joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b165
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x14a7
mov edi, edx
push ebx
push 0x758a48
push 1
push 8
mov esi, ecx
call fcn.005f5c60
mov edx, eax
add esp, 0x10
test edx, edx
je 0x48b196
mov eax, dword [esi]
mov dword [edx], edi
pop edi
mov dword [esi], edx
pop esi
mov dword [edx + 4], eax
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x758a64
push esi
push ebx
xor ecx, ecx
call fcn.0048f95e
push ebx
push 0x758a80
push 0x758a9c
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
int3

Function at 0x48b232
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, 0x1516
mov esi, ecx
push edi
push 0x758ac0
push 1
push 4
call fcn.005f5c60
mov edx, eax
add esp, 0x10
test edx, edx
je 0x48b25c
mov eax, dword [esi]
pop edi
mov dword [edx], eax
mov eax, edx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x758adc
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x758af8
push 0x758b14
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
int3

Function at 0x48b30b
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
je 0x48b35c
cmp dword [ebx - 0x10], 0x2c
jbe 0x48b355
push 0x10
pop edx
call fcn.004878c7
push 0x1c
pop edx
mov esi, eax
call fcn.004878c7
mov edx, eax
test esi, esi
je 0x48b40b
test edx, edx
je 0x48b40b
xor eax, eax
mov edi, edx
push 7
pop ecx
rep stosd dword es:[edi], eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esi + 8], ebx
jmp 0x48b3fc
xor eax, eax
jmp 0x48b407
mov edi, 0x1583
push edi
push 0x758b94
push 1
push 0x10
call fcn.005f5c60
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x48b3a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x758bb0
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x758bcc
push 0x758be8
jmp 0x48b438
mov edi, 0x1584
push edi
push 0x758c0c
push 1
push 0x1c
call fcn.005f5c60
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x48b3ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x758c28
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x758c44
push 0x758c60
jmp 0x48b438
xor eax, eax
mov edi, edx
push 7
pop ecx
rep stosd dword es:[edi], eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esi], edx
test ebx, ebx
jne 0x48b405
mov dword [esi + 0xc], ebx
mov eax, esi
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1577
push esi
push edi
mov edx, 0x758b38
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x758b54
push 0x758b70
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d08b0
int3
Function at 0x48b547
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, ecx
push esi
push edi
mov edi, edx
mov dword [esp + 0x10], edi
test ebx, ebx
je 0x48b69a
cmp ebx, 0x7fffffff
ja 0x48b69a
push dword [ebp + 4]
mov esi, dword [ebp]
mov edx, ebx
mov ecx, edi
call fcn.0048b47c
pop ecx
mov dword [esp + 0x18], eax
cmp dword [esi + 8], eax
jne 0x48b5b2
cmp dword [ebp + 4], 0
jne 0x48b59c
cmp dword [esi + 0x10], ebx
jne 0x48b5b2
push ebx
push edi
push dword [esi + 0xc]
call fcn.006502a0
jmp 0x48b5ab
cmp dword [esi + 0x10], ebx
jne 0x48b5b2
push ebx
push edi
push dword [esi + 0xc]
call fcn.005f0620
add esp, 0xc
test eax, eax
je 0x48b5c0
mov eax, dword [esi]
test eax, eax
je 0x48b5c7
mov esi, eax
mov eax, dword [esp + 0x18]
jmp 0x48b580
mov eax, esi
jmp 0x48b69c
cmp dword [esp + 0x1c], 0
je 0x48b69a
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x48b5f1
push 0x1643
push 0x758c84
push 1
push 0x1c
call fcn.005f5c60
add esp, 0x10
jmp 0x48b5f9
push 0x1c
pop edx
call fcn.004878c7
mov edi, eax
mov dword [esi], edi
test edi, edi
je 0x48b6a2
xor eax, eax
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [esi]
lea edi, [ebx + 1]
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], esi
mov eax, dword [esi]
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 8]
mov ebp, 0x1647
test ecx, ecx
jne 0x48b63c
push ebp
push 0x758cfc
push 1
push edi
call fcn.005f5c60
add esp, 0x10
jmp 0x48b643
mov edx, edi
call fcn.004878c7
mov ecx, eax
mov eax, dword [esi]
mov dword [eax + 0xc], ecx
test ecx, ecx
jne 0x48b675
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x758d18
push esi
push ebp
xor ecx, ecx
call fcn.0048f95e
push ebp
push 0x758d34
push 0x758d50
jmp 0x48b6cc
mov ecx, dword [esi]
mov edx, edi
push ebx
push dword [esp + 0x14]
mov ecx, dword [ecx + 0xc]
call section..text
mov eax, dword [esi]
pop ecx
pop ecx
mov eax, dword [eax + 0xc]
mov byte [ebx + eax], 0
mov eax, dword [esi]
mov dword [eax + 0x10], ebx
mov eax, dword [esi]
jmp 0x48b69c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1643
push esi
push edi
mov edx, 0x758ca0
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x758cbc
push 0x758cd8
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
int3
Function at 0x48b7e5
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0x1757
push 0x758e68
xor al, al
mov dword [esp + 0x20], ecx
push 1
push 0xc
mov edi, edx
mov byte [esp + 0x23], al
xor ebx, ebx
xor ebp, ebp
call fcn.005f5c60
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48b998
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
and dword [esi], ebx
and dword [esi + 8], ebx
lea eax, [ecx + edi]
mov dword [esp + 0x14], eax
lea eax, [edi + edx]
mov dword [esp + 0x1c], eax
cmp edi, eax
jae 0x48b925
mov al, byte [esp + 0x13]
test al, al
jne 0x48b878
mov al, byte [edi + ecx]
cmp al, 0x22
jne 0x48b86b
xor ebp, ebp
mov byte [esp + 0x13], al
inc ebp
inc ebx
inc edi
cmp edi, dword [esp + 0x1c]
jae 0x48b925
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
jmp 0x48b83f
cmp al, 0x27
jne 0x48b886
xor ebp, ebp
mov byte [esp + 0x13], al
inc ebp
jmp 0x48b886
cmp byte [edi + ecx], al
jne 0x48b886
xor eax, eax
test ebp, ebp
sete al
mov ebp, eax
test ebp, ebp
jne 0x48b855
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edx
mov edx, edi
call fcn.0048b7ac
add esp, 0xc
test eax, eax
je 0x48b855
push 0x178a
push 0x758ee0
push 1
push 0xc
call fcn.005f5c60
mov ecx, eax
add esp, 0x10
test ecx, ecx
je 0x48b8f3
mov edx, dword [esp + 0x14]
and dword [ecx + 8], ebp
mov dword [ecx], edx
mov dword [ecx + 4], ebx
cmp dword [esi], ebp
je 0x48b8d5
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x48b8d7
mov dword [esi], ecx
mov eax, dword [esp + 0x2c]
dec edi
inc dword [esi + 8]
add edi, eax
add eax, ebx
mov dword [esi + 4], ecx
add edx, eax
xor ebx, ebx
mov dword [esp + 0x14], edx
jmp 0x48b856
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfd
mov ebx, 0x178a
push esi
push ebx
mov edx, 0x758efc
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push ebx
push 0x758f18
push 0x758f34
jmp 0x48b9c5
mov edi, 0x17b0
push edi
push 0x758f58
push 1
push 0xc
call fcn.005f5c60
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x48b96c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x758f74
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x758f90
push 0x758fac
jmp 0x48b9c5
mov eax, dword [esp + 0x14]
and dword [ecx + 8], 0
mov dword [ecx], eax
mov dword [ecx + 4], ebx
cmp dword [esi], 0
je 0x48b986
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x48b988
mov dword [esi], ecx
inc dword [esi + 8]
mov eax, esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1757
push esi
push edi
mov edx, 0x758e84
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x758ea0
push 0x758ebc
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d08b0
int3
Function at 0x48ba0a
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, edx
xor ebx, ebx
mov ebp, ecx
test edi, edi
je 0x48ba1e
add ebp, edi
xor edi, edi
push 0x17e5
push 0x758fd0
push 1
push 0xc
call fcn.005f5c60
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48bb7a
mov eax, dword [esp + 0x1c]
lea ecx, [edi + ebp]
and dword [esi], ebx
and dword [esi + 8], ebx
mov dword [esp + 0x10], ecx
cmp byte [ecx + eax - 1], bl
lea edx, [eax - 1]
cmovne edx, eax
mov dword [esp + 0x14], edx
jmp 0x48bad2
push dword [esp + 0x24]
mov ecx, ebp
push dword [esp + 0x24]
push edx
mov edx, edi
call fcn.0048b7ac
add esp, 0xc
test eax, eax
je 0x48bacc
push 0x17f8
push 0x759048
push 1
push 0xc
call fcn.005f5c60
mov ecx, eax
add esp, 0x10
test ecx, ecx
je 0x48bb20
mov edx, dword [esp + 0x10]
and dword [ecx + 8], 0
mov dword [ecx], edx
mov dword [ecx + 4], ebx
cmp dword [esi], 0
je 0x48bab1
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x48bab3
mov dword [esi], ecx
mov eax, dword [esp + 0x24]
dec edi
inc dword [esi + 8]
add edi, eax
add eax, ebx
mov dword [esi + 4], ecx
add edx, eax
xor ebx, ebx
mov dword [esp + 0x10], edx
jmp 0x48bacd
inc ebx
mov edx, dword [esp + 0x14]
inc edi
cmp edi, edx
jb 0x48ba5e
mov edi, 0x181e
push edi
push 0x7590c0
push 1
push 0xc
call fcn.005f5c60
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x48bb4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x7590dc
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x7590f8
push 0x759114
jmp 0x48bba7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov ebx, 0x17f8
push esi
push ebx
mov edx, 0x759064
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push ebx
push 0x759080
push 0x75909c
jmp 0x48bba7
mov eax, dword [esp + 0x10]
and dword [ecx + 8], 0
mov dword [ecx], eax
mov dword [ecx + 4], ebx
cmp dword [esi], 0
je 0x48bb69
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x48bb6b
mov dword [esi], ecx
inc dword [esi + 8]
mov eax, esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x17e5
push esi
push edi
mov edx, 0x758fec
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x759008
push 0x759024
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d08b0
int3
Function at 0x48c27f
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
sub esp, 0xc
mov dword [esp + 0x24], ecx
xor edi, edi
mov ebx, edx
mov ebp, edi
call fcn.0048c25c
push 0x19f5
push 0x759434
push 1
push eax
mov dword [esp + 0x2c], eax
call fcn.005f5c60
mov esi, eax
add esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], esi
mov dword [eax], esi
test esi, esi
je 0x48c345
mov ecx, ebx
mov dword [esp + 0x2c], ecx
test ebx, ebx
je 0x48c33b
mov eax, 0x320
cmp ecx, ebx
je 0x48c2fd
mov edx, dword [esp + 0x10]
lea ecx, [esi + edi]
push 3
push dword [esp + 0x24]
sub edx, edi
call section..text
pop ecx
pop ecx
mov ecx, dword [esp + 0x2c]
add edi, 3
add ebp, 3
mov eax, 0x320
mov edx, dword [esp + 0x10]
cmp ecx, eax
mov esi, ecx
cmova esi, eax
mov eax, dword [esp + 0x18]
sub eax, ecx
sub edx, edi
mov ecx, dword [esp + 0x14]
add eax, ebx
push esi
push eax
lea ecx, [ecx + edi]
call section..text
pop ecx
pop ecx
mov ecx, dword [esp + 0x2c]
add edi, esi
add ebp, esi
mov eax, 0x320
sub ecx, esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0x2c], ecx
jne 0x48c2d4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x19f5
push esi
push edi
mov edx, 0x759450
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x75946c
push 0x759488
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
int3
Function at 0x48c694
Capabilities:
Set socket configuration
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, ecx
push 0x17
pop ebx
movzx eax, word [edi]
cmp ax, bx
jne 0x48c6db
cmp dword [0x75a8f0], 0
jne 0x48c6db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 0x1ab1
mov edx, 0x759560
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
or eax, 0xffffffff
jmp 0x48c760
push dword [ebp + 8]
push edx
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x48c702
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 0x1ab2
mov edx, 0x75957c
jmp 0x48c6c9
cmp word [edi], bx
jne 0x48c71c
push 4
lea eax, [ebp - 4]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x48c767
cmp word [edi], bx
push 0x10
pop eax
push 0x1c
pop ecx
cmove eax, ecx
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x48c75e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 0x1ac6
mov edx, 0x7595b4
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x48c6d3
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1abd
mov edx, 0x759598
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push 0xfd
call fcn.005d08b0
int3
Function at 0x48cc7d
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push 0x1b80
push 0x7597f4
push 1
mov edi, 0x88
push edi
call fcn.005f5c60
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48ccd9
push edi
push 0
push esi
call fcn.005c3840
and dword [esi + 0x10], 0
add esp, 0xc
or dword [esi + 0x34], 0xffffffff
xor ecx, ecx
or dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x24], 0x75986c
mov dword [esi + 0x28], 3
call fcn.0048b447
mov dword [esi + 0x84], eax
mov eax, esi
pop edi
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0xfe
mov esi, 0x1b81
push edi
push esi
mov edx, 0x759810
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push esi
push 0x75982c
push 0x759848
call fcn.00401109
add esp, 0xc
push edi
call fcn.005d08b0
int3

Function at 0x48cddb
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, edx
push edi
cmp dword [esi + 0x38], 0
je 0x48cdf5
push 1
push dword [esi + 0x24]
call fcn.005f5b20
pop ecx
pop ecx
mov edi, dword [esp + 0x14]
push 0x1bcd
push 0x759870
push 1
lea ebx, [edi + 1]
mov dword [esi + 0x38], 1
push ebx
call fcn.005f5c60
add esp, 0x10
mov dword [esi + 0x24], eax
test eax, eax
je 0x48ce38
push edi
push ebp
mov edx, ebx
mov ecx, eax
call section..text
mov eax, dword [esi + 0x24]
pop ecx
pop ecx
mov byte [edi + eax], 0
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1bcd
push esi
push edi
mov edx, 0x75988c
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x7598a8
push 0x7598c4
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
int3

Function at 0x48ce71
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x1c], 0
mov dword [esi + 0x18], edx
je 0x48ce8c
push 1
push dword [esi + 0x1c]
call fcn.005f5b20
pop ecx
pop ecx
mov edi, dword [esp + 0x18]
mov ebp, 0x1bde
push ebp
push 0x7598e8
push 1
lea ebx, [edi + 1]
push ebx
call fcn.005f5c60
add esp, 0x10
mov dword [esi + 0x1c], eax
test eax, eax
je 0x48cecf
push edi
push dword [esp + 0x18]
mov edx, ebx
mov ecx, eax
call section..text
mov eax, dword [esi + 0x1c]
pop ecx
pop ecx
mov byte [edi + eax], 0
mov dword [esi + 0x20], edi
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x759904
push esi
push ebp
xor ecx, ecx
call fcn.0048f95e
push ebp
push 0x759920
push 0x75993c
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
int3
Function at 0x48cf03
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x10], edx
push edi
mov edi, dword [esp + 0x1c]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x48cf4b
mov ebx, dword [esp + 0x24]
lea eax, [ebx + 2]
add eax, edi
cmp dword [ecx - 0x10], eax
jbe 0x48d028
lea ebp, [edi + 1]
mov edx, ebp
call fcn.004878c7
mov ecx, dword [esi + 0x10]
lea edx, [ebx + 1]
mov dword [esi], eax
call fcn.004878c7
mov dword [esi + 8], eax
jmp 0x48cfed
mov ebx, 0x1bff
lea ebp, [edi + 1]
push ebx
push 0x7599bc
push 1
push ebp
call fcn.005f5c60
add esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x48cf97
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x7599d8
push esi
push ebx
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push ebx
push 0x7599f4
push 0x759a10
jmp 0x48d055
mov ebx, dword [esp + 0x24]
push 0x1c00
push 0x759a34
push 1
lea eax, [ebx + 1]
push eax
call fcn.005f5c60
add esp, 0x10
mov dword [esi + 8], eax
test eax, eax
jne 0x48cfe9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1c00
push esi
push edi
mov edx, 0x759a50
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x759a6c
push 0x759a88
jmp 0x48d055
or dword [esi + 0x34], 0xffffffff
mov ecx, dword [esi]
mov edx, ebp
push edi
push dword [esp + 0x18]
call section..text
mov eax, dword [esi]
lea edx, [ebx + 1]
push ebx
push dword [esp + 0x2c]
mov byte [edi + eax], 0
mov ecx, dword [esi + 8]
mov dword [esi + 4], edi
call section..text
mov eax, dword [esi + 8]
add esp, 0x10
pop edi
mov byte [ebx + eax], 0
mov dword [esi + 0x14], ebx
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1bfa
push esi
push edi
mov edx, 0x759960
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x75997c
push 0x759998
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d08b0
int3
Function at 0x48d088
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
mov eax, edx
mov dword [esp + 8], eax
push ebp
mov ebp, ecx
push esi
mov esi, 0xff
push edi
test ebx, ebx
je 0x48d0a8
cmp ebx, 0xffffffff
jne 0x48d0bb
test eax, eax
jne 0x48d0b0
xor ebx, ebx
jmp 0x48d0bb
push esi
push eax
call fcn.005f8650
pop ecx
pop ecx
mov ebx, eax
mov edi, dword [esp + 0x24]
test edi, edi
je 0x48d0c8
cmp edi, 0xffffffff
jne 0x48d0e1
cmp dword [esp + 0x20], 0
jne 0x48d0d3
xor edi, edi
jmp 0x48d0e1
push esi
push dword [esp + 0x24]
call fcn.005f8650
pop ecx
pop ecx
mov edi, eax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x48d186
lea edx, [edi + 0x1a]
add edx, ebx
cmp dword [ecx - 0x10], edx
jbe 0x48d252
push 0x18
pop edx
call fcn.004878c7
mov ecx, dword [ebp + 0x10]
lea edx, [ebx + 1]
mov esi, eax
call fcn.004878c7
mov dword [esi], eax
lea edx, [edi + 1]
mov ecx, dword [ebp + 0x10]
call fcn.004878c7
mov dword [esi + 8], eax
mov ecx, dword [esi]
lea edx, [ebx + 1]
push ebx
push dword [esp + 0x18]
call section..text
mov eax, dword [esi]
lea edx, [edi + 1]
push edi
push dword [esp + 0x2c]
mov byte [ebx + eax], 0
mov ecx, dword [esi + 8]
mov dword [esi + 4], ebx
call section..text
mov eax, dword [esi + 8]
add esp, 0x10
mov byte [edi + eax], 0
and dword [esi + 0x14], 0
mov dword [esi + 0xc], edi
mov ecx, dword [ebp + 0x84]
test ecx, ecx
je 0x48d173
mov edx, dword [esi]
push edi
push dword [esi + 8]
push dword [esi + 4]
call fcn.0048b708
add esp, 0xc
mov eax, dword [ebp + 0x44]
test eax, eax
je 0x48d24c
mov dword [eax + 0x14], esi
jmp 0x48d24f
push 0x1c45
push 0x759aac
push 1
push 0x18
call fcn.005f5c60
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48d259
or dword [esi + 0x10], 0xffffffff
lea eax, [ebx + 1]
push 0x1c47
push 0x759b24
push 1
push eax
call fcn.005f5c60
add esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x48d1fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1c47
push esi
push edi
mov edx, 0x759b40
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x759b5c
push 0x759b78
jmp 0x48d286
push 0x1c48
push 0x759b9c
lea eax, [edi + 1]
push 1
push eax
call fcn.005f5c60
add esp, 0x10
mov dword [esi + 8], eax
test eax, eax
jne 0x48d11f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1c48
push esi
push edi
mov edx, 0x759bb8
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x759bd4
push 0x759bf0
jmp 0x48d286
mov dword [ebp + 0x40], esi
mov dword [ebp + 0x44], esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1c45
push esi
push edi
mov edx, 0x759ac8
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x759ae4
push 0x759b00
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d08b0
int3
Function at 0x48d3c2
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
cmp dword [ebx], 0
mov ebp, edx
push 3
mov edi, ecx
mov dword [esp + 0x18], ebp
pop ecx
jne 0x48d402
mov eax, ebp
shl eax, 2
cdq
idiv ecx
push 0x1cd4
push 0x759c1c
add eax, 5
push 1
push eax
call fcn.005f5c60
add esp, 0x10
mov dword [ebx], eax
test eax, eax
je 0x48d46e
mov esi, dword [ebx]
mov ecx, edi
test edi, edi
je 0x48d462
test ebp, ebp
je 0x48d462
lea edx, [edi + ebp]
lea eax, [edi + 3]
cmp eax, edx
ja 0x48d43b
lea ebx, [edi + 3]
mov ebp, edx
push 3
mov edx, esi
call fcn.0048d330
pop ecx
mov ecx, ebx
add esi, 4
lea ebx, [ecx + 3]
cmp ebx, ebp
jbe 0x48d41d
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
sub edi, ecx
lea eax, [edi + ebp]
cmp eax, 1
jne 0x48d448
push eax
jmp 0x48d44e
cmp eax, 2
jne 0x48d459
push eax
mov edx, esi
call fcn.0048d330
add esi, 4
pop ecx
mov byte [esi], 0
sub esi, dword [ebx]
mov eax, esi
jmp 0x48d467
and dword [ebx], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1cd4
push esi
push edi
mov edx, 0x759c38
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x759c54
push 0x759c70
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d08b0
int3