joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7110
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push 0x1020
mov edi, ecx
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4b71ce
push 0x1020
push 0
push esi
call fcn.005869c0
add esp, 0xc
test edi, edi
jne 0x4b7144
xor eax, eax
jmp 0x4b7152
push 0x1000
push edi
call fcn.0058cca6
add esp, 8
mov edx, eax
mov ecx, edi
call fcn.004b3f30
mov edi, eax
mov dword [esp + 8], 0
push str.rbN
lea eax, [esp + 0xc]
mov dword [esi + 4], edi
push edi
push eax
call fcn.0058bf3b
add esp, 0xc
test eax, eax
je 0x4b7192
push str.wbN
lea eax, [esp + 0xc]
push edi
push eax
call fcn.0058bf3b
add esp, 0xc
mov eax, dword [esp + 8]
mov dword [esi], eax
test eax, eax
jne 0x4b71b6
push dword [esi + 4]
call fcn.0058bf82
add esp, 4
push esi
call fcn.0058bf82
add esp, 4
xor eax, eax
pop edi
pop esi
pop ecx
ret
call fcn.004b30f0
mov ecx, esi
mov dword [esi + 0x1008], eax
call fcn.004b6bf0
pop edi
mov eax, esi
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b72a0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x40
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
mov ebx, dword [esp + 0x48]
mov eax, edx
push ebp
push esi
mov ebp, ecx
mov dword [esp + 0x14], eax
push edi
mov edi, dword [esp + 0x58]
mov dword [esp + 0x14], edi
test ebp, ebp
je 0x4b7365
cmp ebx, 1
jle 0x4b72db
cmp byte [ebx + eax - 1], 0
jne 0x4b72db
dec ebx
mov ecx, dword [ebp + 0x1008]
xor edx, edx
push 0
push ebx
push eax
call fcn.004b3450
add esp, 0xc
test eax, eax
je 0x4b72f8
mov esi, dword [eax + 0x14]
jmp 0x4b72fa
xor esi, esi
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.004aca10
test esi, esi
jne 0x4b7348
push 0x40
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4b73f7
push 0x40
push 0
push esi
call fcn.005869c0
add esp, 0xc
lea edi, [esi + 4]
test edi, edi
jne 0x4b737a
call fcn.0058bd31
mov dword [eax], 0x16
call fcn.0058b90e
jmp 0x4b738a
lea ecx, [esi + 4]
mov edi, 0x2c
lea edx, [esp + 0x1c]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4b732f
add ecx, 4
add edx, 4
sub edi, 4
jae 0x4b7354
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00584a28
add esp, 0x40
ret
push 0x30
lea eax, [esp + 0x20]
push eax
push edi
call fcn.00586440
add esp, 0xc
mov eax, dword [esp + 0x5c]
push edi
mov edi, dword [esp + 0x1c]
mov edx, edi
push eax
push dword [esp + 0x1c]
mov dword [esi], eax
mov ecx, dword [ebp]
push ebx
call fcn.004b6950
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edx
push dword [ebp]
call fcn.0058829a
mov ecx, dword [ebp + 0x1008]
add esp, 0x14
cdq
mov dword [ebp + 0x1014], edx
xor edx, edx
mov dword [ebp + 0x1010], eax
push 1
push ebx
push edi
call fcn.004b3450
add esp, 0xc
mov ecx, dword [eax + 0x14]
pop edi
mov dword [eax + 0x14], esi
xor eax, eax
test ecx, ecx
mov ecx, dword [esp + 0x48]
pop esi
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.00584a28
add esp, 0x40
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4b7440
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x38
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x44]
push ebp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4b7510
cmp eax, 1
jle 0x4b7471
cmp byte [eax + edx - 1], 0
jne 0x4b7471
dec eax
mov ecx, dword [edi + 0x1008]
push 0
push eax
push edx
xor edx, edx
call fcn.004b3450
add esp, 0xc
test eax, eax
je 0x4b7510
mov esi, dword [eax + 0x14]
test esi, esi
je 0x4b7510
test ebx, ebx
je 0x4b74fb
mov ebp, dword [esp + 0x54]
cmp ebp, dword [esi]
jl 0x4b74fb
push 0
push dword [esi + 0x38]
push dword [edi]
call fcn.0058885d
add esp, 0xc
test eax, eax
jne 0x4b7510
push dword [edi]
push dword [esi]
push 1
push ebx
call fcn.0058d150
add esp, 0x10
test eax, eax
je 0x4b7510
mov edx, dword [esi]
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.004aca10
lea edx, [esi + 4]
mov edi, 0x2c
lea ecx, [esp + 0x14]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4b7510
add ecx, 4
add edx, 4
sub edi, 4
jae 0x4b74e0
mov eax, dword [esi]
cmp ebp, eax
jle 0x4b74fb
mov byte [eax + ebx], 0
mov eax, dword [esi]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00584a28
add esp, 0x38
ret
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00584a28
add esp, 0x38
ret
Function at 0x4b7730
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
test esi, esi
jne 0x4b774a
lea eax, [ecx + 1]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov ecx, dword [esi + 4]
or edx, 0xffffffff
push 0xffffffffffffffff
push str..tmp
call fcn.004b3e60
mov ebx, eax
mov dword [esp + 0x18], edi
push str.wbN
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.0058bf3b
mov ebp, dword [esp + 0x24]
add esp, 0x14
test ebp, ebp
jne 0x4b7791
push ebx
call fcn.0058bf82
lea eax, [ebp + 1]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov ecx, dword [esi + 0x1008]
lea eax, [esp + 0x14]
xorps xmm0, xmm0
mov dword [esp + 0x24], eax
movq qword [esp + 0x1c], xmm0
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], esi
mov edx, 0x4b31d0
mov dword [esp + 0x18], ebp
mov dword [esi + 0x1018], edi
mov dword [esp + 0x1c], ecx
mov ecx, dword [ecx]
push 0
push eax
mov dword [esp + 0x28], 0x4b75e0
call fcn.004b3a50
add esp, 8
cmp dword [esi + 0x1018], edi
jne 0x4b7881
push dword [esi]
call fcn.00588467
add esp, 4
push ebp
call fcn.00588467
add esp, 4
push 0
push dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
mov ecx, 1
push ebx
cmove edi, ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, dword [esi + 4]
lea eax, [esp + 0x10]
push str.rbN
push ebp
push eax
mov dword [esp + 0x1c], 0
call fcn.0058bf3b
add esp, 0xc
test eax, eax
je 0x4b7849
push str.wbN
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.0058bf3b
add esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esi], eax
test eax, eax
je 0x4b787c
push eax
call fcn.0058829a
add esp, 4
cdq
mov dword [esi + 0x1010], eax
mov dword [esi + 0x1014], edx
push ebx
call fcn.0058bf82
mov eax, edi
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edi, 1
push ebx
call fcn.0058bf82
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4b87f0
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
mov ecx, dword [eax]
cmp byte [ecx], 0
je 0x4b888f
mov eax, dword [esi + 4]
cmp dword [eax], 0x30
jae 0x4b8833
push ecx
call fcn.0058bf82
add esp, 4
push 0x30
call fcn.0058d200
mov edi, eax
add esp, 4
test edi, edi
je 0x4b8897
push 0x30
push 0
push edi
call fcn.005869c0
mov eax, dword [esi]
mov dword [eax], edi
jmp 0x4b883d
push 0x30
push 0
push ecx
call fcn.005869c0
mov eax, dword [esi]
add esp, 0xc
mov edx, dword [esi + 0x48]
mov ecx, dword [eax]
mov eax, dword [edx + 0xc]
push 0x1000
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [eax + 0x14], 0x1000
call fcn.0058d200
mov edi, eax
add esp, 4
test edi, edi
je 0x4b8897
push 0x1000
push 0
push edi
call fcn.005869c0
mov eax, dword [esi]
add esp, 0xc
mov eax, dword [eax]
mov dword [eax + 0xc], edi
mov eax, dword [esi]
mov edx, dword [esi + 0x48]
mov ecx, dword [eax]
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x20], eax
mov eax, dword [esi]
pop edi
pop esi
mov eax, dword [eax]
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4ba000
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0x124
call fcn.0058d200
mov edi, eax
add esp, 4
test edi, edi
je 0x4ba0f8
push 0x124
push 0
push edi
call fcn.005869c0
add esp, 0xc
mov dword [edi + 0x60], 0
lea eax, [esp + 0x10]
xor edx, edx
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [edx + 0x18]
call fcn.004ae770
mov esi, dword [esp + 0x14]
add esp, 8
mov eax, dword [esp + 0x10]
push 0
push 0x40
push 1
push 0
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0x58
mov dword [esi], eax
mov dword [edi + 0xc4], esi
mov dword [edi + 0x94], 1
mov dword [edi + 0xc8], 0
mov dword [edi + 0x68], 0xffffffff
call fcn.0058d200
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4ba139
push 0x58
push 0
push ebx
call fcn.005869c0
mov eax, dword [esp + 0x24]
add esp, 0xc
mov ecx, esi
mov dword [ebx + 0x54], 0x4812f0
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], 0
call fcn.004b2df0
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, dword [esi + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4ba0e0
mov dword [ecx + 8], eax
cmp dword [esi + 0xc], 0
mov dword [esi + 0x10], eax
jne 0x4ba0ec
mov dword [esi + 0xc], eax
inc dword [esi + 4]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x98d
mov edx, 0x61e87c
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x98d
push 0x61e89c
push 0x61e8bc
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x995
mov edx, 0x61e8e0
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x995
push 0x61e900
push 0x61e920
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4ba180
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
test ebx, ebx
jne 0x4ba18b
xor eax, eax
pop ebx
ret
push esi
push 0x54
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4ba27d
push 0x54
push 0
push esi
call fcn.005869c0
push 0xc
mov dword [esi + 0x30], 1
mov dword [esi + 0x14], str.ILibWebClient
mov dword [esi + 8], 0x4b7b70
mov dword [esi], 0x4b9df0
mov dword [esi + 0x1c], 3
call fcn.0058d200
add esp, 0x10
mov dword [esi + 0x18], eax
test eax, eax
je 0x4ba2bb
push edi
push 0
push 0x40
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi + 0x3c], eax
mov dword [esi + 0xc], ebx
call fcn.004afb70
xor ecx, ecx
mov dword [esi + 0x2c], eax
call fcn.004afcc0
xor ecx, ecx
mov dword [esi + 0x24], eax
call fcn.004afcc0
mov edx, esi
mov dword [esi + 0x28], eax
mov ecx, ebx
call fcn.004aee00
mov eax, dword [ebx + 0x2e4]
xor edi, edi
mov dword [esi + 0x34], eax
mov dword [esi + 0x44], 0
nop dword [eax]
push 0
push fcn.004b9900
push 0x4b9ba0
push 0x4b9950
push fcn.004b9080
mov edx, 0xffff
mov ecx, ebx
call fcn.004a9f90
mov ecx, dword [esi + 0x18]
add esp, 0x14
mov dword [edi + ecx], eax
mov eax, dword [esi + 0x18]
mov eax, dword [edi + eax]
test eax, eax
je 0x4ba26f
mov dword [eax + 0x1cc], 0x4b9f90
add edi, 4
cmp edi, 0xc
jl 0x4ba230
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x9ab
mov edx, 0x61e944
xor ecx, ecx
call fcn.004b47e0
push 0x9ab
push 0x61e964
push 0x61e984
call fcn.004010e0
add esp, 0x18
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x9b5
mov edx, 0x61e9b8
xor ecx, ecx
call fcn.004b47e0
push 0x9b5
push 0x61e9d8
push 0x61e9f8
call fcn.004010e0
add esp, 0x18
push 0xfe
call fcn.00587d2d
int3
Function at 0x4bb020
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebx, ecx
push edi
mov dword [esp + 0x14], edx
lea ebp, [esi + 1]
push ebp
call fcn.0058d200
mov edi, eax
add esp, 4
test edi, edi
je 0x4bb082
push ebp
push 0
push edi
call fcn.005869c0
mov eax, dword [ebx]
add esp, 0xc
mov edx, esi
mov dword [eax + 0xfc], edi
mov ecx, dword [ebx]
push esi
push dword [esp + 0x18]
mov ecx, dword [ecx + 0xfc]
call fcn.00401000
mov eax, dword [ebx]
add esp, 8
mov eax, dword [eax + 0xfc]
pop edi
mov byte [esi + eax], 0
pop esi
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3

Function at 0x4bb230
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
push esi
mov esi, ecx
test edx, edx
je 0x4bb25a
nop word [eax + eax]
movsx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5f05a8]
sub edx, 1
jne 0x4bb240
not eax
pop esi
ret
Function at 0x4bb390
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push 0x14
mov edi, ecx
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4bb535
mov ebx, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
xorps xmm0, xmm0
push 0
push 0x40
push 1
movups xmmword [esi], xmm0
push 0
mov dword [esi + 0x10], 0
call ebx
push 0x80
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x10
mov dword [esi + 8], 0x4bb2b0
call fcn.0058d200
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x10], 0
push 0x80
push 0
push eax
call fcn.005869c0
add esp, 0xc
mov dword [edi + 0x78], esi
push 0x14
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4bb535
push 0
push 0x40
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0
mov dword [esi + 0x10], 0
call ebx
push 0x80
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x10
mov dword [esi + 8], 0x4bb2b0
call fcn.0058d200
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x10], 0
push 0x80
push 0
push eax
call fcn.005869c0
add esp, 0xc
mov dword [edi + 0x80], esi
push 0x14
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4bb535
push 0
push 0x40
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0
mov dword [esi + 0x10], 0
call ebx
push 0x80
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x10
mov dword [esi + 8], 0x4bb2b0
call fcn.0058d200
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x10], 0
push 0x80
push 0
push eax
call fcn.005869c0
add esp, 0xc
mov dword [edi + 0x7c], esi
push 0x14
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x4bb535
push 0
push 0x40
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0
mov dword [esi + 0x10], 0
call ebx
push 0x80
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x10
mov dword [esi + 8], 0x4bb2b0
call fcn.0058d200
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x10], 0
push 0x80
push 0
push eax
call fcn.005869c0
add esp, 0xc
mov dword [edi + 0x84], esi
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3

Function at 0x4bbc30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
mov ebx, ecx
push edi
mov edi, edx
lea eax, [edi - 0xc]
push eax
call esi
push 0x8028
mov word [ebx + 2], ax
lea ebp, [ebx + edi]
call esi
push 4
mov word [ebp], ax
call esi
mov word [ebp + 2], ax
or eax, 0xffffffff
test edi, edi
je 0x4bbc7f
movsx ecx, byte [ebx]
lea ebx, [ebx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5f05a8]
sub edi, 1
jne 0x4bbc65
xor eax, 0xacabaab1
push eax
call dword [sym.imp.WS2_32.dll_htonl]
pop edi
pop esi
mov dword [ebp + 4], eax
mov eax, 8
pop ebp
pop ebx
ret
Function at 0x4bbda0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov edi, edx
mov eax, dword [ebp + 0x88]
mov dword [esp + 0x20], eax
neg eax
sbb esi, esi
xor ecx, ecx
and esi, 0x1d
mov eax, 2
cmp dword [ebp + 0x70], ecx
mov dword [esp + 0x1c], esi
cmovne eax, ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], eax
call fcn.004ae180
mov ecx, dword [ebp + 0x78]
mov ebx, eax
mov eax, 8
cmp ebx, eax
cmovg ebx, eax
xor eax, eax
cmp dword [ecx + 0x200], eax
cmovne ebx, eax
lea eax, [ebx + ebx*2]
lea eax, [eax*2 + 0x52]
mov dword [esp + 0x10], eax
add eax, esi
push eax
call fcn.0058d200
add esp, 4
mov dword [edi], eax
test eax, eax
je 0x4bbf31
push dword [esp + 0x18]
mov ecx, 1
mov word [eax], cx
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [edi]
mov edx, dword [esp + 0x10]
add edx, 0xfffffffa
push 0x2a
mov dword [ecx + 2], eax
add edx, esi
mov ecx, dword [edi]
lea eax, [ebp + 0x20]
push eax
add ecx, 6
call fcn.00401000
mov eax, dword [ebp + 0x78]
mov ecx, dword [edi]
mov edx, dword [esp + 0x18]
add edx, 0xffffffcf
mov al, byte [eax + 0x1a0]
add edx, esi
mov byte [ecx + 0x30], al
mov eax, dword [ebp + 0x78]
mov ecx, dword [edi]
add ecx, 0x31
push dword [eax + 0x1a0]
push dword [eax + 0x19c]
call fcn.00401000
mov eax, dword [edi]
add esp, 0x10
mov byte [eax + 0x51], bl
test ebx, ebx
jle 0x4bbeb6
mov esi, dword [esp + 0x14]
xor edx, edx
add esi, 4
nop dword [eax]
mov ecx, dword [edi]
lea esi, [esi + 0x10]
mov eax, dword [esi - 0x10]
lea edx, [edx + 6]
mov dword [edx + ecx + 0x4c], eax
mov eax, dword [ebp + 0x78]
mov ecx, dword [edi]
mov ax, word [eax + 0x32]
mov word [edx + ecx + 0x50], ax
sub ebx, 1
jne 0x4bbe90
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4bbec7
push eax
call fcn.0058bf82
add esp, 4
cmp dword [esp + 0x20], 0
je 0x4bbf22
mov eax, dword [ebp + 0x78]
mov edx, 0x10
mov ecx, edx
mov ebx, 0x1c
cmp word [eax + 0x1d4], 0x17
mov eax, dword [edi]
cmove ecx, ebx
mov ebx, dword [esp + 0x10]
mov byte [ebx + eax], cl
mov ecx, 0x1c
mov eax, dword [ebp + 0x78]
add eax, 0x1d4
cmp word [eax], 0x17
cmove edx, ecx
mov ecx, dword [edi]
push edx
inc ecx
lea edx, [esi - 1]
push eax
add ecx, ebx
call fcn.00401000
add esp, 8
lea eax, [esi + ebx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ebx, dword [esp + 0x10]
pop edi
lea eax, [esi + ebx]
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x5cd
mov edx, 0x61f2b0
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x5cd
push 0x61f2cc
push 0x61f2e8
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4bc380
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, ecx
mov ebx, edx
push esi
push edi
push 0xffffffffffffffff
mov eax, dword [ebp + 0x24]
xor edi, edi
mov dword [esp + 0x18], ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [ebp + 0x24]
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x104], 5
mov esi, dword [esi + 0x10]
test esi, esi
je 0x4bc424
mov ebx, dword [esi]
push 8
call fcn.0058d200
add esp, 4
test eax, eax
je 0x4bc473
mov dword [eax + 4], edi
mov edi, eax
mov dword [eax], ebx
test esi, esi
je 0x4bc41a
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 4]
test edx, edx
je 0x4bc3e4
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov edx, dword [esi + 8]
test edx, edx
je 0x4bc3f1
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
cmp dword [ecx + 0xc], esi
jne 0x4bc3fc
mov eax, dword [esi + 8]
mov dword [ecx + 0xc], eax
cmp dword [ecx + 0x10], esi
jne 0x4bc40e
mov eax, dword [esi + 8]
test eax, eax
jne 0x4bc40b
mov eax, dword [esi + 0xc]
mov dword [ecx + 0x10], eax
dec dword [ecx + 4]
push esi
call fcn.0058bf82
add esp, 4
mov esi, dword [ebp + 0x24]
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x4bc3b5
mov eax, dword [ebp + 0x24]
push 0
push 1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test edi, edi
je 0x4bc46b
mov ebx, dword [esp + 0x1c]
nop dword [eax + eax]
xor esi, esi
test edi, edi
je 0x4bc454
mov esi, dword [edi]
push edi
mov edi, dword [edi + 4]
call fcn.0058bf82
add esp, 4
mov eax, dword [ebp + 0x2c]
test eax, eax
je 0x4bc467
push esi
push ebx
push dword [esp + 0x1c]
push ebp
call eax
add esp, 0x10
test edi, edi
jne 0x4bc440
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0xf47
mov edx, 0x61c99c
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0xf47
push 0x61c9b8
push 0x61c9d4
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x4bd590
Capabilities:
Terminate process

Disassembly:
sub esp, 0x68
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x78]
mov ebp, edx
push edi
mov edi, ecx
lea edx, [esp + 0x1c]
mov ecx, dword [esp + 0x84]
push esi
call fcn.004c4e20
mov ecx, dword [edi + 8]
add esp, 4
add ecx, 0xa
mov dword [esp + 0x14], eax
push ecx
call fcn.0058d200
mov ebx, eax
add esp, 4
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x4bd728
mov edx, dword [edi + 8]
mov ecx, ebx
push edx
push dword [edi]
add edx, 0xa
call fcn.00401000
mov ecx, dword [edi + 8]
mov edx, 0xa
push 1
push 0x61f368
add ecx, ebx
call fcn.00401000
mov ecx, dword [edi + 8]
lea eax, [edi + 0x21]
inc ecx
mov edx, 9
push 8
push eax
add ecx, ebx
call fcn.00401000
mov eax, dword [edi + 8]
mov edx, 1
push esi
mov ecx, ebp
mov byte [ebx + eax + 9], 0
call fcn.004c4bd0
mov ecx, dword [edi + 8]
add esp, 0x1c
add ecx, 9
mov esi, eax
mov edx, esi
push ecx
push ebx
push 6
mov ecx, ebp
call fcn.004c4c40
mov ebx, dword [sym.imp.WS2_32.dll_htons]
add esp, 0xc
add esi, eax
cmp dword [esp + 0x80], 0
je 0x4bd671
push 0x25
call ebx
push 0
mov word [esi + ebp], ax
call ebx
mov word [esi + ebp + 2], ax
add esi, 4
cmp dword [edi + 0x6c], 0
jne 0x4bd67e
push 0x802a
jmp 0x4bd683
push 0x8029
call ebx
push 8
mov word [esi + ebp], ax
call ebx
mov word [esi + ebp + 2], ax
lea ecx, [ebp + 4]
lea eax, [edi + 0x4b]
mov edx, 8
push 8
push eax
add ecx, esi
call fcn.00401000
add esp, 8
lea eax, [esp + 0x1c]
add esi, 0xc
mov ecx, ebp
mov edx, esi
push dword [esp + 0x14]
push eax
push 0x20
call fcn.004c4c40
add esp, 0xc
mov ecx, ebp
lea ebx, [esi + eax]
push dword [edi + 0xc]
mov edx, ebx
push dword [edi + 4]
call fcn.004bbbb0
add ebx, eax
mov ecx, ebp
mov edx, ebx
call fcn.004bbc30
push dword [esp + 0x20]
add ebx, eax
call fcn.0058bf82
add esp, 0xc
lea ecx, [esp + 0x30]
mov edx, 0x40
push dword [edi + 0xc]
push dword [edi + 4]
call fcn.00401000
mov eax, dword [edi + 0xc]
add esp, 8
cmp eax, 0x40
jae 0x4bd769
mov ecx, dword [esp + 0x74]
pop edi
pop esi
mov byte [esp + eax + 0x28], 0
mov eax, ebx
pop ebp
pop ebx
xor ecx, esp
call fcn.00584a28
add esp, 0x68
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x9a1
mov edx, 0x61f30c
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x9a1
push 0x61f328
push 0x61f344
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call fcn.00584b5c
int3