joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0490
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0xc
mov ebx, edx
mov dword [esp + 0x1c], ecx
xor ebp, ebp
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4b05d2
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov dword [esi], ebp
mov dword [esi + 8], ebp
lea edi, [edx + ebx]
cmp byte [edi + eax - 1], 0
lea ecx, [eax - 1]
mov dword [esp + 0x10], edi
cmovne ecx, eax
mov dword [esp + 0x14], ecx
cmp ebx, ecx
jge 0x4b0585
mov edi, dword [esp + 0x2c]
mov eax, 1
mov dword [esp + 0x1c], eax
cmp edi, ecx
jg 0x4b0572
xor ecx, ecx
test edi, edi
jle 0x4b051d
add edx, ebx
nop dword [eax + eax]
mov edi, dword [esp + 0x28]
mov al, byte [edx + ecx]
cmp al, byte [ecx + edi]
mov edi, dword [esp + 0x2c]
jne 0x4b051b
inc ecx
cmp ecx, edi
jl 0x4b0500
mov eax, dword [esp + 0x1c]
jmp 0x4b051d
xor eax, eax
test eax, eax
je 0x4b056e
push 0xc
call fcn.0058d200
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4b0613
cmp dword [esi], 0
mov edx, dword [esp + 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], ebp
mov dword [ecx + 8], 0
je 0x4b0552
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x4b0554
mov dword [esi], ecx
inc dword [esi + 8]
lea eax, [edi + ebp]
dec ebx
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x14]
add edx, eax
add ebx, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
jmp 0x4b0573
mov ecx, dword [esp + 0x14]
inc ebp
inc ebx
cmp ebx, ecx
jge 0x4b0581
mov edx, dword [esp + 0x18]
jmp 0x4b04e2
mov edi, dword [esp + 0x10]
push 0xc
call fcn.0058d200
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4b0654
cmp dword [esi], 0
mov dword [ecx], edi
mov dword [ecx + 4], ebp
mov dword [ecx + 8], 0
je 0x4b05c0
mov eax, dword [esi + 4]
inc dword [esi + 8]
mov dword [esi + 4], ecx
mov dword [eax + 8], ecx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
inc dword [esi + 8]
mov eax, esi
pop edi
mov dword [esi], ecx
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1285
mov edx, 0x61cdf0
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1285
push 0x61ce0c
push 0x61ce28
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1298
mov edx, 0x61ce4c
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1298
push 0x61ce68
push 0x61ce84
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x12be
mov edx, 0x61cea8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x12be
push 0x61cec4
push 0x61cee0
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b0d80
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, edx
mov dword [esp + 0x18], ecx
push esi
push edi
xor esi, esi
xor edi, edi
lea eax, [ebp - 0x320]
mov dword [esp + 0x14], esi
cmp eax, 0x320
jae 0x4b0da6
xor ecx, ecx
jmp 0x4b0db7
mov eax, 0x51eb851f
imul ebp
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea eax, [ecx*2]
add eax, ebp
add eax, ecx
push eax
mov dword [esp + 0x1c], eax
call fcn.0058d200
mov ecx, eax
add esp, 4
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov dword [eax], ecx
test ecx, ecx
je 0x4b0e64
mov ebx, ebp
test ebp, ebp
je 0x4b0e5a
mov eax, 0x320
nop
cmp ebx, ebp
je 0x4b0e1e
mov edx, dword [esp + 0x18]
add ecx, edi
push 3
push 0x61d240
sub edx, edi
call fcn.00401000
mov ecx, dword [esp + 0x24]
add esp, 8
add edi, 3
mov eax, 0x320
add esi, 3
mov dword [esp + 0x14], esi
mov edx, dword [esp + 0x18]
cmp ebx, 0x320
mov esi, ebx
cmovg esi, eax
mov eax, dword [esp + 0x20]
sub eax, ebx
sub edx, edi
add eax, ebp
add ecx, edi
push esi
push eax
call fcn.00401000
add dword [esp + 0x1c], esi
add edi, esi
mov ecx, dword [esp + 0x24]
add esp, 8
sub ebx, esi
mov eax, 0x320
mov esi, dword [esp + 0x14]
jne 0x4b0df0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1492
mov edx, 0x61d158
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1492
push 0x61d174
push 0x61d190
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b12b0
Capabilities:
Set socket configuration
Terminate process

Disassembly:
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
movzx eax, word [edi]
cmp eax, 0x17
jne 0x4b12f5
cmp dword [0x61e0fc], 0
jne 0x4b12f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 0x154e
mov edx, 0x61d24c
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
xor eax, eax
pop edi
pop esi
add esp, 8
ret
push dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b132d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 0x154f
mov edx, 0x61d268
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
xor eax, eax
pop edi
pop esi
add esp, 8
ret
cmp word [edi], 0x17
jne 0x4b1349
push 4
lea eax, [esp + 0x10]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x4b139b
cmp word [edi], 0x17
mov ecx, 0x1c
mov eax, 0x10
cmove eax, ecx
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x4b1393
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 0x155c
mov edx, 0x61d2a0
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop edi
pop esi
add esp, 8
ret
pop edi
mov eax, esi
pop esi
add esp, 8
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1553
mov edx, 0x61d284
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0xfd
call fcn.00587d2d
int3
Function at 0x4b1990
Capabilities:
Terminate process

Disassembly:
push esi
push 0x88
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4b19f3
push 0x88
push 0
push esi
call fcn.005869c0
add esp, 0xc
mov dword [esi + 0x10], 0
xor ecx, ecx
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x24], 0x61d4cc
mov dword [esi + 0x28], 3
call fcn.004afcc0
test eax, eax
je 0x4b19e9
mov dword [eax + 4], 1
mov dword [esi + 0x84], eax
mov eax, esi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1612
mov edx, 0x61d470
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1612
push 0x61d48c
push 0x61d4a8
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3

Function at 0x4b1b10
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, edx
push edi
cmp dword [esi + 0x38], 0
je 0x4b1b29
push dword [esi + 0x24]
call fcn.0058bf82
add esp, 4
mov edi, dword [esp + 0x14]
mov dword [esi + 0x38], 1
lea ebx, [edi + 1]
push ebx
call fcn.0058d200
add esp, 4
mov dword [esi + 0x24], eax
test eax, eax
je 0x4b1b61
push edi
push ebp
mov edx, ebx
mov ecx, eax
call fcn.00401000
mov eax, dword [esi + 0x24]
add esp, 8
mov byte [edi + eax], 0
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x165e
mov edx, 0x61d4d0
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x165e
push 0x61d4ec
push 0x61d508
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3

Function at 0x4b1bb0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebp, edx
push edi
mov edi, ecx
test esi, esi
jns 0x4b1bdd
test ebx, ebx
jne 0x4b1bcd
xor esi, esi
jmp 0x4b1bdd
push 0xff
push ebx
call fcn.0058cca6
add esp, 8
mov esi, eax
mov eax, dword [edi + 0x1c]
mov dword [edi + 0x18], ebp
test eax, eax
je 0x4b1bf0
push eax
call fcn.0058bf82
add esp, 4
lea ebp, [esi + 1]
push ebp
call fcn.0058d200
add esp, 4
mov dword [edi + 0x1c], eax
test eax, eax
je 0x4b1c21
push esi
push ebx
mov edx, ebp
mov ecx, eax
call fcn.00401000
mov eax, dword [edi + 0x1c]
add esp, 8
mov byte [esi + eax], 0
mov dword [edi + 0x20], esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x166f
mov edx, 0x61d52c
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x166f
push 0x61d548
push 0x61d564
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b1c70
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, edx
mov dword [esp + 0x14], eax
mov esi, ecx
test edi, edi
jns 0x4b1c9f
test eax, eax
jne 0x4b1c8f
xor edi, edi
jmp 0x4b1c9f
push 0xff
push eax
call fcn.0058cca6
add esp, 8
mov edi, eax
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
test ebx, ebx
jns 0x4b1cc3
test eax, eax
jne 0x4b1cb3
xor ebx, ebx
jmp 0x4b1cc3
push 0xff
push eax
call fcn.0058cca6
add esp, 8
mov ebx, eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4b1d1d
lea ecx, [ebx + 2]
add ecx, edi
cmp dword [eax - 0x10], ecx
jbe 0x4b1d8d
mov ecx, dword [eax - 0x10]
lea ebp, [edi + 1]
xor edx, edx
cmp ecx, ebp
jbe 0x4b1ced
mov edx, dword [eax]
sub ecx, ebp
mov dword [eax - 0x10], ecx
add dword [eax], ebp
mov ecx, dword [esi + 0x10]
lea eax, [ebx + 1]
mov dword [esi], edx
mov dword [esp + 0x1c], 0
mov edx, dword [ecx - 0x10]
cmp edx, eax
jbe 0x4b1d14
mov ebp, dword [ecx]
sub edx, eax
mov dword [esp + 0x1c], ebp
lea ebp, [edi + 1]
mov dword [ecx - 0x10], edx
add dword [ecx], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 8], eax
jmp 0x4b1d51
lea ebp, [edi + 1]
push ebp
call fcn.0058d200
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x4b1dce
lea eax, [ebx + 1]
push eax
call fcn.0058d200
add esp, 4
mov dword [esi + 8], eax
test eax, eax
je 0x4b1e0f
mov dword [esi + 0x34], 0xffffffff
mov ecx, dword [esi]
mov edx, ebp
push edi
push dword [esp + 0x18]
call fcn.00401000
mov eax, dword [esi]
lea edx, [ebx + 1]
push ebx
push dword [esp + 0x2c]
mov byte [edi + eax], 0
mov ecx, dword [esi + 8]
mov dword [esi + 4], edi
call fcn.00401000
mov eax, dword [esi + 8]
add esp, 0x10
pop edi
mov byte [ebx + eax], 0
mov dword [esi + 0x14], ebx
pop esi
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x168b
mov edx, 0x61d588
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x168b
push 0x61d5a4
push 0x61d5c0
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1690
mov edx, 0x61d5e4
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1690
push 0x61d600
push 0x61d61c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1691
mov edx, 0x61d640
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1691
push 0x61d65c
push 0x61d678
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b2110
Capabilities:
Encode data using base64
Terminate process

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov ebp, edx
cmp dword [ebx], 0
push edi
mov dword [esp + 0x10], ebp
mov edi, ecx
jne 0x4b2153
lea esi, [ebp*4]
mov eax, 0x55555556
imul esi
mov eax, edx
add edx, 5
shr eax, 0x1f
add eax, edx
push eax
call fcn.0058d200
add esp, 4
mov dword [ebx], eax
test eax, eax
je 0x4b229e
mov eax, dword [ebx]
mov esi, edi
mov dword [esp + 0x14], eax
test edi, edi
je 0x4b228e
test ebp, ebp
je 0x4b228e
lea ecx, [edi + ebp]
lea ebx, [edi + 3]
cmp ebx, ecx
ja 0x4b21e9
mov ebp, ecx
nop word [eax + eax]
movzx ecx, byte [esi]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
movzx edx, byte [esi + 1]
movzx ecx, byte [esi + 2]
and edx, 0xf
shr ecx, 6
shl edx, 2
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
movzx ecx, byte [esi + 2]
mov esi, ebx
and ecx, 0x3f
lea ebx, [esi + 3]
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], cl
add eax, 4
cmp ebx, ebp
jbe 0x4b2180
mov ebp, dword [esp + 0x10]
sub edi, esi
lea ecx, [edi + ebp]
cmp ecx, 1
jne 0x4b2236
movzx ecx, byte [esi]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
mov word [eax + 2], 0x3d3d
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
add eax, 4
mov byte [eax], 0
sub eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp ecx, 2
jne 0x4b227f
movzx ecx, byte [esi]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
movzx ecx, byte [esi + 1]
and ecx, 0xf
mov byte [eax + 3], 0x3d
movzx ecx, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
add eax, 4
mov byte [eax], 0
sub eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov dword [ebx], 0
xor eax, eax
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1765
mov edx, 0x61d7b8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1765
push 0x61d7d4
push 0x61d7f0
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b22e0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x4b23f5
test edi, edi
je 0x4b23f5
mov ebx, dword [esp + 0x1c]
cmp dword [ebx], 0
jne 0x4b2326
lea eax, [edi + edi*2]
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, 4
push eax
call fcn.0058d200
add esp, 4
mov dword [ebx], eax
test eax, eax
je 0x4b2409
mov eax, dword [ebx]
add edi, esi
mov dword [esp + 0x14], eax
mov ebp, eax
mov dword [esp + 0x10], 0
cmp esi, edi
ja 0x4b23d4
xor ebx, ebx
xor edx, edx
cmp esi, edi
ja 0x4b2391
xor al, al
nop word [eax + eax]
test al, al
jne 0x4b23e4
mov cl, byte [esi]
inc esi
lea eax, [ecx - 0x2b]
cmp al, 0x4f
ja 0x4b2377
movzx eax, cl
mov al, byte [eax + 0x5f0125]
test al, al
je 0x4b2379
cmp al, 0x24
je 0x4b2377
add al, 0xc3
jmp 0x4b2379
xor al, al
cmp esi, edi
jbe 0x4b2350
cmp edx, 4
jae 0x4b244a
mov byte [esp + edx + 0x10], 0
inc edx
cmp edx, 4
jl 0x4b2344
test ebx, ebx
je 0x4b23c8
mov eax, dword [esp + 0x10]
mov dl, al
shl dl, 2
mov cl, ah
shr cl, 4
mov al, ah
or dl, cl
shl al, 4
mov byte [ebp], dl
mov dl, byte [esp + 0x12]
mov cl, dl
shl dl, 6
or dl, byte [esp + 0x13]
shr cl, 2
or cl, al
mov byte [ebp + 2], dl
mov byte [ebp + 1], cl
dec ebp
add ebp, ebx
cmp esi, edi
jbe 0x4b2340
mov eax, dword [esp + 0x14]
mov byte [ebp], 0
sub ebp, eax
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp esi, edi
ja 0x4b237d
inc ebx
test al, al
je 0x4b238b
dec al
mov byte [esp + edx + 0x10], al
jmp 0x4b238b
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [eax], 0
xor eax, eax
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x17ac
mov edx, 0x61d814
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x17ac
push 0x61d830
push 0x61d84c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call fcn.00584b5c
int3
Function at 0x4b2450
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x18
mov esi, edx
mov ebp, ecx
call fcn.0058d200
mov edi, eax
add esp, 4
test edi, edi
je 0x4b25d0
mov ebx, dword [esp + 0x1c]
xorps xmm0, xmm0
movups xmmword [edi], xmm0
movq qword [edi + 0x10], xmm0
mov dword [edi + 8], esi
test ebx, ebx
