joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469389
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x500144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x40f330
push 0x40f340
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [ebp - 0x214], esi
test edi, edi
je 0x46954f
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, edi
call dword [0x5035f0]
call edi
neg eax
sbb eax, eax
and dword [ebp - 0x214], eax
je 0x46954f
push 0x208
lea eax, [ebp - 0x210]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
mov edi, 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x469464
mov eax, dword [section..data]
cmp eax, section..data
je 0x46954f
test byte [eax + 0x1c], 8
je 0x46954f
cmp byte [eax + 0x19], 2
jb 0x46954f
call fcn.0042386b
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x12
mov edx, 0x40f87c
pop ecx
call fcn.004238e7
jmp 0x46954f
push 0x40f3b0
mov edx, edi
lea ecx, [ebp - 0x210]
call fcn.0041f701
mov edi, eax
test edi, edi
jns 0x4694c9
mov eax, dword [section..data]
cmp eax, section..data
je 0x46954f
test byte [eax + 0x1c], 8
je 0x46954f
cmp byte [eax + 0x19], 2
jb 0x46954f
call fcn.0042386b
push edi
push 0x40949c
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x13
mov edx, 0x40f87c
pop ecx
call fcn.0042371b
jmp 0x46954f
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
jne 0x469503
mov eax, dword [section..data]
cmp eax, section..data
je 0x46954f
test byte [eax + 0x1c], 8
je 0x46954f
cmp byte [eax + 0x19], 2
jb 0x46954f
call fcn.0042386b
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x14
jmp 0x469454
mov edx, eax
lea ecx, [ebp - 0x210]
call fcn.00469151
mov edi, eax
test edi, edi
jns 0x46954c
mov eax, dword [section..data]
cmp eax, section..data
je 0x46954f
test byte [eax + 0x1c], 8
je 0x46954f
cmp byte [eax + 0x19], 2
jb 0x46954f
call fcn.0042386b
push edi
push 0x40f3c8
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x15
jmp 0x4694b9
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004fb5e0
leave
ret
Function at 0x46d912
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
xor edi, edi
push eax
lea ecx, [ebx + 0x20]
mov dword [ebp - 4], edi
call fcn.0047791f
test eax, eax
jne 0x46d976
mov eax, dword [section..data]
cmp eax, section..data
je 0x46d96e
test byte [eax + 0x1c], 1
je 0x46d96e
cmp byte [eax + 0x19], 2
jb 0x46d96e
call fcn.0042386b
push eax
mov eax, dword [section..data]
mov edx, 0x40fe88
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xf
pop ecx
call fcn.004238e7
xor edi, edi
inc edi
jmp 0x46daa2
mov eax, dword [section..data]
cmp eax, section..data
je 0x46d9b3
test byte [eax + 0x1c], 1
je 0x46d9b3
cmp byte [eax + 0x19], 2
jb 0x46d9b3
mov esi, dword [ebx + 0xcc]
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
mov edx, 0x40fe88
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x10
pop ecx
call fcn.00421fda
mov esi, dword [ebp - 4]
mov ecx, esi
mov edx, dword [ebp - 8]
call fcn.00477b27
movzx eax, word [esi]
push 6
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46d9e1
call fcn.0048b320
mov edi, eax
jmp 0x46daa2
push 0x10
push dword [ebx + 0xbc]
push esi
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x46da7d
mov eax, dword [ebp - 4]
cmp word [eax], 0x17
jne 0x46da60
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x46da7d
push 4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], edi
push eax
push 0x1002
push 0xffff
push esi
mov dword [ebp - 0x10], 0xfa00
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x46da7d
push 4
lea eax, [ebp - 0x14]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x46da7d
mov eax, dword [ebp - 4]
push dword [ebp - 8]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x46da8d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x46da8d
call fcn.0048b320
mov edi, eax
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x46daa2
mov ecx, dword [ebx + 0xcc]
mov eax, dword [ebx + 0xc4]
mov dword [eax + ecx*4], esi
inc dword [ebx + 0xcc]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46f7de
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
mov ebx, edx
test esi, esi
jne 0x46f7fb
mov ecx, 0x80004003
jmp 0x46f840
push esi
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov ecx, eax
test ecx, ecx
js 0x46f840
movzx eax, byte [esi + 3]
test eax, eax
je 0x46f7fb
cmp eax, 0xf4
je 0x46f7fb
xor eax, eax
mov word [esi + 2], ax
or dword [esi], ebx
mov ax, word [ebp - 4]
xor ax, word [esi + edi*2]
inc edi
cmp edi, 6
jb 0x46f823
mov word [ebp - 4], ax
mov eax, dword [ebp - 4]
not eax
mov word [esi + edi*2], ax
xor eax, eax
mov word [esi + 0xe], ax
pop edi
pop esi
mov eax, ecx
pop ebx
leave
ret
Function at 0x476e3e
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x500144]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x54]
push edi
push 0xa
push 0x21
push eax
push dword [ebp + 0xc]
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x58], ebx
call dword [sym.imp.msvcrt.dll__ltow_s]
add esp, 0x10
mov dword [ebp - 0x60], ebx
lea eax, [ebp - 0x58]
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x5c], ebx
push eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x78], ebx
push eax
inc ebx
mov dword [ebp - 0x6c], 6
push esi
mov dword [ebp - 0x70], ebx
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
je 0x476eb1
call fcn.0048b320
mov esi, eax
jmp 0x476f5f
mov eax, dword [edi]
push dword [ebp - 0x58]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5035f0]
mov ecx, edi
call esi
mov esi, eax
test esi, esi
jns 0x476f0d
mov eax, dword [section..data]
cmp eax, section..data
je 0x476f5f
test byte [eax + 0x1c], 8
je 0x476f5f
cmp byte [eax + 0x19], 2
jb 0x476f5f
call fcn.0042386b
push esi
push 0x410c38
push eax
mov eax, dword [section..data]
mov edx, 0x410ec4
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xb
pop ecx
call fcn.0042371b
jmp 0x476f5f
cmp dword [ebp + 0x10], ebx
jne 0x476f5f
push dword [ebp + 0xc]
push dword [ebp - 0x58]
call fcn.00477c39
cmp eax, ebx
jne 0x476f5f
mov eax, dword [section..data]
cmp eax, section..data
je 0x476f5a
test dword [eax + 0x1c], 0x800
je 0x476f5a
cmp byte [eax + 0x19], 2
jb 0x476f5a
call fcn.0042386b
push eax
mov eax, dword [section..data]
mov edx, 0x410ec4
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xc
pop ecx
call fcn.004238e7
mov esi, 0x8345001a
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb5e0
leave
ret 0xc
Function at 0x479db0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 8], 0
xor eax, eax
and dword [ebp - 0xc], eax
push ebx
push esi
push edi
push 0xf0000000
push 1
push eax
push eax
mov word [ebp - 4], ax
mov edi, ecx
lea eax, [ebp - 8]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x479e29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x479f70
test byte [eax + 0x1c], 8
je 0x479f70
cmp byte [eax + 0x19], 2
jb 0x479f70
call fcn.0042386b
push edi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x13
jmp 0x479f65
xor ebx, ebx
jmp 0x479e30
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x479f31
movzx eax, word [ebp - 4]
xor edx, edx
imul eax, eax, 0xea60
mov ecx, 0xffff
div ecx
mov edx, dword [edi + 4]
add eax, 0x1388
mov dword [ebp - 0x10], eax
mov ecx, dword [edx]
mov esi, dword [ecx + 0x20]
lea ecx, [ebp - 0xc]
push ecx
push dword [edi + 0x20]
mov ecx, esi
push eax
push edx
call dword [0x5035f0]
call esi
mov edi, eax
test edi, edi
js 0x479ee0
mov eax, dword [section..data]
cmp eax, section..data
je 0x479ebd
test byte [eax + 0x1c], 1
je 0x479ebd
cmp byte [eax + 0x19], 2
jb 0x479ebd
call fcn.0042386b
mov ecx, dword [ebp - 0x10]
mov edx, 0x411064
push ecx
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x15
pop ecx
call fcn.00421fda
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x5035f0]
call esi
and dword [ebp - 0xc], 0
inc ebx
cmp ebx, 0x64
jb 0x479e2d
jmp 0x479eea
mov eax, dword [ebp + 8]
xor edi, edi
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
cmp ebx, 0x64
jne 0x479f86
mov eax, dword [section..data]
cmp eax, section..data
je 0x479f2a
test byte [eax + 0x1c], 1
je 0x479f2a
cmp byte [eax + 0x19], 2
jb 0x479f2a
call fcn.0042386b
push ebx
push eax
mov eax, dword [section..data]
mov edx, 0x411064
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x16
pop ecx
call fcn.00421fda
mov edi, 0x8000ffff
jmp 0x479f86
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x479f70
test byte [eax + 0x1c], 8
je 0x479f70
cmp byte [eax + 0x19], 2
jb 0x479f70
call fcn.0042386b
push edi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x14
mov edx, 0x411064
pop ecx
call fcn.00421fda
test edi, edi
jle 0x479f7f
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x479f86
mov edi, 0x80004005
cmp dword [ebp - 8], 0
je 0x479f97
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x479fae
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x5035f0]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x47a4fa
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov dword [ebp - 8], 1
push esi
push edi
xor esi, esi
or dword [ebx + 0x10], 2
lea eax, [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x47a61e
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x17
jne 0x47a564
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xa
push eax
push 0x17
push 0x29
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x47a61e
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
push dword [eax + 0x18]
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x47a61e
push 4
lea eax, [ebp - 8]
push eax
push 0xfffffffffffffffb
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x47a61e
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 6
je 0x47a5ba
cmp dword [eax + 0xc], 1
je 0x47a5ba
cmp dword [eax + 0xc], 0x11
jne 0x47a5b0
push 3
jmp 0x47a60f
mov esi, 0x80070057
jmp 0x47a6a5
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], esi
push eax
push 0x1002
push 0xffff
push edi
mov dword [ebp - 0xc], 0xfa00
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x47a61e
push 4
lea eax, [ebp - 0x10]
push eax
push 0x1001
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x47a61e
push 0x7fffffff
push edi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x47a61e
push 8
push dword [ebp + 0x10]
push edi
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x47a62f
call fcn.0048b320
mov esi, eax
test esi, esi
jns 0x47a6cd
jmp 0x47a6a5
mov eax, dword [ebp + 8]
lea ecx, [ebx + 0x30]
cmp dword [eax + 0xc], 1
jne 0x47a650
push 0x410eec
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x22
mov dword [ebx + 0x30], eax
mov ecx, esi
pop eax
jmp 0x47a6b5
lea eax, [ebp - 0xc]
xor edx, edx
push eax
push ecx
lea eax, [ebp - 0x10]
inc edx
push eax
mov ecx, edi
call fcn.0048b40b
mov esi, eax
test esi, esi
jns 0x47a6af
mov eax, dword [section..data]
cmp eax, section..data
je 0x47a6a5
test byte [eax + 0x1c], 8
je 0x47a6a5
cmp byte [eax + 0x19], 2
jb 0x47a6a5
call fcn.0042386b
push esi
push 0x4110ac
push eax
mov eax, dword [section..data]
mov edx, 0x4110cc
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xd
pop ecx
call fcn.0042371b
mov ecx, dword [ebp - 0x14]
call fcn.0047a6e0
jmp 0x47a6cd
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x2c], edi
mov dword [ebx + 0x20], ecx
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x1c], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x47e740
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x500144]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, ebx
lea eax, [esi - 8]
push eax
call fcn.0047eda0
push ebx
lea ecx, [esi + 0x58]
call fcn.0047d94e
push ebx
lea ecx, [esi + 0x5c]
call fcn.00473130
cmp dword [esi + 0x1c], ebx
je 0x47e899
push 8
call fcn.004fb25b
mov edi, eax
pop ecx
test edi, edi
jne 0x47e7fd
cmp dword [0x5000a0], 2
jbe 0x47e899
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x4123e0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x412410
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x65
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0x412310
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x8007000e
push eax
mov dword [esp + 0x24], 0x41235c
lea eax, [esp + 0x24]
mov edx, 0x41e339
push eax
push ecx
push ecx
call fcn.0041f1d0
jmp 0x47e899
mov eax, dword [esi + 0x20]
push ebx
push ebx
push edi
push 0x47e910
mov dword [edi], eax
mov eax, dword [esi + 0x1c]
push ebx
mov dword [edi + 4], eax
push ebx
mov dword [esi + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x47e88d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x47e831
movzx eax, ax
or eax, 0x80070000
cmp dword [0x5000a0], 2
jbe 0x47e899
mov dword [esp + 0x18], eax
mov edx, 0x41e339
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x41241c
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x412410
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x74
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x412310
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0x41235c
push eax
lea eax, [esp + 0x28]
jmp 0x47e7f0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, ebx
mov dword [esi + 0x20], ebx
or dword [esi + 0xc], 4
cmp dword [0x5000a0], 4
jbe 0x47e8d4
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 0x412454
push eax
lea ecx, [esp + 0x14]
call fcn.0041eab1
lea eax, [esp + 0x28]
push eax
push 3
push ebx
push ebx
push 0x41e3c9
push 0x5000a0
call fcn.0041e9dc
test edi, edi
je 0x47e8df
push edi
call fcn.004fb234
pop ecx
cmp dword [esi + 0x20], ebx
je 0x47e8f0
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x20], ebx
mov ecx, dword [esp + 0x5c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004fb5e0
mov esp, ebp
pop ebp
ret
Function at 0x47f862
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x78]
inc dword [edi + 0x78]
call fcn.0047e947
lea eax, [edi + 0x48]
xor esi, esi
push eax
push esi
push dword [edi + 0x70]
push dword [edi + 0x68]
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47f96e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x6d
je 0x47f90b
cmp esi, 0x3e5
je 0x47f906
mov ecx, edi
call fcn.0047e9b0
test esi, esi
jle 0x47f8c0
movzx esi, si
or esi, 0x80070000
cmp dword [0x5000a0], 2
jbe 0x47f967
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x412888
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x32a
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x412310
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0x14], 0x4128a4
lea eax, [ebp - 0x14]
mov edx, 0x41e1eb
jmp 0x47f95f
xor esi, esi
inc esi
jmp 0x47f96e
mov ecx, edi
call fcn.0047e9b0
test esi, esi
jle 0x47f91f
movzx esi, si
or esi, 0x80070000
cmp dword [0x5000a0], 2
jbe 0x47f967
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x412888
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x324
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x412310
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], esi
push eax
mov dword [ebp - 0x28], 0x412894
lea eax, [ebp - 0x28]
mov edx, 0x41e1eb
push eax
push ecx
push ecx
call fcn.0041f27b
test esi, esi
jns 0x47f96e
dec dword [edi + 0x78]
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x4800b7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, ecx
push esi
push edi
xor edi, edi
lea eax, [ebx + 0x2c]
mov dword [ebx], 0x401e9c
mov dword [ebx + 4], 0x401e8c
mov dword [ebx + 0x1c], 0x401e68
mov dword [ebx + 0x20], 0x401e54
cmp dword [eax + 4], edi
je 0x4800f4
mov ecx, dword [eax]
call fcn.004f5aa4
lea eax, [ebx + 0x2c]
cmp dword [ebx + 0x78], edi
jne 0x480104
mov dword [ebx + 0x78], 1
or dword [ebx + 0x10], 4
cmp dword [eax + 4], edi
je 0x480110
mov ecx, dword [eax]
call fcn.004f5abe
lea esi, [ebx + 0x3c]
cmp dword [esi + 4], edi
je 0x48011f
mov ecx, dword [esi]
call fcn.004f5aa4
lea edi, [ebx + 0x54]
cmp dword [edi], edi
je 0x480194
mov eax, dword [section..data]
cmp eax, section..data
je 0x48015c
test byte [eax + 0x1c], 1
je 0x48015c
cmp byte [eax + 0x19], 3
jb 0x48015c
call fcn.0042386b
push eax
mov eax, dword [section..data]
mov edx, 0x412aa8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.004238e7
mov edx, dword [edi]
mov dword [esp + 0xc], edx
test edx, edx
je 0x48018d
mov ecx, dword [edx]
lea esi, [edx + 8]
mov eax, dword [edx + 4]
push 0
mov dword [eax], ecx
mov dword [ecx + 4], eax
mov ecx, esi
call fcn.00473130
mov ecx, esi
call fcn.004262d0
push dword [esp + 0xc]
call fcn.004fb234
pop ecx
cmp dword [edi], edi
jne 0x480126
lea esi, [ebx + 0x3c]
cmp dword [esi + 4], 0
je 0x4801a1
mov ecx, dword [esi]
call fcn.004f5abe
lea esi, [ebx + 0x34]
cmp dword [esi + 4], 0
je 0x4801b1
mov ecx, dword [esi]
call fcn.004f5aa4
lea edi, [ebx + 0x5c]
cmp dword [edi], edi
je 0x480226
mov eax, dword [section..data]
cmp eax, section..data
je 0x4801ee
test byte [eax + 0x1c], 1
je 0x4801ee
cmp byte [eax + 0x19], 3
jb 0x4801ee
call fcn.0042386b
push eax
mov eax, dword [section..data]
mov edx, 0x412aa8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xb
pop ecx
call fcn.004238e7
mov edx, dword [edi]
mov dword [esp + 0xc], edx
test edx, edx
je 0x48021f
mov ecx, dword [edx]
lea esi, [edx + 8]
mov eax, dword [edx + 4]
push 0
mov dword [eax], ecx
mov dword [ecx + 4], eax
mov ecx, esi
call fcn.00473130
mov ecx, esi
call fcn.004262d0
push dword [esp + 0xc]
call fcn.004fb234
pop ecx
cmp dword [edi], edi
jne 0x4801b8
lea esi, [ebx + 0x34]
cmp dword [esi + 4], 0
je 0x480233
mov ecx, dword [esi]
call fcn.004f5abe
mov ecx, esi
call fcn.00464dea
lea ecx, [ebx + 0x3c]
call fcn.00464dea
lea ecx, [ebx + 0x44]
call fcn.00464dea
lea ecx, [ebx + 0x4c]
call fcn.00464dea
lea ecx, [ebx + 0x2c]
call fcn.00464dea
lea ecx, [ebx + 0x4c]
call fcn.00464dea
lea ecx, [ebx + 0x44]
call fcn.00464dea
lea ecx, [ebx + 0x3c]
call fcn.00464dea
lea ecx, [ebx + 0x34]
call fcn.00464dea
lea ecx, [ebx + 0x2c]
call fcn.00464dea
lea ecx, [ebx + 0x28]
call fcn.004262d0
pop edi
mov dword [ebx], fcn.004265c0
or dword [ebx + 0x10], 8
pop esi
mov dword [ebx + 4], 0x40107c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4815b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, ebx
cmp dword [esi + 0x18], ebx
je 0x4816a9
push 8
call fcn.004fb25b
mov edi, eax
pop ecx
test edi, edi
jne 0x481625
mov eax, dword [section..data]
cmp eax, section..data
je 0x4816a9
test byte [eax + 0x1c], 8
je 0x4816a9
cmp byte [eax + 0x19], 2
jb 0x4816a9
call fcn.0042386b
push 0x412ad0
push eax
mov eax, dword [section..data]
mov edx, 0x412af0
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x13
pop ecx
call fcn.0042200a
jmp 0x4816a9
mov eax, dword [esi + 0x1c]
push ebx
push ebx
push edi
push 0x47e910
mov dword [edi], eax
mov eax, dword [esi + 0x18]
push ebx
mov dword [edi + 4], eax
push ebx
mov dword [esi + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x48169d
mov eax, dword [section..data]
cmp eax, section..data
je 0x481695
test byte [eax + 0x1c], 8
je 0x481695
cmp byte [eax + 0x19], 2
jb 0x481695
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x481674
movzx ebx, bx
or ebx, 0x80070000
call fcn.0042386b
push ebx
push eax
mov eax, dword [section..data]
mov edx, 0x412af0
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x14
pop ecx
call fcn.00421fda
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4816a9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, ebx
mov dword [esi + 0x1c], ebx
or dword [esi + 0xc], 4
mov eax, dword [section..data]
cmp eax, section..data
je 0x4816e7
test dword [eax + 0x1c], 0x800
je 0x4816e7
cmp byte [eax + 0x19], 4
jb 0x4816e7
call fcn.0042386b
push ebx
push eax
mov eax, dword [section..data]
mov edx, 0x412af0
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x15
pop ecx
call fcn.00421fda
test edi, edi
je 0x4816f2
push edi
call fcn.004fb234
pop ecx
cmp dword [esi + 0x1c], 0
je 0x481704
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x1c], ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret