joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425b14
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x425c71
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x20], 0
jne 0x425c56
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x24], esi
inc esi
jne 0x425b6b
push 0
xor eax, eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea ecx, [ebp - 0xc]
mov edx, 0x425c88
mov eax, ebx
call fcn.00425908
mov word [ebx + 4], 2
mov edx, dword [ebx + 0x14]
mov eax, ebx
call fcn.004258ac
mov dword [ebx + 8], eax
mov ax, word [ebx + 0x18]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 6], ax
push 0
push 0
push 0
mov eax, dword [ebx + 0x24]
push eax
call sub.wsock32.dll_WSAAsyncSelect
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x8004667e
mov eax, dword [ebx + 0x24]
push eax
call sub.wsock32.dll_ioctlsocket
push 0x10
lea eax, [ebx + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x425bed
push 0
call sub.wsock32.dll_WSAGetLastError
lea edx, [ebp - 0x10]
call fcn.0040c388
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea ecx, [ebp - 0xc]
mov edx, 0x425ca0
mov eax, ebx
call fcn.00425908
cmp dword [ebx + 0x24], 0xffffffff
setne al
mov byte [ebx + 0x20], al
lea eax, [ebp - 0x14]
push eax
xor eax, eax
mov al, byte [ebx + 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
xor eax, eax
mov al, byte [ebx + 9]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
xor eax, eax
mov al, byte [ebx + 0xa]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
xor eax, eax
mov al, byte [ebx + 0xb]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
movzx eax, word [ebx + 0x18]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x3c]
mov ecx, 4
mov eax, 0x425cc0
call fcn.00409cd8
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x1c0]
call fcn.0040483c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425c78
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040480c
ret
Function at 0x425ce4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x425d79
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
cmp byte [ebx + 0x20], 0
je 0x425d63
push 0
mov eax, dword [ebp - 4]
push eax
push edx
mov eax, dword [ebx + 0x24]
push eax
call sub.wsock32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jne 0x425d63
call sub.wsock32.dll_WSAGetLastError
mov edi, eax
cmp edi, 0x2733
je 0x425d63
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
test edi, edi
je 0x425d63
push 0
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.0040c388
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea ecx, [ebp - 0xc]
mov edx, 0x425d94
mov eax, ebx
call fcn.00425908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425d80
lea eax, [ebp - 0x10]
call fcn.004047e8
ret

Function at 0x425dc8
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x425e7f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
cmp esi, 0xffffffff
jne 0x425e0e
cmp byte [ebx + 0x20], 0
je 0x425e0e
lea eax, [ebp - 4]
push eax
push 0x4004667f
mov eax, dword [ebx + 0x24]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x425e69
cmp byte [ebx + 0x20], 0
je 0x425e69
push 0
push esi
push edi
mov eax, dword [ebx + 0x24]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x425e69
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
cmp esi, 0x2733
je 0x425e69
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
test esi, esi
je 0x425e69
push 0
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0040c388
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea ecx, [ebp - 0xc]
mov edx, 0x425e98
mov eax, ebx
call fcn.00425908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425e86
lea eax, [ebp - 0x10]
call fcn.004047e8
ret

Function at 0x425f04
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
mov edx, ebx
mov eax, esi
call fcn.00425eb0
cmp dword [ebx], 0
jne 0x425f2a
push 1
call sub.kernel32.dll_Sleep
cmp dword [ebx], 0
jne 0x425f3b
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp eax, dword [esi + 0x1c]
jb 0x425f15
cmp dword [ebx], 0
jne 0x425f5d
push 0
xor eax, eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0xb
lea ecx, [esp + 4]
mov edx, 0x425f6c
mov eax, esi
call fcn.00425908
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x426aa0
Capabilities:
Read file via mapping

Disassembly:
push ebx
call fcn.00426a40
mov ebx, eax
test ebx, ebx
jne 0x426adc
call fcn.004269a4
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [eax], ebx
push eax
call sub.kernel32.dll_UnmapViewOfFile
pop ebx
ret

Function at 0x426d70
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x426f1b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402854
mov edx, dword [0x407e0c]
call fcn.00403ad4
test al, al
jne 0x426ef3
call fcn.00402854
mov edx, dword [0x407da4]
call fcn.00403ad4
test al, al
je 0x426dd9
call fcn.00402854
mov edx, dword [eax + 4]
lea eax, [ebp - 0xc]
call fcn.00404880
jmp 0x426de6
lea eax, [ebp - 0xc]
mov edx, 0x426f30
call fcn.00404880
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 0x426f50
call fcn.00409cd8
mov eax, dword [ebp - 8]
call fcn.00404cc4
push eax
call sub.kernel32.dll_OutputDebugStringA
push 0
xor eax, eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.004231f8
call fcn.00423708
call fcn.004237bc
test al, al
je 0x426ef3
push 0x242014
push 0x426f78
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x426f98
call fcn.00409cd8
mov eax, dword [ebp - 0x28]
call fcn.00404cc4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
cmp eax, 6
jne 0x426ef3
lea edx, [ebp - 0x2c]
xor eax, eax
call fcn.00402be8
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 4]
mov edx, 0x427010
call fcn.00409378
call fcn.0042364c
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x427020
mov edx, 0x427020
mov eax, 0x427048
call fcn.0042c9a4
test al, al
jne 0x426ef3
push 0x242030
push 0x42705c
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x427070
call fcn.00409cd8
mov eax, dword [ebp - 0x30]
call fcn.00404cc4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426f22
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.0040480c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040480c
ret
Function at 0x42710c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4271bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x48e9cc], bl
mov eax, 0x48e9d0
mov edx, esi
call fcn.0040483c
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x18]
xor edx, edx
mov dl, bl
mov eax, dword [0x426430]
call fcn.00417598
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x4271d4
call fcn.00409cd8
push 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004231f8
mov eax, dword [ebp - 4]
call fcn.00404cc4
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4271c3
lea eax, [ebp - 0x18]
call fcn.004047e8
lea eax, [ebp - 4]
call fcn.004047e8
ret

Function at 0x42730c
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
add esp, 0xffffffac
test al, al
je 0x427358
push esp
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [esp + 0x44]
xor ecx, ecx
mov edx, 0x10
call fcn.004031e4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 4]
push eax
mov eax, dword [0x48e9c0]
call fcn.00404cc4
push eax
push 0
push 0x220
push 0
push 0
push 0
call sub.kernel32.dll_GetCommandLineA_1
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 1
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
add esp, 0x54
ret
Function at 0x4274f8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x427670
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4264d0]
call fcn.004273a0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x427653
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp word [ebp - 4], 0x5a4d
jne 0x42763d
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.0041cdf0
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp dword [ebp - 8], 0
je 0x42763d
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.0041cdf0
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp dword [ebp - 0xc], 0x4550
jne 0x42763d
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
test byte [ebp - 0x15], 0x20
je 0x427639
push 2
push 0
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.004273e8
mov eax, dword [ebp - 0x2c]
call fcn.00404cc4
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x427632
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x427680
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x427617
push 0xa
push 0x42768c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x427617
mov byte [ebp - 1], 2
jmp 0x42761b
mov byte [ebp - 1], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42763d
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42765a
mov eax, dword [ebp - 0x10]
call fcn.00403948
ret

Function at 0x427768
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7fc
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cb4
xor eax, eax
push ebp
push 0x427817
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4277ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404cc4
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00404cc4
push eax
mov eax, esi
call fcn.00404cc4
push eax
mov eax, ebx
call fcn.00404cc4
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x804]
mov eax, dword [ebp + 8]
call fcn.004048d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427801
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42781e
lea eax, [ebp - 4]
call fcn.004047e8
ret
Function at 0x4283e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov edx, esp
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
xor edx, edx
mov dl, byte [esp]
mov eax, ebx
call fcn.00402c88
xor ecx, ecx
mov cl, byte [esp]
lea edx, [ebx + 1]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0xc]
xor edx, edx
mov dl, byte [ebx]
test edx, edx
jle 0x42842b
lea eax, [ebx + 1]
xor byte [eax], 0x62
inc eax
dec edx
jne 0x428424
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x429f58
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x429f20
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret
Function at 0x42a924
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x80c], ecx
mov esi, edx
lea edi, [ebp - 0x808]
mov ecx, 0x201
rep movsd dword es:[edi], dword [esi]
mov esi, eax
xor eax, eax
push ebp
push 0x42a9df
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x80c]
mov ecx, esi
mov edx, 0x42a9f8
call fcn.00404b10
mov eax, dword [ebp - 0x80c]
call fcn.00404cc4
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x42a9c6
push 0
lea eax, [ebp - 4]
push eax
push 0x804
lea eax, [ebp - 0x808]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x42a9ba
cmp dword [ebp - 4], 0x804
je 0x42a9be
xor ebx, ebx
jmp 0x42a9c0
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a9e6
lea eax, [ebp - 0x80c]
call fcn.004047e8
ret

