joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486d60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x4c1920
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x519b14]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov eax, dword [ebp + 0x418]
mov edi, dword [ebp + 0x410]
mov ebx, dword [ebp + 0x414]
mov dword [ebp - 0x14], eax
call dword [0x519a00]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], eax
mov dword [ebp], eax
push 2
push eax
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
mov dword [ebp - 0x18], edi
jne 0x486ded
call fcn.00484650
mov esi, eax
jmp 0x486ed5
mov ecx, dword [ebp - 0x14]
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x486e09
call fcn.00484650
jmp 0x486ecc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 0x20], eax
jne 0x486e22
call fcn.00484650
jmp 0x486ecc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x14], esi
jae 0x486e58
lea edx, [ebp + 4]
cmp dword [ebp], edx
je 0x486e46
lea ecx, [ebp]
call fcn.00485220
lea ecx, [ebp - 0x1c]
call fcn.00485030
mov eax, 0x8007000e
jmp 0x486ef2
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.00485d40
mov dword [ebp - 4], 1
jmp 0x486e81
mov ebx, dword [ebp]
test ebx, ebx
jne 0x486e8f
mov esi, 0x8007000e
jmp 0x486ece
call dword [0x519a00]
mov ecx, dword [ebp - 0x20]
push esi
push ebx
push esi
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x486eb0
call fcn.00484650
jmp 0x486ecc
mov edx, dword [ebp]
mov word [edx + eax*2], 0
mov eax, dword [ebp + 0x41c]
mov ecx, dword [ebp]
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.00486bb0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp + 4]
cmp dword [ebp], edx
je 0x486ef0
lea ecx, [ebp]
call fcn.00485220
jmp 0x486ef0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0048cb7d
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0x10
Function at 0x487bf0
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x4c1b06
mov eax, dword fs:[0]
push eax
sub esp, 0xa48
mov eax, dword [0x519b14]
xor eax, esp
mov dword [esp + 0xa44], eax
push ebx
push esi
push edi
mov eax, dword [0x519b14]
xor eax, esp
push eax
lea eax, [esp + 0xa58]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa6c]
mov ebx, dword [esp + 0xa68]
mov edx, dword [esp + 0xa74]
mov esi, ecx
cmp byte [esi + 0x5874], 0
mov dword [esp + 0x10], eax
je 0x487c58
mov eax, 0x810a0001
jmp 0x487e26
test ebx, ebx
mov ecx, dword [esp + 0xa70]
mov byte [esi + 0x5874], 1
mov dword [esi + 4], ecx
jne 0x487c72
mov ebx, 0x4e5fd8
test eax, eax
jne 0x487c7e
mov dword [esp + 0x10], 0x4e5fd8
test edx, edx
je 0x487ca8
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x487c87
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esi + 0x583c]
call fcn.00405350
jmp 0x487d7c
push 0x104
lea edx, [esp + 0x50]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x4c]
push 0x5c
push eax
call fcn.0048d7f1
add esp, 8
test eax, eax
jne 0x487cd7
mov eax, 0x810a0002
jmp 0x487e26
lea ecx, [esp + 0x4c]
push ecx
lea ecx, [esp + 0x18]
mov word [eax], 0
call fcn.00405260
push str._bugreport.exe
push eax
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0xa6c], 0
call fcn.00408f50
add esp, 0xc
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esi + 0x583c]
mov byte [esp + 0xa6c], 1
call fcn.00405dc0
mov edi, 8
cmp dword [esp + 0x48], edi
jb 0x487d38
mov eax, dword [esp + 0x34]
push eax
call fcn.0048c112
add esp, 4
xor eax, eax
cmp dword [esp + 0x2c], edi
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], eax
mov word [esp + 0x34], ax
mov dword [esp + 0xa60], 0xffffffff
jb 0x487d6b
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0048c112
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], eax
mov word [esp + 0x18], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0xffffffffffffffff
push eax
lea edx, [esi + 0x2ec]
push 0x1000
push edx
call fcn.0048dd65
push 0xffffffffffffffff
push ebx
lea eax, [esi + 0x573c]
push 0x40
push eax
call fcn.0048dd65
mov ecx, dword [esp + 0x30]
push 0xffffffffffffffff
push ecx
lea edx, [esi + 0x57bc]
push 0x40
push edx
call fcn.0048dd65
add esp, 0x30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.bdbugreport__u
lea eax, [esp + 0x25c]
push 0xffffffffffffffff
push eax
call fcn.00483cf0
lea eax, [esp + 0x264]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x487de7
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x258]
push ecx
lea ecx, [esi + 0x5858]
call fcn.00405350
push 0x487bb0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
cmp eax, 0x487bb0
mov dword [esi], eax
jne 0x487e24
mov dword [esi], 0
xor eax, eax
mov ecx, dword [esp + 0xa58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa44]
xor ecx, esp
call fcn.0048cb7d
add esp, 0xa54
ret 0x10
Function at 0x488330
Capabilities:
Check if file exists
Read file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x519b14]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x218]
push edi
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov edi, ecx
mov word [esp + 0x18], 0
call fcn.0048d180
add esp, 0xc
push 0x104
lea ecx, [esp + 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x48840f
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x4e13a4
lea edx, [esp + 0x14]
push edx
call ebx
test eax, eax
je 0x4883e5
push esi
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
je 0x4883e5
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4883e5
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [esp + 0x28]
push edx
lea esi, [edi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
mov ecx, esi
call fcn.004882d0
mov esi, dword [esi]
cmp esi, 0xffffffff
jne 0x4883e9
xor eax, eax
jmp 0x48840e
push 0
lea eax, [esp + 0x10]
push eax
push 0x400
add edi, 8
push edi
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
call fcn.0048cb7d
add esp, 0x210
ret 4

Function at 0x488760
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x51d3d0]
mov dword [ebp - 4], eax
jmp 0x488779
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x488796
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x488770
mov esp, ebp
pop ebp
ret
Function at 0x4887a0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x51d3e0], eax
je 0x4887be
mov eax, 0x10dd
jmp 0x48889f
mov eax, dword [0x51d3f0]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48883c
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x48881a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x48881a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.00488910
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.0048c112
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x4887c6
mov dword [0x51d3f0], 0
call fcn.004888b0
mov ecx, dword [0x51d3ec]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x488889
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0048c112
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x488854
mov dword [0x51d3ec], 0
mov dword [0x51d3e0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x488e10
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x488e25
xor eax, eax
jmp 0x488e9a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x488e52
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x488e95
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x488e93
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x488e8f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x488e93
xor eax, eax
jmp 0x488e9a
jmp 0x488e49
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x488f40
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x51d3e4], 0
je 0x488f59
mov eax, dword [0x51d3e4]
jmp 0x488ff9
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x488f6b
xor eax, eax
jmp 0x488ff9
push 8
call fcn.0048c596
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x488fc1
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x488faa
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0048c112
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x51d3e4], eax
mov dword [0x51d3e8], 0
mov eax, dword [ebp - 4]
jmp 0x488ff9
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x488fdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x488f8b
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x51d3ec]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x51d3ec], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x489820
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.004898f0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x4898dc
cmp dword [ebp - 4], 0x50000000
jb 0x48985c
cmp dword [ebp - 4], 0x80000000
ja 0x48985c
mov dword [ebp - 4], 0x80010000
jmp 0x489835
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.0048d180
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x489882
jmp 0x4898dc
