joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480b30
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x507334]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0x80004005
mov word [ebp - 0x210], 0
push 0x1fe
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00489f10
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
push 0xffffffffffffffff
mov edx, dword [0x4e0534]
push edx
push 0x100
lea eax, [ebp - 0x210]
push eax
call fcn.0048f23a
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
push 0xa
lea edx, [ebp - 0x210]
push edx
call fcn.004bf660
push eax
call fcn.004bf670
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x480bbc
jmp 0x480ced
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x218]
call fcn.00482700
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
push edx
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1ac
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x190
push ecx
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x33c
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x320
push eax
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x4cc
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x4b0
push edx
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x65c
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x640
push ecx
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x7ec
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x7d0
push eax
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x97c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x960
push edx
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0xb0c
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0xaf0
push ecx
call fcn.0048f23a
add esp, 0x10
lea ecx, [ebp - 0x218]
call fcn.00482730
mov dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048f726
mov esp, ebp
pop ebp
ret 8
Function at 0x481070
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2a5b
mov eax, dword fs:[0]
push eax
sub esp, 0x87c
mov eax, dword [0x507334]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00489f10
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x4e061c]
push edx
push 0x100
lea eax, [ebp - 0x21c]
push eax
call fcn.0048f23a
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.0047d620
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004bf660
push eax
call fcn.004bf670
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x48111c
jmp 0x48129f
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x224]
call fcn.00482700
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
call fcn.00482840
lea ecx, [ebp - 0x878]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00482930
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], eax
jmp 0x481179
push 0
lea ecx, [ebp - 0x880]
push ecx
lea ecx, [ebp - 0x22c]
call fcn.00482860
lea edx, [ebp - 0x888]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00482810
push eax
lea ecx, [ebp - 0x22c]
call fcn.00482900
movzx eax, al
test eax, eax
je 0x481283
lea ecx, [ebp - 0x22c]
call fcn.00482990
mov ecx, dword [eax]
mov dword [ebp - 0x870], ecx
mov word [ebp - 0x86c], 0
push 0x18e
push 0
lea edx, [ebp - 0x86a]
push edx
call fcn.00489f10
add esp, 0xc
push 0x4b0
push 0
lea eax, [ebp - 0x6dc]
push eax
call fcn.00489f10
add esp, 0xc
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x870]
push ecx
push 0xc8
lea edx, [ebp - 0x86c]
push edx
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp - 0x870]
add eax, 0x190
push eax
push 0xc8
lea ecx, [ebp - 0x6dc]
push ecx
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp - 0x870]
add edx, 0x320
push edx
push 0xc8
lea eax, [ebp - 0x54c]
push eax
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x870]
add ecx, 0x4b0
push ecx
push 0xc8
lea edx, [ebp - 0x3bc]
push edx
call fcn.0048f23a
add esp, 0x10
lea eax, [ebp - 0x86c]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00482770
jmp 0x481165
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.00482730
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f726
mov esp, ebp
pop ebp
ret 8
Function at 0x4815c0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x507334]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0x80004005
mov word [ebp - 0x210], 0
push 0x1fe
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00489f10
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
push 0xffffffffffffffff
mov edx, dword [0x4e0428]
push edx
push 0x100
lea eax, [ebp - 0x210]
push eax
call fcn.0048f23a
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
push 0xa
lea edx, [ebp - 0x210]
push edx
call fcn.004bf660
push eax
call fcn.004bf670
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x48164c
jmp 0x4816d1
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x218]
call fcn.00482700
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
push edx
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1ac
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x190
push ecx
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x33c
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x320
push eax
call fcn.0048f23a
add esp, 0x10
lea ecx, [ebp - 0x218]
call fcn.00482730
mov dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048f726
mov esp, ebp
pop ebp
ret 8
Function at 0x481980
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d29eb
mov eax, dword fs:[0]
push eax
sub esp, 0x560
mov eax, dword [0x507334]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00489f10
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x4e0468]
push edx
push 0x100
lea eax, [ebp - 0x21c]
push eax
call fcn.0048f23a
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.0047d620
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004bf660
push eax
call fcn.004bf670
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x481a2c
jmp 0x481b7f
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x224]
call fcn.00482700
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
call fcn.00482840
lea ecx, [ebp - 0x55c]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00482930
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], eax
jmp 0x481a89
push 0
lea ecx, [ebp - 0x564]
push ecx
lea ecx, [ebp - 0x22c]
call fcn.00482860
lea edx, [ebp - 0x56c]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00482810
push eax
lea ecx, [ebp - 0x22c]
call fcn.00482900
movzx eax, al
test eax, eax
je 0x481b5b
lea ecx, [ebp - 0x22c]
call fcn.00482990
mov ecx, dword [eax]
mov dword [ebp - 0x230], ecx
mov word [ebp - 0x554], 0
push 0x18e
push 0
lea edx, [ebp - 0x552]
push edx
call fcn.00489f10
add esp, 0xc
push 0x190
push 0
lea eax, [ebp - 0x3c4]
push eax
call fcn.00489f10
add esp, 0xc
cmp dword [ebp - 0x230], 0
jne 0x481b08
jmp 0x481a75
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x230]
push ecx
push 0xc8
lea edx, [ebp - 0x554]
push edx
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp - 0x230]
add eax, 0x190
push eax
push 0xc8
lea ecx, [ebp - 0x3c4]
push ecx
call fcn.0048f23a
add esp, 0x10
lea edx, [ebp - 0x554]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.004828d0
jmp 0x481a75
mov ecx, dword [ebp + 8]
call fcn.00481ba0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.00482730
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f726
mov esp, ebp
pop ebp
ret 8
Function at 0x481f70
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x507334]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0x80004005
mov word [ebp - 0x210], 0
push 0x1fe
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00489f10
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
push 0xffffffffffffffff
mov edx, dword [0x4e046c]
push edx
push 0x100
lea eax, [ebp - 0x210]
push eax
call fcn.0048f23a
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
push 0xa
lea edx, [ebp - 0x210]
push edx
call fcn.004bf660
push eax
call fcn.004bf670
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x481ffc
jmp 0x482081
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x218]
call fcn.00482700
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
push edx
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1ac
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x190
push ecx
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x33c
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x320
push eax
call fcn.0048f23a
add esp, 0x10
lea ecx, [ebp - 0x218]
call fcn.00482730
mov dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048f726
mov esp, ebp
pop ebp
ret 8
Function at 0x482460
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d297b
mov eax, dword fs:[0]
push eax
sub esp, 0x884
mov eax, dword [0x507334]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00489f10
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [str.SELECT__FROM_Win32_LogicalDisk_WHERE__FileSystem_IS_NOT_NULL_]
push edx
push 0x100
lea eax, [ebp - 0x21c]
push eax
call fcn.0048f23a
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.0047d620
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004bf660
push eax
call fcn.004bf670
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x48250c
jmp 0x4826b6
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x224]
call fcn.00482700
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
call fcn.00482840
lea ecx, [ebp - 0x880]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00482930
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], eax
jmp 0x482569
push 0
lea ecx, [ebp - 0x888]
push ecx
lea ecx, [ebp - 0x22c]
call fcn.00482860
lea edx, [ebp - 0x890]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00482810
push eax
lea ecx, [ebp - 0x22c]
call fcn.00482900
movzx eax, al
test eax, eax
je 0x482692
lea ecx, [ebp - 0x22c]
call fcn.00482990
mov ecx, dword [eax]
mov dword [ebp - 0x878], ecx
mov word [ebp - 0x874], 0
push 0x18e
push 0
lea edx, [ebp - 0x872]
push edx
call fcn.00489f10
add esp, 0xc
push 0x4b4
push 0
lea eax, [ebp - 0x6e4]
push eax
call fcn.00489f10
add esp, 0xc
cmp dword [ebp - 0x878], 0
jne 0x4825e8
jmp 0x482555
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x878]
push ecx
push 0xc8
lea edx, [ebp - 0x874]
push edx
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp - 0x878]
add eax, 0x190
push eax
push 0xc8
lea ecx, [ebp - 0x6e4]
push ecx
call fcn.0048f23a
add esp, 0x10
mov edx, dword [ebp - 0x878]
mov eax, dword [edx + 0x320]
mov dword [ebp - 0x554], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x878]
add ecx, 0x324
push ecx
push 0xc8
lea edx, [ebp - 0x550]
push edx
call fcn.0048f23a
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp - 0x878]
add eax, 0x4b4
push eax
push 0xc8
lea ecx, [ebp - 0x3c0]
push ecx
call fcn.0048f23a
add esp, 0x10
lea edx, [ebp - 0x874]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00482960
jmp 0x482555
mov ecx, dword [ebp + 8]
call fcn.00481ba0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.00482730
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f726
mov esp, ebp
pop ebp
ret 8
Function at 0x486e47
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x507334]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00486d86
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00489f10
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x486e96
cmp dword [ebp - 0x1c], 5
jb 0x486eae
jmp 0x486eaa
cmp dword [ebp - 0x10], 1
jne 0x486eae
cmp dword [ebp - 0x1c], 4
ja 0x486eaa
jne 0x486eae
cmp dword [ebp - 0x18], 0
jbe 0x486eae
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4d7ba8
call fcn.004528b6
test eax, eax
jge 0x486ecf
mov byte [0x50d4fc], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0048f726
add ebp, 0x78
leave
ret

Function at 0x487317
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x50c884], 0
push esi
jne 0x48728a
call fcn.004871b5
test eax, eax
je 0x4872cd
mov eax, dword [0x50c884]
cmp eax, 1
jne 0x4872ab
push 0xd
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
je 0x4872cd
pop esi
ret
push eax
call dword [0x50c88c]
test eax, eax
jne 0x487315
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4872d1
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x50c884]
call dword [0x50c88c]
mov edi, eax
test edi, edi
je 0x4872f8
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
mov eax, edi
jmp 0x487314
lea edi, [esi + 0xff0]
push esi
push dword [0x50c884]
call dword [0x50c888]
add esi, 0x10
cmp esi, edi
jb 0x4872fe
mov eax, esi
pop edi
pop esi
ret
jmp 0x487277
Function at 0x489c50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x489c8d
cmp dword [ebp + 0x14], edi
je 0x489c8d
cmp ecx, edi
jne 0x489c94
call fcn.00490e77
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004898ea
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x489ca8
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x489cc9
cmp ebx, 0xffffffff
je 0x489cb8
push ebx
push edi
push ecx
call fcn.00489f10
add esp, 0xc
cmp esi, edi
je 0x489c75
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x489c75
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x489ce5
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x489cec
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x489ddd
test word [esi + 0xc], 0x10c
je 0x489d40
mov eax, dword [esi + 4]
test eax, eax
je 0x489d40
jl 0x489e3e
cmp ebx, eax
mov edi, ebx
jb 0x489d11
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x489de5
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004891f8
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x489dd5
cmp ebx, dword [ebp - 0xc]
jb 0x489dad
cmp dword [ebp - 0xc], 0
je 0x489d6a
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x489d5f
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x489d66
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x489d75
mov eax, SysReAllocString
cmp ebx, eax
ja 0x489d75
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x489e11
push eax
push dword [ebp - 8]
push esi
call fcn.0048cd80
pop ecx
push eax
call fcn.004976f2
add esp, 0xc
test eax, eax
je 0x489e50
cmp eax, 0xffffffff
je 0x489e3e
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x489dd5
push esi
call fcn.00497011
cmp eax, 0xffffffff
pop ecx
je 0x489e42
cmp dword [ebp - 4], 0
je 0x489e11
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x489cf4
mov eax, dword [ebp + 0x14]
jmp 0x489c8f
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x489dfc
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00489f10
add esp, 0xc
call fcn.00490e77
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x489c85
cmp dword [ebp + 0xc], 0xffffffff
je 0x489e27
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00489f10
add esp, 0xc
call fcn.00490e77
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x489c85
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x489c8f
or dword [esi + 0xc], 0x10
jmp 0x489e42
Function at 0x48ee1e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x48ee4b
call fcn.00490e8a
mov dword [eax], esi
call fcn.00490e77
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004898ea
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x48ee27
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x48ee7a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.00490e9d
pop ecx
call fcn.00490e77
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x48eea1
test al, 1
je 0x48eea1
test byte [esp + 0xc], 2
je 0x48eea1
call fcn.00490e8a
mov dword [eax], 5
call fcn.00490e77
mov dword [eax], 0xd
jmp 0x48ee71
xor eax, eax
pop esi
ret

Function at 0x48f726
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x507334]
jne 0x48f730
repz ret
jmp fcn.0049f661

Function at 0x494966
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x507c28]
je 0x494981
inc edi
cmp edi, 0x17
jb 0x494972
cmp edi, 0x17
jae 0x494b01
push ebp
push 3
call fcn.004a13cd
cmp eax, 1
pop ecx
je 0x494acd
push 3
call fcn.004a13cd
test eax, eax
pop ecx
jne 0x4949b5
cmp dword [0x507180], 1
je 0x494acd
cmp ebx, 0xfc
je 0x494b00
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x50c988
push ebp
call fcn.0048efec
add esp, 0xc
test eax, eax
je 0x4949eb
push esi
push esi
push esi
push esi
push esi
call fcn.004897ee
add esp, 0x14
push 0x104
mov esi, 0x50c9a1
push esi
push 0
mov byte [0x50caa5], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x494a2f
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0048efec
add esp, 0xc
test eax, eax
je 0x494a2f
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004897ee
add esp, 0x14
push esi
call fcn.004873b0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x494a74
push esi
call fcn.004873b0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x50cc9c
push 0x4d8d54
sub ecx, eax
push ecx
push eax
call fcn.0048c1b2
add esp, 0x14
test eax, eax
je 0x494a74
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004897ee
add esp, 0x14
jmp 0x494a76
xor esi, esi
push 0x4d8d50
push ebx
push ebp
call fcn.004a03cd
add esp, 0xc
test eax, eax
je 0x494a96
push esi
push esi
push esi
push esi
push esi
call fcn.004897ee
add esp, 0x14
push dword [edi*8 + 0x507c2c]
push ebx
push ebp
call fcn.004a03cd
add esp, 0xc
test eax, eax
je 0x494ab8
push esi
push esi
push esi
push esi
push esi
call fcn.004897ee
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004a1210
add esp, 0xc
jmp 0x494b00
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x494b00
cmp ebp, 0xffffffff
je 0x494b00
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x507c2c]
push dword [esi]
call fcn.004873b0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4a1210
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004943e7
xor ebx, ebx
cmp dword [0x50d440], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4a12e6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4a13c6
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4a13c6
push eax
call fcn.00494379
mov dword [esp], 0x4d9978
push edi
mov dword [0x50d440], eax
call esi
push eax
call fcn.00494379
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x50d444], eax
call esi
push eax
call fcn.00494379
mov dword [0x50d448], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0048c444
test eax, eax
pop ecx
pop ecx
je 0x4a12b4
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004897ee
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4a12e6
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00494379
cmp eax, ebx
pop ecx
mov dword [0x50d450], eax
je 0x4a12e6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00494379
pop ecx
mov dword [0x50d44c], eax
mov eax, dword [0x50d44c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4a136b
cmp dword [0x50d450], ecx
je 0x4a136b
push eax
call fcn.004943f0
push dword [0x50d450]
mov esi, eax
call fcn.004943f0
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4a136b
cmp edi, ebx
je 0x4a136b
call esi
cmp eax, ebx
je 0x4a1338
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4a1338
test byte [ebp - 0x18], 1
jne 0x4a136b
lea eax, [ebp - 0x10]
push eax
call fcn.0048c47b
test eax, eax
pop ecx
je 0x4a1353
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004897ee
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4a1362
or dword [ebp + 0x10], 0x200000
jmp 0x4a13a6
or dword [ebp + 0x10], 0x40000
jmp 0x4a13a6
mov eax, dword [0x50d444]
cmp eax, dword [ebp - 8]
je 0x4a13a6
push eax
call fcn.004943f0
cmp eax, ebx
pop ecx
je 0x4a13a6
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4a13a6
mov eax, dword [0x50d448]
cmp eax, dword [ebp - 8]
je 0x4a13a6
push eax
call fcn.004943f0
cmp eax, ebx
pop ecx
je 0x4a13a6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x50d440]
call fcn.004943f0
cmp eax, ebx
pop ecx
je 0x4a13c6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4a13c8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret