joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3d90
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
xor eax, eax
push ebp
test ebx, ebx
mov dword [esp + 0xc], edx
push esi
setg al
lea esi, [ebx + 0x14]
push edi
mov ebp, ecx
lea esi, [esi + eax*4]
push esi
call fcn.0058db11
mov edi, eax
add esp, 4
test edi, edi
je 0x4b3e16
push esi
push 0
push edi
call fcn.00587250
add esp, 0xc
test ebx, ebx
jle 0x4b3dd0
mov dword [edi + 0x14], ebx
push 0
push 0x40
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [edi + 0xc], eax
lea esi, [ebp*8]
mov eax, dword [esp + 0x14]
push esi
mov dword [edi + 4], ebp
mov dword [edi + 8], eax
call fcn.0058db11
add esp, 4
mov dword [edi], eax
mov dword [edi + 0x10], ebx
push esi
push 0
push eax
call fcn.00587250
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b3e80
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, edx
push ebx
mov eax, dword [edi + 8]
call eax
mov ecx, dword [edi]
add esp, 4
lea ebp, [eax*8]
mov eax, dword [ecx + ebp]
add ecx, ebp
test eax, eax
jne 0x4b3ec5
cmp dword [ecx + 4], eax
jne 0x4b3ec3
mov eax, dword [esp + 0x24]
xor esi, esi
mov dword [ecx], ebx
mov ecx, dword [edi]
mov dword [ecx + ebp + 4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
test eax, eax
jns 0x4b3f33
push 8
call fcn.0058db11
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4b4051
mov eax, dword [esp + 0x24]
xorps xmm0, xmm0
movq qword [ecx], xmm0
mov edx, 0x4b3e60
mov dword [ecx + 4], eax
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [ecx], ebx
mov ecx, dword [edi]
push 0x4b3520
mov dword [esp + 0x20], 0
mov ecx, dword [ecx + ebp + 4]
call fcn.004b33c0
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x4b4045
mov esi, dword [eax + 4]
push eax
call fcn.0058c812
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp eax, ebx
jne 0x4b3f53
mov eax, dword [ecx + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
mov dword [ecx + 4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 8
call fcn.0058db11
mov ecx, eax
add esp, 4
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x4b4051
xorps xmm0, xmm0
xor edx, edx
movq qword [ecx], xmm0
mov eax, dword [edi]
mov eax, dword [eax + ebp]
mov dword [ecx], eax
mov eax, dword [edi]
mov eax, dword [eax + ebp + 4]
mov dword [ecx + 4], eax
lea ecx, [edx + 0x18]
mov eax, dword [edi]
mov dword [eax + ebp], 0xffffffff
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004aeee0
mov esi, dword [esp + 0x1c]
add esp, 8
mov eax, dword [esp + 0x18]
push 0
push 0x40
push 1
push 0
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
mov eax, dword [edi]
mov dword [eax + ebp + 4], esi
mov eax, dword [edi]
mov esi, dword [eax + ebp + 4]
mov ecx, esi
call fcn.004b3590
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov dword [eax + 4], esi
mov dword [eax + 0xc], 0
mov ecx, dword [esi + 0xc]
mov dword [eax + 8], ecx
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4b3ff0
mov dword [ecx + 0xc], eax
cmp dword [esi + 0x10], 0
mov dword [esi + 0xc], eax
jne 0x4b3ffc
mov dword [esi + 0x10], eax
inc dword [esi + 4]
push 8
call fcn.0058db11
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4b4051
mov eax, dword [esp + 0x24]
xorps xmm0, xmm0
movq qword [ecx], xmm0
mov edx, 0x4b3e60
mov dword [ecx + 4], eax
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [ecx], ebx
mov ecx, dword [edi]
push 0x4b3520
mov dword [esp + 0x28], 0
mov ecx, dword [ecx + ebp + 4]
call fcn.004b33c0
add esp, 0xc
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b44f0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 1
push dword [esp + 0x1c]
mov esi, edx
xor edx, edx
push esi
call fcn.004b0c00
mov ebp, dword [esp + 0x30]
add esp, 0xc
mov dword [esp + 0x10], eax
mov edi, dword [eax + 8]
dec edi
lea ecx, [ebp - 1]
imul edi, ecx
add edi, esi
mov dword [esp + 0x24], edi
lea eax, [edi + 1]
push eax
call fcn.0058db11
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4b45b3
mov byte [ebx + edi], 0
xor esi, esi
mov edi, dword [esp + 0x10]
mov edi, dword [edi]
test edi, edi
je 0x4b4586
push dword [edi + 4]
mov edx, dword [esp + 0x28]
lea ecx, [ebx + esi]
push dword [edi]
inc edx
sub edx, esi
call fcn.00401000
add esi, dword [edi + 4]
add esp, 8
cmp dword [edi + 8], 0
je 0x4b457f
mov edx, dword [esp + 0x24]
lea ecx, [ebx + esi]
push ebp
push dword [esp + 0x24]
inc edx
sub edx, esi
call fcn.00401000
add esp, 8
add esi, ebp
mov edi, dword [edi + 8]
test edi, edi
jne 0x4b4546
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
test eax, eax
je 0x4b45a2
mov esi, dword [eax + 8]
push eax
call fcn.0058c812
add esp, 4
mov eax, esi
test esi, esi
jne 0x4b4590
push edi
call fcn.0058c812
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1ea0
mov edx, 0x6256d4
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1ea0
push 0x6256f0
push 0x62570c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3

Function at 0x4b4600
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, edx
mov ebx, ecx
push edi
test esi, esi
jns 0x4b4625
test ebx, ebx
jne 0x4b4615
xor esi, esi
jmp 0x4b4625
push 0x1000
push ebx
call fcn.0058d536
add esp, 8
mov esi, eax
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
test edi, edi
jns 0x4b4649
test ebp, ebp
jne 0x4b4639
xor edi, edi
jmp 0x4b4649
push 0x1000
push ebp
call fcn.0058d536
add esp, 8
mov edi, eax
lea eax, [edi + 1]
add eax, esi
push eax
call fcn.0058db11
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4b468e
push esi
lea edx, [edi + 1]
mov ecx, eax
push ebx
add edx, esi
call fcn.00401000
add esi, dword [esp + 0x24]
lea edx, [edi + 1]
push edi
push ebp
mov ecx, esi
call fcn.00401000
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov byte [esi + edi], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1f03
mov edx, 0x625844
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1f03
push 0x625860
push 0x62587c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b46d0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, edx
push edi
mov edi, ecx
test esi, esi
jns 0x4b46f5
test edi, edi
jne 0x4b46e5
xor esi, esi
jmp 0x4b46f5
push 0x1000
push edi
call fcn.0058d536
add esp, 8
mov esi, eax
lea ebp, [esi + 1]
push ebp
call fcn.0058db11
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4b4721
push esi
push edi
mov edx, ebp
mov ecx, ebx
call fcn.00401000
add esp, 8
mov byte [ebx + esi], 0
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1f0d
mov edx, 0x6258a0
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1f0d
push 0x6258bc
push 0x6258d8
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3

Function at 0x4b4770
Capabilities:
Read file on windows
Terminate process

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0x6259b4
push edx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
mov ebx, ecx
call fcn.0058c7cb
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
jne 0x4b47a4
mov dword [ebx], eax
pop edi
pop esi
pop ebx
add esp, 8
ret
push 2
push 0
push eax
call fcn.005890ed
add esp, 0xc
push dword [esp + 0x10]
call fcn.00588b2a
add esp, 4
mov esi, eax
push 0
push 0
push dword [esp + 0x18]
call fcn.005890ed
add esp, 0xc
lea ecx, [esi + 1]
push ecx
call fcn.0058db11
mov edi, eax
add esp, 4
test edi, edi
je 0x4b480b
push dword [esp + 0x10]
push esi
push 1
push edi
call fcn.0058d9e0
mov esi, eax
mov byte [edi + esi], 0
push dword [esp + 0x20]
call fcn.00588cf7
add esp, 0x14
mov dword [ebx], edi
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1f4a
mov edx, 0x6259b8
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1f4a
push 0x6259d4
push 0x6259f0
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3

Function at 0x4b4850
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push 0x625a14
push ecx
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
mov esi, edx
call fcn.0058c7cb
mov eax, dword [esp + 0x10]
add esp, 0xc
test eax, eax
je 0x4b4890
push eax
push dword [esp + 0x10]
push 1
push esi
call fcn.0058c4f0
push dword [esp + 0x14]
call fcn.00588cf7
add esp, 0x14
pop esi
pop ecx
ret

Function at 0x4b48a0
Capabilities:
Write file on windows

Disassembly:
push ecx
push 0x625a18
push dword [0x62b154]
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
call fcn.0058c7cb
mov eax, dword [esp + 0xc]
add esp, 0xc
test eax, eax
je 0x4b48e6
push eax
push dword [esp + 0xc]
push 1
push 0x62b420
call fcn.0058c4f0
push dword [esp + 0x10]
call fcn.00588cf7
add esp, 0x14
pop ecx
ret
Function at 0x4b5150
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
push 0xc
mov edi, edx
mov ebx, ecx
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4b51a4
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
push edi
mov dword [esi + 4], edi
call fcn.0058db11
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x4b51e5
push edi
push ebx
mov edx, edi
mov ecx, eax
call fcn.00401000
add esp, 8
mov dword [esi + 8], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x81
mov edx, 0x625d80
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x81
push 0x625da0
push 0x625dc0
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x86
mov edx, 0x625de4
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x86
push 0x625e04
push 0x625e24
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3

Function at 0x4b52a0
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push 8
mov edi, edx
mov esi, ecx
call fcn.0058db11
add esp, 4
test eax, eax
je 0x4b52d4
xorps xmm0, xmm0
movq qword [eax], xmm0
push eax
mov dword [eax], esi
mov dword [eax + 4], edi
push dword [esi + 0x24]
push 0x4b5250
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
pop edi
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3

Function at 0x4b53f0
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0x18
mov edi, edx
mov esi, ecx
call fcn.0058db11
mov edx, eax
add esp, 4
test edx, edx
je 0x4b5434
mov eax, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [edx], xmm0
mov ecx, esi
movq qword [edx + 0x10], xmm0
mov dword [edx + 8], eax
mov eax, dword [esp + 0x14]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [edx], esi
mov dword [edx + 4], edi
mov dword [edx + 0x14], eax
pop edi
pop esi
jmp fcn.004b5370
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b59f0
Capabilities:
Create thread
Terminate process

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0x30
mov ebx, ecx
call fcn.0058db11
mov edi, eax
add esp, 4
test edi, edi
je 0x4b5b08
push 0x30
push 0
push edi
call fcn.00587250
add esp, 0xc
mov dword [edi + 0x14], str.ILibProcessPipe_Manager
lea eax, [esp + 0x10]
mov dword [edi + 0xc], ebx
xor edx, edx
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [edx + 0x18]
call fcn.004aeee0
mov esi, dword [esp + 0x14]
add esp, 8
mov eax, dword [esp + 0x10]
push 0
push 0x40
push 1
push 0
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 0
push 1
mov dword [esi], eax
push 0
mov dword [edi + 0x18], esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x20], eax
cmp dword [ebx + 8], 0
je 0x4b5a8e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebx + 8], eax
je 0x4b5a8e
push edi
push 0
mov edx, 0x4b59a0
mov ecx, ebx
call fcn.004af160
add esp, 8
jmp 0x4b5aa5
push 0
push 0
push edi
push 0x4b5900
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x24], eax
mov dword [edi + 8], 0x4b59c0
cmp dword [ebx + 4], 0
jne 0x4b5af6
mov esi, dword [ebx + 0x2f0]
mov ecx, esi
call fcn.004b3590
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, dword [esi + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4b5adb
mov dword [ecx + 8], eax
cmp dword [esi + 0xc], 0
mov dword [esi + 0x10], eax
jne 0x4b5ae7
mov dword [esi + 0xc], eax
inc dword [esi + 4]
mov eax, edi
mov dword [edi + 0xc], ebx
pop edi
pop esi
pop ebx
add esp, 8
ret
mov edx, edi
mov ecx, ebx
call fcn.004af290
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1e9
mov edx, 0x625e48
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1e9
push 0x625e68
push 0x625e88
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b5c50
Capabilities:
Create pipe
Terminate process

Disassembly:
sub esp, 0x118
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x114], eax
mov edx, dword [esp + 0x120]
mov eax, 0x5c
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
test edx, edx
mov ecx, 0x6c
push ebx
cmovg eax, ecx
push edx
add eax, edx
push eax
call fcn.0058db11
add esp, 4
lea edx, [ebx + 0x4c]
mov ecx, eax
call fcn.004aec40
mov edi, eax
add esp, 8
mov dword [edi + 0x18], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [edi + 0x28], ebx
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], ebx
nop dword [eax]
push ebx
push edi
push str..pipe_p_u
lea eax, [esp + 0x28]
push 0xff
push eax
call fcn.00401140
add esp, 0x14
lea eax, [esp + 0x10]
inc ebx
push eax
push 0
push 0x1000
push 0x1000
push 1
push 0
push 0x40080001
lea eax, [esp + 0x38]
push eax
call esi
mov dword [edi + 0x38], eax
cmp eax, 0xffffffff
je 0x4b5e4f
cmp eax, 5
je 0x4b5cc0
push 0x14
call fcn.0058db11
add esp, 4
mov dword [edi + 0x40], eax
test eax, eax
je 0x4b5d8c
push 0
push 0
xorps xmm0, xmm0
push 1
movups xmmword [eax], xmm0
push 0
mov dword [eax + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [edi + 0x40]
mov dword [ecx + 0x10], eax
test eax, eax
je 0x4b5dcd
push 0
push 0x80
push 3
lea eax, [esp + 0x1c]
push eax
push 0
push 0x40000000
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi + 0x3c], eax
cmp eax, 0xffffffff
je 0x4b5e0e
mov ecx, dword [esp + 0x120]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005852a8
add esp, 0x118
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x265
mov edx, 0x626000
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x265
push 0x626020
push 0x626040
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x267
mov edx, 0x626064
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x267
push 0x626084
push 0x6260a4
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x26a
mov edx, 0x6260c8
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x26a
push 0x6260e8
push 0x626108
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x262
mov edx, 0x625f9c
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x262
push 0x625fbc
push 0x625fdc
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b6d50
Capabilities:
Create thread
Read file on windows
Terminate process

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
push edi
call fcn.0058db11
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x4b6dd8
mov eax, dword [esp + 0xc]
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x40]
mov dword [esi + 4], edi
test eax, eax
je 0x4b6db0
push eax
push 0
push edi
push ecx
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esi + 0x40]
mov ecx, dword [esi + 0x18]
push 0x4b6550
push esi
mov edx, dword [edx + 0x10]
push 0
call fcn.004b53f0
add esp, 0xc
pop edi
pop esi
ret
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push esi
push 0x4b6b80
push 0
push 0
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x577
mov edx, 0x626210
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x577
push str...microstackILibProcessPipe.c
push 0x626250
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b7000
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, edx
mov ebp, 0xfffffffc
test edi, edi
je 0x4b7186
cmp dword [edi + 0x20], 0
jne 0x4b7053
lea eax, [esp + 0x18]
xor edx, edx
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [ebp + 0x1c]
call fcn.004aeee0
mov esi, dword [esp + 0x1c]
add esp, 8
mov eax, dword [esp + 0x18]
push 0
push 0x40
push 1
push 0
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
mov dword [edi + 0x20], esi
mov eax, dword [edi + 0x20]
push 0xffffffffffffffff
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [edi + 0x20]
cmp dword [eax + 0xc], 0
je 0x4b70ca
mov edx, dword [esp + 0x20]
push ecx
mov ecx, ebx
call fcn.004b5150
mov ebx, dword [edi + 0x20]
add esp, 4
mov ecx, ebx
mov esi, eax
call fcn.004b3590
mov ecx, eax
mov dword [ecx], esi
mov dword [ecx + 4], ebx
mov dword [ecx + 8], 0
mov eax, dword [ebx + 0x10]
mov dword [ecx + 0xc], eax
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4b70a2
mov dword [eax + 8], ecx
cmp dword [ebx + 0xc], 0
mov dword [ebx + 0x10], ecx
jne 0x4b70ae
mov dword [ebx + 0xc], ecx
inc dword [ebx + 4]
mov ecx, dword [edi + 0x20]
push 0
push 1
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push dword [edi + 0x40]
mov esi, dword [esp + 0x24]
push 0
push esi
push ebx
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x4b70fd
mov ecx, dword [edi + 0x20]
mov ebp, eax
push 0
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4b7153
push ecx
mov edx, esi
mov ecx, ebx
xor ebp, ebp
call fcn.004b5150
mov ecx, dword [edi + 0x20]
add esp, 4
mov edx, eax
call fcn.004b0320
mov edx, dword [edi + 0x40]
mov ecx, dword [edi + 0x18]
push 0x4b6760
push edi
mov edx, dword [edx + 0x10]
push ebp
call fcn.004b53f0
mov ecx, dword [edi + 0x20]
add esp, 0xc
push ebp
push 1
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [edi + 0x20]
push 0
push 1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
cmp dword [edi + 0x28], 0
je 0x4b717f
mov edx, dword [edi + 0x40]
mov ecx, dword [edi + 0x18]
mov edx, dword [edx + 0x10]
call fcn.004b52a0
mov eax, dword [edi + 0x28]
push edi
call eax
add esp, 4
mov ecx, edi
call fcn.004b5b50
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4b71b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x48
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x58]
push ebx
mov ebx, dword [esp + 0x54]
push ebp
push esi
push edi
push 2
mov edi, ecx
mov dword [esp + 0x14], edx
push 0
push edi
mov dword [esp + 0x20], eax
call fcn.005890ed
mov eax, dword [esp + 0x68]
add esp, 0xc
mov ebp, dword [esp + 0x64]
add eax, 0x3c
mov esi, dword [sym.imp.WS2_32.dll_htonl]
add eax, ebp
push eax
call esi
push dword [esp + 0x5c]
mov dword [esp + 0x1c], eax
call esi
push ebp
mov dword [esp + 0x20], eax
call esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
push 0x30
test eax, eax
je 0x4b7223
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00586cd0
jmp 0x4b722f
lea eax, [esp + 0x28]
push 0
push eax
call fcn.00587250
add esp, 0xc
lea eax, [esp + 0x18]
push edi
push 0x3c
push 1
push eax
call fcn.0058c4f0
push edi
push dword [esp + 0x70]
push 1
push dword [esp + 0x2c]
call fcn.0058c4f0
push edi
call fcn.00588b2a
cdq
add esp, 0x24
mov dword [esp + 0x10], edx
mov esi, eax
test ebx, ebx
je 0x4b7272
push edi
push ebp
push 1
push ebx
call fcn.0058c4f0
add esp, 0x10
push edi
call fcn.005931d8
mov ecx, dword [esp + 0x58]
add esp, 4
mov edx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005852a8
add esp, 0x48
ret
Function at 0x4b72a0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x111c
call fcn.00585720
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x1114], eax
push ebx
push ebp
push esi
mov ebp, ecx
mov esi, edx
push edi
test ebp, ebp
jne 0x4b72cb
xor eax, eax
jmp 0x4b7427
push dword [ebp]
lea ebx, [ebp + 0x10]
mov dword [esp + 0x18], ebx
call fcn.00588b2a
cdq
add esp, 4
cmp eax, dword [ebp + 0x1010]
jne 0x4b72ee
cmp edx, dword [ebp + 0x1014]
je 0x4b72c4
cmp esi, 0x20
je 0x4b7305
cmp esi, 0x40
mov edi, 0x48
mov eax, 0x3c
cmovne edi, eax
jmp 0x4b730a
mov edi, 0x40
push dword [ebp]
push edi
push 1
push ebx
call fcn.0058d9e0
add esp, 0x10
cmp eax, edi
jl 0x4b72c4
push dword [ebx]
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
call esi
push dword [ebx + 4]
mov dword [ebx], eax
call esi
push dword [ebx + 8]
mov dword [ebx + 4], eax
call esi
mov dword [ebx + 8], eax
push dword [ebp]
call fcn.00588b2a
cdq
add esp, 4
mov ecx, eax
mov esi, edx
mov eax, dword [ebx + 4]
cdq
add eax, ecx
mov dword [ebx - 8], eax
mov eax, 0xff8
adc edx, esi
sub eax, edi
mov dword [ebx - 4], edx
mov ecx, dword [ebx + 4]
cmp ecx, eax
jg 0x4b72c4
push dword [ebp]
lea eax, [edi + ebx]
push ecx
push 1
push eax
call fcn.0058d9e0
add esp, 0x10
cmp eax, dword [ebx + 4]
jne 0x4b72c4
mov esi, dword [ebx + 8]
lea eax, [esp + 0x18]
push eax
call fcn.004cfc70
add esp, 4
test esi, esi
jle 0x4b73e3
mov ebx, 0x1000
nop dword [eax]
push dword [ebp]
cmp esi, ebx
mov eax, esi
cmovg eax, ebx
push eax
lea eax, [esp + 0x128]
push 1
push eax
call fcn.0058d9e0
mov edi, eax
add esp, 0x10
test edi, edi
jle 0x4b73df
push edi
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004cfd20
sub esi, edi
add esp, 0xc
test esi, esi
jg 0x4b73a0
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xf4]
push eax
call fcn.004cfc60
add esp, 8
cmp dword [ebx + 8], 0
jle 0x4b7425
lea ecx, [ebx + 0xc]
mov esi, 0x2c
lea edx, [esp + 0xf0]
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4b7423
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4b7410
jmp 0x4b7425
xor ebx, ebx
mov eax, ebx
mov ecx, dword [esp + 0x1124]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005852a8
add esp, 0x111c
ret