joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d4e2
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
push edi
test esi, esi
je 0x48d60b
test ebx, ebx
je 0x48d60b
mov ebp, dword [esp + 0x20]
cmp dword [ebp], 0
jne 0x48d537
imul eax, ebx, 3
mov edi, 0x1d20
push edi
push 0x759c94
push 1
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, 4
push eax
call fcn.005f5c60
add esp, 0x10
mov dword [ebp], eax
test eax, eax
je 0x48d61c
and dword [esp + 0x10], 0
add ebx, esi
mov edi, dword [ebp]
jmp 0x48d5f9
xor eax, eax
xor edx, edx
mov dword [esp + 0x14], eax
cmp esi, ebx
ja 0x48d5bd
xor cl, cl
test cl, cl
jne 0x48d58c
mov cl, byte [esi]
inc esi
lea eax, [ecx - 0x2b]
cmp al, 0x4f
ja 0x48d56d
movzx eax, cl
mov cl, byte [eax + 0x6c828d]
jmp 0x48d56f
xor cl, cl
test cl, cl
je 0x48d588
and dword [esp + 0x18], 0
lea eax, [ecx - 0x3d]
cmp cl, 0x24
movzx eax, al
cmove eax, dword [esp + 0x18]
mov cl, al
cmp esi, ebx
jbe 0x48d554
cmp esi, ebx
ja 0x48d5a5
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
test cl, cl
je 0x48d5b7
dec cl
mov byte [esp + edx + 0x10], cl
jmp 0x48d5b7
cmp edx, 4
jae 0x48d64f
mov eax, dword [esp + 0x14]
mov byte [esp + edx + 0x10], 0
inc edx
cmp edx, 4
jl 0x48d54e
test eax, eax
je 0x48d5f9
mov al, byte [esp + 0x11]
mov cl, byte [esp + 0x10]
mov dl, byte [esp + 0x12]
shr al, 4
shl cl, 2
or cl, al
mov al, byte [esp + 0x11]
mov byte [edi], cl
mov cl, dl
shl al, 4
shr cl, 2
or cl, al
shl dl, 6
or dl, byte [esp + 0x13]
mov eax, dword [esp + 0x14]
dec eax
mov byte [edi + 1], cl
mov byte [edi + 2], dl
add edi, eax
cmp esi, ebx
jbe 0x48d546
mov byte [edi], 0
sub edi, dword [ebp]
mov eax, edi
jmp 0x48d614
mov eax, dword [esp + 0x20]
and dword [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x759cb0
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x759ccc
push 0x759ce8
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
call fcn.005c0f80
int3

Function at 0x48dce4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x1f54
mov edi, ecx
push ebx
push 0x759d78
push 1
push 0x48
call fcn.005f5c60
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48dd53
push 0x48
push 0
push esi
call fcn.005c3840
add esp, 0xc
mov ecx, str.ILibLifeTime
call fcn.004873e9
xor ecx, ecx
mov dword [esi + 0x18], eax
call fcn.0048dec7
xor ecx, ecx
mov dword [esi + 0x38], eax
mov dword [esi], 0x48d8ba
mov dword [esi + 8], 0x48dc87
mov dword [esi + 0x10], edi
call fcn.0048dec7
mov edx, esi
mov dword [esi + 0x34], eax
mov ecx, edi
call fcn.00488084
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x759d94
push esi
push ebx
xor ecx, ecx
call fcn.0048f95e
push ebx
push 0x759db0
push 0x759dcc
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
int3
Function at 0x48e2fc
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, 0x21b7
push edi
push 0x759e38
push 1
push 0xc
call fcn.005f5c60
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48e352
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, dword [esi]
mov dword [esi + 4], 0x48e28a
test ecx, ecx
je 0x48e339
push 0
xor edx, edx
call fcn.0048eb06
pop ecx
push 0
mov edx, 0x48e267
mov ecx, 0x100
call fcn.0048e77c
pop ecx
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x759e54
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x759e70
push 0x759e8c
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
int3

Function at 0x48e4fe
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, 0x223c
mov ebx, edx
push edi
push 0x759eb0
push 1
push 0x18
mov ebp, ecx
call fcn.005f5c60
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48e59a
push 6
xor eax, eax
mov edi, esi
pop ecx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x18]
and dword [esi + 0x14], eax
mov dword [esi + 8], ebp
mov dword [esi + 0x10], edi
test edi, edi
jle 0x48e592
mov ebp, 0x2243
push ebp
push 0x759f28
push 1
push edi
call fcn.005f5c60
add esp, 0x10
mov dword [esi + 0xc], eax
test eax, eax
jne 0x48e585
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x759f44
push esi
push ebp
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push ebp
push 0x759f60
push 0x759f7c
jmp 0x48e5c2
push edi
push ebx
mov edx, edi
mov ecx, eax
call section..text
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x759ecc
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x759ee8
push 0x759f04
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d08b0
int3
Function at 0x48ec9e
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x1c]
mov esi, edx
xor edx, edx
push dword [esp + 0x1c]
push esi
call fcn.0048ba0a
mov ecx, dword [esp + 0x30]
mov ebp, eax
sub ecx, dword [esp + 0x28]
add esp, 0xc
mov dword [esp + 0x10], ebp
mov edi, dword [ebp + 8]
dec edi
imul edi, ecx
push 0x2498
push 0x759fbc
push 1
add edi, esi
lea eax, [edi + 1]
push eax
mov dword [esp + 0x2c], eax
call fcn.005f5c60
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x48ed52
mov byte [ebx + edi], 0
xor edi, edi
mov esi, dword [ebp]
test esi, esi
je 0x48ed43
mov ebp, dword [esp + 0x1c]
push dword [esi + 4]
mov edx, ebp
lea ecx, [ebx + edi]
push dword [esi]
sub edx, edi
call section..text
add edi, dword [esi + 4]
cmp dword [esi + 8], 0
pop ecx
pop ecx
je 0x48ed38
push dword [esp + 0x24]
mov edx, ebp
lea ecx, [ebx + edi]
push dword [esp + 0x24]
sub edx, edi
call section..text
add edi, dword [esp + 0x2c]
pop ecx
pop ecx
mov esi, dword [esi + 8]
test esi, esi
jne 0x48ed02
mov ebp, dword [esp + 0x10]
mov ecx, ebp
call fcn.0048bbce
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x2498
push esi
push edi
mov edx, 0x759fd8
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x759ff4
push 0x75a010
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d08b0
int3

Function at 0x48ed8e
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, edx
mov ebp, ecx
push edi
test esi, esi
je 0x48ed9f
cmp esi, 0xffffffff
jne 0x48edb6
test ebp, ebp
jne 0x48eda7
xor esi, esi
jmp 0x48edb6
push 0x1000
push ebp
call fcn.005f8650
pop ecx
pop ecx
mov esi, eax
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
cmp edi, 0xffffffff
jne 0x48edda
test ebx, ebx
jne 0x48edcb
xor edi, edi
jmp 0x48edda
push 0x1000
push ebx
call fcn.005f8650
pop ecx
pop ecx
mov edi, eax
push 0x24fb
push 0x75a148
lea eax, [edi + 1]
add eax, esi
push 1
push eax
call fcn.005f5c60
add esp, 0x10
mov dword [esp + 0x18], eax
test eax, eax
je 0x48ee2a
push esi
lea edx, [edi + 1]
mov ecx, eax
push ebp
add edx, esi
call section..text
add esi, dword [esp + 0x20]
lea edx, [edi + 1]
push edi
push ebx
mov ecx, esi
call section..text
mov eax, dword [esp + 0x28]
add esp, 0x10
mov byte [esi + edi], 0
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x24fb
push esi
push edi
mov edx, 0x75a164
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x75a180
push 0x75a19c
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
int3
Function at 0x48ee63
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, edx
push edi
mov edi, ecx
test esi, esi
je 0x48ee74
cmp esi, 0xffffffff
jne 0x48ee8b
test edi, edi
jne 0x48ee7c
xor esi, esi
jmp 0x48ee8b
push 0x1000
push edi
call fcn.005f8650
pop ecx
pop ecx
mov esi, eax
push 0x2505
push 0x75a1c0
lea ebp, [esi + 1]
push 1
push ebp
call fcn.005f5c60
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x48eec1
push esi
push edi
mov edx, ebp
mov ecx, ebx
call section..text
pop ecx
pop ecx
pop edi
mov byte [ebx + esi], 0
mov eax, ebx
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x2505
push esi
push edi
mov edx, 0x75a1dc
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x75a1f8
push 0x75a214
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
int3

Function at 0x48eefa
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x1000
mov edi, 0x76d260
xor esi, esi
and dword [esp + 0x10], esi
mov ebx, ecx
push edi
push 0xffffffffffffffff
push edx
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x75a328
lea eax, [esp + 0x10]
push edi
push eax
call fcn.005ee960
add esp, 0xc
cmp dword [esp + 0xc], esi
jne 0x48ef42
and dword [ebx], esi
xor eax, eax
jmp 0x48efcd
push 2
push 0
push dword [esp + 0x14]
call fcn.005f0210
push dword [esp + 0x18]
call fcn.005d15e0
add esp, 0x10
cmp eax, 0x7fffffff
jge 0x48ef77
push dword [esp + 0xc]
call fcn.005d15e0
mov esi, eax
pop ecx
test esi, esi
jns 0x48ef77
and dword [ebx], 0
jmp 0x48ef3b
push ebp
push 0
push 0
push dword [esp + 0x18]
call fcn.005f0210
mov ebp, 0x2544
lea eax, [esi + 1]
push ebp
push 0x75a330
push 1
push eax
call fcn.005f5c60
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x48efd2
test esi, esi
jle 0x48efba
push dword [esp + 0x10]
push esi
push 1
push edi
call fcn.005f8d30
add esp, 0x10
mov esi, eax
mov byte [edi + esi], 0
push dword [esp + 0x10]
call fcn.005ef610
pop ecx
mov dword [ebx], edi
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x75a34c
push esi
push ebp
xor ecx, ecx
call fcn.0048f95e
push ebp
push 0x75a368
push 0x75a384
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
int3

Function at 0x48f006
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
push 0x1000
mov edi, 0x76d260
mov esi, edx
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x75a3a8
lea eax, [ebp - 4]
push edi
push eax
call fcn.005ee960
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x48f05e
push dword [ebp - 4]
push dword [ebp + 8]
push 1
push esi
call fcn.005f2680
push dword [ebp - 4]
call fcn.005ef610
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48f064
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [0x757898]
mov ebx, 0x76d260
push edi
mov edi, dword [0x75789c]
push 0x1000
push ebx
push 0xffffffffffffffff
push dword [0x76b4e0]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x75a3b0
lea eax, [ebp - 4]
push ebx
push eax
call fcn.005ee960
mov ecx, dword [ebp - 4]
add esp, 0xc
test ecx, ecx
je 0x48f0fa
mov eax, esi
or eax, edi
je 0x48f0de
push 2
push 0
push ecx
call fcn.005f0210
push dword [ebp - 4]
call fcn.005d1580
add esp, 0x10
cmp edx, edi
ja 0x48f0f1
jb 0x48f0d9
cmp eax, esi
jae 0x48f0f1
push dword [ebp - 4]
jmp 0x48f0df
push ecx
push dword [ebp + 8]
push 1
push 0x76c260
call fcn.005f2680
add esp, 0x10
push dword [ebp - 4]
call fcn.005ef610
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48f101
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.005c1580
mov eax, dword [0x6dad44]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x1000
lea eax, [ebp - 0x4004]
mov esi, edx
or edx, 0xffffffff
push edi
push eax
call fcn.00487094
lea eax, [ebp - 0x2004]
or edx, 0xffffffff
push edi
push eax
mov ecx, esi
call fcn.00487094
add esp, 0x10
lea eax, [ebp - 0x2004]
push 0
push eax
lea eax, [ebp - 0x4004]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.005c0e20
mov esp, ebp
pop ebp
ret
Function at 0x48fc16
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, ecx
mov edx, edi
neg edx
push 0
lea eax, [edi + 0x14]
sbb edx, edx
and edx, eax
push 0
mov esi, dword [edx]
push esi
call fcn.005f0210
push esi
push 0x10
push 1
push edi
call fcn.005f8d30
add esp, 0x1c
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret

Function at 0x48fc49
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, ecx
mov edx, edi
neg edx
push 0
lea eax, [edi + 0x14]
sbb edx, edx
and edx, eax
push 0
mov esi, dword [edx]
push esi
call fcn.005f0210
push esi
push 0x10
push 1
push edi
call fcn.005f2680
push esi
call fcn.005ee1c0
add esp, 0x20
pop edi
pop esi
ret

Function at 0x48fc7b
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
lea eax, [ecx + 0x14]
neg esi
push edi
sbb esi, esi
xor edi, edi
and esi, eax
mov ebx, dword [esi]
add esi, 8
test edx, edx
jne 0x48fcca
cmp dword [ecx + 8], edi
jbe 0x48fcfe
push edx
push dword [ecx + 8]
mov edi, esi
push ebx
call fcn.005f0210
push ebx
push 8
push 1
push esi
call fcn.005f8d30
push ebx
push dword [esi + 4]
add eax, esi
push 1
push eax
call fcn.005f8d30
add esp, 0x2c
cmp eax, dword [esi + 4]
je 0x48fcfe
xor edi, edi
jmp 0x48fcfe
cmp dword [edx], edi
jbe 0x48fcfe
push 0
push dword [edx]
mov edi, esi
push ebx
call fcn.005f0210
push ebx
push 8
push 1
push esi
call fcn.005f8d30
push ebx
push dword [esi + 4]
add eax, esi
push 1
push eax
call fcn.005f8d30
xor ecx, ecx
add esp, 0x2c
cmp eax, dword [esi + 4]
cmovne edi, ecx
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x48fd61
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, 0x76d260
push edi
push 0x1000
push ebp
push 0xffffffffffffffff
mov edi, ecx
xor ebx, ebx
push edi
push ebx
push 0xfde9
call esi
push str.rbN
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.005ee960
add esp, 0xc
test eax, eax
je 0x48fdc2
push 0x1000
push ebp
push 0xffffffffffffffff
push edi
push ebx
push 0xfde9
call esi
push 0x75a8d4
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.005ee960
add esp, 0xc
cmp dword [esp + 0x14], ebx
jne 0x48fdcf
xor eax, eax
jmp 0x48fec3
push 2
push ebx
push dword [esp + 0x1c]
call fcn.005f0210
add esp, 0xc
push dword [esp + 0x14]
call fcn.005d15e0
pop ecx
push 0x10
pop ebp
cmp eax, ebp
jge 0x48fe47
test edi, edi
jne 0x48fdf7
mov eax, ebx
jmp 0x48fe04
push 0x104
push edi
call fcn.005f8650
pop ecx
pop ecx
push ebx
push ebx
lea edx, [eax + 0x1009]
mov ecx, ebp
call fcn.004878dc
mov esi, eax
mov edx, edi
mov dword [esi + 4], 0x1f4000
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x14], ecx
mov ecx, esi
call fcn.0048fd04
push dword [esp + 0x1c]
push ebp
push 1
push esi
call fcn.005f2680
push dword [esp + 0x2c]
call fcn.005ee1c0
add esp, 0x1c
jmp 0x48fec1
push ebx
push ebx
push dword [esp + 0x1c]
call fcn.005f0210
add esp, 0xc
test edi, edi
jne 0x48fe5d
mov eax, ebx
jmp 0x48fe6a
push 0x104
push edi
call fcn.005f8650
pop ecx
pop ecx
push ebx
push ebx
lea edx, [eax + 0x1009]
mov ecx, ebp
call fcn.004878dc
push dword [esp + 0x1c]
mov esi, eax
push ebp
push 1
push esi
call fcn.005f8d30
add esp, 0x18
cmp eax, ebp
je 0x48fea7
push 1
push esi
call fcn.005f5b20
push dword [esp + 0x1c]
mov esi, ebx
call fcn.005ef610
add esp, 0xc
jmp 0x48fec1
mov ecx, esi
lea eax, [esi + 0x14]
neg ecx
mov edx, edi
sbb ecx, ecx
and ecx, eax
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
mov ecx, esi
call fcn.0048fd04
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x48feca
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
xor eax, eax
push ebp
push esi
mov ebp, ecx
mov dword [esp + 0x10], eax
mov esi, ebp
mov dword [esp + 0x1c], edx
neg esi
mov dword [esp + 0x14], ebx
push edi
sbb esi, esi
lea eax, [ebp + 0x14]
and esi, eax
push 0
push 0
mov esi, dword [esi]
push esi
call fcn.005f0210
push esi
push 0x10
pop edi
push edi
push 1
push ebp
call fcn.005f8d30
add esp, 0x1c
cmp eax, edi
je 0x48ff18
xor eax, eax
inc eax
jmp 0x49007d
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x48ff5f
push 0
add eax, 4
push eax
push esi
call fcn.005f0210
push esi
push 4
lea eax, [esp + 0x24]
push 1
push eax
call fcn.005f8d30
add esp, 0x1c
cmp eax, 4
jne 0x48ff10
mov eax, dword [esp + 0x10]
mov edi, dword [ebp + 0xc]
add eax, 8
add edi, eax
lea eax, [ebx + 8]
add eax, edi
mov dword [esp + 0x10], edi
cmp eax, dword [ebp + 4]
jbe 0x48ff63
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], edi
lea ebx, [ebp + 8]
cmp dword [ebx], 0
je 0x48ffb2
cmp edi, dword [ebx]
ja 0x48ffad
mov eax, dword [esp + 0x18]
add eax, 8
add eax, edi
cmp eax, dword [ebx]
jbe 0x48ffad
push 0
push dword [ebx]
push esi
call fcn.005f0210
push esi
push 4
push 1
push ebx
call fcn.005f8d30
add esp, 0x1c
cmp eax, 4
jne 0x48ff10
mov edi, dword [esp + 0x10]
xor eax, eax
inc eax
cmp dword [ebx], 0
mov dword [esp + 0x14], eax
jne 0x48ff6b
cmp dword [ebx], 0
jne 0x48ffb9
xor eax, eax
mov dword [ebx], edi
inc eax
jmp 0x48ffbd
mov eax, dword [esp + 0x14]
test eax, eax
je 0x48ffe3
push 0
push 8
push esi
call fcn.005f0210
push esi
push 4
push 1
push ebx
call fcn.005f2680
push esi
call fcn.005ee1c0
mov edi, dword [esp + 0x30]
add esp, 0x20
push 0
push edi
push esi
call fcn.005f0210
and dword [esp + 0x28], 0
lea eax, [esp + 0x28]
push esi
push 4
pop edi
xor ebx, ebx
push edi
inc ebx
push ebx
push eax
call fcn.005f2680
push esi
push edi
lea eax, [esp + 0x4c]
push ebx
push eax
call fcn.005f2680
add esp, 0x2c
cmp dword [esp + 0x28], 0
jbe 0x49002d
push esi
push dword [esp + 0x2c]
push ebx
push dword [esp + 0x2c]
call fcn.005f2680
add esp, 0x10
push esi
call fcn.005ee1c0
cmp dword [ebp + 0xc], 0
pop ecx
je 0x49005b
push 0
push dword [ebp + 0xc]
push esi
call fcn.005f0210
push esi
push edi
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.005f2680
push esi
call fcn.005ee1c0
add esp, 0x20
push 0
push 0xc
push esi
call fcn.005f0210
push esi
push edi
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.005f2680
push esi
call fcn.005ee1c0
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x490085
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, 0x95
mov ebx, edx
push edi
push 0x75bbc0
push 1
push 0xc
mov ebp, ecx
call fcn.005f5c60
mov esi, eax
add esp, 0x10
test esi, esi
je 0x49010d
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x9a
mov dword [esi + 4], ebx
push edi
push 0x75bc44
push 1
push ebx
call fcn.005f5c60
add esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x4900f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea esi, [edi + 0x64]
mov edx, 0x75bc64
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x75bc84
push 0x75bca4
jmp 0x490132
push ebx
push ebp
mov edx, ebx
mov ecx, eax
call section..text
and dword [esi + 8], 0
mov eax, esi
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x75bbe0
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x75bc00
push 0x75bc20
