joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7970
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push 0x1020
mov edi, ecx
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4b7a2e
push 0x1020
push 0
push esi
call fcn.00587250
add esp, 0xc
test edi, edi
jne 0x4b79a4
xor eax, eax
jmp 0x4b79b2
push 0x1000
push edi
call fcn.0058d536
add esp, 8
mov edx, eax
mov ecx, edi
call fcn.004b46d0
mov edi, eax
mov dword [esp + 8], 0
push str.rbN
lea eax, [esp + 0xc]
mov dword [esi + 4], edi
push edi
push eax
call fcn.0058c7cb
add esp, 0xc
test eax, eax
je 0x4b79f2
push str.wbN
lea eax, [esp + 0xc]
push edi
push eax
call fcn.0058c7cb
add esp, 0xc
mov eax, dword [esp + 8]
mov dword [esi], eax
test eax, eax
jne 0x4b7a16
push dword [esi + 4]
call fcn.0058c812
add esp, 4
push esi
call fcn.0058c812
add esp, 4
xor eax, eax
pop edi
pop esi
pop ecx
ret
call fcn.004b3890
mov ecx, esi
mov dword [esi + 0x1008], eax
call fcn.004b7450
pop edi
mov eax, esi
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b7b00
Capabilities:
Terminate process

Disassembly:
sub esp, 0x40
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
mov ebx, dword [esp + 0x48]
mov eax, edx
push ebp
push esi
mov ebp, ecx
mov dword [esp + 0x14], eax
push edi
mov edi, dword [esp + 0x58]
mov dword [esp + 0x14], edi
test ebp, ebp
je 0x4b7bc5
cmp ebx, 1
jle 0x4b7b3b
cmp byte [ebx + eax - 1], 0
jne 0x4b7b3b
dec ebx
mov ecx, dword [ebp + 0x1008]
xor edx, edx
push 0
push ebx
push eax
call fcn.004b3bf0
add esp, 0xc
test eax, eax
je 0x4b7b58
mov esi, dword [eax + 0x14]
jmp 0x4b7b5a
xor esi, esi
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.004ad180
test esi, esi
jne 0x4b7ba8
push 0x40
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4b7c57
push 0x40
push 0
push esi
call fcn.00587250
add esp, 0xc
lea edi, [esi + 4]
test edi, edi
jne 0x4b7bda
call fcn.0058c5c1
mov dword [eax], 0x16
call fcn.0058c19e
jmp 0x4b7bea
lea ecx, [esi + 4]
mov edi, 0x2c
lea edx, [esp + 0x1c]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4b7b8f
add ecx, 4
add edx, 4
sub edi, 4
jae 0x4b7bb4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.005852a8
add esp, 0x40
ret
push 0x30
lea eax, [esp + 0x20]
push eax
push edi
call fcn.00586cd0
add esp, 0xc
mov eax, dword [esp + 0x5c]
push edi
mov edi, dword [esp + 0x1c]
mov edx, edi
push eax
push dword [esp + 0x1c]
mov dword [esi], eax
mov ecx, dword [ebp]
push ebx
call fcn.004b71b0
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edx
push dword [ebp]
call fcn.00588b2a
mov ecx, dword [ebp + 0x1008]
add esp, 0x14
cdq
mov dword [ebp + 0x1014], edx
xor edx, edx
mov dword [ebp + 0x1010], eax
push 1
push ebx
push edi
call fcn.004b3bf0
add esp, 0xc
mov ecx, dword [eax + 0x14]
pop edi
mov dword [eax + 0x14], esi
xor eax, eax
test ecx, ecx
mov ecx, dword [esp + 0x48]
pop esi
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.005852a8
add esp, 0x40
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b7ca0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x38
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x44]
push ebp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4b7d70
cmp eax, 1
jle 0x4b7cd1
cmp byte [eax + edx - 1], 0
jne 0x4b7cd1
dec eax
mov ecx, dword [edi + 0x1008]
push 0
push eax
push edx
xor edx, edx
call fcn.004b3bf0
add esp, 0xc
test eax, eax
je 0x4b7d70
mov esi, dword [eax + 0x14]
test esi, esi
je 0x4b7d70
test ebx, ebx
je 0x4b7d5b
mov ebp, dword [esp + 0x54]
cmp ebp, dword [esi]
jl 0x4b7d5b
push 0
push dword [esi + 0x38]
push dword [edi]
call fcn.005890ed
add esp, 0xc
test eax, eax
jne 0x4b7d70
push dword [edi]
push dword [esi]
push 1
push ebx
call fcn.0058d9e0
add esp, 0x10
test eax, eax
je 0x4b7d70
mov edx, dword [esi]
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.004ad180
lea edx, [esi + 4]
mov edi, 0x2c
lea ecx, [esp + 0x14]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4b7d70
add ecx, 4
add edx, 4
sub edi, 4
jae 0x4b7d40
mov eax, dword [esi]
cmp ebp, eax
jle 0x4b7d5b
mov byte [eax + ebx], 0
mov eax, dword [esi]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005852a8
add esp, 0x38
ret
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005852a8
add esp, 0x38
ret
Function at 0x4b7f90
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
test esi, esi
jne 0x4b7faa
lea eax, [ecx + 1]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov ecx, dword [esi + 4]
or edx, 0xffffffff
push 0xffffffffffffffff
push str..tmp
call fcn.004b4600
mov ebx, eax
mov dword [esp + 0x18], edi
push str.wbN
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.0058c7cb
mov ebp, dword [esp + 0x24]
add esp, 0x14
test ebp, ebp
jne 0x4b7ff1
push ebx
call fcn.0058c812
lea eax, [ebp + 1]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov ecx, dword [esi + 0x1008]
lea eax, [esp + 0x14]
xorps xmm0, xmm0
mov dword [esp + 0x24], eax
movq qword [esp + 0x1c], xmm0
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], esi
mov edx, 0x4b3970
mov dword [esp + 0x18], ebp
mov dword [esi + 0x1018], edi
mov dword [esp + 0x1c], ecx
mov ecx, dword [ecx]
push 0
push eax
mov dword [esp + 0x28], 0x4b7e40
call fcn.004b41f0
add esp, 8
cmp dword [esi + 0x1018], edi
jne 0x4b80e1
push dword [esi]
call fcn.00588cf7
add esp, 4
push ebp
call fcn.00588cf7
add esp, 4
push 0
push dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
mov ecx, 1
push ebx
cmove edi, ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, dword [esi + 4]
lea eax, [esp + 0x10]
push str.rbN
push ebp
push eax
mov dword [esp + 0x1c], 0
call fcn.0058c7cb
add esp, 0xc
test eax, eax
je 0x4b80a9
push str.wbN
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.0058c7cb
add esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esi], eax
test eax, eax
je 0x4b80dc
push eax
call fcn.00588b2a
add esp, 4
cdq
mov dword [esi + 0x1010], eax
mov dword [esi + 0x1014], edx
push ebx
call fcn.0058c812
mov eax, edi
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edi, 1
push ebx
call fcn.0058c812
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4b9060
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
mov ecx, dword [eax]
cmp byte [ecx], 0
je 0x4b90ff
mov eax, dword [esi + 4]
cmp dword [eax], 0x30
jae 0x4b90a3
push ecx
call fcn.0058c812
add esp, 4
push 0x30
call fcn.0058db11
mov edi, eax
add esp, 4
test edi, edi
je 0x4b9107
push 0x30
push 0
push edi
call fcn.00587250
mov eax, dword [esi]
mov dword [eax], edi
jmp 0x4b90ad
push 0x30
push 0
push ecx
call fcn.00587250
mov eax, dword [esi]
add esp, 0xc
mov edx, dword [esi + 0x48]
mov ecx, dword [eax]
mov eax, dword [edx + 0xc]
push 0x1000
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [eax + 0x14], 0x1000
call fcn.0058db11
mov edi, eax
add esp, 4
test edi, edi
je 0x4b9107
push 0x1000
push 0
push edi
call fcn.00587250
mov eax, dword [esi]
add esp, 0xc
mov eax, dword [eax]
mov dword [eax + 0xc], edi
mov eax, dword [esi]
mov edx, dword [esi + 0x48]
mov ecx, dword [eax]
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x20], eax
mov eax, dword [esi]
pop edi
pop esi
mov eax, dword [eax]
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4ba870
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0x128
call fcn.0058db11
mov edi, eax
add esp, 4
test edi, edi
je 0x4ba968
push 0x128
push 0
push edi
call fcn.00587250
add esp, 0xc
mov dword [edi + 0x60], 0
lea eax, [esp + 0x10]
xor edx, edx
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [edx + 0x18]
call fcn.004aeee0
mov esi, dword [esp + 0x14]
add esp, 8
mov eax, dword [esp + 0x10]
push 0
push 0x40
push 1
push 0
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0x58
mov dword [esi], eax
mov dword [edi + 0xc8], esi
mov dword [edi + 0x98], 1
mov dword [edi + 0xcc], 0
mov dword [edi + 0x6c], 0xffffffff
call fcn.0058db11
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4ba9a9
push 0x58
push 0
push ebx
call fcn.00587250
mov eax, dword [esp + 0x24]
add esp, 0xc
mov ecx, esi
mov dword [ebx + 0x54], 0x47fa10
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], 0
call fcn.004b3590
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, dword [esi + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4ba950
mov dword [ecx + 8], eax
cmp dword [esi + 0xc], 0
mov dword [esi + 0x10], eax
jne 0x4ba95c
mov dword [esi + 0xc], eax
inc dword [esi + 4]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x98f
mov edx, 0x6264dc
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x98f
push 0x6264fc
push 0x62651c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x997
mov edx, 0x626540
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x997
push 0x626560
push 0x626580
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4ba9f0
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
test ebx, ebx
jne 0x4ba9fb
xor eax, eax
pop ebx
ret
push esi
push 0x54
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4baaed
push 0x54
push 0
push esi
call fcn.00587250
push 0xc
mov dword [esi + 0x30], 1
mov dword [esi + 0x14], str.ILibWebClient
mov dword [esi + 8], 0x4b83d0
mov dword [esi], 0x4ba660
mov dword [esi + 0x1c], 3
call fcn.0058db11
add esp, 0x10
mov dword [esi + 0x18], eax
test eax, eax
je 0x4bab2b
push edi
push 0
push 0x40
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi + 0x3c], eax
mov dword [esi + 0xc], ebx
call fcn.004b02e0
xor ecx, ecx
mov dword [esi + 0x2c], eax
call fcn.004b0430
xor ecx, ecx
mov dword [esi + 0x24], eax
call fcn.004b0430
mov edx, esi
mov dword [esi + 0x28], eax
mov ecx, ebx
call fcn.004af570
mov eax, dword [ebx + 0x2e4]
xor edi, edi
mov dword [esi + 0x34], eax
mov dword [esi + 0x44], 0
nop dword [eax]
push 0
push fcn.004ba170
push 0x4ba410
push 0x4ba1c0
push fcn.004b98e0
mov edx, 0xffff
mov ecx, ebx
call fcn.004aa700
mov ecx, dword [esi + 0x18]
add esp, 0x14
mov dword [edi + ecx], eax
mov eax, dword [esi + 0x18]
mov eax, dword [edi + eax]
test eax, eax
je 0x4baadf
mov dword [eax + 0x1cc], 0x4ba800
add edi, 4
cmp edi, 0xc
jl 0x4baaa0
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x9ad
mov edx, 0x6265a4
xor ecx, ecx
call fcn.004b4f80
push 0x9ad
push 0x6265c4
push 0x6265e4
call fcn.004010e0
add esp, 0x18
push 0xfe
call fcn.005885bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x9b7
mov edx, 0x626618
xor ecx, ecx
call fcn.004b4f80
push 0x9b7
push 0x626638
push 0x626658
call fcn.004010e0
add esp, 0x18
push 0xfe
call fcn.005885bd
int3
Function at 0x4bb8c0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebx, ecx
push edi
mov dword [esp + 0x14], edx
lea ebp, [esi + 1]
push ebp
call fcn.0058db11
mov edi, eax
add esp, 4
test edi, edi
je 0x4bb922
push ebp
push 0
push edi
call fcn.00587250
mov eax, dword [ebx]
add esp, 0xc
mov edx, esi
mov dword [eax + 0x100], edi
mov ecx, dword [ebx]
push esi
push dword [esp + 0x18]
mov ecx, dword [ecx + 0x100]
call fcn.00401000
mov eax, dword [ebx]
add esp, 8
mov eax, dword [eax + 0x100]
pop edi
mov byte [esi + eax], 0
pop esi
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3

Function at 0x4bbad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
push esi
mov esi, ecx
test edx, edx
je 0x4bbafa
nop word [eax + eax]
movsx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5f15a8]
sub edx, 1
jne 0x4bbae0
not eax
pop esi
ret
Function at 0x4bbc30
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push 0x14
mov edi, ecx
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4bbdd5
mov ebx, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
xorps xmm0, xmm0
push 0
push 0x40
push 1
movups xmmword [esi], xmm0
push 0
mov dword [esi + 0x10], 0
call ebx
push 0x80
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x10
mov dword [esi + 8], 0x4bbb50
call fcn.0058db11
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x10], 0
push 0x80
push 0
push eax
call fcn.00587250
add esp, 0xc
mov dword [edi + 0x78], esi
push 0x14
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4bbdd5
push 0
push 0x40
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0
mov dword [esi + 0x10], 0
call ebx
push 0x80
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x10
mov dword [esi + 8], 0x4bbb50
call fcn.0058db11
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x10], 0
push 0x80
push 0
push eax
call fcn.00587250
add esp, 0xc
mov dword [edi + 0x80], esi
push 0x14
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4bbdd5
push 0
push 0x40
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0
mov dword [esi + 0x10], 0
call ebx
push 0x80
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x10
mov dword [esi + 8], 0x4bbb50
call fcn.0058db11
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x10], 0
push 0x80
push 0
push eax
call fcn.00587250
add esp, 0xc
mov dword [edi + 0x7c], esi
push 0x14
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4bbdd5
push 0
push 0x40
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0
mov dword [esi + 0x10], 0
call ebx
push 0x80
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x10
mov dword [esi + 8], 0x4bbb50
call fcn.0058db11
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x10], 0
push 0x80
push 0
push eax
call fcn.00587250
add esp, 0xc
mov dword [edi + 0x84], esi
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3

Function at 0x4bc4d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
mov ebx, ecx
push edi
mov edi, edx
lea eax, [edi - 0xc]
push eax
call esi
push 0x8028
mov word [ebx + 2], ax
lea ebp, [ebx + edi]
call esi
push 4
mov word [ebp], ax
call esi
mov word [ebp + 2], ax
or eax, 0xffffffff
test edi, edi
je 0x4bc51f
movsx ecx, byte [ebx]
lea ebx, [ebx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5f15a8]
sub edi, 1
jne 0x4bc505
xor eax, 0xacabaab1
push eax
call dword [sym.imp.WS2_32.dll_htonl]
pop edi
pop esi
mov dword [ebp + 4], eax
mov eax, 8
pop ebp
pop ebx
ret
Function at 0x4bc640
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov edi, edx
mov eax, dword [ebp + 0x88]
mov dword [esp + 0x20], eax
neg eax
sbb esi, esi
xor ecx, ecx
and esi, 0x1d
mov eax, 2
cmp dword [ebp + 0x70], ecx
mov dword [esp + 0x1c], esi
cmovne eax, ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], eax
call fcn.004ae8f0
mov ecx, dword [ebp + 0x78]
mov ebx, eax
mov eax, 8
cmp ebx, eax
cmovg ebx, eax
xor eax, eax
cmp dword [ecx + 0x200], eax
cmovne ebx, eax
lea eax, [ebx + ebx*2]
lea eax, [eax*2 + 0x52]
mov dword [esp + 0x10], eax
add eax, esi
push eax
call fcn.0058db11
add esp, 4
mov dword [edi], eax
test eax, eax
je 0x4bc7d1
push dword [esp + 0x18]
mov ecx, 1
mov word [eax], cx
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [edi]
mov edx, dword [esp + 0x10]
add edx, 0xfffffffa
push 0x2a
mov dword [ecx + 2], eax
add edx, esi
mov ecx, dword [edi]
lea eax, [ebp + 0x20]
push eax
add ecx, 6
call fcn.00401000
mov eax, dword [ebp + 0x78]
mov ecx, dword [edi]
mov edx, dword [esp + 0x18]
add edx, 0xffffffcf
mov al, byte [eax + 0x1a0]
add edx, esi
mov byte [ecx + 0x30], al
mov eax, dword [ebp + 0x78]
mov ecx, dword [edi]
add ecx, 0x31
push dword [eax + 0x1a0]
push dword [eax + 0x19c]
call fcn.00401000
mov eax, dword [edi]
add esp, 0x10
mov byte [eax + 0x51], bl
test ebx, ebx
jle 0x4bc756
mov esi, dword [esp + 0x14]
xor edx, edx
add esi, 4
nop dword [eax]
mov ecx, dword [edi]
lea esi, [esi + 0x10]
mov eax, dword [esi - 0x10]
lea edx, [edx + 6]
mov dword [edx + ecx + 0x4c], eax
mov eax, dword [ebp + 0x78]
mov ecx, dword [edi]
mov ax, word [eax + 0x32]
mov word [edx + ecx + 0x50], ax
sub ebx, 1
jne 0x4bc730
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4bc767
push eax
call fcn.0058c812
add esp, 4
cmp dword [esp + 0x20], 0
je 0x4bc7c2
mov eax, dword [ebp + 0x78]
mov edx, 0x10
mov ecx, edx
mov ebx, 0x1c
cmp word [eax + 0x1d4], 0x17
mov eax, dword [edi]
cmove ecx, ebx
mov ebx, dword [esp + 0x10]
mov byte [ebx + eax], cl
mov ecx, 0x1c
mov eax, dword [ebp + 0x78]
add eax, 0x1d4
cmp word [eax], 0x17
cmove edx, ecx
mov ecx, dword [edi]
push edx
inc ecx
lea edx, [esi - 1]
push eax
add ecx, ebx
call fcn.00401000
add esp, 8
lea eax, [esi + ebx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ebx, dword [esp + 0x10]
pop edi
lea eax, [esi + ebx]
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x5cd
mov edx, 0x626f28
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x5cd
push 0x626f44
push 0x626f60
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4bcc20
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, ecx
mov ebx, edx
push esi
push edi
push 0xffffffffffffffff
mov eax, dword [ebp + 0x24]
xor edi, edi
mov dword [esp + 0x18], ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [ebp + 0x24]
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x104], 5
mov esi, dword [esi + 0x10]
test esi, esi
je 0x4bccc4
mov ebx, dword [esi]
push 8
call fcn.0058db11
add esp, 4
test eax, eax
je 0x4bcd13
mov dword [eax + 4], edi
mov edi, eax
mov dword [eax], ebx
test esi, esi
je 0x4bccba
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 4]
test edx, edx
je 0x4bcc84
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov edx, dword [esi + 8]
test edx, edx
je 0x4bcc91
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
cmp dword [ecx + 0xc], esi
jne 0x4bcc9c
mov eax, dword [esi + 8]
mov dword [ecx + 0xc], eax
cmp dword [ecx + 0x10], esi
jne 0x4bccae
mov eax, dword [esi + 8]
test eax, eax
jne 0x4bccab
mov eax, dword [esi + 0xc]
mov dword [ecx + 0x10], eax
dec dword [ecx + 4]
push esi
call fcn.0058c812
add esp, 4
mov esi, dword [ebp + 0x24]
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x4bcc55
mov eax, dword [ebp + 0x24]
push 0
push 1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test edi, edi
je 0x4bcd0b
mov ebx, dword [esp + 0x1c]
nop dword [eax + eax]
xor esi, esi
test edi, edi
je 0x4bccf4
mov esi, dword [edi]
push edi
mov edi, dword [edi + 4]
call fcn.0058c812
add esp, 4
mov eax, dword [ebp + 0x2c]
test eax, eax
je 0x4bcd07
push esi
push ebx
push dword [esp + 0x1c]
push ebp
call eax
add esp, 0x10
test edi, edi
jne 0x4bcce0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0xf47
mov edx, 0x6245fc
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0xf47
push 0x624618
push 0x624634
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4bde30
Capabilities:
Terminate process

Disassembly:
sub esp, 0x68
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x78]
mov ebp, edx
push edi
mov edi, ecx
lea edx, [esp + 0x1c]
mov ecx, dword [esp + 0x84]
push esi
call fcn.004c56c0
mov ecx, dword [edi + 8]
add esp, 4
add ecx, 0xa
mov dword [esp + 0x14], eax
push ecx
call fcn.0058db11
mov ebx, eax
add esp, 4
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x4bdfc8
mov edx, dword [edi + 8]
mov ecx, ebx
push edx
push dword [edi]
add edx, 0xa
call fcn.00401000
mov ecx, dword [edi + 8]
mov edx, 0xa
push 1
push 0x626fe0
add ecx, ebx
call fcn.00401000
mov ecx, dword [edi + 8]
lea eax, [edi + 0x21]
inc ecx
mov edx, 9
push 8
push eax
add ecx, ebx
call fcn.00401000
mov eax, dword [edi + 8]
mov edx, 1
push esi
mov ecx, ebp
mov byte [ebx + eax + 9], 0
call fcn.004c5470
mov ecx, dword [edi + 8]
add esp, 0x1c
add ecx, 9
mov esi, eax
mov edx, esi
push ecx
push ebx
push 6
mov ecx, ebp
call fcn.004c54e0
mov ebx, dword [sym.imp.WS2_32.dll_htons]
add esp, 0xc
add esi, eax
cmp dword [esp + 0x80], 0
je 0x4bdf11
push 0x25
call ebx
push 0
mov word [esi + ebp], ax
call ebx
mov word [esi + ebp + 2], ax
add esi, 4
cmp dword [edi + 0x6c], 0
jne 0x4bdf1e
push 0x802a
jmp 0x4bdf23
push 0x8029
call ebx
push 8
mov word [esi + ebp], ax
call ebx
mov word [esi + ebp + 2], ax
lea ecx, [ebp + 4]
lea eax, [edi + 0x4b]
mov edx, 8
push 8
push eax
add ecx, esi
call fcn.00401000
add esp, 8
lea eax, [esp + 0x1c]
add esi, 0xc
mov ecx, ebp
mov edx, esi
push dword [esp + 0x14]
push eax
push 0x20
call fcn.004c54e0
add esp, 0xc
mov ecx, ebp
lea ebx, [esi + eax]
push dword [edi + 0xc]
mov edx, ebx
push dword [edi + 4]
call fcn.004bc450
add ebx, eax
mov ecx, ebp
mov edx, ebx
call fcn.004bc4d0
push dword [esp + 0x20]
add ebx, eax
call fcn.0058c812
add esp, 0xc
lea ecx, [esp + 0x30]
mov edx, 0x40
push dword [edi + 0xc]
push dword [edi + 4]
call fcn.00401000
mov eax, dword [edi + 0xc]
add esp, 8
cmp eax, 0x40
jae 0x4be009
mov ecx, dword [esp + 0x74]
pop edi
pop esi
mov byte [esp + eax + 0x28], 0
mov eax, ebx
pop ebp
pop ebx
xor ecx, esp
call fcn.005852a8
add esp, 0x68
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x9a1
mov edx, 0x626f84
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x9a1
push 0x626fa0
push 0x626fbc
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
call fcn.005853dc
int3