joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cad85
Capabilities:
Set console window title

Disassembly:
push 0xc
push 0x5c0f40
call fcn.00518194
xor edi, edi
mov dword [ebp - 0x1c], edi
mov esi, str.IsTmsTermSetup.flg
push esi
push edi
call fcn.0048a119
pop ecx
pop ecx
lea edx, [ebp - 0x1c]
mov ecx, eax
call fcn.0042c27f
test eax, eax
je 0x4caed1
cmp dword [ebp - 0x1c], edi
jle 0x4caed1
mov dword [ebp - 4], edi
push edi
push esi
push edi
call fcn.0048a119
pop ecx
pop ecx
mov ecx, eax
call fcn.0042c38a
pop ecx
push esi
push edi
call fcn.0048a119
pop ecx
pop ecx
call fcn.0042a76b
mov dword [ebp - 4], 0xfffffffe
jmp 0x4cae06
call fcn.004f16be
mov esi, eax
jmp 0x4cae1d
call fcn.004f16be
sub eax, esi
cmp eax, 0x2710
ja 0x4cae28
call fcn.00466228
test eax, eax
je 0x4cae0f
jmp 0x4cae33
push str.:7:ContinueCreateNetworkTAMSAfterReboot___EAP:_The_network_is_not_responding___
call fcn.004265da
pop ecx
push edi
mov ecx, fcn.004583a7
call fcn.0040fe48
mov dword [esp], str.Continuing_Terminal_Setup...
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push edi
call fcn.004137dd
mov dword [esp], str._nCompleting_Terminal_Setup...
call fcn.004147da
mov dword [esp], str._nPlease_wait_a_moment__________________
call fcn.004147da
pop ecx
push 0x10
pop esi
push edi
push edi
call fcn.00434564
pop ecx
pop ecx
dec esi
jne 0x4cae6d
push 0xf
pop esi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x5320c4
call fcn.004147da
pop ecx
dec esi
jne 0x4cae7c
push edi
call fcn.004137dd
mov dword [esp], str._nOne_moment...
call fcn.004147da
mov dword [esp], str.PaulaConfig.cfg
push dword [ebp + 8]
call fcn.00458e57
push dword [ebp - 0x1c]
call fcn.004c95ce
add esp, 0xc
push str.:0:ContinueCreateNetworkTAMSAfterReboot___has_completed_the_setup_procedure.
call fcn.00426c01
pop ecx
xor eax, eax
inc eax
jmp 0x4caed3
xor eax, eax
call fcn.005181d9
ret
Function at 0x4caed9
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 7
pop ecx
xor ebx, ebx
xor eax, eax
mov esi, 0x103
lea edi, [ebp - 0x448]
push esi
mov dword [ebp - 0x44c], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.005117f0
add esp, 0xc
push esi
lea eax, [ebp - 0x31f]
push ebx
push eax
mov byte [ebp - 0x320], bl
call fcn.005117f0
add esp, 0xc
push esi
lea eax, [ebp - 0x427]
push ebx
push eax
mov byte [ebp - 0x428], bl
call fcn.005117f0
add esp, 0xc
push esi
lea eax, [ebp - 0x217]
push ebx
push eax
mov byte [ebp - 0x218], bl
call fcn.005117f0
add esp, 0xc
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x320]
push eax
lea ecx, [ebp - 0x110]
call fcn.0046255a
push 0x20
xor esi, esi
lea eax, [ebp - 0x44c]
push ebx
inc esi
push eax
mov dword [ebp - 0x42c], esi
call fcn.005117f0
lea eax, [ebp - 0x218]
add esp, 0x14
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x110]
push eax
push str._s_tamspos
lea eax, [ebp - 0x218]
push 0x104
push eax
mov dword [ebp - 0x448], esi
mov dword [ebp - 0x43c], 0x5705b0
mov dword [ebp - 0x430], ebx
call fcn.004c53b7
add esp, 0x10
mov esi, 0x81
push esi
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x44c]
push eax
call sub.MPR.dll_WNetAddConnection2A
test eax, eax
je 0x4cb037
mov edi, str._GetLastError_
push edi
push str.:2:ConnectMappedDriveTAMS__:_WNetAddConnection2A___failed_to_create_mapped_driver_with_login:__s
call fcn.00426c01
pop ecx
pop ecx
push esi
push ebx
push ebx
lea eax, [ebp - 0x44c]
push eax
call sub.MPR.dll_WNetAddConnection2A
test eax, eax
je 0x4cb037
push edi
push str.:5:ConnectMappedDriveTAMS__:_WNetAddConnection2A___COMPLETELY_FAILED:__s
call fcn.004265da
pop ecx
pop ecx
mov dword [ebp - 0x42c], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x42c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
Function at 0x4cb47f
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.005117f0
add esp, 0xc
push str.Connecting_to_server...
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push str._n_nConnecting_to_TAMS...
call fcn.004147da
pop ecx
call fcn.004caed9
mov esi, 0x599584
push esi
call fcn.004147da
pop ecx
push ebx
push ebx
lea ecx, [ebp - 0x110]
call fcn.0046255a
push str._nWaiting_for_network...
call fcn.004147da
add esp, 0xc
call fcn.004f16be
mov edi, str.T:Start.bat
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], ebx
call fcn.0042ad00
test eax, eax
jne 0x4cb5bf
cmp dword [ebp - 0x114], 0xa
jge 0x4cb561
push 0x5320c4
call fcn.004147da
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004f16be
sub eax, dword [ebp - 0x118]
cmp eax, 0x2710
jbe 0x4cb552
mov dword [ebp - 0x114], 0xde
inc dword [ebp - 0x114]
call fcn.0042ad00
test eax, eax
je 0x4cb516
cmp dword [ebp - 0x114], ebx
jle 0x4cb5bf
call fcn.0042ad00
test eax, eax
jne 0x4cb5bf
push str..FAILED_
call fcn.004147da
pop ecx
lea eax, [ebp - 0x110]
push eax
push str.:2:StartTamsConnectionSession___FAILED_to_connect_to__s.
call fcn.004265da
lea eax, [ebp - 0x110]
push eax
push str.Could_not_connect_to_the_TAMS_server_at__s._n_nWould_you_like_to_try_again___Y_N__n_nYes___No
push str.__Could_Not_Connect___
push ebx
push ebx
call fcn.00435aa1
add esp, 0x1c
test eax, eax
je 0x4cb5bb
push dword [ebp + 8]
call fcn.004cb47f
pop ecx
jmp 0x4cb658
xor edi, edi
jmp 0x4cb5c9
xor edi, edi
push esi
inc edi
call fcn.004147da
pop ecx
push str._n_nConnecting_to_printer...
call fcn.004147da
pop ecx
call fcn.004cb04c
test eax, eax
jne 0x4cb604
push str..FAILED_
call fcn.004147da
pop ecx
call fcn.004c94b3
test eax, eax
je 0x4cb60f
push str._nThe_printer_cannot_be_setup_because_you_are_a_LIMITED_USER.
call fcn.004147da
mov dword [esp], str._nPlease_login_to_Windows_as_Administrator_and_run_the_terminal_setup_again.
jmp 0x4cb609
push str..OK.
call fcn.004147da
pop ecx
cmp dword [ebp + 8], ebx
jne 0x4cb656
cmp edi, ebx
jne 0x4cb635
push str._n_nA_problem_occurred_during_the_connection_process.
call fcn.004147da
mov dword [esp], str._nPress_any_key_to_exit...
call fcn.004147da
mov eax, 0x3a98
jmp 0x4cb650
push str._n_nThe_connection_process_is_complete.
call fcn.004147da
mov dword [esp], str._nPress_any_key_to_exit...
call fcn.004147da
mov eax, 0x2710
pop ecx
call fcn.004352d3
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
Function at 0x4cb667
Capabilities:
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.005117f0
add esp, 0xc
push ebx
push ebx
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x11c], ebx
call fcn.0046255a
push 1
call fcn.004cb47f
add esp, 0xc
push str._n_nSetting_environment...
mov dword [ebp - 0x120], eax
call fcn.004147da
pop ecx
xor ecx, ecx
xor edx, edx
call fcn.00466631
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push eax
push 0x599784
call edi
lea eax, [ebp - 0x110]
push eax
push str.SRET
call edi
lea eax, [ebp - 0x110]
push eax
push str.serverip
call edi
push str.WinXPSp2_DisableThemes_DisableDWM
push str.__COMPAT_LAYER
call edi
push 0x5997d0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4cb73a
push str._GetLastError_
push str.:2:StartTamsGraphicalSession___FAILED:_SetCurrentDirectory__T:___FAILED:__s
call fcn.004265da
push str..FAILED_
call fcn.004147da
add esp, 0xc
jmp 0x4cb745
push str..OK.
call fcn.004147da
pop ecx
push str._n_nStarting_application...
call fcn.004147da
pop ecx
mov ebx, str.START__TAMS_Graphical_Session___MIN_cmd.exe__C__T:_start.bat_
call fcn.0041544b
lea ebx, [ebp - 0x11c]
lea esi, [ebp - 0x118]
call fcn.004128bf
and dword [ebp - 0x114], 0
mov esi, 0x4c6
mov ebx, 0x3e8
push dword [ebp - 0x114]
push str._d_10
call fcn.004147da
push esi
mov eax, ebx
call fcn.004603fd
add esp, 0xc
test eax, eax
jl 0x4cb7d4
push esi
mov eax, ebx
call fcn.004603fd
cmp eax, 0x7fffffff
pop ecx
jge 0x4cb7d4
push esi
mov eax, ebx
call fcn.004603fd
test eax, eax
pop ecx
jl 0x4cb7d4
push esi
mov eax, ebx
call fcn.004603fd
cmp eax, 0x7fffffff
pop ecx
jge 0x4cb7d4
push esi
mov eax, ebx
call fcn.004603fd
pop ecx
push eax
jmp 0x4cb7d6
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x11c]
push dword [ebp - 0x118]
call fcn.004127f9
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 0xa
pop ecx
pop ecx
jle 0x4cb77c
push 0x5304ba
push str.__COMPAT_LAYER
call edi
push str..Done.
call fcn.004147da
mov eax, dword [ebp - 0x120]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
Function at 0x4cb82e
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.005117f0
add esp, 0xc
push str.Starting_telnet_session...
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push ebx
push ebx
lea ecx, [ebp - 0x110]
call fcn.0046255a
push str._n_nConnecting_to_TAMS...
call fcn.004147da
add esp, 0xc
lea ecx, [ebp - 0x110]
call fcn.004ccd6f
cmp eax, ebx
jne 0x4cb8d5
push str..FAILED_
call fcn.004147da
pop ecx
lea eax, [ebp - 0x110]
push eax
push str.:5:StartTamsTelnetSession___FAILED_to_connect_to__s.
call fcn.004265da
lea eax, [ebp - 0x110]
push eax
push str.Could_not_connect_to_the_TAMS_server_at__s._n_nWould_you_like_to_try_again___Y_N__n_nYes___No
push str.__Could_Not_Connect___
push ebx
push ebx
call fcn.00435aa1
add esp, 0x1c
test eax, eax
je 0x4cb8e5
call fcn.004cb82e
jmp 0x4cb8ed
call fcn.004cd2f9
push str..OK.
call fcn.004147da
pop ecx
push 1
call fcn.004120a4
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret

Function at 0x4cbc3a
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push edi
je 0x4cbd19
cmp dword [ebp + 0xc], 0
jle 0x4cbd19
push str..TelNet.c
mov edi, 0x288
push edi
push 1
push esi
call fcn.004cd71a
add esp, 0x10
test eax, eax
je 0x4cbd19
push edi
mov eax, esi
call fcn.004d14fc
test eax, eax
pop ecx
je 0x4cbd19
inc dword [esi + 0xd28]
cmp dword [esi + 0xd30], 0
jne 0x4cbcd5
push 4
lea eax, [ebp - 4]
push eax
push 0x1005
push 0xffff
push dword [esi + 0xacc]
mov dword [ebp - 4], 0x1388
call sub.WSOCK32.dll_setsockopt
test eax, eax
je 0x4cbccb
call sub.WSOCK32.dll_WSAGetLastError
push eax
push esi
push str.:4:TelNetSendBinary__s__EAP:_Failed_to_set_the_send_time_out:_WSAGetLastError___d
call fcn.004265da
add esp, 0xc
mov dword [esi + 0xd30], 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0xacc]
call sub.WSOCK32.dll_send
mov edi, eax
test edi, edi
jg 0x4cbd08
cmp dword [ebp + 0xc], 0x19
jle 0x4cbd08
call sub.WSOCK32.dll_WSAGetLastError
push eax
push esi
push str.:5:TelNetSendBinary__s__FAILED:_send___FAILED:_WSAGetLastError___d
call fcn.004265da
add esp, 0xc
dec dword [esi + 0xd28]
mov eax, esi
call fcn.004d1540
mov eax, edi
jmp 0x4cbd1b
xor eax, eax
pop edi
leave
ret
Function at 0x4cbd1e
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, 0x200
lea esi, [ebx - 1]
push esi
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20b]
push 0
push eax
mov byte [ebp - 0x20c], 0
call fcn.005117f0
mov eax, dword [ebp + 0x10]
add esp, 0xc
test eax, eax
je 0x4cbe66
cmp byte [eax], 0
je 0x4cbe66
lea ecx, [ebp + 0x14]
push ecx
push eax
lea edi, [ebp - 0x20c]
push esi
mov eax, edi
push eax
jmp 0x4cbdb9
lea eax, [ebp - 0x20c]
cmp edi, eax
je 0x4cbd94
push edi
call fcn.00511758
pop ecx
add ebx, ebx
lea eax, [ebx + 0xa]
push eax
push 1
call fcn.00511988
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x4cbe66
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebx - 1]
push eax
push edi
call fcn.005140d9
add esp, 0x10
cmp eax, 0xffffffff
je 0x4cbd83
mov eax, edi
call fcn.004cf154
push edi
call fcn.005120b0
cmp dword [ebp + 0xc], 0
pop ecx
mov dword [ebp - 0x210], eax
jbe 0x4cbdf6
cmp dword [ebp + 0xc], 0x7ffffffe
ja 0x4cbdee
push dword [ebp + 0xc]
jmp 0x4cbdf0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x214]
push str..TelNet.c
mov ebx, 0x2ca
push ebx
push 1
push esi
call fcn.004cd71a
add esp, 0x10
test eax, eax
je 0x4cbe55
push ebx
mov eax, esi
call fcn.004d14fc
test eax, eax
pop ecx
je 0x4cbe55
push 0
push dword [ebp - 0x210]
push edi
push dword [esi + 0xacc]
call sub.WSOCK32.dll_send
mov ebx, eax
mov eax, esi
call fcn.004d1540
lea eax, [ebp - 0x20c]
cmp edi, eax
je 0x4cbe51
push edi
call fcn.00511758
pop ecx
mov eax, ebx
jmp 0x4cbe68
lea eax, [ebp - 0x20c]
cmp edi, eax
je 0x4cbe66
push edi
call fcn.00511758
pop ecx
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
Function at 0x4cc4d3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push edi
xor ebx, ebx
push 0x3e
lea eax, [ebp - 0x54]
push ebx
push eax
mov dword [ebp - 0x58], ebx
call fcn.005117f0
mov edx, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 8], ebx
call fcn.004c3b34
test eax, eax
jne 0x4cc698
mov ecx, dword [ebp + 8]
push 0x3df
mov edi, str..TelNet.c
push edi
mov edx, 0x530484
call fcn.0042d2c6
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 4], eax
jne 0x4cc537
push dword [ebp + 8]
push str.TelNetSavePrinterConfig___FAILED:_Could_not_open_the_given_file___s__for_writing.
call fcn.00426c01
pop ecx
pop ecx
jmp 0x4cc698
push edi
mov edi, 0x3e5
push edi
push 1
push esi
call fcn.004cd71a
add esp, 0x10
test eax, eax
je 0x4cc690
push edi
mov eax, esi
call fcn.004d14fc
test eax, eax
pop ecx
je 0x4cc690
push 0x42
lea eax, [esi + 0xce4]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00512a90
push dword [ebp - 4]
lea eax, [ebp - 0x58]
push 0x42
push 1
push eax
call fcn.005110f1
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
add esp, 0x1c
cmp dword [ebp - 0x50], ebx
je 0x4cc606
push dword [esi + 0xcec]
call edi
cmp eax, ebx
push dword [esi + 0xcec]
mov dword [ebp - 0xc], eax
je 0x4cc5f7
call dword [sym.imp.KERNEL32.dll_GlobalSize]
cmp eax, ebx
mov dword [ebp - 8], eax
jle 0x4cc5d9
push dword [ebp - 4]
lea eax, [ebp - 8]
push 4
push 1
push eax
call fcn.005110f1
push dword [ebp - 4]
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
call fcn.005110f1
add esp, 0x20
jmp 0x4cc5e9
push eax
push str.TelNetSavePrinterConfig___encountered_a_problem:_GlobalSize___returned__ld_for_hDevMode:__GetLastError_
call fcn.00426c01
pop ecx
pop ecx
mov dword [ebp - 0x50], ebx
push dword [esi + 0xcec]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x4cc606
push str.TelNetSavePrinterConfig___encountered_a_problem:_Could_not_GlobalLock___hDevMode_during_save___ld_:__GetLastError_
call fcn.00426c01
pop ecx
pop ecx
mov dword [ebp - 0x50], ebx
cmp dword [ebp - 0x4c], ebx
je 0x4cc67c
push dword [esi + 0xcf0]
call edi
push dword [esi + 0xcf0]
mov edi, eax
cmp edi, ebx
je 0x4cc66d
call dword [sym.imp.KERNEL32.dll_GlobalSize]
cmp eax, ebx
mov dword [ebp - 8], eax
jle 0x4cc64f
push dword [ebp - 4]
lea eax, [ebp - 8]
push 4
push 1
push eax
call fcn.005110f1
push dword [ebp - 4]
push dword [ebp - 8]
push 1
push edi
call fcn.005110f1
add esp, 0x20
jmp 0x4cc65f
push eax
push str.TelNetSavePrinterConfig___encountered_a_problem:_GlobalSize___returned__ld_for_hDevNames:__GetLastError_
call fcn.00426c01
pop ecx
pop ecx
mov dword [ebp - 0x4c], ebx
push dword [esi + 0xcf0]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x4cc67c
push str.TelNetSavePrinterConfig___encountered_a_problem:_Could_not_GlobalLock___hDevNames_during_save___ld_:__GetLastError_
call fcn.00426c01
pop ecx
pop ecx
mov dword [ebp - 0x4c], ebx
mov eax, esi
call fcn.004d1540
mov ecx, dword [ebp - 4]
call fcn.0042d70e
xor eax, eax
inc eax
jmp 0x4cc69a
mov ecx, dword [ebp - 4]
call fcn.0042d70e
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x4cd7fb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push ebx
push esi
mov ebx, str..TelNet.c
push ebx
push 0x862
push 1
push edi
call fcn.004cd71a
add esp, 0x10
test eax, eax
je 0x4cd9cf
mov eax, dword [ebp + 8]
test eax, eax
je 0x4cd9cf
cmp byte [eax], 0
je 0x4cd9cf
mov eax, dword [edi + 0xa8c]
push 1
push 0x2c
mov dword [esp + 0x14], eax
call fcn.00511988
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x4cd861
push str.TelNetCreateSearchString___FAILED:_Could_not_create_search_string_handle:__OUT_OF_MEMORY__
call fcn.004265da
jmp 0x4cd9ce
push 0x2c
push 0
push esi
call fcn.005117f0
add esp, 0xc
push 2
push dword [ebp + 8]
call fcn.005120b0
pop ecx
add eax, 0xa
push eax
call fcn.00511988
test eax, eax
pop ecx
pop ecx
mov dword [esi + 4], eax
jne 0x4cd8ae
push dword [ebp + 8]
call fcn.005120b0
add eax, eax
push eax
push str.TelNetCreateSearchString___FAILED:_Could_not_allocate_memory_for_search_string_of_length__ld_
call fcn.004265da
push esi
call fcn.00511758
add esp, 0x10
jmp 0x4cd9cf
push ebx
mov ebx, 0x881
push ebx
push 1
push edi
call fcn.004cd71a
add esp, 0x10
test eax, eax
je 0x4cd9c8
push ebx
mov eax, edi
call fcn.004d14fc
test eax, eax
pop ecx
je 0x4cd9c8
mov ecx, dword [edi + 0xa88]
mov eax, dword [esp + 0xc]
xor edx, edx
div ecx
mov eax, dword [edi + 0xa84]
test edx, edx
jne 0x4cd8f7
mov ebx, dword [eax + ecx*4 - 4]
jmp 0x4cd8fb
mov ebx, dword [eax + edx*4 - 4]
cmp dword [ebp + 0x10], 0
jne 0x4cd904
inc ebx
jmp 0x4cd915
call fcn.004f16be
cmp ebx, eax
jbe 0x4cd912
sub ebx, eax
add dword [ebp + 0x10], ebx
mov ebx, dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esi + 4]
call fcn.005123e0
mov eax, dword [esi + 4]
pop ecx
pop ecx
call fcn.004cf154
push dword [ebp + 8]
push dword [esi + 4]
call fcn.005120b0
pop ecx
mov ecx, dword [esi + 4]
lea eax, [eax + ecx + 1]
push eax
call fcn.005123e0
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
mov dword [esi], edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], eax
jmp 0x4cd960
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0xaa8], 0
jne 0x4cd958
mov dword [edi + 0xaa8], 1
xor ebx, ebx
lea eax, [edi + 0xad0]
jmp 0x4cd980
inc ebx
mov eax, ecx
mov ecx, dword [eax + 0x28]
test ecx, ecx
jne 0x4cd97d
mov dword [eax + 0x28], esi
mov eax, dword [0x6db874]
test eax, eax
jne 0x4cd99d
call fcn.004a8f27
mov dword [0x6db874], eax
push esi
call fcn.004a9020
and dword [edi + 0xaa8], 0
pop ecx
mov eax, edi
call fcn.004d1540
cmp ebx, 0x34
jle 0x4cd9c4
push ebx
push str.:4:TelNetCreateSearchString___Potential_Memory_Leak:_There_are_too_many_search_strings_for_a_single_TelNet_handle:__d
call fcn.00426c01
pop ecx
pop ecx
mov eax, esi
jmp 0x4cd9d1
push esi
call fcn.00511758
pop ecx
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ce1b7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
test esi, esi
push edi
je 0x4ce253
push 1
push 0x20
call fcn.00511988
pop ecx
mov edi, eax
test edi, edi
pop ecx
push 0x20
jne 0x4ce1e7
push str.TelNetStartConditionRoutine___FAILED:_Could_not_create_new_condition_node_of_size__ld:_OUT_OF_MEMORY_
call fcn.004265da
pop ecx
jmp 0x4ce252
push 0
push edi
call fcn.005117f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add esp, 0xc
mov dword [edi + 0x10], esi
mov esi, str..TelNet.c
push esi
mov ebx, 0xb2e
push ebx
push 1
push eax
mov dword [edi + 4], eax
mov dword [edi + 0x14], ecx
call fcn.004cd71a
add esp, 0x10
test eax, eax
je 0x4ce24c
mov eax, dword [ebp + 8]
push ebx
call fcn.004d14fc
test eax, eax
pop ecx
je 0x4ce24c
cmp dword [0x6db87c], 0
jne 0x4ce25a
call fcn.004a8f27
test eax, eax
mov dword [0x6db87c], eax
jne 0x4ce25a
push str.TelNetStartConditionRoutine___FAILED_because_CreatePtrList___FAILED_
call fcn.004265da
pop ecx
push edi
call fcn.00511758
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0xb3e
push esi
push edi
push 0x4cf510
push 0x3f70
mov ecx, str.TelNetCreateConditionID
call fcn.0042da43
mov ebx, eax
test ebx, ebx
jne 0x4ce2b6
push 0xb43
push esi
push edi
push 0x4cf510
push eax
mov ecx, str.TelNetCreateConditionID
call fcn.0042da43
mov ebx, eax
test ebx, ebx
jne 0x4ce2b6
mov esi, dword [ebp + 8]
call fcn.004cf531
push eax
push str.TelNetStartConditionRoutine___FAILED:_Could_not_start_the_given_TelNet_Condition_Routine:__GetLastError_:_Currently__ld_condition_routines_are_active.
call fcn.004265da
pop ecx
pop ecx
mov eax, esi
call fcn.004d1540
jmp 0x4ce253
push dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
call fcn.004c44d3
mov esi, dword [ebp + 8]
push eax
push dword [ebp + 0x10]
push edi
push esi
push str.Called_for__p_HTELNET___p_Condition__from__s___in___s__line_d.
push ebx
call fcn.0042dde6
add esp, 0x1c
mov dword [edi + 8], ebx
mov dword [edi], ebx
lea eax, [esi + 0xaac]
jmp 0x4ce2e7
mov eax, ecx
mov ecx, dword [eax + 0x1c]
test ecx, ecx
jne 0x4ce2e5
lea ebx, [esi + 0xac4]
mov dword [eax + 0x1c], edi
inc dword [ebx]
cmp dword [ebx], 0xc
jle 0x4ce320
call fcn.004f16be
sub eax, dword [0x6db9a4]
cmp eax, 0xea60
jbe 0x4ce320
push dword [ebx]
push esi
push str.:8:FYI:_The_number_of_condition_routines_for_a_single_TelNet_session___p__has_reached__d_
call fcn.00426c01
add esp, 0xc
mov eax, dword [0x6db87c]
push edi
call fcn.004a9020
pop ecx
mov eax, esi
call fcn.004d1540
mov eax, edi
jmp 0x4ce255
Function at 0x4ced90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
push esi
mov ebx, eax
jge 0x4ceda1
and dword [ebp + 8], 0
test ebx, ebx
jge 0x4ceda7
xor ebx, ebx
cmp dword [ebp + 8], ebx
jg 0x4cee0a
push str..TelNet.c
mov esi, 0xe15
push esi
push 1
push edi
call fcn.004cd71a
add esp, 0x10
test eax, eax
je 0x4cee0a
push esi
mov eax, edi
call fcn.004d14fc
test eax, eax
pop ecx
je 0x4cee0a
mov eax, dword [edi + 0xf4]
cmp dword [ebp + 8], eax
jle 0x4cede1
mov dword [ebp + 8], eax
cmp ebx, eax
jle 0x4cede7
mov ebx, eax
push 1
push 0x10
call fcn.00511988
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x4cee10
mov eax, edi
call fcn.004d1540
push str.TelNetCreateVirtualFile___FAILED:_Could_not_create_virtual_file_handle:__OUT_OF_MEMORY__
call fcn.004265da
pop ecx
xor eax, eax
pop esi
pop ebx
pop ebp
ret
push 0x10
push 0
push esi
call fcn.005117f0
lea eax, [edi + 0xdc]
mov dword [esi], edi
mov cx, word [eax]
imul cx, word [ebp + 8]
add esp, 0xc
inc ebx
mov word [esi + 4], cx
imul bx, word [eax]
mov ax, cx
dec bx
and word [esi + 8], 0
mov word [esi + 0xa], ax
mov word [esi + 6], bx
lea eax, [edi + 0xafc]
jmp 0x4cee52
mov eax, ecx
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x4cee50
mov dword [eax + 0xc], esi
mov eax, dword [0x6db878]
test eax, eax
jne 0x4cee6f
call fcn.004a8f27
mov dword [0x6db878], eax
push esi
call fcn.004a9020
pop ecx
mov eax, edi
call fcn.004d1540
mov eax, esi
jmp 0x4cee0c
Function at 0x4d140e
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x20]
mov eax, dword [ebp + 8]
call fcn.004d14c4
test eax, eax
pop ecx
jne 0x4d1426
push 2
pop eax
pop ebp
ret
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.004d14e6
mov eax, esi
pop esi
pop ebp
ret