cmp dword [ebp - 0x10], 0x10000
jne 0x4898c5
cmp dword [ebp - 0x14], 0x10000
jb 0x4898c5
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4898b8
mov eax, dword [ebp - 0x24]
jmp 0x4898de
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x4898d7
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.004898f0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x489835
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x489920
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.004899f0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x4899e4
cmp dword [ebp - 4], 0x50000000
jb 0x489961
cmp dword [ebp - 4], 0x80000000
ja 0x489961
mov dword [ebp - 4], 0x4fff0000
jmp 0x48993a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.0048d180
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x489987
jmp 0x4899e4
cmp dword [ebp - 0x10], 0x10000
jne 0x4899ca
cmp dword [ebp - 0x14], 0x10000
jb 0x4899ca
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4899bd
mov eax, dword [ebp - 0x24]
jmp 0x4899e6
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x4899df
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.004899f0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x48993a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x489a20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x51d3e0], eax
je 0x489a45
mov eax, 0x10dd
jmp 0x489bdd
cmp dword [0x51d3e4], 0
je 0x489a58
mov eax, dword [0x51d3e4]
jmp 0x489bdd
cmp dword [ebp + 8], 0
jne 0x489a68
mov eax, 6
jmp 0x489bdd
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x489a91
mov dword [ebp - 0xc], 6
mov ecx, dword [ebp - 0xc]
mov dword [0x51d3e4], ecx
mov edx, dword [ebp + 8]
mov dword [0x51d3e8], edx
mov eax, dword [ebp - 0xc]
jmp 0x489bdd
push 0x18
call fcn.0048c596
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x489aea
mov dword [ebp - 0xc], 8
mov ecx, dword [ebp - 0xc]
mov dword [0x51d3e4], ecx
cmp dword [ebp - 0x18], 0
je 0x489ad9
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.0048c112
add esp, 4
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp + 8]
mov dword [0x51d3e8], ecx
mov eax, dword [ebp - 0xc]
jmp 0x489bdd
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.00488460
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00488460
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 8], 0
je 0x489b2a
cmp dword [ebp - 8], 0x1e
jbe 0x489b46
mov dword [ebp - 0xc], 9
cmp dword [0x51d3d8], 0
je 0x489b41
jmp 0x489aba
jmp 0x489ab1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x489b6d
mov dword [ebp - 0xc], 9
cmp dword [0x51d3d8], 0
je 0x489b68
jmp 0x489aba
jmp 0x489ab1
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
push 0x40
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x489b9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
jmp 0x489ab1
mov edx, dword [ebp - 0x18]
mov dword [edx + 4], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [0x51d3f0]
mov dword [edx], eax
mov ecx, dword [ebp - 0x18]
mov dword [0x51d3f0], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x48aae0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x51d3f4], 0
push esi
jne 0x48aa4e
call fcn.0048a96c
test eax, eax
je 0x48aa91
mov eax, dword [0x51d3f4]
cmp eax, 1
jne 0x48aa6f
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x48aa91
pop esi
ret
push eax
call dword [0x51d3fc]
test eax, eax
jne 0x48aad9
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x48aa95
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x51d3f4]
call dword [0x51d3fc]
mov edi, eax
test edi, edi
je 0x48aabc
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x48aad8
lea edi, [esi + 0xff0]
push esi
push dword [0x51d3f4]
call dword [0x51d3f8]
add esi, 0x10
cmp esi, edi
jb 0x48aac2
mov eax, esi
pop edi
pop esi
ret
jmp 0x48aa3b

Function at 0x48ae4c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x519b14]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0048acab
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0048d180
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x48ae9b
cmp dword [ebp - 0x1c], 5
jb 0x48aeb3
jmp 0x48aeaf
cmp dword [ebp - 0x10], 1
jne 0x48aeb3
cmp dword [ebp - 0x1c], 4
ja 0x48aeaf
jne 0x48aeb3
cmp dword [ebp - 0x18], 0
jbe 0x48aeb3
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4e3338
call fcn.00483a50
test eax, eax
jge 0x48aed4
mov byte [0x51e36d], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0048cb7d
add ebp, 0x78
leave
ret

Function at 0x48cb7d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x519b14]
jne 0x48cb87
repz ret
jmp fcn.00494b5c
Function at 0x493cd8
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x519d20]
je 0x493cf3
inc edi
cmp edi, 0x17
jb 0x493ce4
cmp edi, 0x17
jae 0x493e73
push ebp
push 3
call fcn.004a9847
cmp eax, 1
pop ecx
je 0x493e3f
push 3
call fcn.004a9847
test eax, eax
pop ecx
jne 0x493d27
cmp dword [0x519b30], 1
je 0x493e3f
cmp ebx, 0xfc
je 0x493e72
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x51d720
push ebp
call fcn.0048fb89
add esp, 0xc
test eax, eax
je 0x493d5d
push esi
push esi
push esi
push esi
push esi
call fcn.0048e345
add esp, 0x14
push 0x104
mov esi, 0x51d739
push esi
push 0
mov byte [0x51d83d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x493da1
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0048fb89
add esp, 0xc
test eax, eax
je 0x493da1
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0048e345
add esp, 0x14
push esi
call fcn.00490340
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x493de6
push esi
call fcn.00490340
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x51da34
push 0x4e445c
sub ecx, eax
push ecx
push eax
call fcn.004a0548
add esp, 0x14
test eax, eax
je 0x493de6
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0048e345
add esp, 0x14
jmp 0x493de8
xor esi, esi
push 0x4e4458
push ebx
push ebp
call fcn.004a04d7
add esp, 0xc
test eax, eax
je 0x493e08
push esi
push esi
push esi
push esi
push esi
call fcn.0048e345
add esp, 0x14
push dword [edi*8 + 0x519d24]
push ebx
push ebp
call fcn.004a04d7
add esp, 0xc
test eax, eax
je 0x493e2a
push esi
push esi
push esi
push esi
push esi
call fcn.0048e345
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004a968a
add esp, 0xc
jmp 0x493e72
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x493e72
cmp ebp, 0xffffffff
je 0x493e72
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x519d24]
push dword [esi]
call fcn.00490340
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4a968a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00493fab
xor ebx, ebx
cmp dword [0x51e2a0], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4a9760
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4a9840
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4a9840
push eax
call fcn.00493f3d
mov dword [esp], 0x4e5b00
push edi
mov dword [0x51e2a0], eax
call esi
push eax
call fcn.00493f3d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x51e2a4], eax
call esi
push eax
call fcn.00493f3d
mov dword [0x51e2a8], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00494dac
test eax, eax
pop ecx
pop ecx
je 0x4a972e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0048e345
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4a9760
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00493f3d
cmp eax, ebx
pop ecx
mov dword [0x51e2b0], eax
je 0x4a9760
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00493f3d
pop ecx
mov dword [0x51e2ac], eax
mov eax, dword [0x51e2ac]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4a97e5
cmp dword [0x51e2b0], ecx
je 0x4a97e5
push eax
call fcn.00493fb4
push dword [0x51e2b0]
mov esi, eax
call fcn.00493fb4
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4a97e5
cmp edi, ebx
je 0x4a97e5
call esi
cmp eax, ebx
je 0x4a97b2
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4a97b2
test byte [ebp - 0x18], 1
jne 0x4a97e5
lea eax, [ebp - 0x10]
push eax
call fcn.00494e5b
test eax, eax
pop ecx
je 0x4a97cd
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0048e345
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4a97dc
or dword [ebp + 0x10], 0x200000
jmp 0x4a9820
or dword [ebp + 0x10], 0x40000
jmp 0x4a9820
mov eax, dword [0x51e2a4]
cmp eax, dword [ebp - 8]
je 0x4a9820
push eax
call fcn.00493fb4
cmp eax, ebx
pop ecx
je 0x4a9820
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4a9820
mov eax, dword [0x51e2a8]
cmp eax, dword [ebp - 8]
je 0x4a9820
push eax
call fcn.00493fb4
cmp eax, ebx
pop ecx
je 0x4a9820
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x51e2a0]
call fcn.00493fb4
cmp eax, ebx
pop ecx
je 0x4a9840
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4a9842
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret