joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485f81
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0x1ada
push 0x7218d8
push 1
mov edi, 0x88
push edi
call fcn.005e7f10
mov esi, eax
add esp, 0x10
test esi, esi
je 0x485fdb
push edi
push 0
push esi
call fcn.005b5fd0
and dword [esi + 0x10], 0
add esp, 0xc
or dword [esi + 0x34], 0xffffffff
xor ecx, ecx
or dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x24], 0x721950
mov dword [esi + 0x28], 3
call fcn.004847ca
mov dword [esi + 0x84], eax
mov eax, esi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0xfe
mov esi, 0x1adb
push edi
push esi
mov edx, 0x7218f4
xor ecx, ecx
call fcn.00488a50
push esi
push 0x721910
push 0x72192c
call fcn.00401109
add esp, 0x18
push edi
call fcn.005c3000
int3

Function at 0x4860d5
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, edx
push edi
cmp dword [esi + 0x38], 0
je 0x4860ef
push 1
push dword [esi + 0x24]
call fcn.005e7dd0
pop ecx
pop ecx
mov edi, dword [esp + 0x14]
push 0x1b27
push 0x721954
push 1
lea ebx, [edi + 1]
mov dword [esi + 0x38], 1
push ebx
call fcn.005e7f10
add esp, 0x10
mov dword [esi + 0x24], eax
test eax, eax
je 0x486132
push edi
push ebp
mov edx, ebx
mov ecx, eax
call section..text
mov eax, dword [esi + 0x24]
pop ecx
pop ecx
mov byte [edi + eax], 0
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1b27
push esi
push edi
mov edx, 0x721970
xor ecx, ecx
call fcn.00488a50
push edi
push 0x72198c
push 0x7219a8
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3

Function at 0x48616b
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x1c], 0
mov dword [esi + 0x18], edx
je 0x486186
push 1
push dword [esi + 0x1c]
call fcn.005e7dd0
pop ecx
pop ecx
mov edi, dword [esp + 0x18]
mov ebp, 0x1b38
push ebp
push 0x7219cc
push 1
lea ebx, [edi + 1]
push ebx
call fcn.005e7f10
add esp, 0x10
mov dword [esi + 0x1c], eax
test eax, eax
je 0x4861c9
push edi
push dword [esp + 0x18]
mov edx, ebx
mov ecx, eax
call section..text
mov eax, dword [esi + 0x1c]
pop ecx
pop ecx
mov byte [edi + eax], 0
mov dword [esi + 0x20], edi
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x7219e8
push esi
push ebp
xor ecx, ecx
call fcn.00488a50
push ebp
push 0x721a04
push 0x721a20
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3
Function at 0x4861fd
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
push edi
mov edi, dword [esp + 0x18]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x486244
mov ebx, dword [esp + 0x20]
lea eax, [ebx + 2]
add eax, edi
cmp dword [ecx - 0x10], eax
jbe 0x48631a
lea ebp, [edi + 1]
mov edx, ebp
call fcn.00481494
mov ecx, dword [esi + 0x10]
lea edx, [ebx + 1]
mov dword [esi], eax
call fcn.00481494
mov dword [esi + 8], eax
jmp 0x4862e0
mov ebx, 0x1b59
lea ebp, [edi + 1]
push ebx
push 0x721aa0
push 1
push ebp
call fcn.005e7f10
add esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x48628d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x721abc
push esi
push ebx
xor ecx, ecx
call fcn.00488a50
push ebx
push 0x721ad8
push 0x721af4
jmp 0x486344
mov ebx, dword [esp + 0x20]
push 0x1b5a
push 0x721b18
push 1
lea eax, [ebx + 1]
push eax
call fcn.005e7f10
add esp, 0x10
mov dword [esi + 8], eax
test eax, eax
jne 0x4862dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1b5a
push esi
push edi
mov edx, 0x721b34
xor ecx, ecx
call fcn.00488a50
push edi
push 0x721b50
push 0x721b6c
jmp 0x486344
or dword [esi + 0x34], 0xffffffff
mov ecx, dword [esi]
mov edx, ebp
push edi
push dword [esp + 0x14]
call section..text
mov eax, dword [esi]
lea edx, [ebx + 1]
push ebx
push dword [esp + 0x28]
mov byte [edi + eax], 0
mov ecx, dword [esi + 8]
mov dword [esi + 4], edi
call section..text
mov eax, dword [esi + 8]
add esp, 0x10
pop edi
mov byte [ebx + eax], 0
mov dword [esi + 0x14], ebx
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1b54
push esi
push edi
mov edx, 0x721a44
xor ecx, ecx
call fcn.00488a50
push edi
push 0x721a60
push 0x721a7c
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3
Function at 0x486377
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov eax, edx
mov dword [esp + 4], eax
push ebp
mov ebp, ecx
push esi
mov esi, 0xff
push edi
test ebx, ebx
je 0x486396
cmp ebx, 0xffffffff
jne 0x4863a9
test eax, eax
jne 0x48639e
xor ebx, ebx
jmp 0x4863a9
push esi
push eax
call fcn.005ea5b0
pop ecx
pop ecx
mov ebx, eax
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4863b6
cmp edi, 0xffffffff
jne 0x4863cf
cmp dword [esp + 0x1c], 0
jne 0x4863c1
xor edi, edi
jmp 0x4863cf
push esi
push dword [esp + 0x20]
call fcn.005ea5b0
pop ecx
pop ecx
mov edi, eax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x486474
lea edx, [edi + 0x1a]
add edx, ebx
cmp dword [ecx - 0x10], edx
jbe 0x48653a
push 0x18
pop edx
call fcn.00481494
mov ecx, dword [ebp + 0x10]
lea edx, [ebx + 1]
mov esi, eax
call fcn.00481494
mov dword [esi], eax
lea edx, [edi + 1]
mov ecx, dword [ebp + 0x10]
call fcn.00481494
mov dword [esi + 8], eax
mov ecx, dword [esi]
lea edx, [ebx + 1]
push ebx
push dword [esp + 0x14]
call section..text
mov eax, dword [esi]
lea edx, [edi + 1]
push edi
push dword [esp + 0x28]
mov byte [ebx + eax], 0
mov ecx, dword [esi + 8]
mov dword [esi + 4], ebx
call section..text
mov eax, dword [esi + 8]
add esp, 0x10
mov byte [edi + eax], 0
and dword [esi + 0x14], 0
mov dword [esi + 0xc], edi
mov ecx, dword [ebp + 0x84]
test ecx, ecx
je 0x486461
mov edx, dword [esi]
push edi
push dword [esi + 8]
push dword [esi + 4]
call fcn.00484a89
add esp, 0xc
mov eax, dword [ebp + 0x44]
test eax, eax
je 0x486534
mov dword [eax + 0x14], esi
jmp 0x486537
push 0x1b9f
push 0x721b90
push 1
push 0x18
call fcn.005e7f10
mov esi, eax
add esp, 0x10
test esi, esi
je 0x486540
or dword [esi + 0x10], 0xffffffff
lea eax, [ebx + 1]
push 0x1ba1
push 0x721c08
push 1
push eax
call fcn.005e7f10
add esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x4864e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1ba1
push esi
push edi
mov edx, 0x721c24
xor ecx, ecx
call fcn.00488a50
push edi
push 0x721c40
push 0x721c5c
jmp 0x48656a
push 0x1ba2
push 0x721c80
lea eax, [edi + 1]
push 1
push eax
call fcn.005e7f10
add esp, 0x10
mov dword [esi + 8], eax
test eax, eax
jne 0x48640d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1ba2
push esi
push edi
mov edx, 0x721c9c
xor ecx, ecx
call fcn.00488a50
push edi
push 0x721cb8
push 0x721cd4
jmp 0x48656a
mov dword [ebp + 0x40], esi
mov dword [ebp + 0x44], esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1b9f
push esi
push edi
mov edx, 0x721bac
xor ecx, ecx
call fcn.00488a50
push edi
push 0x721bc8
push 0x721be4
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3
Function at 0x486648
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
cmp dword [ebx], 0
mov ebp, edx
push 3
mov edi, ecx
mov dword [esp + 0x18], ebp
pop ecx
jne 0x486688
mov eax, ebp
shl eax, 2
cdq
idiv ecx
push 0x1c2e
push 0x721d00
add eax, 5
push 1
push eax
call fcn.005e7f10
add esp, 0x10
mov dword [ebx], eax
test eax, eax
je 0x4866f4
mov esi, dword [ebx]
mov ecx, edi
test edi, edi
je 0x4866e8
test ebp, ebp
je 0x4866e8
lea edx, [edi + ebp]
lea eax, [edi + 3]
cmp eax, edx
ja 0x4866c1
lea ebx, [edi + 3]
mov ebp, edx
push 3
mov edx, esi
call fcn.004865b6
pop ecx
mov ecx, ebx
add esi, 4
lea ebx, [ecx + 3]
cmp ebx, ebp
jbe 0x4866a3
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
sub edi, ecx
lea eax, [edi + ebp]
cmp eax, 1
jne 0x4866ce
push eax
jmp 0x4866d4
cmp eax, 2
jne 0x4866df
push eax
mov edx, esi
call fcn.004865b6
add esi, 4
pop ecx
mov byte [esi], 0
sub esi, dword [ebx]
mov eax, esi
jmp 0x4866ed
and dword [ebx], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1c2e
push esi
push edi
mov edx, 0x721d1c
xor ecx, ecx
call fcn.00488a50
push edi
push 0x721d38
push 0x721d54
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3
Function at 0x486768
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
push edi
test esi, esi
je 0x486891
test ebx, ebx
je 0x486891
mov ebp, dword [esp + 0x20]
cmp dword [ebp], 0
jne 0x4867bd
imul eax, ebx, 3
mov edi, 0x1c7a
push edi
push 0x721d78
push 1
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, 4
push eax
call fcn.005e7f10
add esp, 0x10
mov dword [ebp], eax
test eax, eax
je 0x4868a2
and dword [esp + 0x10], 0
add ebx, esi
mov edi, dword [ebp]
jmp 0x48687f
xor eax, eax
xor edx, edx
mov dword [esp + 0x14], eax
cmp esi, ebx
ja 0x486843
xor cl, cl
test cl, cl
jne 0x486812
mov cl, byte [esi]
inc esi
lea eax, [ecx - 0x2b]
cmp al, 0x4f
ja 0x4867f3
movzx eax, cl
mov cl, byte [eax + 0x6ba21d]
jmp 0x4867f5
xor cl, cl
test cl, cl
je 0x48680e
and dword [esp + 0x18], 0
lea eax, [ecx - 0x3d]
cmp cl, 0x24
movzx eax, al
cmove eax, dword [esp + 0x18]
mov cl, al
cmp esi, ebx
jbe 0x4867da
cmp esi, ebx
ja 0x48682b
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
test cl, cl
je 0x48683d
dec cl
mov byte [esp + edx + 0x10], cl
jmp 0x48683d
cmp edx, 4
jae 0x4868d5
mov eax, dword [esp + 0x14]
mov byte [esp + edx + 0x10], 0
inc edx
cmp edx, 4
jl 0x4867d4
test eax, eax
je 0x48687f
mov al, byte [esp + 0x11]
mov cl, byte [esp + 0x10]
mov dl, byte [esp + 0x12]
shr al, 4
shl cl, 2
or cl, al
mov al, byte [esp + 0x11]
mov byte [edi], cl
mov cl, dl
shl al, 4
shr cl, 2
or cl, al
shl dl, 6
or dl, byte [esp + 0x13]
mov eax, dword [esp + 0x14]
dec eax
mov byte [edi + 1], cl
mov byte [edi + 2], dl
add edi, eax
cmp esi, ebx
jbe 0x4867cc
mov byte [edi], 0
sub edi, dword [ebp]
mov eax, edi
jmp 0x48689a
mov eax, dword [esp + 0x20]
and dword [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x721d94
push esi
push edi
xor ecx, ecx
call fcn.00488a50
push edi
push 0x721db0
push 0x721dcc
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
call fcn.005b3710
int3
Function at 0x486ea9
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x1e85
mov edi, ecx
push ebx
push 0x721eb8
push 1
push 0x40
call fcn.005e7f10
mov esi, eax
add esp, 0x10
test esi, esi
je 0x486f18
push 0x40
push 0
push esi
call fcn.005b5fd0
add esp, 0xc
mov ecx, str.ILibLifeTime
call fcn.00480fb6
xor ecx, ecx
mov dword [esi + 0x18], eax
call fcn.0048708c
xor ecx, ecx
mov dword [esi + 0x38], eax
mov dword [esi], 0x486b60
mov dword [esi + 8], 0x486e56
mov dword [esi + 0x10], edi
call fcn.0048708c
mov edx, esi
mov dword [esi + 0x30], eax
mov ecx, edi
call fcn.004819aa
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x721ed4
push esi
push ebx
xor ecx, ecx
call fcn.00488a50
push ebx
push 0x721ef0
push 0x721f0c
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3

Function at 0x4874b1
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, 0x20e0
push edi
push 0x721f78
push 1
push 0xc
call fcn.005e7f10
mov esi, eax
add esp, 0x10
test esi, esi
je 0x487507
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, dword [esi]
mov dword [esi + 4], 0x48743f
test ecx, ecx
je 0x4874ee
push 0
xor edx, edx
call fcn.00487c73
pop ecx
push 0
mov edx, 0x48741c
mov ecx, 0x100
call fcn.004878eb
pop ecx
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x721f94
push esi
push edi
xor ecx, ecx
call fcn.00488a50
push edi
push 0x721fb0
push 0x721fcc
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3

Function at 0x4876a3
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, 0x2165
mov ebx, edx
push edi
push 0x721ff0
push 1
push 0x18
call fcn.005e7f10
mov esi, eax
add esp, 0x10
test esi, esi
je 0x487711
push ebp
xor eax, eax
mov edi, esi
push 6
pop ecx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x14]
and dword [esi + 0x14], eax
and dword [esi + 8], eax
mov dword [esi + 0x10], edi
test edi, edi
jle 0x48770a
mov ebp, 0x216c
push ebp
push 0x722068
push 1
push edi
call fcn.005e7f10
add esp, 0x10
mov dword [esi + 0xc], eax
test eax, eax
je 0x487744
push edi
push ebx
mov edx, edi
mov ecx, eax
call section..text
pop ecx
pop ecx
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x72200c
push esi
push edi
xor ecx, ecx
call fcn.00488a50
push edi
push 0x722028
push 0x722044
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x722084
push esi
push ebp
xor ecx, ecx
call fcn.00488a50
push ebp
push 0x7220a0
push 0x7220bc
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3
Function at 0x487e0b
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x1c]
mov esi, edx
xor edx, edx
push dword [esp + 0x1c]
push esi
call fcn.00484d78
mov ecx, dword [esp + 0x30]
mov ebp, eax
sub ecx, dword [esp + 0x28]
push 0x23c1
push 0x7220fc
mov edi, dword [ebp + 8]
dec edi
mov dword [esp + 0x24], ebp
imul edi, ecx
push 1
add edi, esi
lea eax, [edi + 1]
push eax
mov dword [esp + 0x38], eax
call fcn.005e7f10
mov ebx, eax
add esp, 0x1c
test ebx, ebx
je 0x487ebc
mov byte [ebx + edi], 0
xor edi, edi
mov esi, dword [ebp]
test esi, esi
je 0x487ead
mov ebp, dword [esp + 0x1c]
push dword [esi + 4]
mov edx, ebp
lea ecx, [ebx + edi]
push dword [esi]
sub edx, edi
call section..text
add edi, dword [esi + 4]
cmp dword [esi + 8], 0
pop ecx
pop ecx
je 0x487ea2
push dword [esp + 0x24]
mov edx, ebp
lea ecx, [ebx + edi]
push dword [esp + 0x24]
sub edx, edi
call section..text
add edi, dword [esp + 0x2c]
pop ecx
pop ecx
mov esi, dword [esi + 8]
test esi, esi
jne 0x487e6c
mov ebp, dword [esp + 0x10]
mov ecx, ebp
call fcn.00484f33
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x23c1
push esi
push edi
mov edx, 0x722118
xor ecx, ecx
call fcn.00488a50
push edi
push 0x722134
push 0x722150
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3

Function at 0x487ef5
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, edx
mov ebp, ecx
push edi
test esi, esi
je 0x487f06
cmp esi, 0xffffffff
jne 0x487f1d
test ebp, ebp
jne 0x487f0e
xor esi, esi
jmp 0x487f1d
push 0x1000
push ebp
call fcn.005ea5b0
pop ecx
pop ecx
mov esi, eax
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
cmp edi, 0xffffffff
jne 0x487f41
test ebx, ebx
jne 0x487f32
xor edi, edi
jmp 0x487f41
push 0x1000
push ebx
call fcn.005ea5b0
pop ecx
pop ecx
mov edi, eax
push 0x2424
push 0x722288
lea eax, [edi + 1]
add eax, esi
push 1
push eax
call fcn.005e7f10
add esp, 0x10
mov dword [esp + 0x18], eax
test eax, eax
je 0x487f91
push esi
lea edx, [edi + 1]
mov ecx, eax
push ebp
add edx, esi
call section..text
add esi, dword [esp + 0x20]
lea edx, [edi + 1]
push edi
push ebx
mov ecx, esi
call section..text
mov eax, dword [esp + 0x28]
add esp, 0x10
mov byte [esi + edi], 0
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x2424
push esi
push edi
mov edx, 0x7222a4
xor ecx, ecx
call fcn.00488a50
push edi
push 0x7222c0
push 0x7222dc
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3
Function at 0x487fca
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, edx
push edi
mov edi, ecx
test esi, esi
je 0x487fdb
cmp esi, 0xffffffff
jne 0x487ff2
test edi, edi
jne 0x487fe3
xor esi, esi
jmp 0x487ff2
push 0x1000
push edi
call fcn.005ea5b0
pop ecx
pop ecx
mov esi, eax
push 0x242e
push 0x722300
lea ebp, [esi + 1]
push 1
push ebp
call fcn.005e7f10
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x488028
push esi
push edi
mov edx, ebp
mov ecx, ebx
call section..text
pop ecx
pop ecx
pop edi
mov byte [ebx + esi], 0
mov eax, ebx
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x242e
push esi
push edi
mov edx, 0x72231c
xor ecx, ecx
call fcn.00488a50
push edi
push 0x722338
push 0x722354
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3

Function at 0x488061
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x1000
mov edi, 0x72c000
xor esi, esi
and dword [esp + 0x10], esi
mov ebx, ecx
push edi
push 0xffffffffffffffff
push edx
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x722468
lea eax, [esp + 0x10]
push edi
push eax
call fcn.005e1090
add esp, 0xc
cmp dword [esp + 0xc], esi
jne 0x4880a9
and dword [ebx], esi
xor eax, eax
jmp 0x488134
push 2
push 0
push dword [esp + 0x14]
call fcn.005e2940
push dword [esp + 0x18]
call fcn.005c3d10
add esp, 0x10
cmp eax, 0x7fffffff
jge 0x4880de
push dword [esp + 0xc]
call fcn.005c3d10
mov esi, eax
pop ecx
test esi, esi
jns 0x4880de
and dword [ebx], 0
jmp 0x4880a2
push ebp
push 0
push 0
push dword [esp + 0x18]
call fcn.005e2940
mov ebp, 0x246d
lea eax, [esi + 1]
push ebp
push 0x722470
push 1
push eax
call fcn.005e7f10
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x488139
test esi, esi
jle 0x488121
push dword [esp + 0x10]
push esi
push 1
push edi
call fcn.005eac90
add esp, 0x10
mov esi, eax
mov byte [edi + esi], 0
push dword [esp + 0x10]
call fcn.005e1d40
pop ecx
mov dword [ebx], edi
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x72248c
push esi
push ebp
xor ecx, ecx
call fcn.00488a50
push ebp
push 0x7224a8
push 0x7224c4
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3

Function at 0x48816d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
push 0x1000
mov edi, 0x72c000
mov esi, edx
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x7224e8
lea eax, [ebp - 4]
push edi
push eax
call fcn.005e1090
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4881c5
push dword [ebp - 4]
push dword [ebp + 8]
push 1
push esi
call fcn.005e4940
push dword [ebp - 4]
call fcn.005e1d40
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4881cb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push 0x1000
mov esi, 0x72c000
push esi
push 0xffffffffffffffff
push dword [0x72a310]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x7224f0
lea eax, [ebp - 4]
push esi
push eax
call fcn.005e1090
add esp, 0xc
cmp dword [ebp - 4], 0
pop esi
je 0x48822a
push dword [ebp - 4]
push dword [ebp + 8]
push 1
push 0x72b000
call fcn.005e4940
push dword [ebp - 4]
call fcn.005e1d40
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x48822e
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.005b3d10
mov eax, dword [0x6ccd44]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x1000
lea eax, [ebp - 0x4004]
mov esi, edx
or edx, 0xffffffff
push edi
push eax
call fcn.00480c85
lea eax, [ebp - 0x2004]
or edx, 0xffffffff
push edi
push eax
mov ecx, esi
call fcn.00480c85
add esp, 0x10
lea eax, [ebp - 0x2004]
push 0
push eax
lea eax, [ebp - 0x4004]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.005b35b0
mov esp, ebp
pop ebp
ret
Function at 0x4887fc
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x6ccd44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x18], edx
xor ebx, ebx
xor edx, edx
mov dword [ebp - 8], ebx
push edi
mov edi, dword [ebp + 8]
inc edx
mov dword [ebp - 0x1c], edx
mov esi, ecx
mov dword [ebp - 0xc], esi
test edi, edi
je 0x488830
push 7
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 8
xor eax, eax
lea edi, [ebp - 0x3c]
cmp byte [esi], 0x5b
pop ecx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], 6
jne 0x488889
push 0x1000
push esi
call fcn.005ea5b0
pop ecx
pop ecx
mov esi, eax
call fcn.005b4450
mov edi, esp
cmp esi, 2
jge 0x48886f
or eax, 0xffffffff
jmp 0x4889ae
lea eax, [esi - 2]
mov edx, esi
push eax
mov eax, dword [ebp - 0xc]
mov ecx, edi
inc eax
push eax
call section..text
pop ecx
mov byte [edi + esi - 2], bl
mov esi, edi
pop ecx
test esi, esi
jne 0x488894
mov edi, ebx
mov dword [ebp - 0xc], ebx
jmp 0x4888af
push ebx
push ebx
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax*2 + 2]
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4888bb
mov dword [ebp - 0x10], ebx
jmp 0x4888d6
push ebx
push ebx
push 0xffffffffffffffff
push eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x10], eax
test edi, edi
jne 0x4888df
mov dword [ebp - 0x14], ebx
jmp 0x4888e9
mov eax, edi
call fcn.005b4450
mov dword [ebp - 0x14], esp
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x4888f4
mov edi, ebx
jmp 0x4888fb
call fcn.005b4450
mov edi, esp
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x488915
push dword [ebp - 0xc]
push eax
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test edi, edi
je 0x488930
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
push eax
push edi
push 0xffffffffffffffff
push edx
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x14]
push edi
push eax
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
mov esi, eax
test esi, esi
je 0x48895b
cmp dword [ebp - 8], ebx
je 0x488957
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov eax, esi
jmp 0x4889ae
mov esi, dword [ebp - 8]
test esi, esi
je 0x488867
xor eax, eax
inc eax
test eax, eax
jle 0x4889a3
cmp dword [esi + 4], 2
je 0x488979
cmp dword [esi + 4], 0x17
jne 0x48899c
push dword [esi + 0x10]
mov edi, dword [ebp + 8]
mov ecx, edi
push dword [esi + 0x18]
push 0x1c
pop edx
call section..text
mov eax, dword [ebp - 0x1c]
add edi, 0x1c
inc ebx
mov dword [ebp + 8], edi
pop ecx
dec eax
pop ecx
mov dword [ebp - 0x1c], eax
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x488969
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov eax, ebx
lea esp, [ebp - 0x48]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b35b0
mov esp, ebp
pop ebp
ret