je 0x4b2497
call fcn.004b4150
mov ecx, eax
mov esi, edx
mov eax, ebx
cdq
add ecx, eax
adc esi, edx
jmp 0x4b24a5
movlpd qword [esp + 0x10], xmm0
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [edi], ecx
mov dword [edi + 4], esi
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x2c]
push 0xffffffffffffffff
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [ebp + 0x2c]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x4b24ff
mov ecx, ebx
call fcn.004b2df0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov dword [eax + 8], esi
mov ecx, dword [ebx + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x4b24ee
mov dword [ecx + 8], eax
cmp dword [ebx + 0xc], 0
mov dword [ebx + 0x10], eax
jne 0x4b24fa
mov dword [ebx + 0xc], eax
inc dword [ebx + 4]
jmp 0x4b257a
mov edx, dword [edi]
mov ecx, dword [edi + 4]
test esi, esi
je 0x4b250c
mov eax, dword [esi]
jmp 0x4b250e
xor eax, eax
cmp ecx, dword [eax + 4]
jl 0x4b2522
jg 0x4b2519
cmp edx, dword [eax]
jb 0x4b2522
mov esi, dword [esi + 8]
test esi, esi
jne 0x4b2508
jmp 0x4b252f
mov edx, edi
mov ecx, esi
call fcn.004b2e80
test esi, esi
jne 0x4b2566
mov esi, dword [ebp + 0x2c]
mov ecx, esi
call fcn.004b2df0
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, dword [esi + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4b2555
mov dword [ecx + 8], eax
cmp dword [esi + 0xc], 0
mov dword [esi + 0x10], eax
jne 0x4b2561
mov dword [esi + 0xc], eax
inc dword [esi + 4]
jmp 0x4b2597
mov eax, dword [ebp + 0x2c]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4b2574
mov eax, dword [eax]
jmp 0x4b2576
xor eax, eax
cmp eax, edi
jne 0x4b2597
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x4b258a
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push esi
push eax
push 0x4aee50
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov esi, dword [ebp + 0x24]
mov edx, dword [edi + 4]
mov eax, dword [ebp + 0x20]
mov ecx, dword [edi]
cmp esi, edx
jg 0x4b25b3
jl 0x4b25ac
cmp eax, ecx
ja 0x4b25b3
and eax, esi
cmp eax, 0xffffffff
jne 0x4b25b9
mov dword [ebp + 0x20], ecx
mov dword [ebp + 0x24], edx
mov eax, dword [ebp + 0x2c]
push 0
push 1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x188e
mov edx, 0x61d898
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x188e
push 0x61d8b4
push 0x61d8d0
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b2af0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push 0x38
mov ebp, ecx
call fcn.0058d200
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4b2bde
push 0x38
push 0
push ebx
call fcn.005869c0
add esp, 0xc
mov dword [ebx + 0x14], str.ILibLifeTime
lea eax, [esp + 0x10]
xor edx, edx
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [edx + 0x18]
call fcn.004ae770
mov esi, dword [esp + 0x14]
add esp, 8
mov eax, dword [esp + 0x10]
push 0
push 0x40
push 1
push 0
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
xor edx, edx
lea eax, [esp + 0xc]
mov dword [ebx + 0x2c], esi
push eax
lea eax, [esp + 0x14]
mov dword [ebx], 0x4b2620
push eax
lea ecx, [edx + 0x18]
mov dword [ebx + 8], 0x4b2ac0
mov dword [ebx + 0xc], ebp
call fcn.004ae770
mov esi, dword [esp + 0x18]
add esp, 8
mov eax, dword [esp + 0xc]
push 0
push 0x40
push 1
push 0
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
mov dword [ebx + 0x28], esi
mov esi, dword [ebp + 0x2f0]
mov ecx, esi
call fcn.004b2df0
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, dword [esi + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4b2bc3
mov dword [ecx + 8], eax
cmp dword [esi + 0xc], 0
mov dword [esi + 0x10], eax
jne 0x4b2bcf
mov dword [esi + 0xc], eax
inc dword [esi + 4]
mov eax, ebx
pop esi
mov dword [ebx + 0xc], ebp
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1990
mov edx, 0x61d8f4
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1990
push 0x61d910
push 0x61d92c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3

