bbbb0
add esp, 8
lea ecx, [esp + 0xa8]
add edi, eax
mov edx, edi
call fcn.004bbc30
add edi, eax
cmp dword [esp + 0x238], 0
je 0x4c5b84
push 8
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4c5bb7
mov eax, dword [esp + 0x238]
lea edx, [esp + 0x78]
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi], eax
mov eax, dword [esp + 0x23c]
mov dword [esi + 4], eax
mov ecx, dword [ebx + 0x40]
push 1
push 0xc
call fcn.004affa0
add esp, 8
test eax, eax
je 0x4c5b84
movzx ecx, bp
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], ecx
push 2
push edi
lea eax, [esp + 0xb0]
push eax
push 1
push 0
push dword [ebx + 0x2c]
call fcn.004aa1b0
mov ecx, dword [esp + 0x244]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00584a28
add esp, 0x220
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3