joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4876c7
Capabilities:
Read file on windows
Terminate process

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
lea eax, [esp + 8]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
push ebp
push eax
push dword [esp + 0x30]
mov edi, edx
mov dword [esp + 0x1c], ecx
push ebx
xor esi, esi
push edi
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x48782d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x487890
push esi
push esi
push 0xe99
push 0x73edd0
push 1
push 0x28
call fcn.005ed7c0
add esp, 0x10
mov ecx, eax
push 0x18
pop edx
call fcn.00484c1e
pop ecx
pop ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 8], edi
mov edi, dword [esp + 0x34]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax], ebx
mov ebx, 0x400
mov dword [esp + 0x18], eax
mov dword [eax + 0xc], ebp
mov dword [eax + 0x10], ecx
test edi, edi
jne 0x48775c
mov eax, esi
jmp 0x487765
push ebx
push edi
call fcn.005f01d0
pop ecx
pop ecx
add eax, 0xa
cmp eax, 0xffffffff
jae 0x4877cb
test edi, edi
jne 0x487775
mov eax, esi
jmp 0x48777e
push ebx
push edi
call fcn.005f01d0
pop ecx
pop ecx
push 0xfffffffffffffff5
pop ecx
sub ecx, eax
je 0x4877cb
test edi, edi
jne 0x48778d
mov eax, esi
jmp 0x487796
push ebx
push edi
call fcn.005f01d0
pop ecx
pop ecx
add eax, 0xa
cmp eax, 0xffffffef
jae 0x4877cb
test edi, edi
jne 0x4877a6
mov eax, esi
jmp 0x4877af
push ebx
push edi
call fcn.005f01d0
pop ecx
pop ecx
push 0xe9f
push 0x73edec
add eax, 0x1a
push 1
push eax
call fcn.005ed7c0
add esp, 0x10
mov ebx, eax
jmp 0x4877cd
mov ebx, esi
test edi, edi
jne 0x4877d5
mov eax, esi
jmp 0x4877e2
push 0x400
push edi
call fcn.005f01d0
pop ecx
pop ecx
push esi
push esi
lea edx, [eax + 0xa]
mov ecx, ebx
call fcn.00484c1e
test edi, edi
mov ecx, 0x74cbba
mov esi, eax
cmovne ecx, edi
push ecx
push 0x73ee08
push dword [esi - 0x10]
push esi
call fcn.0040117f
mov edx, dword [ebp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push dword [esp + 0x34]
push 0x4874a9
push 0xffffffffffffffff
call fcn.00487bda
add esp, 0x28
mov ecx, esi
call fcn.00484cd3
jmp 0x4878aa
cmp dword [esp + 0x14], esi
jbe 0x487890
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4878aa
push 0xeb0
push 0x73ee14
push 1
push 0x18
call fcn.005ed7c0
mov ecx, eax
add esp, 0x10
test ecx, ecx
je 0x4878b2
mov eax, dword [esp + 0x30]
mov dword [ecx + 0x10], eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebp
mov dword [ecx + 8], edi
mov eax, dword [esp + 0x14]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x487878
mov esi, dword [eax + 0x10]
push ecx
mov dword [ecx + 0x14], esi
mov edx, 0x487625
mov ecx, dword [esp + 0x14]
push 1
call fcn.004850f9
pop ecx
pop ecx
jmp 0x4878aa
cmp dword [esp + 0x2c], esi
je 0x4878aa
push dword [esp + 0x30]
push esi
push ebx
push 5
push edi
push dword [esp + 0x24]
call dword [esp + 0x44]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0xeb0
push esi
push edi
mov edx, 0x73ee30
xor ecx, ecx
call fcn.0048cac3
push edi
push 0x73ee4c
push 0x73ee68
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
int3
Function at 0x4879be
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
xor ebx, ebx
mov dword [esp + 8], edx
push esi
push edi
cmp dword [esp + 0x30], ebx
jne 0x4879d8
mov eax, ebx
mov dword [esp + 0x14], ebx
jmp 0x4879ec
push 0x400
push dword [esp + 0x34]
call fcn.005f01d0
pop ecx
pop ecx
mov dword [esp + 0x14], eax
lea esi, [eax + 0x1c]
cmp esi, 0xffffffff
jae 0x487a1a
push 0xffffffffffffffe3
pop ecx
sub ecx, eax
je 0x487a1a
cmp esi, 0xffffffef
jae 0x487a1a
push 0xee5
push 0x73eea8
add eax, 0x2c
push 1
push eax
call fcn.005ed7c0
add esp, 0x10
jmp 0x487a1c
mov eax, ebx
push ebx
push ebx
mov edx, esi
mov ecx, eax
call fcn.00484c1e
pop ecx
pop ecx
push ebx
push ebx
push 0xee6
push 0x73eec4
push 1
push 0x28
mov ebp, eax
call fcn.005ed7c0
add esp, 0x10
mov ecx, eax
push 0x18
pop edx
call fcn.00484c1e
mov edi, dword [esp + 0x24]
mov ebx, eax
mov esi, dword [esp + 0x28]
pop ecx
pop ecx
push edi
push 0
push dword [esp + 0x2c]
push esi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x30], 0
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x10], eax
mov dword [ebx], esi
mov dword [ebx + 0xc], edi
mov dword [ebx + 4], fcn.004694e6
mov eax, dword [edi + 0x10]
mov dword [ebp], eax
mov eax, 0x74cbbb
cmovne eax, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x18]
add eax, 8
mov dword [ebp + 8], ebx
push str._s__READ_
push eax
lea eax, [ebp + 0x14]
mov dword [ebp + 4], 0x4874a9
push eax
call fcn.0040117f
add esp, 0x10
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x488414
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x14a0
mov edi, edx
push ebx
push 0x73f248
push 1
push 8
mov esi, ecx
call fcn.005ed7c0
mov edx, eax
add esp, 0x10
test edx, edx
je 0x488445
mov eax, dword [esi]
mov dword [edx], edi
pop edi
mov dword [esi], edx
pop esi
mov dword [edx + 4], eax
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x73f264
push esi
push ebx
xor ecx, ecx
call fcn.0048cac3
push ebx
push 0x73f280
push 0x73f29c
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
int3

Function at 0x4884e1
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, 0x150f
mov esi, ecx
push edi
push 0x73f2c0
push 1
push 4
call fcn.005ed7c0
mov edx, eax
add esp, 0x10
test edx, edx
je 0x48850b
mov eax, dword [esi]
pop edi
mov dword [edx], eax
mov eax, edx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x73f2dc
push esi
push edi
xor ecx, ecx
call fcn.0048cac3
push edi
push 0x73f2f8
push 0x73f314
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
int3

Function at 0x4885ba
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
je 0x48860b
cmp dword [ebx - 0x10], 0x2c
jbe 0x488604
push 0x10
pop edx
call fcn.00484ee1
push 0x1c
pop edx
mov esi, eax
call fcn.00484ee1
mov edx, eax
test esi, esi
je 0x4886ba
test edx, edx
je 0x4886ba
xor eax, eax
mov edi, edx
push 7
pop ecx
rep stosd dword es:[edi], eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esi + 8], ebx
jmp 0x4886ab
xor eax, eax
jmp 0x4886b6
mov edi, 0x157c
push edi
push 0x73f394
push 1
push 0x10
call fcn.005ed7c0
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x488655
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x73f3b0
push esi
push edi
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x73f3cc
push 0x73f3e8
jmp 0x4886e7
mov edi, 0x157d
push edi
push 0x73f40c
push 1
push 0x1c
call fcn.005ed7c0
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x48869c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x73f428
push esi
push edi
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x73f444
push 0x73f460
jmp 0x4886e7
xor eax, eax
mov edi, edx
push 7
pop ecx
rep stosd dword es:[edi], eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esi], edx
test ebx, ebx
jne 0x4886b4
mov dword [esi + 0xc], ebx
mov eax, esi
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1570
push esi
push edi
mov edx, 0x73f338
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x73f354
push 0x73f370
call fcn.00401109
add esp, 0xc
push esi
call fcn.005c8390
int3
Function at 0x4887f6
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, ecx
push esi
push edi
mov edi, edx
mov dword [esp + 0x10], edi
test ebx, ebx
je 0x488949
cmp ebx, 0x7fffffff
ja 0x488949
push dword [ebp + 4]
mov esi, dword [ebp]
mov edx, ebx
mov ecx, edi
call fcn.0048872b
pop ecx
mov dword [esp + 0x18], eax
cmp dword [esi + 8], eax
jne 0x488861
cmp dword [ebp + 4], 0
jne 0x48884b
cmp dword [esi + 0x10], ebx
jne 0x488861
push ebx
push edi
push dword [esi + 0xc]
call fcn.00647cc0
jmp 0x48885a
cmp dword [esi + 0x10], ebx
jne 0x488861
push ebx
push edi
push dword [esi + 0xc]
call fcn.005e8140
add esp, 0xc
test eax, eax
je 0x48886f
mov eax, dword [esi]
test eax, eax
je 0x488876
mov esi, eax
mov eax, dword [esp + 0x18]
jmp 0x48882f
mov eax, esi
jmp 0x48894b
cmp dword [esp + 0x1c], 0
je 0x488949
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x4888a0
push 0x163c
push 0x73f484
push 1
push 0x1c
call fcn.005ed7c0
add esp, 0x10
jmp 0x4888a8
push 0x1c
pop edx
call fcn.00484ee1
mov edi, eax
mov dword [esi], edi
test edi, edi
je 0x488951
xor eax, eax
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [esi]
lea edi, [ebx + 1]
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], esi
mov eax, dword [esi]
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 8]
mov ebp, 0x1640
test ecx, ecx
jne 0x4888eb
push ebp
push 0x73f4fc
push 1
push edi
call fcn.005ed7c0
add esp, 0x10
jmp 0x4888f2
mov edx, edi
call fcn.00484ee1
mov ecx, eax
mov eax, dword [esi]
mov dword [eax + 0xc], ecx
test ecx, ecx
jne 0x488924
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x73f518
push esi
push ebp
xor ecx, ecx
call fcn.0048cac3
push ebp
push 0x73f534
push 0x73f550
jmp 0x48897b
mov ecx, dword [esi]
mov edx, edi
push ebx
push dword [esp + 0x14]
mov ecx, dword [ecx + 0xc]
call section..text
mov eax, dword [esi]
pop ecx
pop ecx
mov eax, dword [eax + 0xc]
mov byte [ebx + eax], 0
mov eax, dword [esi]
mov dword [eax + 0x10], ebx
mov eax, dword [esi]
jmp 0x48894b
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x163c
push esi
push edi
mov edx, 0x73f4a0
xor ecx, ecx
call fcn.0048cac3
push edi
push 0x73f4bc
push 0x73f4d8
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
int3
Function at 0x488a94
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, 0x1750
mov dword [esp + 0x1c], ecx
push ebx
push 0x73f668
xor al, al
xor edi, edi
push 1
push 0xc
xor ebp, ebp
mov byte [esp + 0x27], al
call fcn.005ed7c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x488c42
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
and dword [esi], edi
and dword [esi + 8], edi
lea eax, [ecx + 7]
push 7
mov dword [esp + 0x1c], eax
lea eax, [edx + 7]
pop ebx
cmp eax, ebx
jbe 0x488bcf
mov al, byte [esp + 0x17]
test al, al
jne 0x488b14
mov al, byte [ebx + ecx]
cmp al, 0x22
jne 0x488b07
xor ebp, ebp
mov byte [esp + 0x17], al
inc ebp
jmp 0x488b8b
cmp al, 0x27
jne 0x488b22
xor ebp, ebp
mov byte [esp + 0x17], al
inc ebp
jmp 0x488b22
cmp byte [ebx + ecx], al
jne 0x488b22
xor eax, eax
test ebp, ebp
sete al
mov ebp, eax
test ebp, ebp
jne 0x488b8b
push 1
push 0x743a3c
push edx
mov edx, ebx
call fcn.00488a5b
add esp, 0xc
test eax, eax
je 0x488b87
push 0x1783
push 0x73f6e0
push 1
push 0xc
call fcn.005ed7c0
mov ecx, eax
add esp, 0x10
test ecx, ecx
je 0x488b9d
mov edx, dword [esp + 0x18]
and dword [ecx + 8], ebp
mov dword [ecx], edx
mov dword [ecx + 4], edi
cmp dword [esi], ebp
je 0x488b70
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x488b72
mov dword [esi], ecx
inc dword [esi + 8]
inc edx
add edx, edi
mov dword [esi + 4], ecx
mov dword [esp + 0x18], edx
xor edi, edi
mov edx, dword [esp + 0x24]
jmp 0x488b8c
mov edx, dword [esp + 0x24]
inc edi
inc ebx
lea eax, [edx + 7]
cmp ebx, eax
jae 0x488bcf
mov ecx, dword [esp + 0x1c]
jmp 0x488aec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfd
mov ebx, 0x1783
push esi
push ebx
mov edx, 0x73f6fc
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push ebx
push 0x73f718
push 0x73f734
jmp 0x488c6a
mov ebx, 0x17a9
push ebx
push 0x73f758
push 1
push 0xc
call fcn.005ed7c0
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x488c16
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x73f774
push esi
push ebx
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push ebx
push 0x73f790
push 0x73f7ac
jmp 0x488c6a
mov eax, dword [esp + 0x18]
and dword [ecx + 8], 0
mov dword [ecx], eax
mov dword [ecx + 4], edi
cmp dword [esi], 0
je 0x488c30
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x488c32
mov dword [esi], ecx
inc dword [esi + 8]
mov eax, esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x73f684
push esi
push ebx
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push ebx
push 0x73f6a0
push 0x73f6bc
call fcn.00401109
add esp, 0xc
push esi
call fcn.005c8390
int3
Function at 0x488caf
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, edx
xor ebx, ebx
mov ebp, ecx
test edi, edi
je 0x488cc3
add ebp, edi
xor edi, edi
push 0x17de
push 0x73f7d0
push 1
push 0xc
call fcn.005ed7c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x488e1f
mov eax, dword [esp + 0x1c]
lea ecx, [edi + ebp]
and dword [esi], ebx
and dword [esi + 8], ebx
mov dword [esp + 0x10], ecx
cmp byte [ecx + eax - 1], bl
lea edx, [eax - 1]
cmovne edx, eax
mov dword [esp + 0x14], edx
jmp 0x488d77
push dword [esp + 0x24]
mov ecx, ebp
push dword [esp + 0x24]
push edx
mov edx, edi
call fcn.00488a5b
add esp, 0xc
test eax, eax
je 0x488d71
push 0x17f1
push 0x73f848
push 1
push 0xc
call fcn.005ed7c0
mov ecx, eax
add esp, 0x10
test ecx, ecx
je 0x488dc5
mov edx, dword [esp + 0x10]
and dword [ecx + 8], 0
mov dword [ecx], edx
mov dword [ecx + 4], ebx
cmp dword [esi], 0
je 0x488d56
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x488d58
mov dword [esi], ecx
mov eax, dword [esp + 0x24]
dec edi
inc dword [esi + 8]
add edi, eax
add eax, ebx
mov dword [esi + 4], ecx
add edx, eax
xor ebx, ebx
mov dword [esp + 0x10], edx
jmp 0x488d72
inc ebx
mov edx, dword [esp + 0x14]
inc edi
cmp edi, edx
jb 0x488d03
mov edi, 0x1817
push edi
push 0x73f8c0
push 1
push 0xc
call fcn.005ed7c0
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x488df4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x73f8dc
push esi
push edi
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x73f8f8
push 0x73f914
jmp 0x488e4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov ebx, 0x17f1
push esi
push ebx
mov edx, 0x73f864
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push ebx
push 0x73f880
push 0x73f89c
jmp 0x488e4c
mov eax, dword [esp + 0x10]
and dword [ecx + 8], 0
mov dword [ecx], eax
mov dword [ecx + 4], ebx
cmp dword [esi], 0
je 0x488e0e
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x488e10
mov dword [esi], ecx
inc dword [esi + 8]
mov eax, esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x17de
push esi
push edi
mov edx, 0x73f7ec
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x73f808
push 0x73f824
call fcn.00401109
add esp, 0xc
push esi
call fcn.005c8390
int3
Function at 0x48952e
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
sub esp, 0xc
mov dword [esp + 0x24], ecx
xor edi, edi
mov ebx, edx
mov ebp, edi
call fcn.0048950b
push 0x19ee
push 0x73fc34
push 1
push eax
mov dword [esp + 0x2c], eax
call fcn.005ed7c0
mov esi, eax
add esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], esi
mov dword [eax], esi
test esi, esi
je 0x4895f5
mov ecx, ebx
mov dword [esp + 0x2c], ecx
test ebx, ebx
je 0x4895eb
mov eax, 0x320
cmp ecx, ebx
je 0x4895ad
mov edx, dword [esp + 0x10]
lea ecx, [esi + edi]
push 3
push 0x73fd54
sub edx, edi
call section..text
pop ecx
pop ecx
mov ecx, dword [esp + 0x2c]
add edi, 3
add ebp, 3
mov eax, 0x320
mov edx, dword [esp + 0x10]
cmp ecx, eax
mov esi, ecx
cmova esi, eax
mov eax, dword [esp + 0x18]
sub eax, ecx
sub edx, edi
mov ecx, dword [esp + 0x14]
add eax, ebx
push esi
push eax
lea ecx, [ecx + edi]
call section..text
pop ecx
pop ecx
mov ecx, dword [esp + 0x2c]
add edi, esi
add ebp, esi
mov eax, 0x320
sub ecx, esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0x2c], ecx
jne 0x489583
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x19ee
push esi
push edi
mov edx, 0x73fc50
xor ecx, ecx
call fcn.0048cac3
push edi
push 0x73fc6c
push 0x73fc88
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
int3
Function at 0x489940
Capabilities:
Set socket configuration
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, ecx
push 0x17
pop ebx
movzx eax, word [edi]
cmp ax, bx
jne 0x489987
cmp dword [0x7410d8], 0
jne 0x489987
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 0x1aaa
mov edx, 0x73fd60
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
or eax, 0xffffffff
jmp 0x489a0c
push dword [ebp + 8]
push edx
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4899ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 0x1aab
mov edx, 0x73fd7c
jmp 0x489975
cmp word [edi], bx
jne 0x4899c8
push 4
lea eax, [ebp - 4]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x489a13
cmp word [edi], bx
push 0x10
pop eax
push 0x1c
pop ecx
cmove eax, ecx
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x489a0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 0x1abf
mov edx, 0x73fdb4
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x48997f
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1ab6
mov edx, 0x73fd98
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push 0xfd
call fcn.005c8390
int3
Function at 0x489f29
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push 0x1b79
push 0x73fff4
push 1
mov edi, 0x88
push edi
call fcn.005ed7c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x489f85
push edi
push 0
push esi
call fcn.005bb370
and dword [esi + 0x10], 0
add esp, 0xc
or dword [esi + 0x34], 0xffffffff
xor ecx, ecx
or dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x24], 0x74006c
mov dword [esi + 0x28], 3
call fcn.004886f6
mov dword [esi + 0x84], eax
mov eax, esi
pop edi
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0xfe
mov esi, 0x1b7a
push edi
push esi
mov edx, 0x740010
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push esi
push 0x74002c
push 0x740048
call fcn.00401109
add esp, 0xc
push edi
call fcn.005c8390
int3

Function at 0x48a087
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, edx
push edi
cmp dword [esi + 0x38], 0
je 0x48a0a1
push 1
push dword [esi + 0x24]
call fcn.005ed680
pop ecx
pop ecx
mov edi, dword [esp + 0x14]
push 0x1bc6
push 0x740070
push 1
lea ebx, [edi + 1]
mov dword [esi + 0x38], 1
push ebx
call fcn.005ed7c0
add esp, 0x10
mov dword [esi + 0x24], eax
test eax, eax
je 0x48a0e4
push edi
push ebp
mov edx, ebx
mov ecx, eax
call section..text
mov eax, dword [esi + 0x24]
pop ecx
pop ecx
mov byte [edi + eax], 0
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1bc6
push esi
push edi
mov edx, 0x74008c
xor ecx, ecx
call fcn.0048cac3
push edi
push 0x7400a8
push 0x7400c4
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
int3

Function at 0x48a11d
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x1c], 0
mov dword [esi + 0x18], edx
je 0x48a138
push 1
push dword [esi + 0x1c]
call fcn.005ed680
pop ecx
pop ecx
mov edi, dword [esp + 0x18]
mov ebp, 0x1bd7
push ebp
push 0x7400e8
push 1
lea ebx, [edi + 1]
push ebx
call fcn.005ed7c0
add esp, 0x10
mov dword [esi + 0x1c], eax
test eax, eax
je 0x48a17b
push edi
push dword [esp + 0x18]
mov edx, ebx
mov ecx, eax
call section..text
mov eax, dword [esi + 0x1c]
pop ecx
pop ecx
mov byte [edi + eax], 0
mov dword [esi + 0x20], edi
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x740104
push esi
push ebp
xor ecx, ecx
call fcn.0048cac3
push ebp
push 0x740120
push 0x74013c
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c8390
int3
Function at 0x48a1af
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x10], edx
push edi
mov edi, dword [esp + 0x1c]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x48a1f7
mov ebx, dword [esp + 0x24]
lea eax, [ebx + 2]
add eax, edi
cmp dword [ecx - 0x10], eax
jbe 0x48a2d4
lea ebp, [edi + 1]
mov edx, ebp
call fcn.00484ee1
mov ecx, dword [esi + 0x10]
lea edx, [ebx + 1]
mov dword [esi], eax
call fcn.00484ee1
mov dword [esi + 8], eax
jmp 0x48a299
mov ebx, 0x1bf8
lea ebp, [edi + 1]
push ebx
push 0x7401bc
push 1
push ebp
call fcn.005ed7c0
add esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x48a243
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x7401d8
push esi
push ebx
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push ebx
push 0x7401f4
push 0x740210
jmp 0x48a301
mov ebx, dword [esp + 0x24]
push 0x1bf9
push 0x740234
push 1
lea eax, [ebx + 1]
push eax
call fcn.005ed7c0
add esp, 0x10
mov dword [esi + 8], eax
test eax, eax
jne 0x48a295
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1bf9
push esi
push edi
mov edx, 0x740250
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x74026c
push 0x740288
jmp 0x48a301
or dword [esi + 0x34], 0xffffffff
mov ecx, dword [esi]
mov edx, ebp
push edi
push dword [esp + 0x18]
call section..text
mov eax, dword [esi]
lea edx, [ebx + 1]
push ebx
push dword [esp + 0x2c]
mov byte [edi + eax], 0
mov ecx, dword [esi + 8]
mov dword [esi + 4], edi
call section..text
mov eax, dword [esi + 8]
add esp, 0x10
pop edi
mov byte [ebx + eax], 0
mov dword [esi + 0x14], ebx
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1bf3
push esi
push edi
mov edx, 0x740160
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x74017c
push 0x740198
call fcn.00401109
add esp, 0xc
push esi
call fcn.005c8390
int3