Function at 0x4b2df0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [ecx + 0x14]
push edi
test esi, esi
je 0x4b2dfd
mov esi, dword [esi - 4]
xor eax, eax
test esi, esi
setg al
lea ebx, [eax*4 + 0x10]
add ebx, esi
push ebx
call fcn.0058d200
mov edi, eax
add esp, 4
test edi, edi
je 0x4b2e35
push ebx
push 0
push edi
call fcn.005869c0
add esp, 0xc
test esi, esi
jle 0x4b2e2f
mov dword [edi + 0x10], esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3

Function at 0x4b30f0
Capabilities:
Terminate process

Disassembly:
push esi
push 0xc
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4b3125
xorps xmm0, xmm0
movq qword [esi], xmm0
push ecx
mov dword [esi + 8], 0
mov ecx, esi
mov dword [esi + 4], 0x4b3030
call fcn.004b3290
add esp, 4
mov eax, esi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1bc9
mov edx, 0x61d960
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1bc9
push 0x61d97c
push 0x61d998
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b3290
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
test esi, esi
je 0x4b32c6
push 1
push 0
xor edx, edx
mov ecx, esi
call fcn.004b3a50
add esp, 8
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi]
call fcn.0058bf82
add esp, 4
push esi
call fcn.0058bf82
add esp, 4
push 0x14
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4b332d
push 0
push 0x40
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0x800
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x100
mov dword [esi + 8], 0x4b3000
call fcn.0058d200
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x10], 0
push 0x800
push 0
push eax
call fcn.005869c0
add esp, 0xc
mov dword [edi], esi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3

Function at 0x4b3370
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push 0x18
mov ebx, edx
mov edi, ecx
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4b33cb
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movq qword [esi + 0x10], xmm0
mov dword [esi + 8], edi
mov edi, dword [esp + 0x10]
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], edi
test edi, edi
jle 0x4b33c5
push edi
call fcn.0058d200
add esp, 4
mov dword [esi + 0xc], eax
test eax, eax
je 0x4b340c
push edi
push ebx
mov edx, edi
mov ecx, eax
call fcn.00401000
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1c4e
mov edx, 0x61d9bc
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1c4e
push 0x61d9d8
push 0x61d9f4
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1c55
mov edx, 0x61da18
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1c55
push 0x61da34
push 0x61da50
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3