Function at 0x48d442
Capabilities:
Allocate or change rwx memory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
push ebx
push esi
push edi
and dword [ebp - 0x258], 0
jmp 0x48d464
mov eax, dword [section..ex_cod]
add eax, section..ex_cod
mov dword [0x48d004], eax
mov eax, dword [0x48d004]
cmp dword [eax + 0x70], 0
jne 0x48d492
push 0x10
push 0x48d0f0
push 0x48d078
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.0048d387
mov dword [0x48d008], eax
push 0x104
lea eax, [ebp - 0x228]
push eax
push dword [0x48d014]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + eax - 0x229]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
movsx eax, byte [eax]
cmp eax, 0x5c
je 0x48d4de
mov eax, dword [ebp - 0x254]
dec eax
mov dword [ebp - 0x254], eax
jmp 0x48d4c1
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x228]
sub eax, ecx
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0048d369
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0x117], 0
and dword [ebp - 0x23c], 0
mov eax, dword [0x48d004]
mov eax, dword [eax + 4]
and eax, 0x4000000
jne 0x48d545
mov eax, dword [0x48d004]
mov eax, dword [eax + 4]
and eax, 0x2000000
je 0x48d572
call fcn.0048d396
mov dword [ebp - 0x23c], eax
mov eax, dword [0x48d004]
mov eax, dword [eax + 4]
and eax, 0x4000000
je 0x48d572
cmp dword [ebp - 0x23c], 0
je 0x48d572
jmp 0x48dbad
mov eax, dword [0x48d008]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
mov ecx, dword [0x48d008]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x250], ecx
mov eax, dword [0x48d004]
cmp dword [eax + 0x98], 0
je 0x48d731
push 4
push 0x1000
mov eax, dword [0x48d004]
push dword [eax + 0x5c]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jne 0x48d5da
jmp 0x48dbad
mov eax, dword [0x48d004]
mov eax, dword [eax + 0x60]
mov dword [ebp - 0x234], eax
mov eax, dword [0x48d004]
mov ecx, dword [0x48d008]
add ecx, dword [eax + 0x68]
mov eax, dword [0x48d004]
mov esi, dword [ebp - 0x250]
mov eax, dword [eax + 0xac]
xor edx, edx
div dword [esi + 0x3c]
add ecx, edx
mov dword [ebp - 0x11c], ecx
push dword [ebp - 0x244]
mov eax, dword [0x48d004]
push dword [eax + 0x5c]
push dword [ebp - 0x11c]
call fcn.0048d28a
add esp, 0xc
jmp 0x48d63f
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
mov eax, dword [0x48d004]
movzx eax, word [eax + 0xa4]
cmp dword [ebp - 0x258], eax
jge 0x48d71c
cmp dword [ebp - 0x23c], 0
je 0x48d698
mov eax, dword [0x48d004]
mov eax, dword [eax + 4]
and eax, 0x2000000
je 0x48d698
mov eax, dword [ebp - 0x258]
imul eax, eax, 0x18
mov ecx, dword [0x48d004]
mov eax, dword [ecx + eax + 0xbc]
and eax, 0x10000000
je 0x48d698
mov dword [ebp - 0x270], 1
jmp 0x48d69f
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jne 0x48d6f5
mov eax, dword [ebp - 0x258]
imul eax, eax, 0x18
mov ecx, dword [0x48d004]
push dword [ecx + eax + 0xb0]
push dword [ebp - 0x244]
mov eax, dword [ebp - 0x258]
imul eax, eax, 0x18
mov ecx, dword [0x48d004]
mov edx, dword [0x48d008]
add edx, dword [ecx + eax + 0xb4]
push edx
call fcn.0048d369
add esp, 0xc
mov eax, dword [ebp - 0x258]
imul eax, eax, 0x18
mov ecx, dword [0x48d004]
mov edx, dword [ebp - 0x244]
add edx, dword [ecx + eax + 0xb0]
mov dword [ebp - 0x244], edx
jmp 0x48d632
push 0x8000
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x48d8b3
mov eax, dword [0x48d004]
mov ecx, dword [0x48d008]
add ecx, dword [eax + 0x68]
mov eax, dword [0x48d004]
sub ecx, dword [eax + 0x64]
mov eax, dword [0x48d004]
mov esi, dword [ebp - 0x250]
mov eax, dword [eax + 0xac]
xor edx, edx
div dword [esi + 0x3c]
add ecx, edx
mov dword [ebp - 4], ecx
and dword [ebp - 0x258], 0
jmp 0x48d778
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
mov eax, dword [0x48d004]
movzx eax, word [eax + 0xa4]
cmp dword [ebp - 0x258], eax
jge 0x48d8b3
mov eax, dword [ebp - 0x258]
imul eax, eax, 0x18
mov ecx, dword [0x48d004]
cmp dword [ecx + eax + 0xa8], 0
je 0x48d8ae
mov eax, dword [ebp - 0x258]
imul eax, eax, 0x18
mov ecx, dword [0x48d004]
cmp dword [ecx + eax + 0xb0], 0
jbe 0x48d8ae
mov eax, dword [ebp - 0x258]
imul eax, eax, 0x18
mov ecx, dword [0x48d004]
mov edx, dword [0x48d008]
add edx, dword [ecx + eax + 0xb4]
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x258]
imul eax, eax, 0x18
mov ecx, dword [0x48d004]
mov eax, dword [ecx + eax + 0xb0]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x258]
imul eax, eax, 0x18
mov ecx, dword [0x48d004]
mov edx, dword [ebp - 4]
add edx, dword [ecx + eax + 0xac]
mov dword [ebp - 0x11c], edx
cmp dword [ebp - 0x23c], 0
je 0x48d868
mov eax, dword [0x48d004]
mov eax, dword [eax + 4]
and eax, 0x2000000
je 0x48d868
mov eax, dword [ebp - 0x258]
imul eax, eax, 0x18
mov ecx, dword [0x48d004]
mov eax, dword [ecx + eax + 0xbc]
and eax, 0x10000000
je 0x48d868
mov dword [ebp - 0x274], 1
jmp 0x48d86f
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
jne 0x48d8ae
push dword [ebp - 0x244]
mov eax, dword [ebp - 0x258]
imul eax, eax, 0x18
mov ecx, dword [0x48d004]
push dword [ecx + eax + 0xb0]
push dword [ebp - 0x11c]
call fcn.0048d28a
add esp, 0xc
jmp 0x48d76b
mov eax, dword [0x48d004]
mov ecx, dword [0x48d008]
add ecx, dword [eax + 0x84]
mov dword [ebp - 0x24c], ecx
mov eax, dword [ebp - 0x24c]
cmp dword [eax + 0xc], 0
je 0x48daf8
mov eax, dword [0x48d004]
cmp dword [eax + 0x84], 0
je 0x48daf8
lea eax, [ebp - 0x240]
push eax
push 0x40
push 0x14
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x24c]
mov ecx, dword [0x48d008]
add ecx, dword [eax + 0xc]
mov dword [ebp - 0x238], ecx
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jne 0x48d949
push 8
push 0
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jne 0x48d9d0
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0xc]
lea eax, [ebp + eax - 0x118]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x278]
mov al, byte [eax]
mov byte [ebp - 0x281], al
mov eax, dword [ebp - 0x27c]
mov cl, byte [ebp - 0x281]
mov byte [eax], cl
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp byte [ebp - 0x281], 0
jne 0x48d97a
push 8
push 0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jne 0x48d9e3
jmp 0x48dbad
mov eax, dword [ebp - 0x24c]
mov ecx, dword [0x48d008]
add ecx, dword [eax + 0x10]
mov dword [ebp - 0x22c], ecx
mov eax, dword [ebp - 0x24c]
cmp dword [eax], 0
jne 0x48da0e
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x10], eax
jmp 0x48da1f
mov eax, dword [ebp - 0x24c]
mov ecx, dword [0x48d008]
add ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x48dae4
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0x80000000
je 0x48da60
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xffff
movzx eax, ax
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x268], eax
jmp 0x48da86
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
add eax, dword [0x48d008]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
inc eax
inc eax
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jne 0x48da99
jmp 0x48dbad
lea eax, [ebp - 0x240]
push eax
push 0x40
push 4
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x22c]
call fcn.0048d369
add esp, 0xc
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x22c]
add eax, 4
mov dword [ebp - 0x22c], eax
jmp 0x48da1f
mov eax, dword [ebp - 0x24c]
add eax, 0x14
mov dword [ebp - 0x24c], eax
jmp 0x48d8ca
mov eax, dword [0x48d004]
mov ecx, dword [0x48d008]
add ecx, dword [eax + 0x6c]
mov dword [0x48d01c], ecx
lea eax, [ebp - 0x240]
push eax
push 0x40
push 0x1000
push dword [0x48d008]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x250]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x250]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x248]
mov eax, dword [eax + 0x24]
and eax, 0x80000000
je 0x48db75
mov eax, dword [ebp - 0x248]
add eax, 0x24
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x248]
mov eax, dword [eax + 0x24]
sub eax, 0x80000000
mov ecx, dword [ebp - 0x26c]
mov dword [ecx], eax
push 0
push dword [ebp - 0x240]
push 0x1000
push dword [0x48d008]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x48d01c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push eax
mov eax, dword [0x48d004]
cmp dword [eax + 0x6c], 0
jne 0x48dbaa
pop eax
xor eax, eax
inc eax
ret
pop eax
jmp eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]