joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a334
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
mov eax, edx
mov dword [esp + 8], eax
push ebp
mov ebp, ecx
push esi
mov esi, 0xff
push edi
test ebx, ebx
je 0x48a354
cmp ebx, 0xffffffff
jne 0x48a367
test eax, eax
jne 0x48a35c
xor ebx, ebx
jmp 0x48a367
push esi
push eax
call fcn.005f01d0
pop ecx
pop ecx
mov ebx, eax
mov edi, dword [esp + 0x24]
test edi, edi
je 0x48a374
cmp edi, 0xffffffff
jne 0x48a38d
cmp dword [esp + 0x20], 0
jne 0x48a37f
xor edi, edi
jmp 0x48a38d
push esi
push dword [esp + 0x24]
call fcn.005f01d0
pop ecx
pop ecx
mov edi, eax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x48a432
lea edx, [edi + 0x1a]
add edx, ebx
cmp dword [ecx - 0x10], edx
jbe 0x48a4fe
push 0x18
pop edx
call fcn.00484ee1
mov ecx, dword [ebp + 0x10]
lea edx, [ebx + 1]
mov esi, eax
call fcn.00484ee1
mov dword [esi], eax
lea edx, [edi + 1]
mov ecx, dword [ebp + 0x10]
call fcn.00484ee1
mov dword [esi + 8], eax
mov ecx, dword [esi]
lea edx, [ebx + 1]
push ebx
push dword [esp + 0x18]
call section..text
mov eax, dword [esi]
lea edx, [edi + 1]
push edi
push dword [esp + 0x2c]
mov byte [ebx + eax], 0
mov ecx, dword [esi + 8]
mov dword [esi + 4], ebx
call section..text
mov eax, dword [esi + 8]
add esp, 0x10
mov byte [edi + eax], 0
and dword [esi + 0x14], 0
mov dword [esi + 0xc], edi
mov ecx, dword [ebp + 0x84]
test ecx, ecx
je 0x48a41f
mov edx, dword [esi]
push edi
push dword [esi + 8]
push dword [esi + 4]
call fcn.004889b7
add esp, 0xc
mov eax, dword [ebp + 0x44]
test eax, eax
je 0x48a4f8
mov dword [eax + 0x14], esi
jmp 0x48a4fb
push 0x1c3e
push 0x7402ac
push 1
push 0x18
call fcn.005ed7c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48a505
or dword [esi + 0x10], 0xffffffff
lea eax, [ebx + 1]
push 0x1c40
push 0x740324
push 1
push eax
call fcn.005ed7c0
add esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x48a4a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1c40
push esi
push edi
mov edx, 0x740340
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x74035c
push 0x740378
jmp 0x48a532
push 0x1c41
push 0x74039c
lea eax, [edi + 1]
push 1
push eax
call fcn.005ed7c0
add esp, 0x10
mov dword [esi + 8], eax
test eax, eax
jne 0x48a3cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1c41
push esi
push edi
mov edx, 0x7403b8
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x7403d4
push 0x7403f0
jmp 0x48a532
mov dword [ebp + 0x40], esi
mov dword [ebp + 0x44], esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1c3e
push esi
push edi
mov edx, 0x7402c8
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x7402e4
push 0x740300
call fcn.00401109
add esp, 0xc
push esi
call fcn.005c8390
int3
Function at 0x48a610
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
cmp dword [ebx], 0
mov ebp, edx
push 3
mov edi, ecx
mov dword [esp + 0x18], ebp
pop ecx
jne 0x48a650
mov eax, ebp
shl eax, 2
cdq
idiv ecx
push 0x1ccd
push 0x74041c
add eax, 5
push 1
push eax
call fcn.005ed7c0
add esp, 0x10
mov dword [ebx], eax
test eax, eax
je 0x48a6bc
mov esi, dword [ebx]
mov ecx, edi
test edi, edi
je 0x48a6b0
test ebp, ebp
je 0x48a6b0
lea edx, [edi + ebp]
lea eax, [edi + 3]
cmp eax, edx
ja 0x48a689
lea ebx, [edi + 3]
mov ebp, edx
push 3
mov edx, esi
call fcn.0048a57e
pop ecx
mov ecx, ebx
add esi, 4
lea ebx, [ecx + 3]
cmp ebx, ebp
jbe 0x48a66b
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
sub edi, ecx
lea eax, [edi + ebp]
cmp eax, 1
jne 0x48a696
push eax
jmp 0x48a69c
cmp eax, 2
jne 0x48a6a7
push eax
mov edx, esi
call fcn.0048a57e
add esi, 4
pop ecx
mov byte [esi], 0
sub esi, dword [ebx]
mov eax, esi
jmp 0x48a6b5
and dword [ebx], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1ccd
push esi
push edi
mov edx, 0x740438
xor ecx, ecx
call fcn.0048cac3
push edi
push 0x740454
push 0x740470
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
int3
Function at 0x48a730
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
push edi
test esi, esi
je 0x48a859
test ebx, ebx
je 0x48a859
mov ebp, dword [esp + 0x20]
cmp dword [ebp], 0
jne 0x48a785
imul eax, ebx, 3
mov edi, 0x1d19
push edi
push 0x740494
push 1
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, 4
push eax
call fcn.005ed7c0
add esp, 0x10
mov dword [ebp], eax
test eax, eax
je 0x48a86a
and dword [esp + 0x10], 0
add ebx, esi
mov edi, dword [ebp]
jmp 0x48a847
xor eax, eax
xor edx, edx
mov dword [esp + 0x14], eax
cmp esi, ebx
ja 0x48a80b
xor cl, cl
test cl, cl
jne 0x48a7da
mov cl, byte [esi]
inc esi
lea eax, [ecx - 0x2b]
cmp al, 0x4f
ja 0x48a7bb
movzx eax, cl
mov cl, byte [eax + 0x6bf26d]
jmp 0x48a7bd
xor cl, cl
test cl, cl
je 0x48a7d6
and dword [esp + 0x18], 0
lea eax, [ecx - 0x3d]
cmp cl, 0x24
movzx eax, al
cmove eax, dword [esp + 0x18]
mov cl, al
cmp esi, ebx
jbe 0x48a7a2
cmp esi, ebx
ja 0x48a7f3
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
test cl, cl
je 0x48a805
dec cl
mov byte [esp + edx + 0x10], cl
jmp 0x48a805
cmp edx, 4
jae 0x48a89d
mov eax, dword [esp + 0x14]
mov byte [esp + edx + 0x10], 0
inc edx
cmp edx, 4
jl 0x48a79c
test eax, eax
je 0x48a847
mov al, byte [esp + 0x11]
mov cl, byte [esp + 0x10]
mov dl, byte [esp + 0x12]
shr al, 4
shl cl, 2
or cl, al
mov al, byte [esp + 0x11]
mov byte [edi], cl
mov cl, dl
shl al, 4
shr cl, 2
or cl, al
shl dl, 6
or dl, byte [esp + 0x13]
mov eax, dword [esp + 0x14]
dec eax
mov byte [edi + 1], cl
mov byte [edi + 2], dl
add edi, eax
cmp esi, ebx
jbe 0x48a794
mov byte [edi], 0
sub edi, dword [ebp]
mov eax, edi
jmp 0x48a862
mov eax, dword [esp + 0x20]
and dword [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x7404b0
push esi
push edi
xor ecx, ecx
call fcn.0048cac3
push edi
push 0x7404cc
push 0x7404e8
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
call fcn.005b8a60
int3

Function at 0x48aea0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x1f25
mov edi, ecx
push ebx
push 0x740578
push 1
push 0x40
call fcn.005ed7c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48af0f
push 0x40
push 0
push esi
call fcn.005bb370
add esp, 0xc
mov ecx, str.ILibLifeTime
call fcn.00484a03
xor ecx, ecx
mov dword [esi + 0x18], eax
call fcn.0048b083
xor ecx, ecx
mov dword [esi + 0x38], eax
mov dword [esi], 0x48ab04
mov dword [esi + 8], 0x48ae43
mov dword [esi + 0x10], edi
call fcn.0048b083
mov edx, esi
mov dword [esi + 0x30], eax
mov ecx, edi
call fcn.004853ee
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x740594
push esi
push ebx
xor ecx, ecx
call fcn.0048cac3
push ebx
push 0x7405b0
push 0x7405cc
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
int3
Function at 0x48b4a8
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, 0x2180
push edi
push 0x740638
push 1
push 0xc
call fcn.005ed7c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48b4fe
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, dword [esi]
mov dword [esi + 4], 0x48b436
test ecx, ecx
je 0x48b4e5
push 0
xor edx, edx
call fcn.0048bc6b
pop ecx
push 0
mov edx, 0x48b413
mov ecx, 0x100
call fcn.0048b8e1
pop ecx
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x740654
push esi
push edi
xor ecx, ecx
call fcn.0048cac3
push edi
push 0x740670
push 0x74068c
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
int3

Function at 0x48b69a
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, 0x2205
mov ebx, edx
push edi
push 0x7406b0
push 1
push 0x18
call fcn.005ed7c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48b734
xor eax, eax
mov edi, esi
push 6
pop ecx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x18]
and dword [esi + 0x14], eax
and dword [esi + 8], eax
mov dword [esi + 0x10], edi
test edi, edi
jle 0x48b72c
mov ebp, 0x220c
push ebp
push 0x740728
push 1
push edi
call fcn.005ed7c0
add esp, 0x10
mov dword [esi + 0xc], eax
test eax, eax
jne 0x48b71f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x740744
push esi
push ebp
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push ebp
push 0x740760
push 0x74077c
jmp 0x48b75c
push edi
push ebx
mov edx, edi
mov ecx, eax
call section..text
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x7406cc
push esi
push edi
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x7406e8
push 0x740704
call fcn.00401109
add esp, 0xc
push esi
call fcn.005c8390
int3
Function at 0x48be03
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x1c]
mov esi, edx
xor edx, edx
push dword [esp + 0x1c]
push esi
call fcn.00488caf
mov ecx, dword [esp + 0x30]
mov ebp, eax
sub ecx, dword [esp + 0x28]
add esp, 0xc
mov dword [esp + 0x10], ebp
mov edi, dword [ebp + 8]
dec edi
imul edi, ecx
push 0x2461
push 0x7407bc
push 1
add edi, esi
lea eax, [edi + 1]
push eax
mov dword [esp + 0x2c], eax
call fcn.005ed7c0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x48beb7
mov byte [ebx + edi], 0
xor edi, edi
mov esi, dword [ebp]
test esi, esi
je 0x48bea8
mov ebp, dword [esp + 0x1c]
push dword [esi + 4]
mov edx, ebp
lea ecx, [ebx + edi]
push dword [esi]
sub edx, edi
call section..text
add edi, dword [esi + 4]
cmp dword [esi + 8], 0
pop ecx
pop ecx
je 0x48be9d
push dword [esp + 0x24]
mov edx, ebp
lea ecx, [ebx + edi]
push dword [esp + 0x24]
sub edx, edi
call section..text
add edi, dword [esp + 0x2c]
pop ecx
pop ecx
mov esi, dword [esi + 8]
test esi, esi
jne 0x48be67
mov ebp, dword [esp + 0x10]
mov ecx, ebp
call fcn.00488e73
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x2461
push esi
push edi
mov edx, 0x7407d8
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x7407f4
push 0x740810
call fcn.00401109
add esp, 0xc
push esi
call fcn.005c8390
int3

Function at 0x48bef3
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, edx
mov ebp, ecx
push edi
test esi, esi
je 0x48bf04
cmp esi, 0xffffffff
jne 0x48bf1b
test ebp, ebp
jne 0x48bf0c
xor esi, esi
jmp 0x48bf1b
push 0x1000
push ebp
call fcn.005f01d0
pop ecx
pop ecx
mov esi, eax
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
cmp edi, 0xffffffff
jne 0x48bf3f
test ebx, ebx
jne 0x48bf30
xor edi, edi
jmp 0x48bf3f
push 0x1000
push ebx
call fcn.005f01d0
pop ecx
pop ecx
mov edi, eax
push 0x24c4
push 0x740948
lea eax, [edi + 1]
add eax, esi
push 1
push eax
call fcn.005ed7c0
add esp, 0x10
mov dword [esp + 0x18], eax
test eax, eax
je 0x48bf8f
push esi
lea edx, [edi + 1]
mov ecx, eax
push ebp
add edx, esi
call section..text
add esi, dword [esp + 0x20]
lea edx, [edi + 1]
push edi
push ebx
mov ecx, esi
call section..text
mov eax, dword [esp + 0x28]
add esp, 0x10
mov byte [esi + edi], 0
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x24c4
push esi
push edi
mov edx, 0x740964
xor ecx, ecx
call fcn.0048cac3
push edi
push 0x740980
push 0x74099c
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
int3
Function at 0x48bfc8
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, edx
push edi
mov edi, ecx
test esi, esi
je 0x48bfd9
cmp esi, 0xffffffff
jne 0x48bff0
test edi, edi
jne 0x48bfe1
xor esi, esi
jmp 0x48bff0
push 0x1000
push edi
call fcn.005f01d0
pop ecx
pop ecx
mov esi, eax
push 0x24ce
push 0x7409c0
lea ebp, [esi + 1]
push 1
push ebp
call fcn.005ed7c0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x48c026
push esi
push edi
mov edx, ebp
mov ecx, ebx
call section..text
pop ecx
pop ecx
pop edi
mov byte [ebx + esi], 0
mov eax, ebx
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x24ce
push esi
push edi
mov edx, 0x7409dc
xor ecx, ecx
call fcn.0048cac3
push edi
push 0x7409f8
push 0x740a14
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
int3

Function at 0x48c05f
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x1000
mov edi, 0x74e940
xor esi, esi
and dword [esp + 0x10], esi
mov ebx, ecx
push edi
push 0xffffffffffffffff
push edx
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x740b28
lea eax, [esp + 0x10]
push edi
push eax
call fcn.005e6450
add esp, 0xc
cmp dword [esp + 0xc], esi
jne 0x48c0a7
and dword [ebx], esi
xor eax, eax
jmp 0x48c132
push 2
push 0
push dword [esp + 0x14]
call fcn.005e7d00
push dword [esp + 0x18]
call fcn.005c90d0
add esp, 0x10
cmp eax, 0x7fffffff
jge 0x48c0dc
push dword [esp + 0xc]
call fcn.005c90d0
mov esi, eax
pop ecx
test esi, esi
jns 0x48c0dc
and dword [ebx], 0
jmp 0x48c0a0
push ebp
push 0
push 0
push dword [esp + 0x18]
call fcn.005e7d00
mov ebp, 0x250d
lea eax, [esi + 1]
push ebp
push 0x740b30
push 1
push eax
call fcn.005ed7c0
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x48c137
test esi, esi
jle 0x48c11f
push dword [esp + 0x10]
push esi
push 1
push edi
call fcn.005f08b0
add esp, 0x10
mov esi, eax
mov byte [edi + esi], 0
push dword [esp + 0x10]
call fcn.005e7100
pop ecx
mov dword [ebx], edi
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x740b4c
push esi
push ebp
xor ecx, ecx
call fcn.0048cac3
push ebp
push 0x740b68
push 0x740b84
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
int3

Function at 0x48c16b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
push 0x1000
mov edi, 0x74e940
mov esi, edx
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x740ba8
lea eax, [ebp - 4]
push edi
push eax
call fcn.005e6450
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x48c1c3
push dword [ebp - 4]
push dword [ebp + 8]
push 1
push esi
call fcn.005ea1e0
push dword [ebp - 4]
call fcn.005e7100
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48c1c9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [0x73e1d0]
mov ebx, 0x74e940
push edi
mov edi, dword [0x73e1d4]
push 0x1000
push ebx
push 0xffffffffffffffff
push dword [0x74cbc4]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x740bb0
lea eax, [ebp - 4]
push ebx
push eax
call fcn.005e6450
mov ecx, dword [ebp - 4]
add esp, 0xc
test ecx, ecx
je 0x48c25f
mov eax, esi
or eax, edi
je 0x48c243
push 2
push 0
push ecx
call fcn.005e7d00
push dword [ebp - 4]
call fcn.005c9070
add esp, 0x10
cmp edx, edi
ja 0x48c256
jb 0x48c23e
cmp eax, esi
jae 0x48c256
push dword [ebp - 4]
jmp 0x48c244
push ecx
push dword [ebp + 8]
push 1
push 0x74d940
call fcn.005ea1e0
add esp, 0x10
push dword [ebp - 4]
call fcn.005e7100
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48c266
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.005b9060
mov eax, dword [0x6d1d44]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x1000
lea eax, [ebp - 0x4004]
mov esi, edx
or edx, 0xffffffff
push edi
push eax
call fcn.004846c9
lea eax, [ebp - 0x2004]
or edx, 0xffffffff
push edi
push eax
mov ecx, esi
call fcn.004846c9
add esp, 0x10
lea eax, [ebp - 0x2004]
push 0
push eax
lea eax, [ebp - 0x4004]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.005b8900
mov esp, ebp
pop ebp
ret
Function at 0x48cc84
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, 0x95
mov ebx, edx
push edi
push 0x7410f8
push 1
push 0xc
mov ebp, ecx
call fcn.005ed7c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48cd0c
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x9a
mov dword [esi + 4], ebx
push edi
push 0x74117c
push 1
push ebx
call fcn.005ed7c0
add esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x48ccf4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea esi, [edi + 0x64]
mov edx, 0x74119c
push esi
push edi
xor ecx, ecx
call fcn.0048cac3
push edi
push 0x7411bc
push 0x7411dc
jmp 0x48cd31
push ebx
push ebp
mov edx, ebx
mov ecx, eax
call section..text
and dword [esi + 8], 0
mov eax, esi
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x741118
push esi
push edi
xor ecx, ecx
call fcn.0048cac3
push edi
push 0x741138
push 0x741158
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
int3

Function at 0x48cd71
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x113
mov edi, ecx
push ebx
push 0x741200
push 1
push 0x38
call fcn.005ed7c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48cdde
push 0x38
push 0
push esi
call fcn.005bb370
add esp, 0xc
mov ecx, str.ILibProcessPipe_Manager
call fcn.00484a03
push 4
pop ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x10], edi
call fcn.0048b083
mov dword [esi + 0x20], eax
mov edx, esi
mov dword [esi + 8], 0x48cd48
mov ecx, edi
cmp dword [edi + 4], 0
jne 0x48cdd3
call fcn.004853ee
jmp 0x48cdd8
call fcn.00485199
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x741220
push esi
push ebx
xor ecx, ecx
call fcn.0048cac3
push ebx
push 0x741240
push 0x741260
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
int3
Function at 0x48cfa7
Capabilities:
Create pipe
Terminate process

Disassembly:
sub esp, 0x114
mov eax, dword [0x6d1d44]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x128]
xor ebp, ebp
mov eax, esi
mov ebx, ecx
not eax
push edi
mov edi, ebp
cmp eax, 0x68
jbe 0x48d012
cmp esi, 0xffffff97
jae 0x48d012
lea eax, [esi + 0x68]
cmp eax, 0xffffffef
jae 0x48d012
test esi, esi
je 0x48cfee
lea eax, [esi + 0x78]
cmp eax, 0xffffffef
jae 0x48d012
push 0x19d
push 0x741320
push 1
push 0x78
pop eax
test esi, esi
lea ecx, [eax + 0x10]
cmovg eax, ecx
add eax, esi
push eax
call fcn.005ed7c0
add esp, 0x10
jmp 0x48d014
mov eax, ebp
push ebp
push esi
push 0x68
pop edx
mov ecx, eax
call fcn.00484c1e
mov esi, eax
pop ecx
pop ecx
mov dword [esi + 0x1c], ebx
xor ebx, ebx
mov dword [esi + 0x2c], ebp
inc ebx
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebp
push edi
push esi
push str..pipe_p_u
lea eax, [esp + 0x28]
push 0xff
push eax
call fcn.0040117f
add esp, 0x14
lea eax, [esp + 0x10]
inc edi
push eax
push ebp
mov eax, 0x1000
push eax
push eax
push ebx
push ebp
push 0x40080001
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0x40], eax
cmp eax, 0xffffffff
je 0x48d167
cmp eax, 5
je 0x48d03d
mov ebx, 0x1ad
push ebx
push 0x7413b4
push 1
push 0x14
call fcn.005ed7c0
mov edi, eax
add esp, 0x10
mov dword [esi + 0x48], edi
test edi, edi
je 0x48d196
xor eax, eax
stosd dword es:[edi], eax
push ebp
push ebp
push 1
stosd dword es:[edi], eax
push ebp
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esi + 0x48]
mov dword [ecx + 0x10], eax
test eax, eax
jne 0x48d0f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
lea edi, [ebx + 2]
push esi
push edi
mov edx, 0x741438
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x741458
push 0x741478
jmp 0x48d1be
push ebp
push 0x80
push 3
lea eax, [esp + 0x1c]
push eax
push ebp
push 0x40000000
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x44], eax
cmp eax, 0xffffffff
jne 0x48d14c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1b2
push esi
push edi
mov edx, 0x74149c
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x7414bc
push 0x7414dc
jmp 0x48d1be
mov ecx, dword [esp + 0x120]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005b8900
add esp, 0x114
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1aa
push esi
push edi
mov edx, 0x741350
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x741370
push 0x741390
jmp 0x48d1be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x7413d4
push esi
push ebx
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push ebx
push 0x7413f4
push 0x741414
call fcn.00401109
add esp, 0xc
push esi
call fcn.005c8390
int3
Function at 0x48ddfb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
and dword [esp], 0
cmp dword [ebp + 0x10], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov ebx, dword [edi + 0x28]
jne 0x48df61
mov esi, dword [ebp + 0x18]
push esi
push dword [edi + 0x14]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push str.ReadExHandler__p___p_____TotalRead:__llu__bytesRead:__llu
push 2
call fcn.0048cbcd
add dword [edi + 0x14], esi
add esp, 0x18
mov eax, dword [esp + 0xc]
xor esi, esi
cmp dword [edi + 0x64], esi
jne 0x48deaa
push dword [edi + 0xc]
push eax
push dword [edi + 0x14]
mov eax, dword [edi]
add eax, dword [edi + 0xc]
push eax
push str._ReadExHandler__p___llu___llu_____llu_
push 2
call fcn.0048cbcd
push dword [edi + 0x34]
lea eax, [esp + 0x28]
push dword [edi + 0x30]
push eax
mov eax, dword [edi + 0xc]
push dword [edi + 0x14]
add eax, dword [edi]
push eax
call ebx
mov eax, dword [esp + 0x38]
add esp, 0x2c
sub dword [edi + 0x14], eax
add dword [edi + 0xc], eax
push dword [edi + 0x64]
push eax
push dword [edi + 0x14]
push dword [edi + 0xc]
push str._____readOffset:__llu__totalRead:__llu__consumed:__llu__PAUSE:__d
push 2
call fcn.0048cbcd
add esp, 0x18
cmp dword [edi + 0x64], esi
jne 0x48deaa
mov eax, dword [esp + 0xc]
test eax, eax
je 0x48deaa
cmp dword [edi + 0x14], esi
ja 0x48de3e
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x48deb4
mov dword [edi + 0xc], esi
cmp dword [edi + 0x64], esi
jne 0x48df53
mov edx, dword [edi + 0xc]
test edx, edx
je 0x48deda
mov ecx, dword [edi]
push eax
lea eax, [ecx + edx]
mov edx, dword [edi + 4]
push eax
call fcn.00467a49
pop ecx
pop ecx
mov dword [edi + 0xc], esi
jmp 0x48df05
mov ecx, dword [edi + 4]
cmp eax, ecx
jne 0x48df05
mov ebx, 0x514
lea eax, [ecx + ecx]
push ebx
push 0x741764
push 1
push eax
push dword [edi]
call fcn.005ed970
add esp, 0x14
mov dword [edi], eax
test eax, eax
je 0x48df6a
shl dword [edi + 4], 1
mov eax, dword [edi + 4]
sub eax, dword [edi + 0x14]
push eax
mov eax, dword [edi + 0xc]
add eax, dword [edi + 0x14]
push eax
push dword [edi]
push str.ILibChain_ReadEx2_______p___llu___llu_
push 2
call fcn.0048cbcd
mov eax, dword [edi + 4]
add esp, 0x14
mov ecx, dword [edi + 0xc]
add ecx, dword [edi + 0x14]
sub eax, dword [edi + 0x14]
push dword [edi + 0x60]
add ecx, dword [edi]
mov edx, dword [ebp + 0xc]
push edi
push fcn.0048ddfb
push eax
push ecx
push dword [edi + 0x48]
mov ecx, dword [ebp + 8]
call fcn.004876c7
xor eax, eax
add esp, 0x18
inc eax
jmp 0x48df63
push str.HANDLE_will_get_removed
push 2
call fcn.0048cbcd
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x741784
push esi
push ebx
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push ebx
push 0x7417a4
push 0x7417c4
call fcn.00401109
add esp, 0xc
push esi
call fcn.005c8390
int3