joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458aa0
Capabilities:
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x49f1d8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4c86e0]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push esi
push edi
mov eax, dword [0x4c86e0]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 4], 0xffffffff
lea esi, [edi + 4]
mov ebx, edx
jne 0x458ae7
call fcn.00458e50
test al, al
je 0x458b0c
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
xor ebx, ebx
cmp eax, ebx
je 0x458aff
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov ecx, dword [ecx]
cmp ecx, ebx
jne 0x458b13
push 0x4b2824
call fcn.0044f5c0
add esp, 4
xor al, al
jmp 0x458bea
mov edx, dword [esp + 0x54]
xor eax, eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
push edx
mov word [esp + 0x30], bx
mov dword [esp + 0x3a], eax
mov word [esp + 0x3e], ax
mov dword [esp + 0x34], ecx
call dword [sym.imp.WS2_32.dll_htons]
push ebx
mov edi, 0xf
push 0x4ac2d4
lea ecx, [esp + 0x18]
mov word [esp + 0x36], ax
mov word [esp + 0x34], 2
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.00408030
mov dword [esp + 0x4c], ebx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.00458920
add esp, 8
test eax, eax
jne 0x458bc0
mov eax, dword [esp + 0x14]
mov esi, 0x10
cmp dword [esp + 0x28], esi
jae 0x458b93
lea eax, [esp + 0x14]
push eax
push 0x4b2838
call fcn.0044f5c0
add esp, 8
mov dword [esp + 0x4c], 0xffffffff
cmp dword [esp + 0x28], esi
jb 0x458bbc
mov edx, dword [esp + 0x14]
push edx
call fcn.00459b1e
add esp, 4
xor al, al
jmp 0x458bde
mov dword [esp + 0x4c], 0xffffffff
cmp dword [esp + 0x28], 0x10
jb 0x458bdc
mov eax, dword [esp + 0x14]
push eax
call fcn.00459b1e
add esp, 4
mov al, 1
mov byte [esp + 0x14], bl
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0047e440
add esp, 0x40
ret 4
Function at 0x458c10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b130
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4c86e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov byte [ebp - 0x11], 0
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], esi
mov ebx, dword [sym.imp.WS2_32.dll_send]
nop
cmp esi, edi
jae 0x458cab
push 0
mov eax, edi
sub eax, esi
push eax
mov ecx, dword [ebp + 0xc]
lea edx, [esi + ecx]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call ebx
test eax, eax
jne 0x458c84
mov dword [ebp - 0x18], 0xaa
push 0x4bb4e8
lea edx, [ebp - 0x18]
push edx
call fcn.0048453b
cmp eax, 0xffffffff
jne 0x458ca4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x1c], 0xb1
push 0x4bb4e8
lea eax, [ebp - 0x1c]
push eax
call fcn.0048453b
add esi, eax
mov dword [ebp - 0x20], esi
jmp 0x458c50
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x458cf0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b110
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4c86e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, edx
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], ebx
cmp ecx, ebx
jne 0x458d41
mov dword [ebp - 0x18], 0xcf
push 0x4bb4e8
lea eax, [ebp - 0x18]
push eax
call fcn.0048453b
cmp esi, ebx
jne 0x458d5a
mov dword [ebp - 0x1c], 0xd3
push 0x4bb4e8
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0048453b
cmp eax, ebx
jne 0x458d73
mov dword [ebp - 0x20], 0xd7
push 0x4bb4e8
lea edx, [ebp - 0x20]
push edx
call fcn.0048453b
push ebx
push eax
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, ebx
jne 0x458d9c
mov dword [ebp - 0x24], 0xe3
push 0x4bb4e8
lea edx, [ebp - 0x24]
push edx
call fcn.0048453b
cmp eax, 0xffffffff
jne 0x458dbc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x28], 0xea
push 0x4bb4e8
lea eax, [ebp - 0x28]
push eax
call fcn.0048453b
mov dword [esi], eax
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x458e50
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ecx
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
jne 0x458e69
xor al, al
pop ecx
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea ecx, [esp + 8]
push ecx
push 0x1006
push 0xffff
push eax
mov dword [esp + 0x18], 0x4e20
call esi
mov eax, dword [edi + 4]
push 4
lea edx, [esp + 8]
push edx
push 0x1005
push 0xffff
push eax
call esi
mov al, 1
pop esi
pop ecx
ret
Function at 0x45a951
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x499788
call fcn.004841d4
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.00463420
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x45a99c
call fcn.00463420
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x45a9ad
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x45a9ba
or eax, 0xffffffff
jmp 0x45ab16
mov ecx, esi
call fcn.0045a4a3
mov dword [ebp - 0x14], eax
call fcn.0045d79b
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x45aa38
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x45aa38
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x45aa38
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.00426550
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x45aa38
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x45aa38
mov ecx, ebx
call fcn.004609eb
test eax, eax
je 0x45aa38
push 0
mov ecx, ebx
call fcn.00460a06
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0045f4ef
push dword [ebp - 0x14]
call fcn.0045d6f3
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.0045a759
xor edi, edi
cmp eax, edi
je 0x45aa95
test byte [esi + 0x3c], 0x10
je 0x45aa7f
push 4
pop edi
mov ecx, esi
call fcn.00460885
test ax, 0x100
je 0x45aa75
push 5
pop edi
push edi
mov ecx, esi
call fcn.0045d2bb
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x45aa95
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00460bd5
or dword [ebp - 4], 0xffffffff
jmp 0x45aac0
cmp dword [ebp - 0x28], edi
je 0x45aace
push 1
mov ecx, ebx
call fcn.00460a06
cmp dword [ebp - 0x2c], edi
je 0x45aade
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x45aaf7
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x45aaf7
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.0045a4dd
cmp dword [esi + 0x58], edi
je 0x45ab13
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.00484279
ret
Function at 0x45ab47
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00463420
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x45ab7e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0045a759
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x45e9df
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x45ea18
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004342d0
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00406530
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x46074a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x46078d
call fcn.00463420
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x46078d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4607a8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00460301
test ebx, ebx
mov esi, eax
je 0x4607a6
test edi, edi
je 0x4607a6
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x465871
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x46589a
call fcn.00463420
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x4658bd
push eax
push dword [esi + 4]
call fcn.004657fc
push esi
push eax
mov ecx, 0x4cc690
call fcn.004654b2
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x466103
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x499d2e
call fcn.004841a1
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.004660c5
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.00402a40
push dword [esi + 8]
mov edi, dword [edi + 8]
push 0
push 3
push dword [ebp + 0x18]
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [esi + 4], eax
jne 0x466169
push eax
push dword [esi + 8]
call fcn.004657fc
push dword [esi + 0xc]
mov ecx, 0x4cc690
push eax
call fcn.004654b2
mov eax, esi
call fcn.00484279
ret 0x18

Function at 0x46f208
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x46f24e
call fcn.00463420
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x46f24e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x46f291
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x46f27a
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x46f27a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x46f28e
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x470c7b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4c86e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x470cbb
push 0x4a7448
push 4
push eax
call fcn.0048212d
push eax
call fcn.004017c0
add esp, 0x10
jmp 0x470ccd
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x470d3b
push edi
call fcn.004845c0
mov edi, dword [eax]
call fcn.004845c0
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.0047ef85
add esp, 0x18
mov ebx, eax
call fcn.004845c0
cmp dword [eax], 0
je 0x470d1b
call fcn.004845c0
push dword [eax]
call fcn.0045ac42
pop ecx
jmp 0x470d22
call fcn.004845c0
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x470d3b
cmp ebx, esi
jae 0x470d3b
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x470d3d
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0047e440
leave
ret
Function at 0x471e69
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x471e97
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x471eb5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00471dd3
jmp 0x471eb5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x471eb5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00471dd3
test edi, edi
mov eax, edi
jne 0x471e9f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4cc6f4]
test ecx, ecx
je 0x471f78
jmp 0x471e68
ret 8

Function at 0x47abbd
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x47abc6
xor eax, eax
jmp 0x47ac2f
cmp dword [esp + 8], 0
jne 0x47abd2
call fcn.00461650
push edi
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.00480dc7
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x47ac0d
push dword [esi + 0x10]
call fcn.00480acd
test eax, eax
pop ecx
jne 0x47ac0d
mov esi, dword [esi + 0xc]
call fcn.004845d3
push esi
push dword [eax]
push 1
call fcn.004799ec
push dword [esi + 0x10]
call fcn.00480afc
test eax, eax
pop ecx
je 0x47ac2c
push dword [esi + 0x10]
call fcn.00485a62
push eax
call fcn.004017c0
pop ecx
pop ecx
jmp 0x47abfb
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x47ac38
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x47ac42
call fcn.00461650
push dword [esi + 0x10]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.00485c6d
add esp, 0x10
cmp eax, dword [esp + 0xc]
je 0x47ac6f
mov esi, dword [esi + 0xc]
call fcn.004845d3
push esi
push dword [eax]
push 1
call fcn.004799ec
pop esi
ret 8

Function at 0x47e440
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c86e0]
jne 0x47e44a
repz ret
jmp fcn.00487a8c
Function at 0x480b2b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x480b68
cmp dword [ebp + 0x14], edi
je 0x480b68
cmp ecx, edi
jne 0x480b6f
call fcn.004845c0
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004806b6
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x480b83
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x480ba4
cmp ebx, 0xffffffff
je 0x480b93
push ebx
push edi
push ecx
call fcn.00483d60
add esp, 0xc
cmp esi, edi
je 0x480b50
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x480b50
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x480bc0
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x480bc7
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x480cb8
test word [esi + 0xc], 0x10c
je 0x480c1b
mov eax, dword [esi + 4]
test eax, eax
je 0x480c1b
jl 0x480d19
cmp ebx, eax
mov edi, ebx
jb 0x480bec
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x480cc0
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0047e048
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x480cb0
cmp ebx, dword [ebp - 0xc]
jb 0x480c88
cmp dword [ebp - 0xc], 0
je 0x480c45
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x480c3a
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x480c41
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x480c50
mov eax, SysReAllocString
cmp ebx, eax
ja 0x480c50
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x480cec
push eax
push dword [ebp - 8]
push esi
call fcn.004858af
pop ecx
push eax
call fcn.0048d8bc
add esp, 0xc
test eax, eax
je 0x480d2b
cmp eax, 0xffffffff
je 0x480d19
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x480cb0
push esi
call fcn.0048d1db
cmp eax, 0xffffffff
pop ecx
je 0x480d1d
cmp dword [ebp - 4], 0
je 0x480cec
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x480bcf
mov eax, dword [ebp + 0x14]
jmp 0x480b6a
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x480cd7
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00483d60
add esp, 0xc
call fcn.004845c0
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x480b60
cmp dword [ebp + 0xc], 0xffffffff
je 0x480d02
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00483d60
add esp, 0xc
call fcn.004845c0
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x480b60
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x480b6a
or dword [esi + 0xc], 0x10
jmp 0x480d1d
Function at 0x487b90
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4c89a8]
je 0x487bab
inc edi
cmp edi, 0x17
jb 0x487b9c
cmp edi, 0x17
jae 0x487d2b
push ebp
push 3
call fcn.004927f1
cmp eax, 1
pop ecx
je 0x487cf7
push 3
call fcn.004927f1
test eax, eax
pop ecx
jne 0x487bdf
cmp dword [0x4c86d0], 1
je 0x487cf7
cmp ebx, 0xfc
je 0x487d2a
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4ccef8
push ebp
call fcn.0048212d
add esp, 0xc
test eax, eax
je 0x487c15
push esi
push esi
push esi
push esi
push esi
call fcn.004805ba
add esp, 0x14
push 0x104
mov esi, 0x4ccf11
push esi
push 0
mov byte [0x4cd015], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x487c59
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0048212d
add esp, 0xc
test eax, eax
je 0x487c59
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004805ba
add esp, 0x14
push esi
call fcn.004844b0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x487c9e
push esi
call fcn.004844b0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4cd20c
push 0x4a9bec
sub ecx, eax
push ecx
push eax
call fcn.0048262b
add esp, 0x14
test eax, eax
je 0x487c9e
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004805ba
add esp, 0x14
jmp 0x487ca0
xor esi, esi
push 0x4a9be8
push ebx
push ebp
call fcn.004821bc
add esp, 0xc
test eax, eax
je 0x487cc0
push esi
push esi
push esi
push esi
push esi
call fcn.004805ba
add esp, 0x14
push dword [edi*8 + 0x4c89ac]
push ebx
push ebp
call fcn.004821bc
add esp, 0xc
test eax, eax
je 0x487ce2
push esi
push esi
push esi
push esi
push esi
call fcn.004805ba
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00492634
add esp, 0xc
jmp 0x487d2a
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x487d2a
cmp ebp, 0xffffffff
je 0x487d2a
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4c89ac]
push dword [esi]
call fcn.004844b0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x492634
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0048aa0c
xor ebx, ebx
cmp dword [0x4cd478], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x49270a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4927ea
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a9fbc
push edi
call esi
cmp eax, ebx
je 0x4927ea
push eax
call fcn.0048a99e
mov dword [esp], 0x4a9fac
push edi
mov dword [0x4cd478], eax
call esi
push eax
call fcn.0048a99e
mov dword [esp], 0x4a9f98
push edi
mov dword [0x4cd47c], eax
call esi
push eax
call fcn.0048a99e
mov dword [0x4cd480], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00484cb4
test eax, eax
pop ecx
pop ecx
je 0x4926d8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004805ba
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x49270a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0048a99e
cmp eax, ebx
pop ecx
mov dword [0x4cd488], eax
je 0x49270a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0048a99e
pop ecx
mov dword [0x4cd484], eax
mov eax, dword [0x4cd484]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x49278f
cmp dword [0x4cd488], ecx
je 0x49278f
push eax
call fcn.0048aa15
push dword [0x4cd488]
mov esi, eax
call fcn.0048aa15
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x49278f
cmp edi, ebx
je 0x49278f
call esi
cmp eax, ebx
je 0x49275c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x49275c
test byte [ebp - 0x18], 1
jne 0x49278f
lea eax, [ebp - 0x10]
push eax
call fcn.00484ceb
test eax, eax
pop ecx
je 0x492777
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004805ba
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x492786
or dword [ebp + 0x10], 0x200000
jmp 0x4927ca
or dword [ebp + 0x10], 0x40000
jmp 0x4927ca
mov eax, dword [0x4cd47c]
cmp eax, dword [ebp - 8]
je 0x4927ca
push eax
call fcn.0048aa15
cmp eax, ebx
pop ecx
je 0x4927ca
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4927ca
mov eax, dword [0x4cd480]
cmp eax, dword [ebp - 8]
je 0x4927ca
push eax
call fcn.0048aa15
cmp eax, ebx
pop ecx
je 0x4927ca
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4cd478]
call fcn.0048aa15
cmp eax, ebx
pop ecx
je 0x4927ea
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4927ec
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret