joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ab1b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x1004
call fcn.0059bb50
mov eax, dword [0x6b0d44]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebp
push esi
mov esi, dword [esp + 0x1014]
xor ebp, ebp
push edi
test esi, esi
je 0x47ab48
mov edi, dword [esi + 0x30]
jmp 0x47ab4a
mov edi, ebp
test esi, esi
je 0x47ad27
cmp dword [esi + 0x78], ebp
je 0x47ad27
cmp dword [esi + 0x78], 3
je 0x47ad27
push ebx
mov ecx, esi
call fcn.0047d2ff
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [esi + 0x7c]
call ebx
cmp dword [esi + 0x78], 1
jl 0x47ad1a
cmp dword [esi + 0x78], 2
jg 0x47ad1a
jne 0x47abc0
cmp dword [edi + 0x138], ebp
je 0x47abc0
push ebp
push 1
push dword [esi + 0x7c]
mov dword [esi + 0x78], 3
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebp
push esi
push edi
call dword [edi + 0x138]
add esp, 0xc
push 0xffffffffffffffff
push dword [esi + 0x7c]
call ebx
jmp 0x47abc7
mov dword [esi + 0x78], 3
mov eax, dword [esi + 0xf0]
test eax, eax
jle 0x47abe4
mov edx, dword [esi + 0x3c]
mov ecx, edi
push eax
push dword [esi + 0xec]
call fcn.00479dc5
pop ecx
pop ecx
mov eax, dword [esi + 0x40]
cmp dword [edi + eax*4 + 0x14c], ebp
je 0x47acdb
push dword [esi + 0x34]
call fcn.00566e60
push dword [esi + 0x34]
call fcn.00565900
push eax
call fcn.0049ebb0
add esp, 0xc
test eax, eax
je 0x47acdb
push 0x1000
lea eax, [esp + 0x14]
push eax
push dword [esi + 0x34]
call fcn.00565900
pop ecx
push eax
call fcn.0049f510
mov ecx, dword [esi + 0x40]
add esp, 0xc
mov ebp, eax
mov ecx, dword [edi + ecx*4 + 0x14c]
cmp dword [ecx + 0x88], 0
je 0x47aca9
mov ebx, dword [esi + 0x44]
mov edx, ebx
neg edx
sbb edx, edx
lea ecx, [ebx + 0x20]
and edx, ecx
test dword [edx], 0x20000
je 0x47ac74
mov dx, word [esi + 0x3c]
lea eax, [esp + 0x10]
push ebp
push ecx
mov ecx, dword [edi + 0x1b8]
push eax
call fcn.0047fe04
jmp 0x47ac9b
mov ecx, ebx
lea eax, [ebx + 0x20]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esp + 0x10]
test dword [ecx], 0x10000
je 0x47aca0
push ebp
push ecx
mov ecx, dword [edi + 0x1b8]
mov edx, ebx
push eax
call fcn.0047fb7a
add esp, 0xc
jmp 0x47acc1
push 2
push ebp
push eax
push 1
push ebx
jmp 0x47acb6
push 2
push ebp
lea eax, [esp + 0x18]
push eax
push 1
push dword [esi + 0x44]
push dword [edi + 0x1c]
call fcn.00467d91
add esp, 0x18
push dword [esi + 0x34]
call fcn.00565900
push eax
call fcn.0049ebb0
pop ecx
pop ecx
test eax, eax
jne 0x47ac15
xor ebp, ebp
mov ecx, dword [edi + 0x24]
lea edx, [esi + 1]
call fcn.0046fb73
mov ecx, dword [esi + 0x30]
mov edx, esi
mov ecx, dword [ecx + 0x24]
call fcn.0046fb73
mov edx, dword [esi + 0x40]
mov ecx, edi
call fcn.004778ad
mov eax, dword [esi + 0x3c]
mov ecx, esi
mov dword [edi + eax*4 + 0x174], ebp
call fcn.0047aa48
push 1
push esi
call fcn.005cdee0
pop ecx
pop ecx
jmp 0x47ad26
push ebp
push 1
push dword [esi + 0x7c]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
pop ebx
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0059b3f0
add esp, 0x1004
ret
Function at 0x47d218
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ebp, edx
push 0x153e
push 0x7649f4
push 1
lea ebx, [edi + 0xc]
mov dword [esp + 0x1c], ecx
push ebx
call fcn.005ce020
mov esi, eax
add esp, 0x10
test esi, esi
je 0x47d2b2
and dword [esi + 4], 0
push edi
mov dword [esi], 3
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 8], ax
lea ecx, [esi + 0xc]
push edi
push dword [esp + 0x1c]
xor eax, eax
mov edx, edi
mov word [esi + 0xa], ax
call section..text
and dword [esp + 0x24], 0
mov eax, 0x4000
mov edi, dword [esp + 0x18]
mov word [esp + 0x24], ax
push dword [esp + 0x24]
movzx edx, bp
mov ecx, dword [edi + 0x80]
call fcn.0047064e
push 0x32
push ebx
push esi
mov edx, ebp
mov ecx, edi
call fcn.0047a49c
push 1
push esi
call fcn.005cdee0
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x153e
push esi
push edi
mov edx, 0x764a10
xor ecx, ecx
call fcn.0047145c
push edi
push 0x764a2c
push 0x764a48
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x47e4ca
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebp, 0x18de
mov esi, 0x214
push ebp
push 0x764bfc
push 1
push esi
mov ebx, ecx
call fcn.005ce020
mov edi, eax
add esp, 0x10
test edi, edi
je 0x47e60d
push esi
push 0
push edi
call fcn.0059de40
add esp, 0xc
mov dword [edi + 0x108], 0xffff
xor ecx, ecx
call fcn.0046febf
push 2
mov dword [edi + 0x28], eax
lea esi, [edi + 0x34]
pop eax
push 0
mov dword [edi + 0x14], str.ILibWebRTC
mov dword [edi + 0x30], 0x481faa
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x17
mov word [edi + 0x36], ax
lea ebp, [edi + 0x44]
pop eax
push 0
mov word [ebp], ax
call dword [sym.imp.WS2_32.dll_htons]
push edi
push 0
push fcn.0047dbd1
push 0
push esi
mov esi, 0x800
mov word [edi + 0x46], ax
mov edx, esi
mov dword [edi + 0xc], ebx
mov ecx, ebx
mov dword [edi + 8], 0x477639
call fcn.0046a1b2
add esp, 0x14
mov dword [edi + 0x1c], eax
test eax, eax
jne 0x47e589
push 1
push edi
call fcn.005cdee0
pop ecx
pop ecx
xor eax, eax
jmp 0x47e608
push edi
push 0
push fcn.0047dbd1
push 0
push ebp
mov edx, esi
mov ecx, ebx
call fcn.0046a1b2
add esp, 0x14
mov dword [edi + 0x20], eax
test eax, eax
je 0x47e57b
mov edx, edi
mov ecx, ebx
call fcn.0046c508
mov ecx, dword [edi + 0x1c]
call fcn.00469f81
mov ebp, dword [sym.imp.WS2_32.dll_htons]
movzx eax, ax
push eax
call ebp
mov ecx, dword [edi + 0x20]
mov word [edi + 0x36], ax
call fcn.00469f81
movzx eax, ax
push eax
call ebp
mov ecx, ebx
mov word [edi + 0x46], ax
call fcn.0046c53e
mov dword [edi + 0x24], eax
lea eax, [edi + 0x10c]
push 0x20
push eax
call fcn.004a39d0
push ecx
mov ecx, ebx
call fcn.0047f50f
mov dword [edi + 0x1b8], eax
add esp, 0xc
mov dword [eax + 0x2c], edi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x764c18
push esi
push ebp
xor ecx, ecx
call fcn.0047145c
push ebp
push 0x764c34
push 0x764c50
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x47f50f
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0x1b7a
push 0x764d88
push 1
push 0x5c
mov edi, ecx
call fcn.005ce020
mov esi, eax
add esp, 0x10
test esi, esi
je 0x47f5a3
push 0x5c
push 0
push esi
call fcn.0059de40
push 0
push 0
push fcn.00401150
push 0x47f4fa
push 0x47f3e5
mov edx, 0x1000
mov dword [esi + 8], 0x47e76a
mov ecx, edi
call fcn.00467bd3
add esp, 0x20
mov dword [esi + 0x30], eax
xor ecx, ecx
mov dword [esi + 0x1c], 0x47e316
mov dword [esi + 0x20], 0x47e374
mov dword [esi + 0x24], 0x47e3d0
mov dword [esi + 0x28], 0x47e3f5
call fcn.0046d68a
mov edx, esi
mov dword [esi + 0x44], eax
mov ecx, edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x14], str.ILibWebRTC_TURN_Client
call fcn.0046c508
pop edi
mov eax, esi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0xfe
mov esi, 0x1b7b
push edi
push esi
mov edx, 0x764da4
xor ecx, ecx
call fcn.0047145c
push esi
push 0x764dc0
push 0x764ddc
call fcn.004010b4
add esp, 0x18
push edi
call fcn.005aae60
int3

Function at 0x47f650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6b0d44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
movsx eax, byte [ebx + 1]
sub eax, 1
je 0x47f6dd
sub eax, 1
jne 0x47f706
push 0xc
pop edx
push edx
push ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], 0x2112a442
call section..text
pop ecx
pop ecx
push 7
pop ecx
xor eax, eax
mov edi, esi
push 0x17
rep stosd dword es:[edi], eax
pop eax
push 0x10
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
cmp eax, 0x10
jne 0x47f6c5
mov al, byte [ebx + ecx + 4]
xor al, byte [ebp + ecx - 0x14]
mov byte [esi + ecx + 8], al
inc ecx
cmp ecx, 0x10
jl 0x47f6b1
jmp 0x47f706
lea edx, [esi + 0x17]
lea edi, [ebx + 0x13]
mov al, byte [ebp + ecx - 0x14]
xor al, byte [edi]
inc ecx
dec edi
mov byte [edx], al
dec edx
cmp ecx, 0x10
jl 0x47f6cb
jmp 0x47f706
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, eax
mov edi, esi
xor eax, eax
xor ecx, 0x2112a442
push 2
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push ecx
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esi + 4], eax
movzx eax, word [ebx + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, 0x2112
xor ax, cx
movzx eax, ax
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp - 4]
pop edi
mov word [esi + 2], ax
xor ecx, ebp
pop esi
pop ebx
call fcn.0059b3f0
mov esp, ebp
pop ebp
ret
Function at 0x47f738
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x6b0d44]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, edx
push edi
mov edi, dword [esp + 0x38]
movzx eax, word [esi + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, 0x2112
xor ebx, ebx
xor ax, cx
mov byte [ebp], bl
movzx ecx, ax
push 2
pop eax
cmp word [esi], ax
push ecx
setne al
inc al
mov byte [ebp + 1], al
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp + 2], ax
movzx eax, word [esi]
dec eax
sub eax, 1
je 0x47f809
sub eax, 0x15
jne 0x47f824
push 0xc
pop edx
push edx
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 0x2112a442
call section..text
pop ecx
pop ecx
push 0x10
call dword [sym.imp.WS2_32.dll_htonl]
cmp eax, 0x10
jne 0x47f7cd
mov al, byte [esp + ebx + 0x10]
xor byte [esi + ebx + 8], al
inc ebx
cmp ebx, 0x10
jl 0x47f7bd
jmp 0x47f7f2
lea edi, [esi + 0x17]
mov ecx, ebx
mov edx, edi
mov al, byte [esp + ecx + 0x10]
xor al, byte [edx]
mov byte [esp + ecx + 0x20], al
inc ecx
dec edx
cmp ecx, 0x10
jl 0x47f7d4
mov al, byte [esp + ebx + 0x20]
inc ebx
mov byte [edi], al
dec edi
cmp ebx, 0x10
jl 0x47f7e5
push 0x10
lea eax, [esi + 8]
push eax
push 0x10
lea ecx, [ebp + 4]
pop edx
call section..text
pop ecx
pop ecx
push 0x14
jmp 0x47f823
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
xor eax, 0x2112a442
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp + 4], eax
push 8
pop ebx
mov ecx, dword [esp + 0x30]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059b3f0
add esp, 0x24
ret

Function at 0x47fb7a
Capabilities:
Terminate process

Disassembly:
sub esp, 0x2c
mov eax, dword [0x6b0d44]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
push esi
push edi
push 0x1c98
push 0x764f08
mov dword [esp + 0x1c], eax
mov ebp, ecx
lea eax, [ebx + 0x32]
mov dword [esp + 0x18], edx
push 1
push eax
call fcn.005ce020
mov edi, eax
add esp, 0x10
test edi, edi
je 0x47fc45
lea eax, [esp + 0x18]
push 0xc
push eax
call fcn.004a39d0
lea eax, [esp + 0x20]
mov ecx, edi
push eax
push 0x16
pop edx
call fcn.0047f5dc
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x30]
mov esi, eax
lea eax, [esp + 0x24]
push eax
call fcn.0047f738
push eax
lea eax, [esp + 0x38]
mov edx, esi
push eax
push 0x12
mov ecx, edi
call fcn.0047f60e
push ebx
push dword [esp + 0x34]
add esi, eax
mov ecx, edi
push 0x13
mov edx, esi
call fcn.0047f60e
add esi, eax
mov ecx, edi
mov edx, esi
call fcn.00477b1a
push 0
add esi, eax
push esi
push edi
push 1
push 0
push dword [ebp + 0x30]
call fcn.00467d91
mov ecx, dword [esp + 0x78]
add esp, 0x40
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059b3f0
add esp, 0x2c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0xfe
mov esi, 0x1c9a
push edi
push esi
mov edx, 0x764f24
xor ecx, ecx
call fcn.0047145c
push esi
push str...microstackILibWebRTC.c
push 0x764f5c
call fcn.004010b4
add esp, 0x18
push edi
call fcn.005aae60
int3
Function at 0x47fe85
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
test edx, edx
jne 0x47fe94
xor eax, eax
jmp 0x47ff72
push esi
mov esi, dword [ebp + 8]
or ecx, 0xffffffff
cmp esi, 8
jb 0x47ff51
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x69e0c0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x69e0c0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x69e0c0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x69e0c0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x69e0c0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x69e0c0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x69e0c0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x69e0c0]
sub edi, 1
jne 0x47feaa
pop edi
test esi, esi
je 0x47ff6d
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x69e0c0]
inc edx
sub esi, 1
jne 0x47ff55
not ecx
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x480f52
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
push 0xfffffffffffffffd
pop esi
test edi, edi
je 0x4810c5
cmp dword [edi + 0x84], 0
jne 0x4810c5
cmp dword [edi + 0xdc], 0
jne 0x4810c5
mov ecx, dword [edi + 0x94]
call fcn.0047700d
mov ebx, eax
test ebx, ebx
je 0x4810c5
cmp dword [ebx + 0x28], 3
jne 0x480fe9
mov ecx, dword [ebx + 0x24]
mov ebp, 0x7655f4
movzx eax, word [ecx]
cmp ax, word [ebp]
jne 0x480fe9
movzx eax, byte [ecx + 2]
cmp al, byte [ebp + 2]
jne 0x480fe9
cmp dword [esp + 0x18], 0
jle 0x480fd9
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push edx
push edi
call fcn.00480ecf
add esp, 0x14
jmp 0x4810ae
cmp dword [esp + 0x20], 0
je 0x4810b5
jmp 0x4810a7
mov ebp, dword [esp + 0x18]
test ebp, ebp
jle 0x481067
push 0x745
push 0x7655f8
push 1
push 0x10
call fcn.005ce020
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4810cd
push ebp
push str._X_r_n
push 0x10
push esi
call fcn.0040112a
push 0
push 0
push eax
push esi
push edi
call fcn.00480ecf
add esp, 0x24
cmp eax, 0xfffffffc
je 0x481064
push 0
push dword [esp + 0x20]
push ebp
push dword [esp + 0x1c]
push edi
call fcn.00480ecf
add esp, 0x14
cmp eax, 0xfffffffc
je 0x481064
push 0
push 1
push 2
push 0x765684
push edi
call fcn.00480ecf
add esp, 0x14
mov esi, eax
jmp 0x481067
push 0xfffffffffffffffc
pop esi
cmp dword [esp + 0x20], 1
jne 0x4810b0
cmp esi, 0xfffffffc
je 0x4810a3
cmp esi, 0xfffffffe
je 0x4810a3
cmp dword [ebx + 4], 4
jne 0x481093
push 4
push str.HEAD
push dword [ebx]
call fcn.005e4560
add esp, 0xc
test eax, eax
je 0x4810a3
push 1
push 1
push 5
push str.0_r_n_r_n
jmp 0x480fcb
test esi, esi
js 0x4810b0
mov ecx, edi
call fcn.0048097c
mov esi, eax
cmp esi, 1
je 0x4810c5
cmp dword [edi + 0xac], 0
je 0x4810c5
and dword [edi + 0xac], 0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x745
push esi
push edi
mov edx, 0x765618
xor ecx, ecx
call fcn.0047145c
push edi
push 0x765638
push 0x765658
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3

Function at 0x4812b1
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov ebp, edx
push 0x94
push 0x76571c
push 1
lea ebx, [edi + 1]
mov dword [esp + 0x1c], ecx
push ebx
call fcn.005ce020
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4812fd
mov eax, dword [esp + 0x10]
mov edx, ebx
add eax, ebp
mov ecx, esi
push edi
push eax
call section..text
pop ecx
pop ecx
mov byte [esi + edi], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xfe
mov edx, 0x765740
push eax
push esi
xor ecx, ecx
lea edi, [esi - 0x6a]
push edi
call fcn.0047145c
push edi
push 0x765764
push 0x765788
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x482388
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0x350
push 0x765b8c
push 1
push 0x7c
mov edi, ecx
call fcn.005ce020
mov esi, eax
add esp, 0x10
test esi, esi
je 0x482486
push 0x7c
push 0
push esi
call fcn.0059de40
add esp, 0xc
mov dword [esi + 0x14], str.ILibWrapper_WebRTC_ConnectionFactory
mov edx, esi
mov dword [esi + 8], 0x481d93
mov ecx, edi
call fcn.0046c508
push ecx
mov ecx, edi
call fcn.0047e4ca
mov dword [esi + 0x20], eax
pop ecx
test eax, eax
jne 0x4823fd
mov ecx, dword [edi + 0x2f0]
mov edx, esi
call fcn.00470014
push 1
push esi
call fcn.005cdee0
pop ecx
xor eax, eax
jmp 0x482482
mov edx, dword [esp + 0xc]
mov ecx, esi
call fcn.00481c7e
cmp dword [esp + 0xc], 1
je 0x48241f
mov edx, dword [esi + 0x38]
lea eax, [esi + 0x3c]
mov ecx, dword [esi + 0x20]
push eax
call fcn.0047e448
pop ecx
mov eax, dword [esi + 0x20]
mov edx, 0x47751c
push 0
push 0x10
pop ecx
mov dword [eax + 0x138], 0x482040
mov dword [eax + 0x13c], 0x482094
mov dword [eax + 0x140], 0x482117
mov eax, dword [esi + 0x20]
mov dword [eax + 0x1ac], 0x4821a3
mov dword [eax + 0x1b0], 0x482149
mov dword [eax + 0x1b4], 0x4822b2
mov dword [eax + 0x1a8], fcn.00401150
call fcn.004705bb
mov dword [esi + 0x24], eax
mov eax, esi
mov dword [esi + 0xc], edi
pop ecx
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0xfe
mov esi, 0x351
push edi
push esi
mov edx, 0x765bb0
xor ecx, ecx
call fcn.0047145c
add esp, 0xc
push esi
push 0x765bd4
push 0x765bf8
call fcn.004010b4
add esp, 0xc
push edi
call fcn.005aae60
int3

Function at 0x482972
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
mov ebx, ecx
mov dword [esp + 0xc], edx
push edi
push 0x48
pop ecx
mov edx, dword [ebx - 0xc]
call fcn.0046c159
mov ebp, dword [esp + 0x18]
mov edi, eax
push 0x4ec
push 0x765eb0
push 1
lea esi, [ebp + 1]
mov dword [edi + 0x14], str.ILibWrapper_WebRTC_DataChannel
push esi
mov dword [edi + 0x40], ebx
call fcn.005ce020
add esp, 0x10
mov dword [edi + 0x34], eax
test eax, eax
je 0x482a28
push ebp
push dword [esp + 0x14]
mov edx, esi
mov ecx, eax
call section..text
mov eax, dword [edi + 0x34]
mov esi, dword [esp + 0x24]
pop ecx
pop ecx
mov byte [eax + ebp], 0
mov word [edi + 0x30], si
mov dword [edi + 0x38], 0x4665c1
mov eax, dword [ebx + 0x74]
push 0xffffffffffffffff
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx edx, word [edi + 0x30]
mov ecx, dword [ebx + 0x74]
push edi
call fcn.0047064e
mov eax, dword [ebx + 0x74]
pop ecx
push 0
push 1
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov ecx, edi
call fcn.0048127e
mov ecx, dword [ebx]
mov edx, esi
push ebp
push dword [esp + 0x14]
call fcn.0047d218
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x4ec
push esi
push edi
mov edx, 0x765ed4
xor ecx, ecx
call fcn.0047145c
push edi
push str...microstackILibWrapperWebRTC.c
push 0x765f1c
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x482a61
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [esp + 0x20]
push eax
xor esi, esi
xor eax, eax
push 0x69ed40
inc eax
mov dword [esp + 0x28], esi
push eax
push esi
push 0x69ed20
mov ebp, edx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], esi
mov ebx, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call edi
test eax, eax
js 0x482b66
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x482b66
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x482b66
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
test eax, eax
js 0x482b66
lea eax, [esp + 0x10]
push eax
push 0x69ed60
push 1
push esi
push 0x69ed30
call edi
test eax, eax
js 0x482b66
push ebp
mov ebp, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
call ebp
mov edi, eax
test edi, edi
je 0x482b66
mov eax, dword [esp + 0x10]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x482b56
push 0x69ebc0
call ebp
mov esi, eax
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x482b56
mov ecx, dword [esp + 0x10]
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x20]
test eax, eax
js 0x482b56
mov eax, dword [esp + 0x14]
push dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
test eax, eax
push 1
pop eax
cmovns ebx, eax
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
test esi, esi
je 0x482b66
push esi
call edi
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x482b74
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x482b82
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x482b90
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x482b9e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov edx, dword [esp + 0x20]
test edx, edx
je 0x482bac
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x14
ret
Function at 0x4831ae
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6b0d44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x48320f
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0059b3f0
mov esp, ebp
pop ebp
ret

Function at 0x48321e
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x128]
sub esp, 0x1a8
mov eax, dword [0x6b0d44]
xor eax, ebp
mov dword [ebp + 0x124], eax
push esi
push 0x104
lea eax, [ebp - 0x44]
mov esi, ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x48328f
push 0x38
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], 0x3c
push 0
push eax
call fcn.0059de40
and dword [ebp - 0x78], 0
lea eax, [ebp - 0x44]
add esp, 0xc
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x74], str.runas
mov dword [ebp - 0x6c], esi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
jmp 0x483291
xor eax, eax
mov ecx, dword [ebp + 0x124]
xor ecx, ebp
pop esi
call fcn.0059b3f0
lea esp, [ebp + 0x128]
pop ebp
ret