joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ec9e
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x1c]
mov esi, edx
xor edx, edx
push dword [esp + 0x1c]
push esi
call fcn.0048ba0a
mov ecx, dword [esp + 0x30]
mov ebp, eax
sub ecx, dword [esp + 0x28]
add esp, 0xc
mov dword [esp + 0x10], ebp
mov edi, dword [ebp + 8]
dec edi
imul edi, ecx
push 0x2498
push 0x758fbc
push 1
add edi, esi
lea eax, [edi + 1]
push eax
mov dword [esp + 0x2c], eax
call fcn.005f5ba0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x48ed52
mov byte [ebx + edi], 0
xor edi, edi
mov esi, dword [ebp]
test esi, esi
je 0x48ed43
mov ebp, dword [esp + 0x1c]
push dword [esi + 4]
mov edx, ebp
lea ecx, [ebx + edi]
push dword [esi]
sub edx, edi
call section..text
add edi, dword [esi + 4]
cmp dword [esi + 8], 0
pop ecx
pop ecx
je 0x48ed38
push dword [esp + 0x24]
mov edx, ebp
lea ecx, [ebx + edi]
push dword [esp + 0x24]
sub edx, edi
call section..text
add edi, dword [esp + 0x2c]
pop ecx
pop ecx
mov esi, dword [esi + 8]
test esi, esi
jne 0x48ed02
mov ebp, dword [esp + 0x10]
mov ecx, ebp
call fcn.0048bbce
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x2498
push esi
push edi
mov edx, 0x758fd8
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x758ff4
push 0x759010
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d0820
int3

Function at 0x48ed8e
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, edx
mov ebp, ecx
push edi
test esi, esi
je 0x48ed9f
cmp esi, 0xffffffff
jne 0x48edb6
test ebp, ebp
jne 0x48eda7
xor esi, esi
jmp 0x48edb6
push 0x1000
push ebp
call fcn.005f8590
pop ecx
pop ecx
mov esi, eax
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
cmp edi, 0xffffffff
jne 0x48edda
test ebx, ebx
jne 0x48edcb
xor edi, edi
jmp 0x48edda
push 0x1000
push ebx
call fcn.005f8590
pop ecx
pop ecx
mov edi, eax
push 0x24fb
push 0x759148
lea eax, [edi + 1]
add eax, esi
push 1
push eax
call fcn.005f5ba0
add esp, 0x10
mov dword [esp + 0x18], eax
test eax, eax
je 0x48ee2a
push esi
lea edx, [edi + 1]
mov ecx, eax
push ebp
add edx, esi
call section..text
add esi, dword [esp + 0x20]
lea edx, [edi + 1]
push edi
push ebx
mov ecx, esi
call section..text
mov eax, dword [esp + 0x28]
add esp, 0x10
mov byte [esi + edi], 0
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x24fb
push esi
push edi
mov edx, 0x759164
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x759180
push 0x75919c
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d0820
int3
Function at 0x48ee63
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, edx
push edi
mov edi, ecx
test esi, esi
je 0x48ee74
cmp esi, 0xffffffff
jne 0x48ee8b
test edi, edi
jne 0x48ee7c
xor esi, esi
jmp 0x48ee8b
push 0x1000
push edi
call fcn.005f8590
pop ecx
pop ecx
mov esi, eax
push 0x2505
push 0x7591c0
lea ebp, [esi + 1]
push 1
push ebp
call fcn.005f5ba0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x48eec1
push esi
push edi
mov edx, ebp
mov ecx, ebx
call section..text
pop ecx
pop ecx
pop edi
mov byte [ebx + esi], 0
mov eax, ebx
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x2505
push esi
push edi
mov edx, 0x7591dc
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x7591f8
push 0x759214
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d0820
int3

Function at 0x48eefa
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x1000
mov edi, 0x76c260
xor esi, esi
and dword [esp + 0x10], esi
mov ebx, ecx
push edi
push 0xffffffffffffffff
push edx
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x759328
lea eax, [esp + 0x10]
push edi
push eax
call fcn.005ee8a0
add esp, 0xc
cmp dword [esp + 0xc], esi
jne 0x48ef42
and dword [ebx], esi
xor eax, eax
jmp 0x48efcd
push 2
push 0
push dword [esp + 0x14]
call fcn.005f0150
push dword [esp + 0x18]
call fcn.005d1550
add esp, 0x10
cmp eax, 0x7fffffff
jge 0x48ef77
push dword [esp + 0xc]
call fcn.005d1550
mov esi, eax
pop ecx
test esi, esi
jns 0x48ef77
and dword [ebx], 0
jmp 0x48ef3b
push ebp
push 0
push 0
push dword [esp + 0x18]
call fcn.005f0150
mov ebp, 0x2544
lea eax, [esi + 1]
push ebp
push 0x759330
push 1
push eax
call fcn.005f5ba0
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x48efd2
test esi, esi
jle 0x48efba
push dword [esp + 0x10]
push esi
push 1
push edi
call fcn.005f8c70
add esp, 0x10
mov esi, eax
mov byte [edi + esi], 0
push dword [esp + 0x10]
call fcn.005ef550
pop ecx
mov dword [ebx], edi
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x75934c
push esi
push ebp
xor ecx, ecx
call fcn.0048f95e
push ebp
push 0x759368
push 0x759384
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d0820
int3

Function at 0x48f006
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
push 0x1000
mov edi, 0x76c260
mov esi, edx
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x7593a8
lea eax, [ebp - 4]
push edi
push eax
call fcn.005ee8a0
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x48f05e
push dword [ebp - 4]
push dword [ebp + 8]
push 1
push esi
call fcn.005f25c0
push dword [ebp - 4]
call fcn.005ef550
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48f064
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [0x756898]
mov ebx, 0x76c260
push edi
mov edi, dword [0x75689c]
push 0x1000
push ebx
push 0xffffffffffffffff
push dword [0x76a4e0]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x7593b0
lea eax, [ebp - 4]
push ebx
push eax
call fcn.005ee8a0
mov ecx, dword [ebp - 4]
add esp, 0xc
test ecx, ecx
je 0x48f0fa
mov eax, esi
or eax, edi
je 0x48f0de
push 2
push 0
push ecx
call fcn.005f0150
push dword [ebp - 4]
call fcn.005d14f0
add esp, 0x10
cmp edx, edi
ja 0x48f0f1
jb 0x48f0d9
cmp eax, esi
jae 0x48f0f1
push dword [ebp - 4]
jmp 0x48f0df
push ecx
push dword [ebp + 8]
push 1
push 0x76b260
call fcn.005f25c0
add esp, 0x10
push dword [ebp - 4]
call fcn.005ef550
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48f101
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.005c1510
mov eax, dword [0x6d9d44]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x1000
lea eax, [ebp - 0x4004]
mov esi, edx
or edx, 0xffffffff
push edi
push eax
call fcn.00487094
lea eax, [ebp - 0x2004]
or edx, 0xffffffff
push edi
push eax
mov ecx, esi
call fcn.00487094
add esp, 0x10
lea eax, [ebp - 0x2004]
push 0
push eax
lea eax, [ebp - 0x4004]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.005c0db0
mov esp, ebp
pop ebp
ret
Function at 0x48fc16
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, ecx
mov edx, edi
neg edx
push 0
lea eax, [edi + 0x14]
sbb edx, edx
and edx, eax
push 0
mov esi, dword [edx]
push esi
call fcn.005f0150
push esi
push 0x10
push 1
push edi
call fcn.005f8c70
add esp, 0x1c
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret

Function at 0x48fc49
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, ecx
mov edx, edi
neg edx
push 0
lea eax, [edi + 0x14]
sbb edx, edx
and edx, eax
push 0
mov esi, dword [edx]
push esi
call fcn.005f0150
push esi
push 0x10
push 1
push edi
call fcn.005f25c0
push esi
call fcn.005ee100
add esp, 0x20
pop edi
pop esi
ret

Function at 0x48fc7b
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
lea eax, [ecx + 0x14]
neg esi
push edi
sbb esi, esi
xor edi, edi
and esi, eax
mov ebx, dword [esi]
add esi, 8
test edx, edx
jne 0x48fcca
cmp dword [ecx + 8], edi
jbe 0x48fcfe
push edx
push dword [ecx + 8]
mov edi, esi
push ebx
call fcn.005f0150
push ebx
push 8
push 1
push esi
call fcn.005f8c70
push ebx
push dword [esi + 4]
add eax, esi
push 1
push eax
call fcn.005f8c70
add esp, 0x2c
cmp eax, dword [esi + 4]
je 0x48fcfe
xor edi, edi
jmp 0x48fcfe
cmp dword [edx], edi
jbe 0x48fcfe
push 0
push dword [edx]
mov edi, esi
push ebx
call fcn.005f0150
push ebx
push 8
push 1
push esi
call fcn.005f8c70
push ebx
push dword [esi + 4]
add eax, esi
push 1
push eax
call fcn.005f8c70
xor ecx, ecx
add esp, 0x2c
cmp eax, dword [esi + 4]
cmovne edi, ecx
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x48fd61
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, 0x76c260
push edi
push 0x1000
push ebp
push 0xffffffffffffffff
mov edi, ecx
xor ebx, ebx
push edi
push ebx
push 0xfde9
call esi
push str.rbN
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.005ee8a0
add esp, 0xc
test eax, eax
je 0x48fdc2
push 0x1000
push ebp
push 0xffffffffffffffff
push edi
push ebx
push 0xfde9
call esi
push 0x7598d4
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.005ee8a0
add esp, 0xc
cmp dword [esp + 0x14], ebx
jne 0x48fdcf
xor eax, eax
jmp 0x48fec3
push 2
push ebx
push dword [esp + 0x1c]
call fcn.005f0150
add esp, 0xc
push dword [esp + 0x14]
call fcn.005d1550
pop ecx
push 0x10
pop ebp
cmp eax, ebp
jge 0x48fe47
test edi, edi
jne 0x48fdf7
mov eax, ebx
jmp 0x48fe04
push 0x104
push edi
call fcn.005f8590
pop ecx
pop ecx
push ebx
push ebx
lea edx, [eax + 0x1009]
mov ecx, ebp
call fcn.004878dc
mov esi, eax
mov edx, edi
mov dword [esi + 4], 0x1f4000
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x14], ecx
mov ecx, esi
call fcn.0048fd04
push dword [esp + 0x1c]
push ebp
push 1
push esi
call fcn.005f25c0
push dword [esp + 0x2c]
call fcn.005ee100
add esp, 0x1c
jmp 0x48fec1
push ebx
push ebx
push dword [esp + 0x1c]
call fcn.005f0150
add esp, 0xc
test edi, edi
jne 0x48fe5d
mov eax, ebx
jmp 0x48fe6a
push 0x104
push edi
call fcn.005f8590
pop ecx
pop ecx
push ebx
push ebx
lea edx, [eax + 0x1009]
mov ecx, ebp
call fcn.004878dc
push dword [esp + 0x1c]
mov esi, eax
push ebp
push 1
push esi
call fcn.005f8c70
add esp, 0x18
cmp eax, ebp
je 0x48fea7
push 1
push esi
call fcn.005f5a60
push dword [esp + 0x1c]
mov esi, ebx
call fcn.005ef550
add esp, 0xc
jmp 0x48fec1
mov ecx, esi
lea eax, [esi + 0x14]
neg ecx
mov edx, edi
sbb ecx, ecx
and ecx, eax
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
mov ecx, esi
call fcn.0048fd04
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x48feca
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
xor eax, eax
push ebp
push esi
mov ebp, ecx
mov dword [esp + 0x10], eax
mov esi, ebp
mov dword [esp + 0x1c], edx
neg esi
mov dword [esp + 0x14], ebx
push edi
sbb esi, esi
lea eax, [ebp + 0x14]
and esi, eax
push 0
push 0
mov esi, dword [esi]
push esi
call fcn.005f0150
push esi
push 0x10
pop edi
push edi
push 1
push ebp
call fcn.005f8c70
add esp, 0x1c
cmp eax, edi
je 0x48ff18
xor eax, eax
inc eax
jmp 0x49007d
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x48ff5f
push 0
add eax, 4
push eax
push esi
call fcn.005f0150
push esi
push 4
lea eax, [esp + 0x24]
push 1
push eax
call fcn.005f8c70
add esp, 0x1c
cmp eax, 4
jne 0x48ff10
mov eax, dword [esp + 0x10]
mov edi, dword [ebp + 0xc]
add eax, 8
add edi, eax
lea eax, [ebx + 8]
add eax, edi
mov dword [esp + 0x10], edi
cmp eax, dword [ebp + 4]
jbe 0x48ff63
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], edi
lea ebx, [ebp + 8]
cmp dword [ebx], 0
je 0x48ffb2
cmp edi, dword [ebx]
ja 0x48ffad
mov eax, dword [esp + 0x18]
add eax, 8
add eax, edi
cmp eax, dword [ebx]
jbe 0x48ffad
push 0
push dword [ebx]
push esi
call fcn.005f0150
push esi
push 4
push 1
push ebx
call fcn.005f8c70
add esp, 0x1c
cmp eax, 4
jne 0x48ff10
mov edi, dword [esp + 0x10]
xor eax, eax
inc eax
cmp dword [ebx], 0
mov dword [esp + 0x14], eax
jne 0x48ff6b
cmp dword [ebx], 0
jne 0x48ffb9
xor eax, eax
mov dword [ebx], edi
inc eax
jmp 0x48ffbd
mov eax, dword [esp + 0x14]
test eax, eax
je 0x48ffe3
push 0
push 8
push esi
call fcn.005f0150
push esi
push 4
push 1
push ebx
call fcn.005f25c0
push esi
call fcn.005ee100
mov edi, dword [esp + 0x30]
add esp, 0x20
push 0
push edi
push esi
call fcn.005f0150
and dword [esp + 0x28], 0
lea eax, [esp + 0x28]
push esi
push 4
pop edi
xor ebx, ebx
push edi
inc ebx
push ebx
push eax
call fcn.005f25c0
push esi
push edi
lea eax, [esp + 0x4c]
push ebx
push eax
call fcn.005f25c0
add esp, 0x2c
cmp dword [esp + 0x28], 0
jbe 0x49002d
push esi
push dword [esp + 0x2c]
push ebx
push dword [esp + 0x2c]
call fcn.005f25c0
add esp, 0x10
push esi
call fcn.005ee100
cmp dword [ebp + 0xc], 0
pop ecx
je 0x49005b
push 0
push dword [ebp + 0xc]
push esi
call fcn.005f0150
push esi
push edi
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.005f25c0
push esi
call fcn.005ee100
add esp, 0x20
push 0
push 0xc
push esi
call fcn.005f0150
push esi
push edi
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.005f25c0
push esi
call fcn.005ee100
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x490085
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, 0x95
mov ebx, edx
push edi
push 0x75abc0
push 1
push 0xc
mov ebp, ecx
call fcn.005f5ba0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x49010d
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x9a
mov dword [esi + 4], ebx
push edi
push 0x75ac44
push 1
push ebx
call fcn.005f5ba0
add esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x4900f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea esi, [edi + 0x64]
mov edx, 0x75ac64
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x75ac84
push 0x75aca4
jmp 0x490132
push ebx
push ebp
mov edx, ebx
mov ecx, eax
call section..text
and dword [esi + 8], 0
mov eax, esi
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x75abe0
push esi
push edi
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x75ac00
push 0x75ac20
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d0820
int3

Function at 0x49016e
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x113
mov edi, ecx
push ebx
push 0x75acc8
push 1
push 0x38
call fcn.005f5ba0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4901db
push 0x38
push 0
push esi
call fcn.005c37d0
add esp, 0xc
mov ecx, str.ILibProcessPipe_Manager
call fcn.004873e9
push 4
pop ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x10], edi
call fcn.0048dec7
mov dword [esi + 0x20], eax
mov edx, esi
mov dword [esi + 8], 0x490145
mov ecx, edi
cmp dword [edi + 4], 0
jne 0x4901d0
call fcn.00488084
jmp 0x4901d5
call fcn.00487e0f
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x75ace8
push esi
push ebx
xor ecx, ecx
call fcn.0048f95e
push ebx
push 0x75ad08
push 0x75ad28
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d0820
int3
Function at 0x4903a7
Capabilities:
Create pipe
Terminate process

Disassembly:
sub esp, 0x114
mov eax, dword [0x6d9d44]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x128]
xor ebp, ebp
mov eax, esi
mov ebx, ecx
not eax
push edi
mov edi, ebp
cmp eax, 0x68
jbe 0x490412
cmp esi, 0xffffff97
jae 0x490412
lea eax, [esi + 0x68]
cmp eax, 0xffffffef
jae 0x490412
test esi, esi
je 0x4903ee
lea eax, [esi + 0x78]
cmp eax, 0xffffffef
jae 0x490412
push 0x19d
push 0x75ade8
push 1
push 0x78
pop eax
test esi, esi
lea ecx, [eax + 0x10]
cmovg eax, ecx
add eax, esi
push eax
call fcn.005f5ba0
add esp, 0x10
jmp 0x490414
mov eax, ebp
push ebp
push esi
push 0x68
pop edx
mov ecx, eax
call fcn.00487604
mov esi, eax
pop ecx
pop ecx
mov dword [esi + 0x1c], ebx
xor ebx, ebx
mov dword [esi + 0x2c], ebp
inc ebx
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebp
push edi
push esi
push str..pipe_p_u
lea eax, [esp + 0x28]
push 0xff
push eax
call fcn.0040117f
add esp, 0x14
lea eax, [esp + 0x10]
inc edi
push eax
push ebp
mov eax, 0x1000
push eax
push eax
push ebx
push ebp
push 0x40080001
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0x40], eax
cmp eax, 0xffffffff
je 0x490567
cmp eax, 5
je 0x49043d
mov ebx, 0x1ad
push ebx
push 0x75ae7c
push 1
push 0x14
call fcn.005f5ba0
mov edi, eax
add esp, 0x10
mov dword [esi + 0x48], edi
test edi, edi
je 0x490596
xor eax, eax
stosd dword es:[edi], eax
push ebp
push ebp
push 1
stosd dword es:[edi], eax
push ebp
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esi + 0x48]
mov dword [ecx + 0x10], eax
test eax, eax
jne 0x4904f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
lea edi, [ebx + 2]
push esi
push edi
mov edx, 0x75af00
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x75af20
push 0x75af40
jmp 0x4905be
push ebp
push 0x80
push 3
lea eax, [esp + 0x1c]
push eax
push ebp
push 0x40000000
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x44], eax
cmp eax, 0xffffffff
jne 0x49054c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1b2
push esi
push edi
mov edx, 0x75af64
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x75af84
push 0x75afa4
jmp 0x4905be
mov ecx, dword [esp + 0x120]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005c0db0
add esp, 0x114
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1aa
push esi
push edi
mov edx, 0x75ae18
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x75ae38
push 0x75ae58
jmp 0x4905be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x75ae9c
push esi
push ebx
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push ebx
push 0x75aebc
push 0x75aedc
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d0820
int3
Function at 0x49138c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
and dword [esp], 0
cmp dword [ebp + 0x10], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov ebx, dword [edi + 0x28]
jne 0x4914f2
mov esi, dword [ebp + 0x18]
push esi
push dword [edi + 0x14]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push str.ReadExHandler__p___p_____TotalRead:__llu__bytesRead:__llu
push 2
call fcn.0048fac1
add dword [edi + 0x14], esi
add esp, 0x18
mov eax, dword [esp + 0xc]
xor esi, esi
cmp dword [edi + 0x64], esi
jne 0x49143b
push dword [edi + 0xc]
push eax
push dword [edi + 0x14]
mov eax, dword [edi]
add eax, dword [edi + 0xc]
push eax
push str._ReadExHandler__p___llu___llu_____llu_
push 2
call fcn.0048fac1
push dword [edi + 0x34]
lea eax, [esp + 0x28]
push dword [edi + 0x30]
push eax
mov eax, dword [edi + 0xc]
push dword [edi + 0x14]
add eax, dword [edi]
push eax
call ebx
mov eax, dword [esp + 0x38]
add esp, 0x2c
sub dword [edi + 0x14], eax
add dword [edi + 0xc], eax
push dword [edi + 0x64]
push eax
push dword [edi + 0x14]
push dword [edi + 0xc]
push str._____readOffset:__llu__totalRead:__llu__consumed:__llu__PAUSE:__d
push 2
call fcn.0048fac1
add esp, 0x18
cmp dword [edi + 0x64], esi
jne 0x49143b
mov eax, dword [esp + 0xc]
test eax, eax
je 0x49143b
cmp dword [edi + 0x14], esi
ja 0x4913cf
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x491445
mov dword [edi + 0xc], esi
cmp dword [edi + 0x64], esi
jne 0x4914e4
mov edx, dword [edi + 0xc]
test edx, edx
je 0x49146b
mov ecx, dword [edi]
push eax
lea eax, [ecx + edx]
mov edx, dword [edi + 4]
push eax
call fcn.00469703
pop ecx
pop ecx
mov dword [edi + 0xc], esi
jmp 0x491496
mov ecx, dword [edi + 4]
cmp eax, ecx
jne 0x491496
mov ebx, 0x514
lea eax, [ecx + ecx]
push ebx
push 0x75b4ac
push 1
push eax
push dword [edi]
call fcn.005f5d50
add esp, 0x14
mov dword [edi], eax
test eax, eax
je 0x4914fb
shl dword [edi + 4], 1
mov eax, dword [edi + 4]
sub eax, dword [edi + 0x14]
push eax
mov eax, dword [edi + 0xc]
add eax, dword [edi + 0x14]
push eax
push dword [edi]
push str.ILibChain_ReadEx2_______p___llu___llu_
push 2
call fcn.0048fac1
mov eax, dword [edi + 4]
add esp, 0x14
mov ecx, dword [edi + 0xc]
add ecx, dword [edi + 0x14]
sub eax, dword [edi + 0x14]
push dword [edi + 0x60]
add ecx, dword [edi]
mov edx, dword [ebp + 0xc]
push edi
push fcn.0049138c
push eax
push ecx
push dword [edi + 0x48]
mov ecx, dword [ebp + 8]
call fcn.0048a3a7
xor eax, eax
add esp, 0x18
inc eax
jmp 0x4914f4
push str.HANDLE_will_get_removed
push 2
call fcn.0048fac1
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x75b534
push esi
push ebx
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push ebx
push 0x75b554
push 0x75b4cc
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d0820
int3
Function at 0x49175c
Capabilities:
Create thread
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x54d
mov edi, edx
push ebx
push 0x75b618
push 1
push edi
mov esi, ecx
call fcn.005f5ba0
mov ecx, eax
add esp, 0x10
mov dword [esi], ecx
test ecx, ecx
je 0x4917f0
mov eax, dword [esp + 0x10]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x34], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], edi
test eax, eax
je 0x4917a4
mov dword [esi + 0x60], eax
cmp dword [esi + 0x48], 0
je 0x4917cb
push dword [esi + 0x60]
mov edx, dword [esi + 0x40]
push esi
push fcn.0049138c
push edi
push ecx
mov ecx, dword [esi + 0x1c]
push dword [esi + 0x48]
mov ecx, dword [ecx + 0x10]
call fcn.0048a3a7
add esp, 0x18
jmp 0x4917ec
xor edi, edi
push edi
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push edi
push esi
push 0x491247
push edi
push edi
mov dword [esi + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x75b638
push esi
push ebx
xor ecx, ecx
call fcn.0048f95e
push ebx
push 0x75b658
push 0x75b678
call fcn.00401109
add esp, 0x18
push esi
call fcn.005d0820
int3