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
int3

Function at 0x49016e
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x113
mov edi, ecx
push ebx
push 0x75bcc8
push 1
push 0x38
call fcn.005f5c60
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4901db
push 0x38
push 0
push esi
call fcn.005c3840
add esp, 0xc
mov ecx, str.ILibProcessPipe_Manager
call fcn.004873e9
push 4
pop ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x10], edi
call fcn.0048dec7
mov dword [esi + 0x20], eax
mov edx, esi
mov dword [esi + 8], 0x490145
mov ecx, edi
cmp dword [edi + 4], 0
jne 0x4901d0
call fcn.00488084
jmp 0x4901d5
call fcn.00487e0f
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x75bce8
push esi
push ebx
xor ecx, ecx
call fcn.0048f95e
push ebx
push 0x75bd08
push 0x75bd28
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
int3
Function at 0x4903a7
Capabilities:
Create pipe
Terminate process

Disassembly:
sub esp, 0x114
mov eax, dword [0x6dad44]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x128]
xor ebp, ebp
mov eax, esi
mov ebx, ecx
not eax
push edi
mov edi, ebp
cmp eax, 0x68
jbe 0x490412
cmp esi, 0xffffff97
jae 0x490412
lea eax, [esi + 0x68]
cmp eax, 0xffffffef
jae 0x490412
test esi, esi
je 0x4903ee
lea eax, [esi + 0x78]
cmp eax, 0xffffffef
jae 0x490412
push 0x19d
push 0x75bde8
push 1
push 0x78
pop eax
test esi, esi
lea ecx, [eax + 0x10]
cmovg eax, ecx
add eax, esi
push eax
call fcn.005f5c60
add esp, 0x10
jmp 0x490414
mov eax, ebp
push ebp
push esi
push 0x68
pop edx
mov ecx, eax
call fcn.00487604
mov esi, eax
pop ecx
pop ecx
mov dword [esi + 0x1c], ebx
xor ebx, ebx
mov dword [esi + 0x2c], ebp
inc ebx
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebp
push edi
push esi
push str..pipe_p_u
lea eax, [esp + 0x28]
push 0xff
push eax
call fcn.0040117f
add esp, 0x14
lea eax, [esp + 0x10]
inc edi
push eax
push ebp
mov eax, 0x1000
push eax
push eax
push ebx
push ebp
push 0x40080001
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0x40], eax
cmp eax, 0xffffffff
je 0x490567
cmp eax, 5
je 0x49043d
mov ebx, 0x1ad
push ebx
push 0x75be7c
push 1
push 0x14
call fcn.005f5c60
mov edi, eax
add esp, 0x10
mov dword [esi + 0x48], edi
test edi, edi
je 0x490596
xor eax, eax
stosd dword es:[edi], eax
push ebp
push ebp
push 1
stosd dword es:[edi], eax
push ebp
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esi + 0x48]
mov dword [ecx + 0x10], eax
test eax, eax
jne 0x4904f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
lea edi, [ebx + 2]
push esi
push edi
mov edx, 0x75bf00
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x75bf20
push 0x75bf40
jmp 0x4905be
push ebp
push 0x80
push 3
lea eax, [esp + 0x1c]
push eax
push ebp
push 0x40000000
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x44], eax
cmp eax, 0xffffffff
jne 0x49054c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1b2
push esi
push edi
mov edx, 0x75bf64
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x75bf84
push 0x75bfa4
jmp 0x4905be
mov ecx, dword [esp + 0x120]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005c0e20
add esp, 0x114
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1aa
push esi
push edi
mov edx, 0x75be18
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x75be38
push 0x75be58
jmp 0x4905be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x75be9c
push esi
push ebx
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push ebx
push 0x75bebc
push 0x75bedc
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d08b0
int3