joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0c00
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0xc
mov ebx, edx
mov dword [esp + 0x1c], ecx
xor ebp, ebp
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4b0d42
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov dword [esi], ebp
mov dword [esi + 8], ebp
lea edi, [edx + ebx]
cmp byte [edi + eax - 1], 0
lea ecx, [eax - 1]
mov dword [esp + 0x10], edi
cmovne ecx, eax
mov dword [esp + 0x14], ecx
cmp ebx, ecx
jge 0x4b0cf5
mov edi, dword [esp + 0x2c]
mov eax, 1
mov dword [esp + 0x1c], eax
cmp edi, ecx
jg 0x4b0ce2
xor ecx, ecx
test edi, edi
jle 0x4b0c8d
add edx, ebx
nop dword [eax + eax]
mov edi, dword [esp + 0x28]
mov al, byte [edx + ecx]
cmp al, byte [ecx + edi]
mov edi, dword [esp + 0x2c]
jne 0x4b0c8b
inc ecx
cmp ecx, edi
jl 0x4b0c70
mov eax, dword [esp + 0x1c]
jmp 0x4b0c8d
xor eax, eax
test eax, eax
je 0x4b0cde
push 0xc
call fcn.0058db11
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4b0d83
cmp dword [esi], 0
mov edx, dword [esp + 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], ebp
mov dword [ecx + 8], 0
je 0x4b0cc2
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
jmp 0x4b0cc4
mov dword [esi], ecx
inc dword [esi + 8]
lea eax, [edi + ebp]
dec ebx
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x14]
add edx, eax
add ebx, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
jmp 0x4b0ce3
mov ecx, dword [esp + 0x14]
inc ebp
inc ebx
cmp ebx, ecx
jge 0x4b0cf1
mov edx, dword [esp + 0x18]
jmp 0x4b0c52
mov edi, dword [esp + 0x10]
push 0xc
call fcn.0058db11
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4b0dc4
cmp dword [esi], 0
mov dword [ecx], edi
mov dword [ecx + 4], ebp
mov dword [ecx + 8], 0
je 0x4b0d30
mov eax, dword [esi + 4]
inc dword [esi + 8]
mov dword [esi + 4], ecx
mov dword [eax + 8], ecx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
inc dword [esi + 8]
mov eax, esi
pop edi
mov dword [esi], ecx
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1285
mov edx, 0x624a50
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1285
push 0x624a6c
push 0x624a88
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1298
mov edx, 0x624aac
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1298
push 0x624ac8
push 0x624ae4
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x12be
mov edx, 0x624b08
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x12be
push 0x624b24
push 0x624b40
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b14f0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, edx
mov dword [esp + 0x18], ecx
push esi
push edi
xor esi, esi
xor edi, edi
lea eax, [ebp - 0x320]
mov dword [esp + 0x14], esi
cmp eax, 0x320
jae 0x4b1516
xor ecx, ecx
jmp 0x4b1527
mov eax, 0x51eb851f
imul ebp
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea eax, [ecx*2]
add eax, ebp
add eax, ecx
push eax
mov dword [esp + 0x1c], eax
call fcn.0058db11
mov ecx, eax
add esp, 4
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov dword [eax], ecx
test ecx, ecx
je 0x4b15d4
mov ebx, ebp
test ebp, ebp
je 0x4b15ca
mov eax, 0x320
nop
cmp ebx, ebp
je 0x4b158e
mov edx, dword [esp + 0x18]
add ecx, edi
push 3
push 0x624ea0
sub edx, edi
call fcn.00401000
mov ecx, dword [esp + 0x24]
add esp, 8
add edi, 3
mov eax, 0x320
add esi, 3
mov dword [esp + 0x14], esi
mov edx, dword [esp + 0x18]
cmp ebx, 0x320
mov esi, ebx
cmovg esi, eax
mov eax, dword [esp + 0x20]
sub eax, ebx
sub edx, edi
add eax, ebp
add ecx, edi
push esi
push eax
call fcn.00401000
add dword [esp + 0x1c], esi
add edi, esi
mov ecx, dword [esp + 0x24]
add esp, 8
sub ebx, esi
mov eax, 0x320
mov esi, dword [esp + 0x14]
jne 0x4b1560
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1492
mov edx, 0x624db8
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1492
push 0x624dd4
push 0x624df0
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b1a20
Capabilities:
Set socket configuration
Terminate process

Disassembly:
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
movzx eax, word [edi]
cmp eax, 0x17
jne 0x4b1a65
cmp dword [0x625d5c], 0
jne 0x4b1a65
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 0x154e
mov edx, 0x624eac
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
xor eax, eax
pop edi
pop esi
add esp, 8
ret
push dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b1a9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 0x154f
mov edx, 0x624ec8
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
xor eax, eax
pop edi
pop esi
add esp, 8
ret
cmp word [edi], 0x17
jne 0x4b1ab9
push 4
lea eax, [esp + 0x10]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x4b1b0b
cmp word [edi], 0x17
mov ecx, 0x1c
mov eax, 0x10
cmove eax, ecx
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x4b1b03
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 0x155c
mov edx, 0x624f00
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop edi
pop esi
add esp, 8
ret
pop edi
mov eax, esi
pop esi
add esp, 8
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1553
mov edx, 0x624ee4
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0xfd
call fcn.005885bd
int3
Function at 0x4b2100
Capabilities:
Terminate process

Disassembly:
push esi
push 0x88
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4b2163
push 0x88
push 0
push esi
call fcn.00587250
add esp, 0xc
mov dword [esi + 0x10], 0
xor ecx, ecx
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x24], 0x62512c
mov dword [esi + 0x28], 3
call fcn.004b0430
test eax, eax
je 0x4b2159
mov dword [eax + 4], 1
mov dword [esi + 0x84], eax
mov eax, esi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1612
mov edx, 0x6250d0
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1612
push 0x6250ec
push 0x625108
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3

Function at 0x4b2280
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, edx
push edi
cmp dword [esi + 0x38], 0
je 0x4b2299
push dword [esi + 0x24]
call fcn.0058c812
add esp, 4
mov edi, dword [esp + 0x14]
mov dword [esi + 0x38], 1
lea ebx, [edi + 1]
push ebx
call fcn.0058db11
add esp, 4
mov dword [esi + 0x24], eax
test eax, eax
je 0x4b22d1
push edi
push ebp
mov edx, ebx
mov ecx, eax
call fcn.00401000
mov eax, dword [esi + 0x24]
add esp, 8
mov byte [edi + eax], 0
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x165e
mov edx, 0x625130
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x165e
push 0x62514c
push 0x625168
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3

Function at 0x4b2320
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebp, edx
push edi
mov edi, ecx
test esi, esi
jns 0x4b234d
test ebx, ebx
jne 0x4b233d
xor esi, esi
jmp 0x4b234d
push 0xff
push ebx
call fcn.0058d536
add esp, 8
mov esi, eax
mov eax, dword [edi + 0x1c]
mov dword [edi + 0x18], ebp
test eax, eax
je 0x4b2360
push eax
call fcn.0058c812
add esp, 4
lea ebp, [esi + 1]
push ebp
call fcn.0058db11
add esp, 4
mov dword [edi + 0x1c], eax
test eax, eax
je 0x4b2391
push esi
push ebx
mov edx, ebp
mov ecx, eax
call fcn.00401000
mov eax, dword [edi + 0x1c]
add esp, 8
mov byte [esi + eax], 0
mov dword [edi + 0x20], esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x166f
mov edx, 0x62518c
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x166f
push 0x6251a8
push 0x6251c4
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b23e0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, edx
mov dword [esp + 0x14], eax
mov esi, ecx
test edi, edi
jns 0x4b240f
test eax, eax
jne 0x4b23ff
xor edi, edi
jmp 0x4b240f
push 0xff
push eax
call fcn.0058d536
add esp, 8
mov edi, eax
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
test ebx, ebx
jns 0x4b2433
test eax, eax
jne 0x4b2423
xor ebx, ebx
jmp 0x4b2433
push 0xff
push eax
call fcn.0058d536
add esp, 8
mov ebx, eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4b248d
lea ecx, [ebx + 2]
add ecx, edi
cmp dword [eax - 0x10], ecx
jbe 0x4b24fd
mov ecx, dword [eax - 0x10]
lea ebp, [edi + 1]
xor edx, edx
cmp ecx, ebp
jbe 0x4b245d
mov edx, dword [eax]
sub ecx, ebp
mov dword [eax - 0x10], ecx
add dword [eax], ebp
mov ecx, dword [esi + 0x10]
lea eax, [ebx + 1]
mov dword [esi], edx
mov dword [esp + 0x1c], 0
mov edx, dword [ecx - 0x10]
cmp edx, eax
jbe 0x4b2484
mov ebp, dword [ecx]
sub edx, eax
mov dword [esp + 0x1c], ebp
lea ebp, [edi + 1]
mov dword [ecx - 0x10], edx
add dword [ecx], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 8], eax
jmp 0x4b24c1
lea ebp, [edi + 1]
push ebp
call fcn.0058db11
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x4b253e
lea eax, [ebx + 1]
push eax
call fcn.0058db11
add esp, 4
mov dword [esi + 8], eax
test eax, eax
je 0x4b257f
mov dword [esi + 0x34], 0xffffffff
mov ecx, dword [esi]
mov edx, ebp
push edi
push dword [esp + 0x18]
call fcn.00401000
mov eax, dword [esi]
lea edx, [ebx + 1]
push ebx
push dword [esp + 0x2c]
mov byte [edi + eax], 0
mov ecx, dword [esi + 8]
mov dword [esi + 4], edi
call fcn.00401000
mov eax, dword [esi + 8]
add esp, 0x10
pop edi
mov byte [ebx + eax], 0
mov dword [esi + 0x14], ebx
pop esi
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x168b
mov edx, 0x6251e8
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x168b
push 0x625204
push 0x625220
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1690
mov edx, 0x625244
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1690
push 0x625260
push 0x62527c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1691
mov edx, 0x6252a0
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1691
push 0x6252bc
push 0x6252d8
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b28b0
Capabilities:
Encode data using base64
Terminate process

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov ebp, edx
cmp dword [ebx], 0
push edi
mov dword [esp + 0x10], ebp
mov edi, ecx
jne 0x4b28f3
lea esi, [ebp*4]
mov eax, 0x55555556
imul esi
mov eax, edx
add edx, 5
shr eax, 0x1f
add eax, edx
push eax
call fcn.0058db11
add esp, 4
mov dword [ebx], eax
test eax, eax
je 0x4b2a3e
mov eax, dword [ebx]
mov esi, edi
mov dword [esp + 0x14], eax
test edi, edi
je 0x4b2a2e
test ebp, ebp
je 0x4b2a2e
lea ecx, [edi + ebp]
lea ebx, [edi + 3]
cmp ebx, ecx
ja 0x4b2989
mov ebp, ecx
nop word [eax + eax]
movzx ecx, byte [esi]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
movzx edx, byte [esi + 1]
movzx ecx, byte [esi + 2]
and edx, 0xf
shr ecx, 6
shl edx, 2
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
movzx ecx, byte [esi + 2]
mov esi, ebx
and ecx, 0x3f
lea ebx, [esi + 3]
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], cl
add eax, 4
cmp ebx, ebp
jbe 0x4b2920
mov ebp, dword [esp + 0x10]
sub edi, esi
lea ecx, [edi + ebp]
cmp ecx, 1
jne 0x4b29d6
movzx ecx, byte [esi]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
mov word [eax + 2], 0x3d3d
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
add eax, 4
mov byte [eax], 0
sub eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp ecx, 2
jne 0x4b2a1f
movzx ecx, byte [esi]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
movzx ecx, byte [esi + 1]
and ecx, 0xf
mov byte [eax + 3], 0x3d
movzx ecx, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
add eax, 4
mov byte [eax], 0
sub eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov dword [ebx], 0
xor eax, eax
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1765
mov edx, 0x625418
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1765
push 0x625434
push 0x625450
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b2a80
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x4b2b95
test edi, edi
je 0x4b2b95
mov ebx, dword [esp + 0x1c]
cmp dword [ebx], 0
jne 0x4b2ac6
lea eax, [edi + edi*2]
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, 4
push eax
call fcn.0058db11
add esp, 4
mov dword [ebx], eax
test eax, eax
je 0x4b2ba9
mov eax, dword [ebx]
add edi, esi
mov dword [esp + 0x14], eax
mov ebp, eax
mov dword [esp + 0x10], 0
cmp esi, edi
ja 0x4b2b74
xor ebx, ebx
xor edx, edx
cmp esi, edi
ja 0x4b2b31
xor al, al
nop word [eax + eax]
test al, al
jne 0x4b2b84
mov cl, byte [esi]
inc esi
lea eax, [ecx - 0x2b]
cmp al, 0x4f
ja 0x4b2b17
movzx eax, cl
mov al, byte [eax + 0x5f1125]
test al, al
je 0x4b2b19
cmp al, 0x24
je 0x4b2b17
add al, 0xc3
jmp 0x4b2b19
xor al, al
cmp esi, edi
jbe 0x4b2af0
cmp edx, 4
jae 0x4b2bea
mov byte [esp + edx + 0x10], 0
inc edx
cmp edx, 4
jl 0x4b2ae4
test ebx, ebx
je 0x4b2b68
mov eax, dword [esp + 0x10]
mov dl, al
shl dl, 2
mov cl, ah
shr cl, 4
mov al, ah
or dl, cl
shl al, 4
mov byte [ebp], dl
mov dl, byte [esp + 0x12]
mov cl, dl
shl dl, 6
or dl, byte [esp + 0x13]
shr cl, 2
or cl, al
mov byte [ebp + 2], dl
mov byte [ebp + 1], cl
dec ebp
add ebp, ebx
cmp esi, edi
jbe 0x4b2ae0
mov eax, dword [esp + 0x14]
mov byte [ebp], 0
sub ebp, eax
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp esi, edi
ja 0x4b2b1d
inc ebx
test al, al
je 0x4b2b2b
dec al
mov byte [esp + edx + 0x10], al
jmp 0x4b2b2b
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [eax], 0
xor eax, eax
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x17ac
mov edx, 0x625474
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x17ac
push 0x625490
push 0x6254ac
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
call fcn.005853dc
int3
Function at 0x4b2bf0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x18
mov esi, edx
mov ebp, ecx
call fcn.0058db11
mov edi, eax
add esp, 4
test edi, edi
je 0x4b2d70
mov ebx, dword [esp + 0x1c]
xorps xmm0, xmm0
movups xmmword [edi], xmm0
movq qword [edi + 0x10], xmm0
mov dword [edi + 8], esi
test ebx, ebx
je 0x4b2c37
call fcn.004b48f0
mov ecx, eax
mov esi, edx
mov eax, ebx
cdq
add ecx, eax
adc esi, edx
jmp 0x4b2c45
movlpd qword [esp + 0x10], xmm0
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [edi], ecx
mov dword [edi + 4], esi
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x2c]
push 0xffffffffffffffff
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [ebp + 0x2c]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x4b2c9f
mov ecx, ebx
call fcn.004b3590
mov dword [eax], edi
mov dword [eax + 4], ebx
mov dword [eax + 8], esi
mov ecx, dword [ebx + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x4b2c8e
mov dword [ecx + 8], eax
cmp dword [ebx + 0xc], 0
mov dword [ebx + 0x10], eax
jne 0x4b2c9a
mov dword [ebx + 0xc], eax
inc dword [ebx + 4]
jmp 0x4b2d1a
mov edx, dword [edi]
mov ecx, dword [edi + 4]
test esi, esi
je 0x4b2cac
mov eax, dword [esi]
jmp 0x4b2cae
xor eax, eax
cmp ecx, dword [eax + 4]
jl 0x4b2cc2
jg 0x4b2cb9
cmp edx, dword [eax]
jb 0x4b2cc2
mov esi, dword [esi + 8]
test esi, esi
jne 0x4b2ca8
jmp 0x4b2ccf
mov edx, edi
mov ecx, esi
call fcn.004b3620
test esi, esi
jne 0x4b2d06
mov esi, dword [ebp + 0x2c]
mov ecx, esi
call fcn.004b3590
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, dword [esi + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4b2cf5
mov dword [ecx + 8], eax
cmp dword [esi + 0xc], 0
mov dword [esi + 0x10], eax
jne 0x4b2d01
mov dword [esi + 0xc], eax
inc dword [esi + 4]
jmp 0x4b2d37
mov eax, dword [ebp + 0x2c]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4b2d14
mov eax, dword [eax]
jmp 0x4b2d16
xor eax, eax
cmp eax, edi
jne 0x4b2d37
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x4b2d2a
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push esi
push eax
push 0x4af5c0
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov esi, dword [ebp + 0x24]
mov edx, dword [edi + 4]
mov eax, dword [ebp + 0x20]
mov ecx, dword [edi]
cmp esi, edx
jg 0x4b2d53
jl 0x4b2d4c
cmp eax, ecx
ja 0x4b2d53
and eax, esi
cmp eax, 0xffffffff
jne 0x4b2d59
mov dword [ebp + 0x20], ecx
mov dword [ebp + 0x24], edx
mov eax, dword [ebp + 0x2c]
push 0
push 1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x188e
mov edx, 0x6254f8
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x188e
push 0x625514
push 0x625530
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b3290
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push 0x38
mov ebp, ecx
call fcn.0058db11
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4b337e
push 0x38
push 0
push ebx
call fcn.00587250
add esp, 0xc
mov dword [ebx + 0x14], str.ILibLifeTime
lea eax, [esp + 0x10]
xor edx, edx
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [edx + 0x18]
call fcn.004aeee0
mov esi, dword [esp + 0x14]
add esp, 8
mov eax, dword [esp + 0x10]
push 0
push 0x40
push 1
push 0
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
xor edx, edx
lea eax, [esp + 0xc]
mov dword [ebx + 0x2c], esi
push eax
lea eax, [esp + 0x14]
mov dword [ebx], 0x4b2dc0
push eax
lea ecx, [edx + 0x18]
mov dword [ebx + 8], 0x4b3260
mov dword [ebx + 0xc], ebp
call fcn.004aeee0
mov esi, dword [esp + 0x18]
add esp, 8
mov eax, dword [esp + 0xc]
push 0
push 0x40
push 1
push 0
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
mov dword [ebx + 0x28], esi
mov esi, dword [ebp + 0x2f0]
mov ecx, esi
call fcn.004b3590
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, dword [esi + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4b3363
mov dword [ecx + 8], eax
cmp dword [esi + 0xc], 0
mov dword [esi + 0x10], eax
jne 0x4b336f
mov dword [esi + 0xc], eax
inc dword [esi + 4]
mov eax, ebx
pop esi
mov dword [ebx + 0xc], ebp
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1990
mov edx, 0x625554
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1990
push 0x625570
push 0x62558c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3

Function at 0x4b3590
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [ecx + 0x14]
push edi
test esi, esi
je 0x4b359d
mov esi, dword [esi - 4]
xor eax, eax
test esi, esi
setg al
lea ebx, [eax*4 + 0x10]
add ebx, esi
push ebx
call fcn.0058db11
mov edi, eax
add esp, 4
test edi, edi
je 0x4b35d5
push ebx
push 0
push edi
call fcn.00587250
add esp, 0xc
test esi, esi
jle 0x4b35cf
mov dword [edi + 0x10], esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3

Function at 0x4b3890
Capabilities:
Terminate process

Disassembly:
push esi
push 0xc
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4b38c5
xorps xmm0, xmm0
movq qword [esi], xmm0
push ecx
mov dword [esi + 8], 0
mov ecx, esi
mov dword [esi + 4], 0x4b37d0
call fcn.004b3a30
add esp, 4
mov eax, esi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1bc9
mov edx, 0x6255c0
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1bc9
push 0x6255dc
push 0x6255f8
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x4b3a30
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
test esi, esi
je 0x4b3a66
push 1
push 0
xor edx, edx
mov ecx, esi
call fcn.004b41f0
add esp, 8
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi]
call fcn.0058c812
add esp, 4
push esi
call fcn.0058c812
add esp, 4
push 0x14
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4b3acd
push 0
push 0x40
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0x800
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x100
mov dword [esi + 8], 0x4b37a0
call fcn.0058db11
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x10], 0
push 0x800
push 0
push eax
call fcn.00587250
add esp, 0xc
mov dword [edi], esi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3

Function at 0x4b3b10
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push 0x18
mov ebx, edx
mov edi, ecx
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4b3b6b
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movq qword [esi + 0x10], xmm0
mov dword [esi + 8], edi
mov edi, dword [esp + 0x10]
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], edi
test edi, edi
jle 0x4b3b65
push edi
call fcn.0058db11
add esp, 4
mov dword [esi + 0xc], eax
test eax, eax
je 0x4b3bac
push edi
push ebx
mov edx, edi
mov ecx, eax
call fcn.00401000
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1c4e
mov edx, 0x62561c
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1c4e
push 0x625638
push 0x625654
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x1c55
mov edx, 0x625678
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x1c55
push 0x625694
push 0x6256b0
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3