joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4558a0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5cc
mov eax, dword [0x4b0650]
xor eax, esp
mov dword [esp + 0x5c8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, ecx
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x4558e6
mov ecx, dword [edi + 0x40]
sub ecx, eax
mov eax, 0x28c1979
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jb 0x4558eb
call fcn.004606a6
imul esi, esi, 0x324
add esi, dword [edi + 0x3c]
mov ecx, 0xc9
lea edi, [esp + 0x1a0]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1a0]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x45594e
push 0x104
lea ecx, [esp + 0x4cc]
push ecx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
lea edx, [esp + 0x4c8]
push edx
push 0x49c784
call fcn.0046415e
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100
push 0x160
lea eax, [esp + 0x48]
push eax
push 0
lea ecx, [esp + 0x4d8]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
jl 0x455979
mov edx, dword [esp + 0x40]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetIconInfo]
mov eax, dword [ebx]
mov edi, dword [esp + 0x3c]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edx, dword [ebx]
push edx
mov esi, eax
call dword [sym.imp.GDI32.dll_SaveDC]
push esi
call dword [sym.imp.GDI32.dll_SaveDC]
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push 3
push 0
push 0
push 0x10
push 0x10
push ecx
mov ecx, dword [ebx]
add edx, 0xc
push edx
add eax, 0xe
push eax
push ecx
call dword [sym.imp.USER32.dll_DrawIconEx]
push 0xffffffffffffffff
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
test esi, esi
je 0x455a18
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
test eax, eax
je 0x455a18
xor esi, esi
mov edx, dword [ebx]
push 0xffffffffffffffff
push edx
call dword [sym.imp.GDI32.dll_RestoreDC]
mov eax, dword [esp + 0x3c]
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
push eax
call ebx
mov ecx, dword [esp + 0x38]
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_DestroyIcon]
test esi, esi
je 0x455a4d
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
test edi, edi
je 0x455a54
push edi
call ebx
mov ecx, dword [esp + 0x5d4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004601ff
mov esp, ebp
pop ebp
ret 0x18
Function at 0x45b6d0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ebx, ebx
push ebx
mov ebp, ecx
call edi
push 1
mov esi, eax
call edi
push ebx
push str.Shell_TrayWnd
mov edi, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x45b718
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x10]
cmp eax, ebx
jle 0x45b733
sub eax, dword [esp + 0x18]
lea ecx, [edi - 0xe2]
lea eax, [eax + esi - 0xcd]
jmp 0x45b763
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
jle 0x45b743
add ecx, 0xffffff1e
jmp 0x45b75d
mov eax, dword [esp + 0x18]
cmp eax, edi
jge 0x45b756
add eax, 5
lea ecx, [edi - 0xe2]
jmp 0x45b763
mov ecx, dword [esp + 0x1c]
add ecx, 0x1f
lea eax, [esi - 0xcd]
mov edx, dword [ebp + 4]
push 0x10
push 0xdf
push 0xc8
push ecx
push eax
push ebx
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x45c4b0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.0045bb10
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0
push 0x465
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 0x10
Function at 0x45e44e
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
lea ebp, [esp - 0x26c]
sub esp, 0x2ec
mov eax, dword [0x4b0650]
xor eax, ebp
mov dword [ebp + 0x268], eax
mov eax, dword [ebp + 0x274]
push ebx
push esi
push edi
mov edi, 0x103
xor ebx, ebx
push edi
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x61]
push ebx
push eax
mov byte [ebp + 0x60], bl
call fcn.00460750
add esp, 0xc
lea esi, [edi + 1]
push esi
lea eax, [ebp + 0x60]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + 0x60]
push 0x5c
push eax
call fcn.00463740
cmp eax, ebx
pop ecx
pop ecx
je 0x45e4f0
push eax
call fcn.00465660
mov dword [ebp - 0x6c], 1
sub dword [ebp - 0x6c], eax
lea eax, [ebp + 0x60]
push eax
call fcn.00465660
add eax, dword [ebp - 0x6c]
pop ecx
cmp eax, ebx
pop ecx
jle 0x45e4d3
mov byte [ebp + eax + 0x60], bl
push 9
lea eax, [ebp + 0x60]
push str.crash.dmp
push eax
call fcn.00464d10
add esp, 0xc
lea eax, [ebp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
push ebx
push 2
push ebx
push ebx
push 0xc0000000
lea eax, [ebp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x70], eax
je 0x45e621
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x74]
push edi
mov dword [ebp - 0x7c], eax
lea eax, [ebp + 0x165]
push ebx
push eax
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x6c], ebx
mov byte [ebp + 0x164], bl
call fcn.00460750
add esp, 0xc
push esi
lea eax, [ebp + 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp + 0x164]
push eax
call fcn.00465660
cmp byte [ebp + eax + 0x163], 0x5c
pop ecx
je 0x45e578
push 1
lea eax, [ebp + 0x164]
push 0x49a4f0
push eax
call fcn.00464d10
add esp, 0xc
push 0xb
lea eax, [ebp + 0x164]
push str.DbgHelp.dll
push eax
call fcn.00464d10
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0xc
lea eax, [ebp + 0x164]
push eax
call esi
lea eax, [ebp + 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x45e5de
push str.MiniDumpWriteDump
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [ebp - 0x6c], eax
je 0x45e5de
push ebx
push ebx
lea eax, [ebp - 0x80]
push eax
push ebx
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x6c]
push 0xc7
lea eax, [ebp - 0x67]
push ebx
push eax
mov byte [ebp - 0x68], bl
call fcn.00460750
push dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
push edi
push 0x49cacc
push 0x77
push eax
call fcn.004644b4
add esp, 0x20
lea eax, [ebp - 0x68]
push eax
call esi
cmp edi, ebx
je 0x45e618
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x268]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004601ff
add ebp, 0x26c
leave
ret 4
Function at 0x45e9ce
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
je 0x45eaab
cmp byte [edi], bl
je 0x45eaab
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x45eaab
push ebx
push ebx
push 3
push ebx
push 3
push SysReAllocString
push edi
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x45eaab
push ebx
push edi
mov dword [ebp - 8], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
mov byte [esi], bl
je 0x45ea9d
push edi
call fcn.004607f0
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x45ea9d
push eax
push edi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x45ea94
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push 0x49a4f0
push dword [ebp - 4]
mov dword [ebp + 8], ebx
mov dword [ebp - 0xc], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x45ea94
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push str._d._d._d._d
push 0x77
push esi
call fcn.004644b4
add esp, 0x1c
mov dword [ebp - 8], 1
push dword [ebp - 4]
call fcn.004604e9
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
jmp 0x45eaad
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45eab2
Capabilities:
Get file version info
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [0x4b0650]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp edi, ebx
mov esi, edx
je 0x45ec56
cmp byte [edi], bl
je 0x45ec56
cmp esi, ebx
je 0x45ec56
push ebx
push ebx
push 3
push ebx
push 3
push SysReAllocString
push edi
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x4c], eax
je 0x45ec56
push ebx
push edi
mov dword [ebp - 0x58], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, ebx
mov dword [ebp - 0x48], eax
mov byte [esi], bl
je 0x45eb93
push eax
call fcn.004607f0
cmp eax, ebx
pop ecx
mov dword [ebp - 0x5c], eax
je 0x45eb93
push eax
push dword [ebp - 0x48]
push ebx
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x45eb8a
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x49a4f0
push dword [ebp - 0x5c]
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x54], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x45eb8a
push esi
call fcn.00465660
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx + 0xc]
push edx
movzx edx, word [ecx + 0xe]
push edx
movzx edx, word [ecx + 8]
movzx ecx, word [ecx + 0xa]
push edx
push ecx
dec eax
push str._d._d._d._d
push eax
push esi
call fcn.004644b4
add esp, 0x20
mov dword [ebp - 0x58], 1
push dword [ebp - 0x5c]
call fcn.004604e9
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea eax, [ebp - 0x50]
push eax
push 0x40
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x4c]
call edi
test eax, eax
je 0x45ec48
cmp dword [ebp - 0x50], 0x40
jne 0x45ec48
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0x50]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x17c]
push eax
push dword [ebp - 0x4c]
call edi
test eax, eax
je 0x45ec48
cmp dword [ebp - 0x50], 0xf8
jne 0x45ec48
push esi
call fcn.00465660
add esi, eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x5c], ebx
call fcn.00462989
push 9
pop ecx
mov esi, eax
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x84]
mov eax, dword [ebp - 0x74]
push dword [ebp - 0x80]
inc eax
push dword [ebp - 0x7c]
push dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x70]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d
push 0x77
push dword [ebp - 0x54]
call fcn.004644b4
add esp, 0x2c
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x58]
jmp 0x45ec58
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004601ff
leave
ret
Function at 0x45f799
Capabilities:
Parse pe header

Disassembly:
push ebp
sub esp, 0x90
lea ebp, [esp - 4]
mov eax, dword [0x4b0650]
xor eax, ebp
mov dword [ebp + 0x90], eax
push 0x118
mov eax, 0x49657b
call fcn.0046688f
mov ebx, dword [ebp + 0x9c]
mov esi, dword [ebp + 0xa0]
mov eax, dword [ebp + 0xa4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xa8]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp + 0xac]
mov dword [ebp - 0x24], edx
and dword [ebp - 4], 0
mov byte [ebp + 0x40], 0
xor eax, eax
lea edi, [ebp + 0x41]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
pop ecx
xor eax, eax
lea edi, [ebp + 0x48]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x18]
push eax
push 0x40
lea eax, [ebp]
push eax
push esi
push ebx
call edx
test eax, eax
je 0x45f821
cmp dword [ebp - 0x18], 0x40
mov byte [ebp - 0x14], 1
je 0x45f825
mov byte [ebp - 0x14], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.0045f75e
cmp word [ebp], 0x5a4d
sete al
mov byte [ebp - 0x14], al
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.0045f75e
lea eax, [ebp - 0x18]
push eax
mov edi, pe_nt_image_headers32
push edi
lea eax, [ebp - 0x124]
push eax
mov eax, dword [ebp + 0x3c]
add eax, esi
push eax
push ebx
call dword [ebp - 0x24]
test eax, eax
je 0x45f86f
cmp dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 1
je 0x45f873
mov byte [ebp - 0x14], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.0045f75e
cmp dword [ebp - 0x124], 0x4550
jne 0x45f8a4
cmp word [ebp - 0x120], 0x14c
jne 0x45f8a4
cmp word [ebp - 0x10c], 0x10b
mov byte [ebp - 0x14], 1
je 0x45f8a8
mov byte [ebp - 0x14], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.0045f75e
mov eax, dword [ebp + 0x3c]
lea eax, [esi + eax + 0xf8]
mov dword [ebp - 0x1c], eax
movzx edi, word [ebp - 0x11e]
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], edi
jae 0x45f955
lea eax, [ebp - 0x18]
push eax
push 0x28
lea eax, [ebp + 0x68]
push eax
push dword [ebp - 0x1c]
push ebx
call dword [ebp - 0x24]
test eax, eax
je 0x45f8f3
cmp dword [ebp - 0x18], 0x28
mov byte [ebp - 0x14], 1
je 0x45f8f7
mov byte [ebp - 0x14], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.0045f75e
add dword [ebp - 0x1c], 0x28
push 0x28
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0046691e
add esp, 0xc
test eax, eax
je 0x45f955
mov ecx, dword [ebp + 0x8c]
mov eax, 0x20000020
and ecx, eax
cmp ecx, eax
jne 0x45f946
mov eax, dword [ebp + 0x74]
add eax, esi
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x78]
add eax, ecx
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
xor eax, eax
inc eax
jmp 0x45f957
inc dword [ebp - 0x20]
jmp 0x45f8cb
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x90]
xor ecx, ebp
call fcn.004601ff
add ebp, 0x94
leave
ret

Function at 0x4601ff
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b0650]
jne 0x460209
repz ret
jmp fcn.004693dc
Function at 0x4695f1
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4b07d8]
je 0x46960c
inc edi
cmp edi, 0x17
jb 0x4695fd
cmp edi, 0x17
jae 0x46978c
push ebp
push 3
call fcn.00474636
cmp eax, 1
pop ecx
je 0x469758
push 3
call fcn.00474636
test eax, eax
pop ecx
jne 0x469640
cmp dword [0x4b06d0], 1
je 0x469758
cmp ebx, 0xfc
je 0x46978b
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4b30f8
push ebp
call fcn.00462525
add esp, 0xc
test eax, eax
je 0x469676
push esi
push esi
push esi
push esi
push esi
call fcn.00460586
add esp, 0x14
push 0x104
mov esi, 0x4b3111
push esi
push 0
mov byte [0x4b3215], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4696ba
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00462525
add esp, 0xc
test eax, eax
je 0x4696ba
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00460586
add esp, 0x14
push esi
call fcn.00465660
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4696ff
push esi
call fcn.00465660
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4b340c
push 0x49c86c
sub ecx, eax
push ecx
push eax
call fcn.00462104
add esp, 0x14
test eax, eax
je 0x4696ff
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00460586
add esp, 0x14
jmp 0x469701
xor esi, esi
push 0x49d828
push ebx
push ebp
call fcn.00462653
add esp, 0xc
test eax, eax
je 0x469721
push esi
push esi
push esi
push esi
push esi
call fcn.00460586
add esp, 0x14
push dword [edi*8 + 0x4b07dc]
push ebx
push ebp
call fcn.00462653
add esp, 0xc
test eax, eax
je 0x469743
push esi
push esi
push esi
push esi
push esi
call fcn.00460586
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00474479
add esp, 0xc
jmp 0x46978b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x46978b
cmp ebp, 0xffffffff
je 0x46978b
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4b07dc]
push dword [esi]
call fcn.00465660
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x474479
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00468d70
xor ebx, ebx
cmp dword [0x4b37f8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x47454f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x47462f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x47462f
push eax
call fcn.00468d02
mov dword [esp], 0x49db7c
push edi
mov dword [0x4b37f8], eax
call esi
push eax
call fcn.00468d02
mov dword [esp], 0x49db68
push edi
mov dword [0x4b37fc], eax
call esi
push eax
call fcn.00468d02
mov dword [0x4b3800], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0046d8e6
test eax, eax
pop ecx
pop ecx
je 0x47451d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00460586
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x47454f
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00468d02
cmp eax, ebx
pop ecx
mov dword [0x4b3808], eax
je 0x47454f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00468d02
pop ecx
mov dword [0x4b3804], eax
mov eax, dword [0x4b3804]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4745d4
cmp dword [0x4b3808], ecx
je 0x4745d4
push eax
call fcn.00468d79
push dword [0x4b3808]
mov esi, eax
call fcn.00468d79
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4745d4
cmp edi, ebx
je 0x4745d4
call esi
cmp eax, ebx
je 0x4745a1
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4745a1
test byte [ebp - 0x18], 1
jne 0x4745d4
lea eax, [ebp - 0x10]
push eax
call fcn.0046d91d
test eax, eax
pop ecx
je 0x4745bc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00460586
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4745cb
or dword [ebp + 0x10], 0x200000
jmp 0x47460f
or dword [ebp + 0x10], 0x40000
jmp 0x47460f
mov eax, dword [0x4b37fc]
cmp eax, dword [ebp - 8]
je 0x47460f
push eax
call fcn.00468d79
cmp eax, ebx
pop ecx
je 0x47460f
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x47460f
mov eax, dword [0x4b3800]
cmp eax, dword [ebp - 8]
je 0x47460f
push eax
call fcn.00468d79
cmp eax, ebx
pop ecx
je 0x47460f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b37f8]
call fcn.00468d79
cmp eax, ebx
pop ecx
je 0x47462f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x474631
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48c315
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4b3bb0], 0
push esi
jne 0x48c288
call fcn.0048c1b3
test eax, eax
je 0x48c2cb
mov eax, dword [0x4b3bb0]
cmp eax, 1
jne 0x48c2a9
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x48c2cb
pop esi
ret
push eax
call dword [0x4b3bb8]
test eax, eax
jne 0x48c313
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x48c2cf
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4b3bb0]
call dword [0x4b3bb8]
mov edi, eax
test edi, edi
je 0x48c2f6
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x48c312
lea edi, [esi + 0xff0]
push esi
push dword [0x4b3bb0]
call dword [0x4b3bb4]
add esi, 0x10
cmp esi, edi
jb 0x48c2fc
mov eax, esi
pop edi
pop esi
ret
jmp 0x48c275

Function at 0x48c466
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4b0650]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0048c3fb
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00460750
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x48c4b5
cmp dword [ebp - 0x1c], 5
jb 0x48c4cd
jmp 0x48c4c9
cmp dword [ebp - 0x10], 1
jne 0x48c4cd
cmp dword [ebp - 0x1c], 4
ja 0x48c4c9
jne 0x48c4cd
cmp dword [ebp - 0x18], 0
jbe 0x48c4cd
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x49fbe4
call fcn.0040c480
test eax, eax
jge 0x48c4ee
mov byte [0x4b2a60], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004601ff
add ebp, 0x78
leave
ret
Function at 0x48d6b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x497638
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b0650]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x4b3c98]
test eax, eax
jne 0x48d6e2
xor esi, esi
jmp 0x48d6eb
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
je 0x48d72d
cmp dword [esi + 0x14], 0
jne 0x48d76f
cmp dword [esi + 0x10], 0
jne 0x48d775
push 0x48d1d0
push 0x4b3c90
call fcn.0048d3d0
mov eax, dword [0x4b3c98]
add esp, 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
mov dword [esp + 0x20], 0xffffffff
je 0x48d75b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x48d75b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x48d7b5
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x48d7a3
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x48d775
cmp dword [esi + 0x14], 0
je 0x48d707
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x48d7da
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x48d80b
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x48d80b
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x48d80b
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x48d7bf
jmp 0x48d701