joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464db0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc8bb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e60], 0
jne 0x464e8d
mov ecx, 0x662224
call fcn.00408890
cmp dword [0x661e60], 0
jne 0x464e83
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x80
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x464e35
mov ecx, dword [ebp - 0x1c]
call fcn.0045cf10
mov dword [ebp - 0x20], eax
jmp 0x464e3c
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x464e62
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x464e7a
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e60], edx
mov ecx, 0x662224
call fcn.00408850
mov eax, dword [0x661e60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x464f30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db45b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e64], 0
jne 0x46500a
mov ecx, 0x662208
call fcn.00408890
cmp dword [0x661e64], 0
jne 0x465000
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x5c
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x464fb2
mov ecx, dword [ebp - 0x1c]
call fcn.004ecd30
mov dword [ebp - 0x20], eax
jmp 0x464fb9
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x464fdf
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x464ff7
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e64], edx
mov ecx, 0x662208
call fcn.00408850
mov eax, dword [0x661e64]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ee40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eb998
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x65b4e4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x30]
call fcn.0040c000
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x34], 8
jne 0x46eec0
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x40]
call fcn.0046e460
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x10]
cmp eax, 0x2bf20
jb 0x46eeb1
jmp 0x46eec0
push 0x2710
call fcn.00506ab0
add esp, 4
jmp 0x46ee8a
cmp dword [ebp - 0x34], 0
jne 0x46eed6
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x40]
call fcn.0046e810
test eax, eax
jne 0x46eef1
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040c050
mov eax, dword [ebp - 0x38]
jmp 0x46ef0a
mov dword [ebp - 0x3c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040c050
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005b0968
mov esp, ebp
pop ebp
ret
Function at 0x46f460
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5edf20
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0xa4]
and ecx, 4
jne 0x46f49b
jmp 0x46f58e
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x100
call fcn.0040bfe0
movzx edx, al
test edx, edx
je 0x46f4c0
mov ecx, dword [ebp - 0x24]
call fcn.0046ee40
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0xa8]
imul ecx, ecx, 0x3e8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0xa8], 0
jbe 0x46f514
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x10]
cmp dword [ebp - 0x14], eax
ja 0x46f4f6
jmp 0x46f58e
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub edx, ecx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x3e8
jae 0x46f514
mov dword [ebp - 0x14], 0x3e8
mov eax, dword [ebp - 0x24]
add eax, 0xac
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040c070
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
push edx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
call fcn.0046e170
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x46f589
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x609fc7
call fcn.0040bf50
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
call fcn.0046f880
jmp 0x46f58e
jmp 0x46f4c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x47dbe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dfc65
mov eax, dword fs:[0]
push eax
sub esp, 0x1b4
mov eax, dword [0x65b4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1b0], ecx
push 1
push 2
lea ecx, [ebp - 0xac]
call fcn.0040b160
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push 0x61aedc
lea ecx, [ebp - 0xac]
push ecx
call fcn.00409c80
add esp, 8
push eax
call fcn.00409c80
add esp, 8
lea edx, [ebp - 0x150]
push edx
lea ecx, [ebp - 0xac]
call fcn.00409610
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1b8], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1b8]
call fcn.0040bf30
push eax
push 0x61aef0
push 0x896
push 0x61af14
push 0x20
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x150]
call fcn.0040c050
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
call fcn.00409ef0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0040bf50
mov dword [ebp - 4], 2
push 0x609d1a
lea ecx, [ebp - 0x16c]
call fcn.0040bf50
mov byte [ebp - 4], 3
push str.process
lea ecx, [ebp - 0x188]
call fcn.0040bf50
mov byte [ebp - 4], 4
lea edx, [ebp - 0x16c]
push edx
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004fb430
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x188]
call fcn.0040c050
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x16c]
call fcn.0040c050
push 0x61af34
lea ecx, [ebp - 0x2c]
call fcn.0040bf30
push eax
call fcn.005b14c5
add esp, 8
test eax, eax
jne 0x47dd78
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0xb1]
call fcn.0052d5f0
mov byte [ebp - 4], 5
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0xb1]
call fcn.00528840
movzx eax, al
mov dword [ebp - 0xb0], eax
push 1
push 2
lea ecx, [ebp - 0x134]
call fcn.0040b160
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0xb0]
push ecx
push 0x61af44
lea edx, [ebp - 0x134]
push edx
call fcn.00409c80
add esp, 8
mov ecx, eax
call fcn.0041c060
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0x134]
call fcn.00409610
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], ecx
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1c0]
call fcn.0040bf30
push eax
push str.CPolicyManager::KillProcessByName
push 0x8a8
push 0x61af78
push 0x20
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1a8]
call fcn.0040c050
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x134]
call fcn.00409ef0
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0x1ac], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb1]
call fcn.005284a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040c050
mov eax, dword [ebp - 0x1ac]
jmp 0x47de84
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b0968
mov esp, ebp
pop ebp
ret 4
Function at 0x4801b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5ccb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e6c], 0
jne 0x48028a
mov ecx, 0x662280
call fcn.00408890
cmp dword [0x661e6c], 0
jne 0x480280
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x3c
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x480232
mov ecx, dword [ebp - 0x1c]
call fcn.004808d0
mov dword [ebp - 0x20], eax
jmp 0x480239
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x48025f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x480277
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e6c], edx
mov ecx, 0x662280
call fcn.00408850
mov eax, dword [0x661e6c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4802b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db2fb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e70], 0
jne 0x48038a
mov ecx, 0x662264
call fcn.00408890
cmp dword [0x661e70], 0
jne 0x480380
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x68
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x480332
mov ecx, dword [ebp - 0x1c]
call fcn.004ea630
mov dword [ebp - 0x20], eax
jmp 0x480339
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x48035f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x480377
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e70], edx
mov ecx, 0x662264
call fcn.00408850
mov eax, dword [0x661e70]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x480460
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc71b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e74], 0
jne 0x48053d
mov ecx, 0x662248
call fcn.00408890
cmp dword [0x661e74], 0
jne 0x480533
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0xc8
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x4804e5
mov ecx, dword [ebp - 0x1c]
call fcn.0049c010
mov dword [ebp - 0x20], eax
jmp 0x4804ec
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x480512
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x48052a
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e74], edx
mov ecx, 0x662248
call fcn.00408850
mov eax, dword [0x661e74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x487140
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d9eeb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x662244
call fcn.0041b290
test eax, eax
jne 0x487203
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x7c
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x4871b0
mov ecx, dword [ebp - 0x1c]
call fcn.004a9d70
mov dword [ebp - 0x20], eax
jmp 0x4871b7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x4871dd
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x4871f5
push 0x61b3f0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x662244
call fcn.0041b2e0
mov ecx, 0x662244
call fcn.0041b290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x487220
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db2ab
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x662240
call fcn.0041b290
test eax, eax
jne 0x4872e6
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x160
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x487293
mov ecx, dword [ebp - 0x1c]
call fcn.004ac4c0
mov dword [ebp - 0x20], eax
jmp 0x48729a
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x4872c0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x4872d8
push 0x61b420
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x662240
call fcn.0041b2e0
mov ecx, 0x662240
call fcn.0041b290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48be90
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc583
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x65b4e4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
push str.SetCallBack
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
push 0x61850c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x20], eax
push str.GetPolicyBase
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x24], eax
push 0x61852c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x28], eax
push 0x618538
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x2c], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x20], 0
je 0x48bf75
lea ecx, [ebp - 0x34]
call fcn.0040c000
mov dword [ebp - 4], 0
lea eax, [ebp - 0x34]
push eax
call fcn.00516600
add esp, 4
push 0
push 0
lea ecx, [ebp - 0x34]
call fcn.0040bf30
push eax
push 4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x20]
call edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.0040c050
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 0
je 0x48bfbb
push 0x23c
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.005b4520
add esp, 0xc
mov ecx, 0x4f
mov esi, 0x65d3c8
lea edi, [ebp - 0x274]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x274]
push ecx
call dword [ebp - 0x10]
mov dword [ebp - 0x14], 1
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x20], 0
je 0x48c024
call fcn.00404950
mov dword [ebp - 0x294], eax
lea ecx, [ebp - 0x290]
call fcn.0040c000
mov dword [ebp - 4], 1
lea eax, [ebp - 0x290]
push eax
push 0x618548
mov ecx, dword [ebp - 0x294]
call fcn.0040cf60
push 0
push 0
lea ecx, [ebp - 0x290]
call fcn.0040bf30
push eax
push 2
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x20]
call edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x290]
call fcn.0040c050
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.005b0968
mov esp, ebp
pop ebp
ret
Function at 0x48e110
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d797b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x66229c
call fcn.0041b290
test eax, eax
jne 0x48e1d3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x60
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x48e180
mov ecx, dword [ebp - 0x1c]
call fcn.004af1e0
mov dword [ebp - 0x20], eax
jmp 0x48e187
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x48e1ad
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x48e1c5
push 0x618b08
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x66229c
call fcn.0041b2e0
mov ecx, 0x66229c
call fcn.0041b290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48e490
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc541
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x65b4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x12c], ecx
lea ecx, [ebp - 0x2c]
call fcn.0040c000
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
push 0x6179ac
call fcn.00404950
mov ecx, eax
call fcn.0040cf60
push 0x6179d8
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0xf0]
push edx
call fcn.00404a40
add esp, 0xc
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x134], eax
mov byte [ebp - 4], 1
push 0x6179d4
mov ecx, dword [ebp - 0x134]
push ecx
lea edx, [ebp - 0x10c]
push edx
call fcn.00404a40
add esp, 0xc
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x13c], eax
mov byte [ebp - 4], 2
push str.ArpBlock.log
mov ecx, dword [ebp - 0x13c]
push ecx
lea edx, [ebp - 0x48]
push edx
call fcn.00404a40
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10c]
call fcn.0040c050
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xf0]
call fcn.0040c050
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040bf30
push eax
call fcn.0051b730
add esp, 8
cmp dword [ebp - 0x50], 0
ja 0x48e5ac
cmp dword [ebp - 0x54], 0x500000
jb 0x48e5bd
lea ecx, [ebp - 0x48]
call fcn.0040bf30
push eax
call fcn.00503060
add esp, 4
push 0x6179dc
lea ecx, [ebp - 0x48]
call fcn.0040bf30
push eax
call fcn.005b0ac9
add esp, 8
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x48e6d9
lea ecx, [ebp - 0x128]
push ecx
call fcn.004fffc0
add esp, 4
mov dword [ebp - 0x140], eax
mov edx, dword [ebp - 0x140]
mov dword [ebp - 0x144], edx
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x144]
call fcn.0040bf30
push eax
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
push 0x6179e0
push 0x80
lea eax, [ebp - 0xd4]
push eax
call fcn.005b0ba7
add esp, 0x14
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x128]
call fcn.0040c050
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x148], ecx
mov edx, dword [ebp - 0x148]
add edx, 1
mov dword [ebp - 0x14c], edx
mov eax, dword [ebp - 0x148]
mov cl, byte [eax]
mov byte [ebp - 0x14d], cl
add dword [ebp - 0x148], 1
cmp byte [ebp - 0x14d], 0
jne 0x48e65a
mov edx, dword [ebp - 0x148]
sub edx, dword [ebp - 0x14c]
mov dword [ebp - 0x154], edx
mov eax, dword [ebp - 0x4c]
push eax
push 1
mov ecx, dword [ebp - 0x154]
push ecx
lea edx, [ebp - 0xd4]
push edx
call fcn.005b0d41
add esp, 0x10
mov ecx, dword [ebp + 0x10]
call fcn.0040bf30
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040bf30
push eax
mov eax, dword [ebp + 8]
push eax
push str._s_IP:__s__MAC:_s_r_n
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.005b0dc3
add esp, 0x14
mov edx, dword [ebp - 0x4c]
push edx
call fcn.005b0f84
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0040c050
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040c050
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b0968
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a5660
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d9d0b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x6622a4
call fcn.0041b290
test eax, eax
jne 0x4a5723
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x60
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x4a56d0
mov ecx, dword [ebp - 0x1c]
call fcn.004a5ca0
mov dword [ebp - 0x20], eax
jmp 0x4a56d7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x4a56fd
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x4a5715
push 0x617824
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x6622a4
call fcn.0041b2e0
mov ecx, 0x6622a4
call fcn.0041b290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a5790
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e653b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x6622a0
call fcn.0041b290
test eax, eax
jne 0x4a5856
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x138
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x4a5803
mov ecx, dword [ebp - 0x1c]
call fcn.0049a220
mov dword [ebp - 0x20], eax
jmp 0x4a580a
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x4a5830
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x4a5848
push 0x617854
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x6622a0
call fcn.0041b2e0
mov ecx, 0x6622a0
call fcn.0041b290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret