joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b35f0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
xor eax, eax
push ebp
test ebx, ebx
mov dword [esp + 0xc], edx
push esi
setg al
lea esi, [ebx + 0x14]
push edi
mov ebp, ecx
lea esi, [esi + eax*4]
push esi
call fcn.0058d200
mov edi, eax
add esp, 4
test edi, edi
je 0x4b3676
push esi
push 0
push edi
call fcn.005869c0
add esp, 0xc
test ebx, ebx
jle 0x4b3630
mov dword [edi + 0x14], ebx
push 0
push 0x40
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [edi + 0xc], eax
lea esi, [ebp*8]
mov eax, dword [esp + 0x14]
push esi
mov dword [edi + 4], ebp
mov dword [edi + 8], eax
call fcn.0058d200
add esp, 4
mov dword [edi], eax
mov dword [edi + 0x10], ebx
push esi
push 0
push eax
call fcn.005869c0
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b36e0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, edx
push ebx
mov eax, dword [edi + 8]
call eax
mov ecx, dword [edi]
add esp, 4
lea ebp, [eax*8]
mov eax, dword [ecx + ebp]
add ecx, ebp
test eax, eax
jne 0x4b3725
cmp dword [ecx + 4], eax
jne 0x4b3723
mov eax, dword [esp + 0x24]
xor esi, esi
mov dword [ecx], ebx
mov ecx, dword [edi]
mov dword [ecx + ebp + 4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
test eax, eax
jns 0x4b3793
push 8
call fcn.0058d200
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4b38b1
mov eax, dword [esp + 0x24]
xorps xmm0, xmm0
movq qword [ecx], xmm0
mov edx, 0x4b36c0
mov dword [ecx + 4], eax
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [ecx], ebx
mov ecx, dword [edi]
push 0x4b2d80
mov dword [esp + 0x20], 0
mov ecx, dword [ecx + ebp + 4]
call fcn.004b2c20
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x4b38a5
mov esi, dword [eax + 4]
push eax
call fcn.0058bf82
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp eax, ebx
jne 0x4b37b3
mov eax, dword [ecx + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
mov dword [ecx + 4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 8
call fcn.0058d200
mov ecx, eax
add esp, 4
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x4b38b1
xorps xmm0, xmm0
xor edx, edx
movq qword [ecx], xmm0
mov eax, dword [edi]
mov eax, dword [eax + ebp]
mov dword [ecx], eax
mov eax, dword [edi]
mov eax, dword [eax + ebp + 4]
mov dword [ecx + 4], eax
lea ecx, [edx + 0x18]
mov eax, dword [edi]
mov dword [eax + ebp], 0xffffffff
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004ae770
mov esi, dword [esp + 0x1c]
add esp, 8
mov eax, dword [esp + 0x18]
push 0
push 0x40
push 1
push 0
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
mov eax, dword [edi]
mov dword [eax + ebp + 4], esi
mov eax, dword [edi]
mov esi, dword [eax + ebp + 4]
mov ecx, esi
call fcn.004b2df0
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov dword [eax + 4], esi
mov dword [eax + 0xc], 0
mov ecx, dword [esi + 0xc]
mov dword [eax + 8], ecx
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4b3850
mov dword [ecx + 0xc], eax
cmp dword [esi + 0x10], 0
mov dword [esi + 0xc], eax
jne 0x4b385c
mov dword [esi + 0x10], eax
inc dword [esi + 4]
push 8
call fcn.0058d200
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4b38b1
mov eax, dword [esp + 0x24]
xorps xmm0, xmm0
movq qword [ecx], xmm0
mov edx, 0x4b36c0
mov dword [ecx + 4], eax
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [ecx], ebx
mov ecx, dword [edi]
push 0x4b2d80
mov dword [esp + 0x28], 0
mov ecx, dword [ecx + ebp + 4]
call fcn.004b2c20
add esp, 0xc
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b3d50
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 1
push dword [esp + 0x1c]
mov esi, edx
xor edx, edx
push esi
call fcn.004b0490
mov ebp, dword [esp + 0x30]
add esp, 0xc
mov dword [esp + 0x10], eax
mov edi, dword [eax + 8]
dec edi
lea ecx, [ebp - 1]
imul edi, ecx
add edi, esi
mov dword [esp + 0x24], edi
lea eax, [edi + 1]
push eax
call fcn.0058d200
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4b3e13
mov byte [ebx + edi], 0
xor esi, esi
mov edi, dword [esp + 0x10]
mov edi, dword [edi]
test edi, edi
je 0x4b3de6
push dword [edi + 4]
mov edx, dword [esp + 0x28]
lea ecx, [ebx + esi]
push dword [edi]
inc edx
sub edx, esi
call fcn.00401000
add esi, dword [edi + 4]
add esp, 8
cmp dword [edi + 8], 0
je 0x4b3ddf
mov edx, dword [esp + 0x24]
lea ecx, [ebx + esi]
push ebp
push dword [esp + 0x24]
inc edx
sub edx, esi
call fcn.00401000
add esp, 8
add esi, ebp
mov edi, dword [edi + 8]
test edi, edi
jne 0x4b3da6
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
test eax, eax
je 0x4b3e02
mov esi, dword [eax + 8]
push eax
call fcn.0058bf82
add esp, 4
mov eax, esi
test esi, esi
jne 0x4b3df0
push edi
call fcn.0058bf82
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1ea0
mov edx, 0x61da74
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1ea0
push 0x61da90
push 0x61daac
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3

Function at 0x4b3e60
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, edx
mov ebx, ecx
push edi
test esi, esi
jns 0x4b3e85
test ebx, ebx
jne 0x4b3e75
xor esi, esi
jmp 0x4b3e85
push 0x1000
push ebx
call fcn.0058cca6
add esp, 8
mov esi, eax
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
test edi, edi
jns 0x4b3ea9
test ebp, ebp
jne 0x4b3e99
xor edi, edi
jmp 0x4b3ea9
push 0x1000
push ebp
call fcn.0058cca6
add esp, 8
mov edi, eax
lea eax, [edi + 1]
add eax, esi
push eax
call fcn.0058d200
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4b3eee
push esi
lea edx, [edi + 1]
mov ecx, eax
push ebx
add edx, esi
call fcn.00401000
add esi, dword [esp + 0x24]
lea edx, [edi + 1]
push edi
push ebp
mov ecx, esi
call fcn.00401000
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov byte [esi + edi], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1f03
mov edx, 0x61dbe4
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1f03
push 0x61dc00
push 0x61dc1c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b3f30
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, edx
push edi
mov edi, ecx
test esi, esi
jns 0x4b3f55
test edi, edi
jne 0x4b3f45
xor esi, esi
jmp 0x4b3f55
push 0x1000
push edi
call fcn.0058cca6
add esp, 8
mov esi, eax
lea ebp, [esi + 1]
push ebp
call fcn.0058d200
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4b3f81
push esi
push edi
mov edx, ebp
mov ecx, ebx
call fcn.00401000
add esp, 8
mov byte [ebx + esi], 0
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1f0d
mov edx, 0x61dc40
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1f0d
push 0x61dc5c
push 0x61dc78
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3

Function at 0x4b3fd0
Capabilities:
Read file on windows
Terminate process

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0x61dd54
push edx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
mov ebx, ecx
call fcn.0058bf3b
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
jne 0x4b4004
mov dword [ebx], eax
pop edi
pop esi
pop ebx
add esp, 8
ret
push 2
push 0
push eax
call fcn.0058885d
add esp, 0xc
push dword [esp + 0x10]
call fcn.0058829a
add esp, 4
mov esi, eax
push 0
push 0
push dword [esp + 0x18]
call fcn.0058885d
add esp, 0xc
lea ecx, [esi + 1]
push ecx
call fcn.0058d200
mov edi, eax
add esp, 4
test edi, edi
je 0x4b406b
push dword [esp + 0x10]
push esi
push 1
push edi
call fcn.0058d150
mov esi, eax
mov byte [edi + esi], 0
push dword [esp + 0x20]
call fcn.00588467
add esp, 0x14
mov dword [ebx], edi
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1f4a
mov edx, 0x61dd58
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1f4a
push 0x61dd74
push 0x61dd90
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3

Function at 0x4b40b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push 0x61ddb4
push ecx
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
mov esi, edx
call fcn.0058bf3b
mov eax, dword [esp + 0x10]
add esp, 0xc
test eax, eax
je 0x4b40f0
push eax
push dword [esp + 0x10]
push 1
push esi
call fcn.0058bc60
push dword [esp + 0x14]
call fcn.00588467
add esp, 0x14
pop esi
pop ecx
ret

