joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a260
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dd96b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e54], 0
jne 0x45a33a
mov ecx, 0x6641ec
call fcn.004087a0
cmp dword [0x663e54], 0
jne 0x45a330
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x64
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x45a2e2
mov ecx, dword [ebp - 0x1c]
call fcn.004562b0
mov dword [ebp - 0x20], eax
jmp 0x45a2e9
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x45a30f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x45a327
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e54], edx
mov ecx, 0x6641ec
call fcn.00408760
mov eax, dword [0x663e54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45ae00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e85ab
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e58], 0
jne 0x45aedd
mov ecx, 0x6641d0
call fcn.004087a0
cmp dword [0x663e58], 0
jne 0x45aed3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0xe0
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x45ae85
mov ecx, dword [ebp - 0x1c]
call fcn.004b0ea0
mov dword [ebp - 0x20], eax
jmp 0x45ae8c
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x45aeb2
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x45aeca
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e58], edx
mov ecx, 0x6641d0
call fcn.00408760
mov eax, dword [0x663e58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465da0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dd90b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e60], 0
jne 0x465e7d
mov ecx, 0x664224
call fcn.004087a0
cmp dword [0x663e60], 0
jne 0x465e73
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x80
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x465e25
mov ecx, dword [ebp - 0x1c]
call fcn.0045deb0
mov dword [ebp - 0x20], eax
jmp 0x465e2c
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x465e52
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x465e6a
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e60], edx
mov ecx, 0x664224
call fcn.00408760
mov eax, dword [0x663e60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x465f00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc45b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e64], 0
jne 0x465fda
mov ecx, 0x664208
call fcn.004087a0
cmp dword [0x663e64], 0
jne 0x465fd0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x5c
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x465f82
mov ecx, dword [ebp - 0x1c]
call fcn.004ede30
mov dword [ebp - 0x20], eax
jmp 0x465f89
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x465faf
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x465fc7
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e64], edx
mov ecx, 0x664208
call fcn.00408760
mov eax, dword [0x663e64]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e360
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ecb48
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x65d4e4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x30]
call fcn.0040bee0
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x34], 8
jne 0x46e3e0
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x40]
call fcn.0046d980
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x10]
cmp eax, 0x2bf20
jb 0x46e3d1
jmp 0x46e3e0
push 0x2710
call fcn.00507ad0
add esp, 4
jmp 0x46e3aa
cmp dword [ebp - 0x34], 0
jne 0x46e3f6
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x40]
call fcn.0046dd30
test eax, eax
jne 0x46e411
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040bf30
mov eax, dword [ebp - 0x38]
jmp 0x46e42a
mov dword [ebp - 0x3c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040bf30
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005b1988
mov esp, ebp
pop ebp
ret
Function at 0x46e980
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ef120
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0xa4]
and ecx, 4
jne 0x46e9bb
jmp 0x46eaae
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x100
call fcn.0040bec0
movzx edx, al
test edx, edx
je 0x46e9e0
mov ecx, dword [ebp - 0x24]
call fcn.0046e360
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0xa8]
imul ecx, ecx, 0x3e8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0xa8], 0
jbe 0x46ea34
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x10]
cmp dword [ebp - 0x14], eax
ja 0x46ea16
jmp 0x46eaae
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub edx, ecx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x3e8
jae 0x46ea34
mov dword [ebp - 0x14], 0x3e8
mov eax, dword [ebp - 0x24]
add eax, 0xac
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040bf50
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
push edx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
call fcn.0046d690
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x46eaa9
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x60afe6
call fcn.0040be30
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
call fcn.0046eda0
jmp 0x46eaae
jmp 0x46e9e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x47d1e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e0d15
mov eax, dword fs:[0]
push eax
sub esp, 0x1b4
mov eax, dword [0x65d4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1b0], ecx
push 1
push 2
lea ecx, [ebp - 0xac]
call fcn.0040b040
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push 0x61c03c
lea ecx, [ebp - 0xac]
push ecx
call fcn.00409b60
add esp, 8
push eax
call fcn.00409b60
add esp, 8
lea edx, [ebp - 0x150]
push edx
lea ecx, [ebp - 0xac]
call fcn.004094f0
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1b8], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1b8]
call fcn.0040be10
push eax
push 0x61c050
push 0x896
push 0x61c074
push 0x20
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x150]
call fcn.0040bf30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
call fcn.00409dd0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0040be30
mov dword [ebp - 4], 2
push 0x60ae3a
lea ecx, [ebp - 0x16c]
call fcn.0040be30
mov byte [ebp - 4], 3
push str.process
lea ecx, [ebp - 0x188]
call fcn.0040be30
mov byte [ebp - 4], 4
lea edx, [ebp - 0x16c]
push edx
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004fc450
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x188]
call fcn.0040bf30
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x16c]
call fcn.0040bf30
push 0x61c094
lea ecx, [ebp - 0x2c]
call fcn.0040be10
push eax
call fcn.005b24e5
add esp, 8
test eax, eax
jne 0x47d378
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0xb1]
call fcn.0052e5c0
mov byte [ebp - 4], 5
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0xb1]
call fcn.005297d0
movzx eax, al
mov dword [ebp - 0xb0], eax
push 1
push 2
lea ecx, [ebp - 0x134]
call fcn.0040b040
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0xb0]
push ecx
push 0x61c0a4
lea edx, [ebp - 0x134]
push edx
call fcn.00409b60
add esp, 8
mov ecx, eax
call fcn.0041ca40
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0x134]
call fcn.004094f0
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], ecx
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1c0]
call fcn.0040be10
push eax
push str.CPolicyManager::KillProcessByName
push 0x8a8
push 0x61c0d8
push 0x20
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1a8]
call fcn.0040bf30
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x134]
call fcn.00409dd0
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0x1ac], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb1]
call fcn.0051d130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040bf30
mov eax, dword [ebp - 0x1ac]
jmp 0x47d484
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b1988
mov esp, ebp
pop ebp
ret 4
Function at 0x47f770
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d6c8b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e6c], 0
jne 0x47f84a
mov ecx, 0x664280
call fcn.004087a0
cmp dword [0x663e6c], 0
jne 0x47f840
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x3c
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x47f7f2
mov ecx, dword [ebp - 0x1c]
call fcn.0047fe70
mov dword [ebp - 0x20], eax
jmp 0x47f7f9
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x47f81f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x47f837
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e6c], edx
mov ecx, 0x664280
call fcn.00408760
mov eax, dword [0x663e6c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47f870
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc2cb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e70], 0
jne 0x47f94a
mov ecx, 0x664264
call fcn.004087a0
cmp dword [0x663e70], 0
jne 0x47f940
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x68
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x47f8f2
mov ecx, dword [ebp - 0x1c]
call fcn.004eb730
mov dword [ebp - 0x20], eax
jmp 0x47f8f9
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x47f91f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x47f937
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e70], edx
mov ecx, 0x664264
call fcn.00408760
mov eax, dword [0x663e70]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47fa20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dd76b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e74], 0
jne 0x47fafd
mov ecx, 0x664248
call fcn.004087a0
cmp dword [0x663e74], 0
jne 0x47faf3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0xc8
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x47faa5
mov ecx, dword [ebp - 0x1c]
call fcn.0049b9e0
mov dword [ebp - 0x20], eax
jmp 0x47faac
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x47fad2
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x47faea
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e74], edx
mov ecx, 0x664248
call fcn.00408760
mov eax, dword [0x663e74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x486250
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5daecb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x664244
call fcn.0043ead0
test eax, eax
jne 0x486313
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x7c
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x4862c0
mov ecx, dword [ebp - 0x1c]
call fcn.004a9560
mov dword [ebp - 0x20], eax
jmp 0x4862c7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x4862ed
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x486305
push 0x61c550
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x664244
call fcn.0041bd20
mov ecx, 0x664244
call fcn.0043ead0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x486330
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc27b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x664240
call fcn.0043ead0
test eax, eax
jne 0x4863f6
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x160
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x4863a3
mov ecx, dword [ebp - 0x1c]
call fcn.004ac2b0
mov dword [ebp - 0x20], eax
jmp 0x4863aa
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x4863d0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x4863e8
push 0x61c580
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x664240
call fcn.0041bd20
mov ecx, 0x664240
call fcn.0043ead0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48b100
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dd603
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x65d4e4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
push str.SetCallBack
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
push 0x61966c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x20], eax
push str.GetPolicyBase
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x24], eax
push 0x61968c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x28], eax
push 0x619698
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x2c], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x20], 0
je 0x48b1e5
lea ecx, [ebp - 0x34]
call fcn.0040bee0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x34]
push eax
call fcn.00517630
add esp, 4
push 0
push 0
lea ecx, [ebp - 0x34]
call fcn.0040be10
push eax
push 4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x20]
call edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.0040bf30
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 0
je 0x48b22b
push 0x23c
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.005b5540
add esp, 0xc
mov ecx, 0x4f
mov esi, 0x65f3c8
lea edi, [ebp - 0x274]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x274]
push ecx
call dword [ebp - 0x10]
mov dword [ebp - 0x14], 1
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x20], 0
je 0x48b294
call fcn.00404970
mov dword [ebp - 0x294], eax
lea ecx, [ebp - 0x290]
call fcn.0040bee0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x290]
push eax
push 0x6196a8
mov ecx, dword [ebp - 0x294]
call fcn.0040ce30
push 0
push 0
lea ecx, [ebp - 0x290]
call fcn.0040be10
push eax
push 2
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x20]
call edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x290]
call fcn.0040bf30
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.005b1988
mov esp, ebp
pop ebp
ret
Function at 0x48d3c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d88fb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x66429c
call fcn.0043ead0
test eax, eax
jne 0x48d483
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x60
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x48d430
mov ecx, dword [ebp - 0x1c]
call fcn.004aefd0
mov dword [ebp - 0x20], eax
jmp 0x48d437
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x48d45d
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x48d475
push 0x619c68
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x66429c
call fcn.0041bd20
mov ecx, 0x66429c
call fcn.0043ead0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d6a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dd5c1
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x65d4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x12c], ecx
lea ecx, [ebp - 0x2c]
call fcn.0040bee0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
push 0x618b0c
call fcn.00404970
mov ecx, eax
call fcn.0040ce30
push 0x618b38
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0xf0]
push edx
call fcn.00404a60
add esp, 0xc
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x134], eax
mov byte [ebp - 4], 1
push 0x618b34
mov ecx, dword [ebp - 0x134]
push ecx
lea edx, [ebp - 0x10c]
push edx
call fcn.00404a60
add esp, 0xc
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x13c], eax
mov byte [ebp - 4], 2
push str.ArpBlock.log
mov ecx, dword [ebp - 0x13c]
push ecx
lea edx, [ebp - 0x48]
push edx
call fcn.00404a60
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10c]
call fcn.0040bf30
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xf0]
call fcn.0040bf30
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040be10
push eax
call fcn.0051c6c0
add esp, 8
cmp dword [ebp - 0x50], 0
ja 0x48d7bc
cmp dword [ebp - 0x54], 0x500000
jb 0x48d7cd
lea ecx, [ebp - 0x48]
call fcn.0040be10
push eax
call fcn.00504080
add esp, 4
push 0x618b3c
lea ecx, [ebp - 0x48]
call fcn.0040be10
push eax
call fcn.005b1ae9
add esp, 8
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x48d8e9
lea ecx, [ebp - 0x128]
push ecx
call fcn.00500fe0
add esp, 4
mov dword [ebp - 0x140], eax
mov edx, dword [ebp - 0x140]
mov dword [ebp - 0x144], edx
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x144]
call fcn.0040be10
push eax
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
push 0x618b40
push 0x80
lea eax, [ebp - 0xd4]
push eax
call fcn.005b1bc7
add esp, 0x14
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x128]
call fcn.0040bf30
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x148], ecx
mov edx, dword [ebp - 0x148]
add edx, 1
mov dword [ebp - 0x14c], edx
mov eax, dword [ebp - 0x148]
mov cl, byte [eax]
mov byte [ebp - 0x14d], cl
add dword [ebp - 0x148], 1
cmp byte [ebp - 0x14d], 0
jne 0x48d86a
mov edx, dword [ebp - 0x148]
sub edx, dword [ebp - 0x14c]
mov dword [ebp - 0x154], edx
mov eax, dword [ebp - 0x4c]
push eax
push 1
mov ecx, dword [ebp - 0x154]
push ecx
lea edx, [ebp - 0xd4]
push edx
call fcn.005b1d61
add esp, 0x10
mov ecx, dword [ebp + 0x10]
call fcn.0040be10
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040be10
push eax
mov eax, dword [ebp + 8]
push eax
push str._s_IP:__s__MAC:_s_r_n
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.005b1de3
add esp, 0x14
mov edx, dword [ebp - 0x4c]
push edx
call fcn.005b1fa4
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0040bf30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040bf30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b1988
mov esp, ebp
pop ebp
ret 0xc