joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d4db
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, 0xf7e
mov edi, edx
push ebx
push 0x76127c
push 1
push 8
mov esi, ecx
call fcn.005ce020
mov edx, eax
add esp, 0x10
test edx, edx
je 0x46d50c
mov eax, dword [esi]
mov dword [edx], edi
pop edi
mov dword [esi], edx
pop esi
mov dword [edx + 4], eax
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x761298
push esi
push ebx
xor ecx, ecx
call fcn.0047145c
push ebx
push 0x7612b4
push 0x7612d0
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3

Function at 0x46d5b1
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, 0xfee
mov esi, ecx
push edi
push 0x7612f4
push 1
push 4
call fcn.005ce020
mov edx, eax
add esp, 0x10
test edx, edx
je 0x46d5db
mov eax, dword [esi]
pop edi
mov dword [edx], eax
mov eax, edx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x761310
push esi
push edi
xor ecx, ecx
call fcn.0047145c
push edi
push 0x76132c
push 0x761348
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3

Function at 0x46d68a
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
je 0x46d6db
cmp dword [ebx - 0x10], 0x2c
jbe 0x46d6d4
push 0x10
pop edx
call fcn.0046c082
push 0x1c
pop edx
mov esi, eax
call fcn.0046c082
mov edx, eax
test esi, esi
je 0x46d790
test edx, edx
je 0x46d790
xor eax, eax
mov edi, edx
push 7
pop ecx
rep stosd dword es:[edi], eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esi + 8], ebx
jmp 0x46d775
xor eax, eax
jmp 0x46d78c
mov edi, 0x105b
push edi
push 0x7613c8
push 1
push 0x10
call fcn.005ce020
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x46d722
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x7613e4
push esi
push edi
xor ecx, ecx
call fcn.0047145c
push edi
push 0x761400
push 0x76141c
jmp 0x46d7ba
mov edi, 0x105c
push edi
push 0x761440
push 1
push 0x1c
call fcn.005ce020
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x46d766
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x76145c
push esi
push edi
xor ecx, ecx
call fcn.0047145c
push edi
push 0x761478
push 0x761494
jmp 0x46d7ba
xor eax, eax
mov edi, edx
push 7
pop ecx
rep stosd dword es:[edi], eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esi], edx
test ebx, ebx
jne 0x46d78a
push ebx
push 0x40
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi + 0xc], eax
mov eax, esi
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x104f
push esi
push edi
mov edx, 0x76136c
xor ecx, ecx
call fcn.0047145c
push edi
push 0x761388
push 0x7613a4
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x46d8d3
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, ecx
push esi
push edi
mov edi, edx
mov edx, ebx
push dword [ebp + 4]
mov esi, dword [ebp]
mov ecx, edi
mov dword [esp + 0x14], edi
call fcn.0046d7fc
mov dword [esp + 0x1c], eax
pop ecx
test ebx, ebx
je 0x46da1a
cmp dword [esi + 8], eax
jne 0x46d932
cmp dword [ebp + 4], 0
jne 0x46d91c
cmp dword [esi + 0x10], ebx
jne 0x46d932
push ebx
push edi
push dword [esi + 0xc]
call fcn.006283b0
jmp 0x46d92b
cmp dword [esi + 0x10], ebx
jne 0x46d932
push ebx
push edi
push dword [esi + 0xc]
call fcn.005e4560
add esp, 0xc
test eax, eax
je 0x46d940
mov eax, dword [esi]
test eax, eax
je 0x46d947
mov esi, eax
mov eax, dword [esp + 0x18]
jmp 0x46d900
mov eax, esi
jmp 0x46da1c
cmp dword [esp + 0x1c], 0
je 0x46da1a
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x46d971
push 0x111b
push 0x7614b8
push 1
push 0x1c
call fcn.005ce020
add esp, 0x10
jmp 0x46d979
push 0x1c
pop edx
call fcn.0046c082
mov edi, eax
mov dword [esi], edi
test edi, edi
je 0x46da22
xor eax, eax
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [esi]
lea edi, [ebx + 1]
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], esi
mov eax, dword [esi]
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 8]
mov ebp, 0x111f
test ecx, ecx
jne 0x46d9bc
push ebp
push 0x761530
push 1
push edi
call fcn.005ce020
add esp, 0x10
jmp 0x46d9c3
mov edx, edi
call fcn.0046c082
mov ecx, eax
mov eax, dword [esi]
mov dword [eax + 0xc], ecx
test ecx, ecx
jne 0x46d9f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x76154c
push esi
push ebp
xor ecx, ecx
call fcn.0047145c
push ebp
push 0x761568
push 0x761584
jmp 0x46da4c
mov ecx, dword [esi]
mov edx, edi
push ebx
push dword [esp + 0x14]
mov ecx, dword [ecx + 0xc]
call section..text
mov eax, dword [esi]
pop ecx
pop ecx
mov eax, dword [eax + 0xc]
mov byte [ebx + eax], 0
mov eax, dword [esi]
mov dword [eax + 0x10], ebx
mov eax, dword [esi]
jmp 0x46da1c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x111b
push esi
push edi
mov edx, 0x7614d4
xor ecx, ecx
call fcn.0047145c
push edi
push 0x7614f0
push 0x76150c
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x46db65
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, 0x122f
mov dword [esp + 0x18], ecx
push ebx
push 0x76169c
xor al, al
xor edi, edi
push 1
push 0xc
xor ebp, ebp
mov byte [esp + 0x23], al
call fcn.005ce020
mov esi, eax
add esp, 0x10
test esi, esi
je 0x46dd0d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
and dword [esi], edi
and dword [esi + 8], edi
lea eax, [ecx + 7]
push 7
mov dword [esp + 0x18], eax
lea eax, [edx + 7]
pop ebx
cmp eax, ebx
jle 0x46dc9d
mov al, byte [esp + 0x13]
test al, al
jne 0x46dbe5
mov al, byte [ebx + ecx]
cmp al, 0x22
jne 0x46dbd8
xor ebp, ebp
mov byte [esp + 0x13], al
inc ebp
jmp 0x46dc5c
cmp al, 0x27
jne 0x46dbf3
xor ebp, ebp
mov byte [esp + 0x13], al
inc ebp
jmp 0x46dbf3
cmp byte [ebx + ecx], al
jne 0x46dbf3
xor eax, eax
test ebp, ebp
sete al
mov ebp, eax
test ebp, ebp
jne 0x46dc5c
push 1
push 0x7652c0
push edx
mov edx, ebx
call fcn.0046db2c
add esp, 0xc
test eax, eax
je 0x46dc58
push 0x1262
push 0x761714
push 1
push 0xc
call fcn.005ce020
mov ecx, eax
add esp, 0x10
test ecx, ecx
je 0x46dc6e
mov edx, dword [esp + 0x14]
and dword [ecx + 8], ebp
mov dword [ecx], edx
mov dword [ecx + 4], edi
cmp dword [esi], ebp
je 0x46dc41
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x46dc43
mov dword [esi], ecx
inc dword [esi + 8]
inc edx
add edx, edi
mov dword [esi + 4], ecx
mov dword [esp + 0x14], edx
xor edi, edi
mov edx, dword [esp + 0x20]
jmp 0x46dc5d
mov edx, dword [esp + 0x20]
inc edi
inc ebx
lea eax, [edx + 7]
cmp ebx, eax
jge 0x46dc9d
mov ecx, dword [esp + 0x18]
jmp 0x46dbbd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfd
mov ebx, 0x1262
push esi
push ebx
mov edx, 0x761730
xor ecx, ecx
call fcn.0047145c
push ebx
push 0x76174c
push 0x761768
jmp 0x46dd32
mov ebx, 0x1288
push ebx
push 0x76178c
push 1
push 0xc
call fcn.005ce020
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x46dce1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x7617a8
push esi
push ebx
xor ecx, ecx
call fcn.0047145c
push ebx
push 0x7617c4
push 0x7617e0
jmp 0x46dd32
mov eax, dword [esp + 0x14]
and dword [ecx + 8], 0
mov dword [ecx], eax
mov dword [ecx + 4], edi
cmp dword [esi], 0
je 0x46dcfb
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x46dcfd
mov dword [esi], ecx
inc dword [esi + 8]
mov eax, esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x7616b8
push esi
push ebx
xor ecx, ecx
call fcn.0047145c
push ebx
push 0x7616d4
push 0x7616f0
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x46dd77
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push 0x12bc
push 0x761804
mov ebp, ecx
mov edi, edx
push 1
push 0xc
mov dword [esp + 0x20], ebp
xor ebx, ebx
call fcn.005ce020
mov esi, eax
add esp, 0x10
test esi, esi
je 0x46dec7
mov eax, dword [esp + 0x1c]
add ebp, edi
and dword [esi], ebx
and dword [esi + 8], ebx
cmp byte [eax + ebp - 1], bl
lea ecx, [eax - 1]
cmovne ecx, eax
mov dword [esp + 0x14], ecx
jmp 0x46de2c
push dword [esp + 0x24]
mov edx, edi
push dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0046db2c
add esp, 0xc
test eax, eax
je 0x46de26
push 0x12cf
push 0x76187c
push 1
push 0xc
call fcn.005ce020
mov ecx, eax
add esp, 0x10
test ecx, ecx
je 0x46de74
and dword [ecx + 8], 0
mov dword [ecx], ebp
mov dword [ecx + 4], ebx
cmp dword [esi], 0
je 0x46de0f
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x46de11
mov dword [esi], ecx
mov eax, dword [esp + 0x24]
dec edi
inc dword [esi + 8]
add edi, eax
add eax, ebx
mov dword [esi + 4], ecx
add ebp, eax
xor ebx, ebx
jmp 0x46de27
inc ebx
mov ecx, dword [esp + 0x14]
inc edi
cmp edi, ecx
jl 0x46ddc2
mov edi, 0x12f5
push edi
push 0x7618f4
push 1
push 0xc
call fcn.005ce020
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x46dea0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x761910
push esi
push edi
xor ecx, ecx
call fcn.0047145c
push edi
push 0x76192c
push 0x761948
jmp 0x46def1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov ebx, 0x12cf
push esi
push ebx
mov edx, 0x761898
xor ecx, ecx
call fcn.0047145c
push ebx
push 0x7618b4
push 0x7618d0
jmp 0x46def1
and dword [ecx + 8], 0
mov dword [ecx], ebp
mov dword [ecx + 4], ebx
cmp dword [esi], 0
je 0x46deb6
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x46deb8
mov dword [esi], ecx
inc dword [esi + 8]
mov eax, esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x12bc
push esi
push edi
mov edx, 0x761820
xor ecx, ecx
call fcn.0047145c
push edi
push 0x76183c
push 0x761858
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x46e550
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
sub esp, 0xc
mov dword [esp + 0x24], ecx
xor edi, edi
mov ebx, edx
mov ebp, edi
call fcn.0046e52e
push 0x14c9
push 0x761c68
push 1
push eax
mov dword [esp + 0x2c], eax
call fcn.005ce020
mov esi, eax
add esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], esi
mov dword [eax], esi
test esi, esi
je 0x46e617
mov ecx, ebx
mov dword [esp + 0x2c], ecx
test ebx, ebx
je 0x46e60d
mov eax, 0x320
cmp ecx, ebx
je 0x46e5cf
mov edx, dword [esp + 0x10]
lea ecx, [esi + edi]
push 3
push 0x761d88
sub edx, edi
call section..text
pop ecx
pop ecx
mov ecx, dword [esp + 0x2c]
add edi, 3
add ebp, 3
mov eax, 0x320
mov edx, dword [esp + 0x10]
cmp ecx, eax
mov esi, ecx
cmovg esi, eax
mov eax, dword [esp + 0x18]
sub eax, ecx
sub edx, edi
mov ecx, dword [esp + 0x14]
add eax, ebx
push esi
push eax
lea ecx, [ecx + edi]
call section..text
pop ecx
pop ecx
mov ecx, dword [esp + 0x2c]
add edi, esi
add ebp, esi
mov eax, 0x320
sub ecx, esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0x2c], ecx
jne 0x46e5a5
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x14c9
push esi
push edi
mov edx, 0x761c84
xor ecx, ecx
call fcn.0047145c
push edi
push 0x761ca0
push 0x761cbc
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x46e961
Capabilities:
Set socket configuration
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push edi
mov edi, ecx
push 0x17
pop ebx
movzx eax, word [edi]
cmp ax, bx
jne 0x46e9a5
cmp dword [0x762fa8], 0
jne 0x46e9a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 0x1585
mov edx, 0x761d94
xor ecx, ecx
call fcn.0047145c
add esp, 0xc
xor eax, eax
jmp 0x46ea35
push esi
push dword [ebp + 8]
push edx
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46e9d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 0x1586
mov edx, 0x761db0
xor ecx, ecx
call fcn.0047145c
add esp, 0xc
jmp 0x46ea2e
cmp word [edi], bx
jne 0x46e9f1
push 4
lea eax, [ebp - 4]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x46ea3b
cmp word [edi], bx
push 0x10
pop eax
push 0x1c
pop ecx
cmove eax, ecx
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x46ea32
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 0x1593
mov edx, 0x761de8
xor ecx, ecx
call fcn.0047145c
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x46ea34
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x158a
mov edx, 0x761dcc
xor ecx, ecx
call fcn.0047145c
add esp, 0xc
push 0xfd
call fcn.005aae60
int3
Function at 0x46eec6
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0x1648
push 0x762028
push 1
mov edi, 0x88
push edi
call fcn.005ce020
mov esi, eax
add esp, 0x10
test esi, esi
je 0x46ef20
push edi
push 0
push esi
call fcn.0059de40
and dword [esi + 0x10], 0
add esp, 0xc
or dword [esi + 0x34], 0xffffffff
xor ecx, ecx
or dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x24], 0x7620a0
mov dword [esi + 0x28], 3
call fcn.0046d7c9
mov dword [esi + 0x84], eax
mov eax, esi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0xfe
mov esi, 0x1649
push edi
push esi
mov edx, 0x762044
xor ecx, ecx
call fcn.0047145c
push esi
push 0x762060
push 0x76207c
call fcn.004010b4
add esp, 0x18
push edi
call fcn.005aae60
int3

Function at 0x46f01a
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, edx
push edi
cmp dword [esi + 0x38], 0
je 0x46f034
push 1
push dword [esi + 0x24]
call fcn.005cdee0
pop ecx
pop ecx
mov edi, dword [esp + 0x14]
push 0x1695
push 0x7620a4
push 1
lea ebx, [edi + 1]
mov dword [esi + 0x38], 1
push ebx
call fcn.005ce020
add esp, 0x10
mov dword [esi + 0x24], eax
test eax, eax
je 0x46f077
push edi
push ebp
mov edx, ebx
mov ecx, eax
call section..text
mov eax, dword [esi + 0x24]
pop ecx
pop ecx
mov byte [edi + eax], 0
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1695
push esi
push edi
mov edx, 0x7620c0
xor ecx, ecx
call fcn.0047145c
push edi
push 0x7620dc
push 0x7620f8
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3

Function at 0x46f0b0
Capabilities:
Terminate process

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
mov edi, ecx
test esi, esi
jns 0x46f0dc
cmp dword [esp + 0x10], 0
jne 0x46f0ca
xor esi, esi
jmp 0x46f0dc
push 0xff
push dword [esp + 0x14]
call fcn.005d06e0
pop ecx
pop ecx
mov esi, eax
cmp dword [edi + 0x1c], 0
mov dword [edi + 0x18], ebp
je 0x46f0f1
push 1
push dword [edi + 0x1c]
call fcn.005cdee0
pop ecx
pop ecx
push 0x16a6
push 0x76211c
lea ebp, [esi + 1]
push 1
push ebp
call fcn.005ce020
add esp, 0x10
mov dword [edi + 0x1c], eax
test eax, eax
je 0x46f12e
push esi
push dword [esp + 0x14]
mov edx, ebp
mov ecx, eax
call section..text
mov eax, dword [edi + 0x1c]
pop ecx
pop ecx
mov byte [esi + eax], 0
mov dword [edi + 0x20], esi
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x16a6
push esi
push edi
mov edx, 0x762138
xor ecx, ecx
call fcn.0047145c
push edi
push 0x762154
push 0x762170
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x46f167
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebp, edx
mov esi, ecx
test edi, edi
jns 0x46f18e
test ebp, ebp
jne 0x46f17f
xor edi, edi
jmp 0x46f18e
push 0xff
push ebp
call fcn.005d06e0
pop ecx
pop ecx
mov edi, eax
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jns 0x46f1b3
cmp dword [esp + 0x18], 0
jne 0x46f1a1
xor ebx, ebx
jmp 0x46f1b3
push 0xff
push dword [esp + 0x1c]
call fcn.005d06e0
pop ecx
pop ecx
mov ebx, eax
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x46f1e5
lea edx, [ebx + 2]
add edx, edi
cmp dword [ecx - 0x10], edx
jbe 0x46f2b8
lea edx, [edi + 1]
call fcn.0046c082
mov ecx, dword [esi + 0x10]
lea edx, [ebx + 1]
mov dword [esi], eax
call fcn.0046c082
mov dword [esi + 8], eax
jmp 0x46f281
push 0x16c7
push 0x7621f0
lea eax, [edi + 1]
push 1
push eax
call fcn.005ce020
add esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x46f232
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x16c7
push esi
push edi
mov edx, 0x76220c
xor ecx, ecx
call fcn.0047145c
push edi
push 0x762228
push 0x762244
jmp 0x46f2e2
push 0x16c8
push 0x762268
lea eax, [ebx + 1]
push 1
push eax
call fcn.005ce020
add esp, 0x10
mov dword [esi + 8], eax
test eax, eax
jne 0x46f27d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x16c8
push esi
push edi
mov edx, 0x762284
xor ecx, ecx
call fcn.0047145c
push edi
push 0x7622a0
push 0x7622bc
jmp 0x46f2e2
or dword [esi + 0x34], 0xffffffff
mov ecx, dword [esi]
lea edx, [edi + 1]
push edi
push ebp
call section..text
mov eax, dword [esi]
lea edx, [ebx + 1]
push ebx
push dword [esp + 0x24]
mov byte [edi + eax], 0
mov ecx, dword [esi + 8]
mov dword [esi + 4], edi
call section..text
mov eax, dword [esi + 8]
add esp, 0x10
pop edi
mov byte [ebx + eax], 0
mov dword [esi + 0x14], ebx
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x16c2
push esi
push edi
mov edx, 0x762194
xor ecx, ecx
call fcn.0047145c
push edi
push 0x7621b0
push 0x7621cc
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x46f329
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov eax, edx
mov dword [esp + 8], eax
mov ebx, ecx
push esi
mov esi, 0xff
push edi
test ebp, ebp
jns 0x46f356
test eax, eax
jne 0x46f34b
xor ebp, ebp
jmp 0x46f356
push esi
push eax
call fcn.005d06e0
pop ecx
pop ecx
mov ebp, eax
mov edi, dword [esp + 0x20]
test edi, edi
jns 0x46f377
cmp dword [esp + 0x1c], 0
jne 0x46f369
xor edi, edi
jmp 0x46f377
push esi
push dword [esp + 0x20]
call fcn.005d06e0
pop ecx
pop ecx
mov edi, eax
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x46f41c
lea edx, [ebp + 0x1a]
add edx, edi
cmp dword [ecx - 0x10], edx
jbe 0x46f4e2
push 0x18
pop edx
call fcn.0046c082
mov ecx, dword [ebx + 0x10]
lea edx, [ebp + 1]
mov esi, eax
call fcn.0046c082
mov dword [esi], eax
lea edx, [edi + 1]
mov ecx, dword [ebx + 0x10]
call fcn.0046c082
mov dword [esi + 8], eax
mov ecx, dword [esi]
lea edx, [ebp + 1]
push ebp
push dword [esp + 0x14]
call section..text
mov eax, dword [esi]
lea edx, [edi + 1]
push edi
push dword [esp + 0x28]
mov byte [eax + ebp], 0
mov ecx, dword [esi + 8]
mov dword [esi + 4], ebp
call section..text
mov eax, dword [esi + 8]
add esp, 0x10
mov byte [edi + eax], 0
and dword [esi + 0x14], 0
mov dword [esi + 0xc], edi
mov ecx, dword [ebx + 0x84]
test ecx, ecx
je 0x46f409
mov edx, dword [esi]
push edi
push dword [esi + 8]
push dword [esi + 4]
call fcn.0046da88
add esp, 0xc
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x46f4dc
mov dword [eax + 0x14], esi
jmp 0x46f4df
push 0x170d
push 0x7622e0
push 1
push 0x18
call fcn.005ce020
mov esi, eax
add esp, 0x10
test esi, esi
je 0x46f4e8
or dword [esi + 0x10], 0xffffffff
lea eax, [ebp + 1]
push 0x170f
push 0x762358
push 1
push eax
call fcn.005ce020
add esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x46f48d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x170f
push esi
push edi
mov edx, 0x762374
xor ecx, ecx
call fcn.0047145c
push edi
push 0x762390
push 0x7623ac
jmp 0x46f512
push 0x1710
push 0x7623d0
lea eax, [edi + 1]
push 1
push eax
call fcn.005ce020
add esp, 0x10
mov dword [esi + 8], eax
test eax, eax
jne 0x46f3b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1710
push esi
push edi
mov edx, 0x7623ec
xor ecx, ecx
call fcn.0047145c
push edi
push 0x762408
push 0x762424
jmp 0x46f512
mov dword [ebx + 0x40], esi
mov dword [ebx + 0x44], esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x170d
push esi
push edi
mov edx, 0x7622fc
xor ecx, ecx
call fcn.0047145c
push edi
push 0x762318
push 0x762334
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x46f5ef
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
cmp dword [ebx], 0
mov ebp, edx
push 3
mov edi, ecx
mov dword [esp + 0x18], ebp
pop ecx
jne 0x46f62f
mov eax, ebp
shl eax, 2
cdq
idiv ecx
push 0x179c
push 0x762450
add eax, 5
push 1
push eax
call fcn.005ce020
add esp, 0x10
mov dword [ebx], eax
test eax, eax
je 0x46f69b
mov esi, dword [ebx]
mov ecx, edi
test edi, edi
je 0x46f68f
test ebp, ebp
je 0x46f68f
lea edx, [edi + ebp]
lea eax, [edi + 3]
cmp eax, edx
ja 0x46f668
lea ebx, [edi + 3]
mov ebp, edx
push 3
mov edx, esi
call fcn.0046f55e
pop ecx
mov ecx, ebx
add esi, 4
lea ebx, [ecx + 3]
cmp ebx, ebp
jbe 0x46f64a
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
sub edi, ecx
lea eax, [edi + ebp]
cmp eax, 1
jne 0x46f675
push eax
jmp 0x46f67b
cmp eax, 2
jne 0x46f686
push eax
mov edx, esi
call fcn.0046f55e
add esi, 4
pop ecx
mov byte [esi], 0
sub esi, dword [ebx]
mov eax, esi
jmp 0x46f694
and dword [ebx], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x179c
push esi
push edi
mov edx, 0x76246c
xor ecx, ecx
call fcn.0047145c
push edi
push 0x762488
push 0x7624a4
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x46f721
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
push edi
test esi, esi
je 0x46f84a
test ebx, ebx
je 0x46f84a
mov ebp, dword [esp + 0x20]
cmp dword [ebp], 0
jne 0x46f776
imul eax, ebx, 3
mov edi, 0x17e8
push edi
push 0x7624c8
push 1
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, 4
push eax
call fcn.005ce020
add esp, 0x10
mov dword [ebp], eax
test eax, eax
je 0x46f85b
and dword [esp + 0x10], 0
add ebx, esi
mov edi, dword [ebp]
jmp 0x46f838
xor eax, eax
xor edx, edx
mov dword [esp + 0x14], eax
cmp esi, ebx
ja 0x46f7fc
xor cl, cl
test cl, cl
jne 0x46f7cb
mov cl, byte [esi]
inc esi
lea eax, [ecx - 0x2b]
cmp al, 0x4f
ja 0x46f7ac
movzx eax, cl
mov cl, byte [eax + 0x69e03d]
jmp 0x46f7ae
xor cl, cl
test cl, cl
je 0x46f7c7
and dword [esp + 0x18], 0
lea eax, [ecx - 0x3d]
cmp cl, 0x24
movzx eax, al
cmove eax, dword [esp + 0x18]
mov cl, al
cmp esi, ebx
jbe 0x46f793
cmp esi, ebx
ja 0x46f7e4
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
test cl, cl
je 0x46f7f6
dec cl
mov byte [esp + edx + 0x10], cl
jmp 0x46f7f6
cmp edx, 4
jae 0x46f88e
mov eax, dword [esp + 0x14]
mov byte [esp + edx + 0x10], 0
inc edx
cmp edx, 4
jl 0x46f78d
test eax, eax
je 0x46f838
mov al, byte [esp + 0x11]
mov cl, byte [esp + 0x10]
mov dl, byte [esp + 0x12]
shr al, 4
shl cl, 2
or cl, al
mov al, byte [esp + 0x11]
mov byte [edi], cl
mov cl, dl
shl al, 4
shr cl, 2
or cl, al
shl dl, 6
or dl, byte [esp + 0x13]
mov eax, dword [esp + 0x14]
dec eax
mov byte [edi + 1], cl
mov byte [edi + 2], dl
add edi, eax
cmp esi, ebx
jbe 0x46f785
mov byte [edi], 0
sub edi, dword [ebp]
mov eax, edi
jmp 0x46f853
mov eax, dword [esp + 0x20]
and dword [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x7624e4
push esi
push edi
xor ecx, ecx
call fcn.0047145c
push edi
push 0x762500
push 0x76251c
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
call fcn.0059b550
int3