Function at 0x4b4100
Capabilities:
Write file on windows

Disassembly:
push ecx
push 0x61ddb8
push dword [0x6234d4]
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
call fcn.0058bf3b
mov eax, dword [esp + 0xc]
add esp, 0xc
test eax, eax
je 0x4b4146
push eax
push dword [esp + 0xc]
push 1
push 0x6237a0
call fcn.0058bc60
push dword [esp + 0x10]
call fcn.00588467
add esp, 0x14
pop ecx
ret
Function at 0x4b48e0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
push 0xc
mov edi, edx
mov ebx, ecx
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4b4934
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
push edi
mov dword [esi + 4], edi
call fcn.0058d200
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x4b4975
push edi
push ebx
mov edx, edi
mov ecx, eax
call fcn.00401000
add esp, 8
mov dword [esi + 8], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x81
mov edx, 0x61e120
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x81
push 0x61e140
push 0x61e160
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x86
mov edx, 0x61e184
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x86
push 0x61e1a4
push 0x61e1c4
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3

Function at 0x4b4a30
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push 8
mov edi, edx
mov esi, ecx
call fcn.0058d200
add esp, 4
test eax, eax
je 0x4b4a64
xorps xmm0, xmm0
movq qword [eax], xmm0
push eax
mov dword [eax], esi
mov dword [eax + 4], edi
push dword [esi + 0x24]
push 0x4b49e0
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
pop edi
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3

Function at 0x4b4b80
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0x18
mov edi, edx
mov esi, ecx
call fcn.0058d200
mov edx, eax
add esp, 4
test edx, edx
je 0x4b4bc4
mov eax, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [edx], xmm0
mov ecx, esi
movq qword [edx + 0x10], xmm0
mov dword [edx + 8], eax
mov eax, dword [esp + 0x14]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [edx], esi
mov dword [edx + 4], edi
mov dword [edx + 0x14], eax
pop edi
pop esi
jmp fcn.004b4b00
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b5180
Capabilities:
Create thread
Terminate process

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0x30
mov ebx, ecx
call fcn.0058d200
mov edi, eax
add esp, 4
test edi, edi
je 0x4b5298
push 0x30
push 0
push edi
call fcn.005869c0
add esp, 0xc
mov dword [edi + 0x14], str.ILibProcessPipe_Manager
lea eax, [esp + 0x10]
mov dword [edi + 0xc], ebx
xor edx, edx
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [edx + 0x18]
call fcn.004ae770
mov esi, dword [esp + 0x14]
add esp, 8
mov eax, dword [esp + 0x10]
push 0
push 0x40
push 1
push 0
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 0
push 1
mov dword [esi], eax
push 0
mov dword [edi + 0x18], esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x20], eax
cmp dword [ebx + 8], 0
je 0x4b521e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebx + 8], eax
je 0x4b521e
push edi
push 0
mov edx, 0x4b5130
mov ecx, ebx
call fcn.004ae9f0
add esp, 8
jmp 0x4b5235
push 0
push 0
push edi
push 0x4b5090
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x24], eax
mov dword [edi + 8], 0x4b5150
cmp dword [ebx + 4], 0
jne 0x4b5286
mov esi, dword [ebx + 0x2f0]
mov ecx, esi
call fcn.004b2df0
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, dword [esi + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4b526b
mov dword [ecx + 8], eax
cmp dword [esi + 0xc], 0
mov dword [esi + 0x10], eax
jne 0x4b5277
mov dword [esi + 0xc], eax
inc dword [esi + 4]
mov eax, edi
mov dword [edi + 0xc], ebx
pop edi
pop esi
pop ebx
add esp, 8
ret
mov edx, edi
mov ecx, ebx
call fcn.004aeb20
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1e9
mov edx, 0x61e1e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x1e9
push 0x61e208
push 0x61e228
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b53e0
Capabilities:
Create pipe
Terminate process

Disassembly:
sub esp, 0x118
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x114], eax
mov edx, dword [esp + 0x120]
mov eax, 0x5c
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
test edx, edx
mov ecx, 0x6c
push ebx
cmovg eax, ecx
push edx
add eax, edx
push eax
call fcn.0058d200
add esp, 4
lea edx, [ebx + 0x4c]
mov ecx, eax
call fcn.004ae4d0
mov edi, eax
add esp, 8
mov dword [edi + 0x18], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [edi + 0x28], ebx
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], ebx
nop dword [eax]
push ebx
push edi
push str..pipe_p_u
lea eax, [esp + 0x28]
push 0xff
push eax
call fcn.00401140
add esp, 0x14
lea eax, [esp + 0x10]
inc ebx
push eax
push 0
push 0x1000
push 0x1000
push 1
push 0
push 0x40080001
lea eax, [esp + 0x38]
push eax
call esi
mov dword [edi + 0x38], eax
cmp eax, 0xffffffff
je 0x4b55df
cmp eax, 5
je 0x4b5450
push 0x14
call fcn.0058d200
add esp, 4
mov dword [edi + 0x40], eax
test eax, eax
je 0x4b551c
push 0
push 0
xorps xmm0, xmm0
push 1
movups xmmword [eax], xmm0
push 0
mov dword [eax + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [edi + 0x40]
mov dword [ecx + 0x10], eax
test eax, eax
je 0x4b555d
push 0
push 0x80
push 3
lea eax, [esp + 0x1c]
push eax
push 0
push 0x40000000
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi + 0x3c], eax
cmp eax, 0xffffffff
je 0x4b559e
mov ecx, dword [esp + 0x120]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00584a28
add esp, 0x118
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x265
mov edx, 0x61e3a0
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x265
push 0x61e3c0
push 0x61e3e0
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x267
mov edx, 0x61e404
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x267
push 0x61e424
push 0x61e444
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x26a
mov edx, 0x61e468
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x26a
push 0x61e488
push 0x61e4a8
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x262
mov edx, 0x61e33c
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x262
push 0x61e35c
push 0x61e37c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b64f0
Capabilities:
Create thread
Read file on windows
Terminate process

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
push edi
call fcn.0058d200
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x4b6578
mov eax, dword [esp + 0xc]
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x40]
mov dword [esi + 4], edi
test eax, eax
je 0x4b6550
push eax
push 0
push edi
push ecx
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esi + 0x40]
mov ecx, dword [esi + 0x18]
push 0x4b5ce0
push esi
mov edx, dword [edx + 0x10]
push 0
call fcn.004b4b80
add esp, 0xc
pop edi
pop esi
ret
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push esi
push 0x4b6320
push 0
push 0
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x577
mov edx, 0x61e5b0
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x577
push str...microstackILibProcessPipe.c
push 0x61e5f0
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b67a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, edx
mov ebp, 0xfffffffc
test edi, edi
je 0x4b6926
cmp dword [edi + 0x20], 0
jne 0x4b67f3
lea eax, [esp + 0x18]
xor edx, edx
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [ebp + 0x1c]
call fcn.004ae770
mov esi, dword [esp + 0x1c]
add esp, 8
mov eax, dword [esp + 0x18]
push 0
push 0x40
push 1
push 0
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
mov dword [edi + 0x20], esi
mov eax, dword [edi + 0x20]
push 0xffffffffffffffff
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [edi + 0x20]
cmp dword [eax + 0xc], 0
je 0x4b686a
mov edx, dword [esp + 0x20]
push ecx
mov ecx, ebx
call fcn.004b48e0
mov ebx, dword [edi + 0x20]
add esp, 4
mov ecx, ebx
mov esi, eax
call fcn.004b2df0
mov ecx, eax
mov dword [ecx], esi
mov dword [ecx + 4], ebx
mov dword [ecx + 8], 0
mov eax, dword [ebx + 0x10]
mov dword [ecx + 0xc], eax
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4b6842
mov dword [eax + 8], ecx
cmp dword [ebx + 0xc], 0
mov dword [ebx + 0x10], ecx
jne 0x4b684e
mov dword [ebx + 0xc], ecx
inc dword [ebx + 4]
mov ecx, dword [edi + 0x20]
push 0
push 1
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push dword [edi + 0x40]
mov esi, dword [esp + 0x24]
push 0
push esi
push ebx
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x4b689d
mov ecx, dword [edi + 0x20]
mov ebp, eax
push 0
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4b68f3
push ecx
mov edx, esi
mov ecx, ebx
xor ebp, ebp
call fcn.004b48e0
mov ecx, dword [edi + 0x20]
add esp, 4
mov edx, eax
call fcn.004afbb0
mov edx, dword [edi + 0x40]
mov ecx, dword [edi + 0x18]
push 0x4b5f00
push edi
mov edx, dword [edx + 0x10]
push ebp
call fcn.004b4b80
mov ecx, dword [edi + 0x20]
add esp, 0xc
push ebp
push 1
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [edi + 0x20]
push 0
push 1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
cmp dword [edi + 0x28], 0
je 0x4b691f
mov edx, dword [edi + 0x40]
mov ecx, dword [edi + 0x18]
mov edx, dword [edx + 0x10]
call fcn.004b4a30
mov eax, dword [edi + 0x28]
push edi
call eax
add esp, 4
mov ecx, edi
call fcn.004b52e0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4b6950
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x48
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x58]
push ebx
mov ebx, dword [esp + 0x54]
push ebp
push esi
push edi
push 2
mov edi, ecx
mov dword [esp + 0x14], edx
push 0
push edi
mov dword [esp + 0x20], eax
call fcn.0058885d
mov eax, dword [esp + 0x68]
add esp, 0xc
mov ebp, dword [esp + 0x64]
add eax, 0x3c
mov esi, dword [sym.imp.WS2_32.dll_htonl]
add eax, ebp
push eax
call esi
push dword [esp + 0x5c]
mov dword [esp + 0x1c], eax
call esi
push ebp
mov dword [esp + 0x20], eax
call esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
push 0x30
test eax, eax
je 0x4b69c3
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00586440
jmp 0x4b69cf
lea eax, [esp + 0x28]
push 0
push eax
call fcn.005869c0
add esp, 0xc
lea eax, [esp + 0x18]
push edi
push 0x3c
push 1
push eax
call fcn.0058bc60
push edi
push dword [esp + 0x70]
push 1
push dword [esp + 0x2c]
call fcn.0058bc60
push edi
call fcn.0058829a
cdq
add esp, 0x24
mov dword [esp + 0x10], edx
mov esi, eax
test ebx, ebx
je 0x4b6a12
push edi
push ebp
push 1
push ebx
call fcn.0058bc60
add esp, 0x10
push edi
call fcn.005928c8
mov ecx, dword [esp + 0x58]
add esp, 4
mov edx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00584a28
add esp, 0x48
ret
Function at 0x4b6a40
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x111c
call fcn.00584ea0
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x1114], eax
push ebx
push ebp
push esi
mov ebp, ecx
mov esi, edx
push edi
test ebp, ebp
jne 0x4b6a6b
xor eax, eax
jmp 0x4b6bc7
push dword [ebp]
lea ebx, [ebp + 0x10]
mov dword [esp + 0x18], ebx
call fcn.0058829a
cdq
add esp, 4
cmp eax, dword [ebp + 0x1010]
jne 0x4b6a8e
cmp edx, dword [ebp + 0x1014]
je 0x4b6a64
cmp esi, 0x20
je 0x4b6aa5
cmp esi, 0x40
mov edi, 0x48
mov eax, 0x3c
cmovne edi, eax
jmp 0x4b6aaa
mov edi, 0x40
push dword [ebp]
push edi
push 1
push ebx
call fcn.0058d150
add esp, 0x10
cmp eax, edi
jl 0x4b6a64
push dword [ebx]
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
call esi
push dword [ebx + 4]
mov dword [ebx], eax
call esi
push dword [ebx + 8]
mov dword [ebx + 4], eax
call esi
mov dword [ebx + 8], eax
push dword [ebp]
call fcn.0058829a
cdq
add esp, 4
mov ecx, eax
mov esi, edx
mov eax, dword [ebx + 4]
cdq
add eax, ecx
mov dword [ebx - 8], eax
mov eax, 0xff8
adc edx, esi
sub eax, edi
mov dword [ebx - 4], edx
mov ecx, dword [ebx + 4]
cmp ecx, eax
jg 0x4b6a64
push dword [ebp]
lea eax, [edi + ebx]
push ecx
push 1
push eax
call fcn.0058d150
add esp, 0x10
cmp eax, dword [ebx + 4]
jne 0x4b6a64
mov esi, dword [ebx + 8]
lea eax, [esp + 0x18]
push eax
call fcn.004cf3d0
add esp, 4
test esi, esi
jle 0x4b6b83
mov ebx, 0x1000
nop dword [eax]
push dword [ebp]
cmp esi, ebx
mov eax, esi
cmovg eax, ebx
push eax
lea eax, [esp + 0x128]
push 1
push eax
call fcn.0058d150
mov edi, eax
add esp, 0x10
test edi, edi
jle 0x4b6b7f
push edi
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004cf480
sub esi, edi
add esp, 0xc
test esi, esi
jg 0x4b6b40
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xf4]
push eax
call fcn.004cf3c0
add esp, 8
cmp dword [ebx + 8], 0
jle 0x4b6bc5
lea ecx, [ebx + 0xc]
mov esi, 0x2c
lea edx, [esp + 0xf0]
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4b6bc3
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4b6bb0
jmp 0x4b6bc5
xor ebx, ebx
mov eax, ebx
mov ecx, dword [esp + 0x1124]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00584a28
add esp, 0x111c
ret