joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4be3d0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x34
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x44]
push esi
push edi
push pe_nt_image_headers32
mov dword [esp + 0x14], edx
mov edi, ecx
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4be546
push pe_nt_image_headers32
push 0
push esi
call fcn.00587250
add esp, 0xc
lea eax, [esi + 0x4b]
push 8
push eax
call fcn.004e3140
mov eax, dword [edi + 0x204]
mov dword [esi + 0x88], eax
mov dword [esi + 0x78], edi
call fcn.004b48f0
push 0xe0
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], edx
call fcn.0058db11
add esp, 0xc
mov dword [esi + 0x14], eax
test eax, eax
je 0x4be587
push 0xe0
push 0
push eax
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 1
call fcn.00587250
add esp, 0xc
mov edx, esi
mov ecx, edi
push 0
push 0
call fcn.004bbfb0
add esp, 8
test eax, eax
jns 0x4be4b5
push dword [esi + 0x14]
call fcn.0058c812
add esp, 4
push esi
call fcn.0058c812
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005852a8
add esp, 0x34
ret
lea ecx, [esp + 0x14]
push ecx
lea edx, [edi + 0x108]
mov ecx, eax
call fcn.004bc370
add esp, 4
lea eax, [esp + 0x14]
lea ecx, [esi + 0x20]
mov edx, 0x2b
push 0x2b
push eax
call fcn.00401000
movsx eax, byte [esp + 0x1c]
mov edx, 9
push eax
lea eax, [esp + 0x21]
mov ecx, ebx
push eax
call fcn.00401000
movsx ecx, byte [esp + 0x24]
mov edx, 0x21
movsx eax, byte [esp + ecx + 0x25]
push eax
lea eax, [esp + 0x2a]
add eax, ecx
mov ecx, ebp
push eax
call fcn.00401000
movsx eax, byte [esp + 0x2c]
add esp, 0x18
mov edx, dword [esp + 0x10]
mov ecx, esi
mov byte [eax + ebx], 0
movsx eax, byte [esp + eax + 0x15]
mov byte [eax + ebp], 0
call fcn.004bc640
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005852a8
add esp, 0x34
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0xa26
mov edx, 0x627040
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0xa26
push 0x62705c
push 0x627078
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0xa2c
mov edx, 0x62709c
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0xa2c
push 0x6270b8
push 0x6270d4
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4be910
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
mov ebp, edx
push esi
push edi
mov dword [esp + 0x10], ebp
mov esi, dword [ecx + ebp*4 + 0x148]
mov ecx, dword [esi + 0x64]
test ecx, ecx
jle 0x4be9d4
cmp dword [esi + 0x88], 0
je 0x4be9da
lea eax, [ecx*8]
sub eax, ecx
shl eax, 2
push eax
call fcn.0058db11
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4bea23
mov eax, dword [esi + 0x64]
lea ecx, [eax*8]
sub ecx, eax
shl ecx, 2
push ecx
push 0
push ebx
call fcn.00587250
xor edi, edi
add esp, 0xc
cmp dword [esi + 0x64], edi
jle 0x4be9af
xor edx, edx
lea ecx, [ebx + 4]
mov ebp, 2
mov word [ecx - 4], bp
lea edx, [edx + 6]
mov eax, dword [esi + 0x5c]
lea ecx, [ecx + 0x1c]
inc edi
mov ax, word [eax + edx - 2]
mov word [ecx - 0x1e], ax
mov eax, dword [esi + 0x5c]
mov eax, dword [edx + eax - 6]
mov dword [ecx - 0x1c], eax
cmp edi, dword [esi + 0x64]
jl 0x4be985
mov ebp, dword [esp + 0x10]
mov ecx, dword [esi + 0x78]
mov edx, ebx
push ebp
push 0x4be8b0
push dword [esi + 0x64]
mov ecx, dword [ecx + 0x1b4]
call fcn.004c5ba0
add esp, 0xc
push ebx
call fcn.0058c812
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp dword [esi + 0x6c], 0
mov edi, dword [esi + 0x78]
jne 0x4bea15
push ecx
mov ecx, esi
mov dword [esi + 0x10], 1
call fcn.004be140
mov ecx, dword [edi + 0x20]
lea edx, [edi + 1]
add esp, 4
push 0
push 0x4be5d0
push 0xbb8
call fcn.004b2bf0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp fcn.004be790
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0xad7
mov edx, 0x6270f8
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0xad7
push 0x627114
push 0x627130
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4c2b20
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
lea ebp, [ebx + 0xc]
mov dword [esp + 0x10], edx
push ebp
mov edi, ecx
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4c2bda
push ebx
mov dword [esi], 3
mov dword [esi + 4], 0
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 8], ax
lea ecx, [esi + 0xc]
push ebx
push dword [esp + 0x1c]
xor eax, eax
mov edx, ebx
mov word [esi + 0xa], ax
call fcn.00401000
mov ebx, dword [esp + 0x18]
mov eax, 0x4000
mov ecx, dword [edi + 0x78]
mov dword [esp + 0x24], 0
mov word [esp + 0x24], ax
push dword [esp + 0x24]
movzx edx, bx
call fcn.004b3e80
add esp, 0xc
cmp dword [edi + 0x70], 2
jne 0x4c2bcb
push 0xffffffffffffffff
push dword [edi + 0x74]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [edi + 0x38]
mov ecx, dword [edi + 0x2c]
push ebp
push esi
push 0x32
push ebx
call fcn.004bf670
add esp, 0x10
push 0
push 1
push dword [edi + 0x74]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call fcn.0058c812
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x153f
mov edx, 0x627308
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x153f
push 0x627324
push 0x627340
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4c4230
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x210
mov ebx, ecx
call fcn.0058db11
mov edi, eax
add esp, 4
test edi, edi
je 0x4c43a3
push 0x210
push 0
push edi
call fcn.00587250
add esp, 0xc
mov dword [edi + 0x104], 0xffff
lea eax, [esp + 0x14]
xor edx, edx
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [edx + 0x18]
call fcn.004aeee0
mov esi, dword [esp + 0x18]
add esp, 8
mov eax, dword [esp + 0x14]
push 0
push 0x40
push 1
push 0
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
mov eax, 2
mov dword [edi + 0x24], esi
lea esi, [edi + 0x30]
push 0
mov dword [edi + 0x14], str.ILibWebRTC
mov dword [edi + 0x2c], 0x4c79c0
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi + 0x32], ax
lea ebp, [edi + 0x40]
mov eax, 0x17
push 0
mov word [ebp], ax
call dword [sym.imp.WS2_32.dll_htons]
push edi
push 0
push fcn.004c36b0
push 0
push esi
mov edx, 0x800
mov word [edi + 0x42], ax
mov ecx, ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], 0x4bbe20
call fcn.004acca0
add esp, 0x14
mov dword [edi + 0x18], eax
push edi
test eax, eax
je 0x4c4329
push 0
push fcn.004c36b0
push 0
push ebp
mov edx, 0x800
mov ecx, ebx
call fcn.004acca0
add esp, 0x14
mov dword [edi + 0x1c], eax
test eax, eax
jne 0x4c433b
push edi
call fcn.0058c812
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, edi
mov ecx, ebx
call fcn.004af570
mov ecx, dword [edi + 0x18]
call fcn.004aca90
mov ebp, dword [sym.imp.WS2_32.dll_htons]
movzx eax, ax
push eax
call ebp
mov ecx, dword [edi + 0x1c]
mov word [edi + 0x32], ax
call fcn.004aca90
movzx eax, ax
push eax
call ebp
mov word [edi + 0x42], ax
mov eax, dword [ebx + 0x2e4]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x108]
push 0x20
push eax
call fcn.004e3140
push ecx
mov ecx, ebx
call fcn.004c5360
add esp, 0xc
mov dword [edi + 0x1b4], eax
mov dword [eax + 0x28], edi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x18e1
mov edx, 0x6274a0
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x18e1
push 0x6274bc
push 0x6274d8
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4c4830
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x40
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
lea eax, [esp + 0x1c]
push esi
push edi
push eax
push ecx
mov ebx, edx
mov esi, ecx
push 8
push ecx
mov edx, ebp
mov dword [esp + 0x20], esi
mov ecx, ebx
xor edi, edi
call fcn.004c4600
add esp, 0x10
mov dword [esp + 0x20], eax
test eax, eax
je 0x4c49d9
push edi
push ecx
push 8
push ecx
mov edx, ebp
mov ecx, ebx
call fcn.004c4600
add esp, 0x10
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
mov edx, ebp
push eax
push ecx
push 0x8028
push ecx
mov ecx, ebx
call fcn.004c4600
add esp, 0x10
mov dword [esp + 0x1c], eax
test eax, eax
jle 0x4c4928
push edi
push ecx
push 0x8028
push ecx
mov edx, ebp
mov ecx, ebx
call fcn.004c4600
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov esi, eax
push dword [ecx]
call dword [sym.imp.WS2_32.dll_ntohl]
mov edi, eax
or ecx, 0xffffffff
xor edi, 0x5354554e
lea eax, [ebx + ebp]
mov edx, eax
test esi, esi
je 0x4c48fd
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5f15a8]
sub esi, 1
jne 0x4c48e0
lea eax, [ebx + ebp]
not ecx
cmp ecx, edi
jne 0x4c49d9
movzx eax, word [eax + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx edi, ax
lea eax, [edi - 8]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov esi, dword [esp + 0x10]
mov word [ebx + ebp + 2], ax
mov edx, dword [esi + 0x50]
lea eax, [esp + 0x28]
mov ecx, dword [esi + 0x30]
push eax
push dword [esi + 0x38]
call fcn.004c47a0
add esp, 8
mov dword [esp + 0x10], 0x14
call fcn.004e69f0
push 0
mov esi, eax
call fcn.004d1c80
push eax
push 0x10
lea eax, [esp + 0x34]
push eax
push esi
call fcn.004e6bd0
push dword [esp + 0x2c]
add ebx, ebp
push ebx
push esi
call fcn.004e6de0
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x5c]
push eax
push esi
call fcn.004e6b20
push esi
call fcn.004e6980
add esp, 0x30
cmp dword [esp + 0x1c], 0
jle 0x4c499a
push edi
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebx + 2], ax
cmp dword [esp + 0x20], 0x14
jne 0x4c49d9
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x38]
mov esi, 0x10
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4c49d9
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4c49b0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.005852a8
add esp, 0x40
ret
mov ecx, dword [esp + 0x4c]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005852a8
add esp, 0x40
ret
Function at 0x4c5360
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x58
mov ebx, ecx
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4c5425
push 0x58
push 0
push esi
call fcn.00587250
add esp, 0xc
mov dword [esi + 8], 0x4c4590
mov edx, 0x1000
mov ecx, ebx
push 0
push 0
push fcn.00403f00
push 0x4c5340
push 0x4c5230
call fcn.004aa700
add esp, 0x14
mov dword [esi + 0x2c], eax
xor ecx, ecx
mov dword [esi + 0x18], 0x4c4020
mov dword [esi + 0x1c], 0x4c40b0
mov dword [esi + 0x20], 0x4c4120
mov dword [esi + 0x24], 0x4c4150
call fcn.004b0430
mov dword [esi + 0x40], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], str.ILibWebRTC_TURN_Client
mov edi, dword [ebx + 0x2f0]
mov ecx, edi
call fcn.004b3590
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], 0
mov ecx, dword [edi + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x4c540c
mov dword [ecx + 8], eax
cmp dword [edi + 0xc], 0
mov dword [edi + 0x10], eax
jne 0x4c5418
mov dword [edi + 0xc], eax
inc dword [edi + 4]
mov eax, esi
pop edi
mov dword [esi + 0xc], ebx
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1b7e
mov edx, 0x6275d8
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1b7e
push 0x6275f4
push 0x627610
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4c5560
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x2c]
push esi
push edi
mov edi, dword [esp + 0x38]
movsx eax, byte [ebp + 1]
sub eax, 1
je 0x4c5659
sub eax, 1
jne 0x4c567f
push 0xc
push ecx
lea edx, [eax + 0xc]
mov dword [esp + 0x14], 0x2112a442
lea ecx, [esp + 0x18]
call fcn.00401000
add esp, 8
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov eax, 0x17
movq qword [edi + 0x10], xmm0
mov dword [edi + 0x18], 0
push 0x10
mov word [edi], ax
call dword [sym.imp.WS2_32.dll_htonl]
cmp eax, 0x10
jne 0x4c5619
push ebx
lea ecx, [edi + 9]
lea edx, [esp + 0x11]
lea esi, [ebp + 5]
lea ebx, [eax - 0xc]
movzx eax, byte [esi - 1]
lea esi, [esi + 4]
xor al, byte [edx - 1]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [esi - 4]
xor al, byte [edx - 4]
mov byte [ecx - 4], al
movzx eax, byte [esi - 3]
xor al, byte [edx - 3]
mov byte [ecx - 3], al
movzx eax, byte [esi - 2]
xor al, byte [edx - 2]
mov byte [ecx - 2], al
sub ebx, 1
jne 0x4c55e0
pop ebx
jmp 0x4c567f
xor ecx, ecx
lea edx, [edi + 0x16]
lea esi, [ebp + 0x12]
mov al, byte [esp + ecx + 0xc]
lea esi, [esi - 4]
xor al, byte [esi + 5]
lea edx, [edx - 4]
mov byte [edx + 5], al
mov al, byte [esp + ecx + 0xd]
xor al, byte [esi + 4]
mov byte [edx + 4], al
mov al, byte [esp + ecx + 0xe]
xor al, byte [esi + 3]
mov byte [edx + 3], al
mov al, byte [esp + ecx + 0xf]
add ecx, 4
xor al, byte [esi + 2]
mov byte [edx + 2], al
cmp ecx, 0x10
jl 0x4c5621
jmp 0x4c567f
push dword [ebp + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
xor eax, 0x2112a442
xorps xmm0, xmm0
mov ecx, 2
movups xmmword [edi], xmm0
push eax
mov word [edi], cx
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [edi + 4], eax
movzx eax, word [ebp + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, 0x2112
xor ax, cx
movzx eax, ax
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x2c]
mov word [edi + 2], ax
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005852a8
add esp, 0x24
ret
Function at 0x4c56c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, dword [esp + 0x2c]
push esi
mov esi, ecx
push edi
mov edi, edx
movzx eax, word [esi + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, 0x2112
mov byte [edi], 0
xor ax, cx
cmp word [esi], 2
movzx ecx, ax
setne al
inc al
push ecx
mov byte [edi + 1], al
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi + 2], ax
movzx eax, word [esi]
sub eax, 2
je 0x4c583b
sub eax, 0x15
je 0x4c572e
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005852a8
add esp, 0x24
ret
push 0xc
push ebx
mov edx, 0xc
mov dword [esp + 0x14], 0x2112a442
lea ecx, [esp + 0x18]
call fcn.00401000
add esp, 8
push 0x10
call dword [sym.imp.WS2_32.dll_htonl]
cmp eax, 0x10
jne 0x4c578e
xor ecx, ecx
nop dword [eax]
movzx eax, byte [esp + ecx + 0xc]
xor byte [esi + ecx + 8], al
movzx eax, byte [esp + ecx + 0xd]
xor byte [esi + ecx + 9], al
movzx eax, byte [esp + ecx + 0xe]
xor byte [esi + ecx + 0xa], al
movzx eax, byte [esp + ecx + 0xf]
xor byte [esi + ecx + 0xb], al
add ecx, 4
cmp ecx, 0x10
jl 0x4c5760
jmp 0x4c57e3
xor eax, eax
lea edx, [esi + 0x16]
movzx ecx, byte [esp + eax + 0xc]
lea edx, [edx - 4]
xor cl, byte [edx + 5]
mov byte [esp + eax + 0x1c], cl
movzx ecx, byte [esp + eax + 0xd]
xor cl, byte [edx + 4]
mov byte [esp + eax + 0x1d], cl
movzx ecx, byte [esp + eax + 0xe]
xor cl, byte [edx + 3]
mov byte [esp + eax + 0x1e], cl
movzx ecx, byte [esp + eax + 0xf]
xor cl, byte [edx + 2]
mov byte [esp + eax + 0x1f], cl
add eax, 4
cmp eax, 0x10
jl 0x4c5793
xor ecx, ecx
lea edx, [esi + 0x17]
mov al, byte [esp + ecx + 0x1c]
lea edx, [edx - 1]
inc ecx
mov byte [edx + 1], al
cmp ecx, 0x10
jl 0x4c57d3
lea eax, [edi + 4]
add esi, 8
test eax, eax
je 0x4c5814
test esi, esi
je 0x4c580e
movups xmm0, xmmword [esi]
pop edi
pop esi
movups xmmword [eax], xmm0
mov eax, 0x14
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005852a8
add esp, 0x24
ret
xorps xmm0, xmm0
movups xmmword [eax], xmm0
call fcn.0058c5c1
mov dword [eax], 0x16
call fcn.0058c19e
pop edi
pop esi
mov eax, 0x14
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005852a8
add esp, 0x24
ret
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
xor eax, 0x2112a442
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [esp + 0x2c]
mov dword [edi + 4], eax
mov eax, 8
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005852a8
add esp, 0x24
ret
Function at 0x4c5970
Capabilities:
Terminate process

Disassembly:
sub esp, 0x208
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x74]
mov ebp, edx
push 0xc
push eax
mov edi, ecx
call fcn.004e3140
push dword [edi + 0x38]
lea eax, [esp + 0x19c]
push dword [edi + 0x50]
push dword [edi + 0x30]
push 0x627508
push 0x80
push eax
call fcn.00401140
mov esi, eax
lea eax, [esp + 0x30]
push eax
call fcn.004d68b0
add esp, 0x24
lea eax, [esp + 0x190]
push esi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004d6910
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x84]
push eax
call fcn.004d6790
add esp, 8
push 4
call dword [sym.imp.WS2_32.dll_htons]
push 0x2112a442
mov word [esp + 0x94], ax
call dword [sym.imp.WS2_32.dll_htonl]
push dword [edi + 0x34]
movq xmm0, qword [esp + 0x78]
lea ecx, [esp + 0x94]
push dword [edi + 0x30]
mov dword [esp + 0x9c], eax
mov edx, 0x14
mov eax, dword [esp + 0x84]
push 6
movq qword [esp + 0xa4], xmm0
mov dword [esp + 0xac], eax
call fcn.004c54e0
add esp, 0xc
lea ecx, [esp + 0x90]
lea ebx, [eax + 0x14]
push dword [edi + 0x54]
mov edx, ebx
push dword [edi + 0x50]
push 0x14
call fcn.004c54e0
add esp, 0xc
lea ecx, [esp + 0x90]
add ebx, eax
mov edx, ebx
push dword [edi + 0x4c]
push dword [edi + 0x48]
push 0x15
call fcn.004c54e0
add esp, 0xc
lea ecx, [esp + 0x90]
add ebx, eax
lea eax, [esp + 0x80]
mov edx, ebx
push 0x10
push eax
call fcn.004bc450
add esp, 8
lea ecx, [esp + 0x90]
add ebx, eax
mov edx, ebx
call fcn.004bc4d0
add ebx, eax
cmp dword [esp + 0x21c], 0
je 0x4c5b07
push 8
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4c5b5b
mov eax, dword [esp + 0x21c]
lea edx, [esp + 0x74]
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi], ebp
mov dword [esi + 4], eax
mov ecx, dword [edi + 0x40]
push 1
push 0xc
call fcn.004b0710
add esp, 8
test eax, eax
je 0x4c5b28
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], 2
jmp 0x4c5b28
mov ecx, dword [edi + 0x40]
lea edx, [esp + 0x74]
push 1
push 0xc
call fcn.004b0710
add esp, 8
test eax, eax
je 0x4c5b28
mov dword [eax + 0x14], ebp
mov dword [eax + 0x18], 0
push 2
push ebx
lea eax, [esp + 0x98]
push eax
push 1
push 0
push dword [edi + 0x2c]
call fcn.004aa920
mov ecx, dword [esp + 0x22c]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005852a8
add esp, 0x208
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4c60f0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x30
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x40]
push ebp
push esi
mov dword [esp + 0x14], eax
mov ebp, ecx
lea eax, [ebx + 0x32]
mov dword [esp + 0x10], edx
push edi
push eax
call fcn.0058db11
mov edi, eax
add esp, 4
test edi, edi
je 0x4c61bd
lea eax, [esp + 0x1c]
push 0xc
push eax
call fcn.004e3140
lea eax, [esp + 0x24]
mov edx, 0x16
push eax
mov ecx, edi
call fcn.004c5470
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x34]
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x1c]
push eax
call fcn.004c56c0
add esp, 4
mov edx, esi
mov ecx, edi
push eax
lea eax, [esp + 0x2c]
push eax
push 0x12
call fcn.004c54e0
add esp, 0xc
add esi, eax
mov edx, esi
mov ecx, edi
push ebx
push dword [esp + 0x1c]
push 0x13
call fcn.004c54e0
add esp, 0xc
add esi, eax
mov edx, esi
mov ecx, edi
call fcn.004bc4d0
push 0
add esi, eax
push esi
push edi
push 1
push 0
push dword [ebp + 0x2c]
call fcn.004aa920
mov ecx, dword [esp + 0x54]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005852a8
add esp, 0x30
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1c9d
mov edx, 0x627704
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1c9d
push str...microstackILibWebRTC.c
push 0x62773c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4c6200
Capabilities:
Terminate process

Disassembly:
sub esp, 0x220
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x230]
lea eax, [esp + 0x74]
push edi
push 0xc
push eax
mov ebp, edx
mov ebx, ecx
call fcn.004e3140
lea eax, [esp + 0x80]
mov ecx, esi
push eax
lea edx, [esp + 0xa0]
call fcn.004c56c0
add esp, 0xc
mov edi, eax
lea eax, [esp + 0x1a8]
push dword [ebx + 0x38]
push dword [ebx + 0x50]
push dword [ebx + 0x30]
push 0x627508
push 0x80
push eax
call fcn.00401140
mov esi, eax
lea eax, [esp + 0x30]
push eax
call fcn.004d68b0
add esp, 0x1c
lea eax, [esp + 0x1a8]
push esi
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004d6910
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x88]
push eax
call fcn.004d6790
mov esi, dword [sym.imp.WS2_32.dll_htons]
add esp, 8
mov eax, ebp
xor eax, 0x4000
push eax
call esi
mov word [esp + 0x14], ax
xor eax, eax
push 9
mov word [esp + 0x1a], ax
call esi
push 0x2112a442
mov word [esp + 0xac], ax
call dword [sym.imp.WS2_32.dll_htonl]
movq xmm0, qword [esp + 0x78]
lea ecx, [esp + 0xa8]
mov dword [esp + 0xac], eax
mov edx, 0x14
mov eax, dword [esp + 0x80]
mov dword [esp + 0xb8], eax
lea eax, [esp + 0x94]
push edi
push eax
push 0x12
movq qword [esp + 0xbc], xmm0
call fcn.004c54e0
add esp, 0xc
lea edi, [eax + 0x14]
push 0xc
call esi
push 4
mov word [esp + edi + 0xac], ax
call esi
mov word [esp + edi + 0xaa], ax
lea ecx, [esp + 0xac]
push 4
lea eax, [esp + 0x18]
push eax
add ecx, edi
mov edx, 4
call fcn.00401000
push dword [ebx + 0x34]
add edi, 8
lea ecx, [esp + 0xb4]
push dword [ebx + 0x30]
mov edx, edi
push 6
call fcn.004c54e0
add esp, 0x14
lea ecx, [esp + 0xa8]
add edi, eax
mov edx, edi
push dword [ebx + 0x54]
push dword [ebx + 0x50]
push 0x14
call fcn.004c54e0
add esp, 0xc
lea ecx, [esp + 0xa8]
add edi, eax
mov edx, edi
push dword [ebx + 0x4c]
push dword [ebx + 0x48]
push 0x15
call fcn.004c54e0
add esp, 0xc
lea ecx, [esp + 0xa8]
add edi, eax
lea eax, [esp + 0x84]
mov edx, edi
push 0x10
push eax
call fcn.004bc450
add esp, 8
lea ecx, [esp + 0xa8]
add edi, eax
mov edx, edi
call fcn.004bc4d0
add edi, eax
cmp dword [esp + 0x238], 0
je 0x4c6424
push 8
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4c6457
mov eax, dword [esp + 0x238]
lea edx, [esp + 0x78]
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi], eax
mov eax, dword [esp + 0x23c]
mov dword [esi + 4], eax
mov ecx, dword [ebx + 0x40]
push 1
push 0xc
call fcn.004b0710
add esp, 8
test eax, eax
je 0x4c6424
movzx ecx, bp
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], ecx
push 2
push edi
lea eax, [esp + 0xb0]
push eax
push 1
push 0
push dword [ebx + 0x2c]
call fcn.004aa920
mov ecx, dword [esp + 0x244]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005852a8
add esp, 0x220
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3