Function at 0x42c868
Capabilities:
Query environment variable

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, eax
push 0x800
lea eax, [esp + 4]
push eax
mov eax, dword [ebx]
call fcn.00404cc4
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov edx, esp
mov ecx, ebx
xchg ecx, eax
call fcn.004048d8
add esp, 0x800
pop ebx
ret
Function at 0x42dae8
Capabilities:
Create process on windows
Create process suspended
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cb4
mov eax, dword [ebp - 8]
call fcn.00404cb4
mov eax, dword [ebp - 0xc]
call fcn.00404cb4
xor eax, eax
push ebp
push 0x42dd07
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
mov edx, 0x42dd20
mov eax, 0x80000000
call fcn.004230ec
lea eax, [ebp - 0x10]
call fcn.0042c868
lea eax, [ebp - 0x70]
push eax
xor ecx, ecx
mov edx, 0x42dd44
mov eax, dword [ebp - 0xc]
call fcn.00426b0c
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0xc]
call fcn.00404880
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.004031e4
lea eax, [ebp - 0x6c]
xor ecx, ecx
mov edx, 0x10
call fcn.004031e4
mov dword [ebp - 0x5c], 0x44
call fcn.0042d988
test al, al
jne 0x42dbb2
lea eax, [ebp - 0x18]
call fcn.004047e8
jmp 0x42dbc5
lea eax, [ebp - 0x18]
mov ecx, dword [0x48e9b8]
mov edx, 0x42dd50
call fcn.00404b10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x74]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x8c], eax
mov byte [ebp - 0x88], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x80], 0xb
lea eax, [ebp - 0x90]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.00404b10
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x7c], eax
mov byte [ebp - 0x78], 0xb
lea edx, [ebp - 0x8c]
mov ecx, 2
mov eax, 0x42dd60
call fcn.00409cd8
mov ecx, dword [ebp - 0x74]
mov edx, 0x42dd88
mov eax, dword [ebp - 0x10]
call fcn.00426b0c
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00404cc4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x42dcb2
push 0x2710
mov eax, dword [ebp - 0x6c]
push eax
call sub.user32.dll_WaitForInputIdle
push 0x7d0
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 0x64]
call fcn.00429f58
mov esi, eax
test esi, esi
je 0x42dc9e
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call sub.user32.dll_SetWindowPos
push 3
push esi
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x42dccf
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x94]
call fcn.0040c388
mov edx, dword [ebp - 0x94]
mov al, 4
call fcn.0042710c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42dd0e
lea eax, [ebp - 0x94]
mov edx, 2
call fcn.0040480c
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.0040480c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040480c
ret
Function at 0x42e0e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
mov eax, dword [0x48e92c]
test byte [eax + 0x25], 0x10
je 0x42e122
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404a58
jmp 0x42e129
mov eax, ebx
call fcn.004047e8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42e290
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], edx
mov esi, eax
xor eax, eax
push ebp
push 0x42e40a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x48e92c]
test byte [eax + 0x24], 4
je 0x42e3e8
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x18]
mov eax, dword [0x48d5cc]
mov eax, dword [eax]
call fcn.004273e8
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404cc4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jbe 0x42e3df
mov eax, ebx
call fcn.004027c4
mov edi, eax
push edi
push ebx
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404cc4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x42e3cd
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x42e418
push edi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x42e3c4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
call fcn.0040776c
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0xc]
mov ax, word [eax + 8]
mov word [ebp - 0x10], ax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
call fcn.0040776c
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0xc]
mov ax, word [eax + 0xc]
mov word [ebp - 0x14], ax
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0xe]
call fcn.00408d8c
push dword [ebp - 0x1c]
push 0x42e424
lea edx, [ebp - 0x20]
movzx eax, word [ebp - 0x10]
call fcn.00408d8c
push dword [ebp - 0x20]
push 0x42e424
lea edx, [ebp - 0x24]
movzx eax, word [ebp - 0x12]
call fcn.00408d8c
push dword [ebp - 0x24]
push 0x42e424
lea edx, [ebp - 0x28]
movzx eax, word [ebp - 0x14]
call fcn.00408d8c
push dword [ebp - 0x28]
mov eax, esi
mov edx, 7
call fcn.00404b84
jmp 0x42e3d4
mov eax, esi
call fcn.004047e8
jmp 0x42e3d4
mov eax, esi
call fcn.004047e8
mov edx, ebx
mov eax, edi
call fcn.004027e4
jmp 0x42e3ef
mov eax, esi
call fcn.004047e8
jmp 0x42e3ef
mov eax, esi
call fcn.004047e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e411
lea eax, [ebp - 0x28]
mov edx, 5
call fcn.0040480c
ret
Function at 0x42eaf8
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42eb80
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x48e92c]
test byte [eax + 0x25], 0x20
je 0x42eb63
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fdiv dword [0x42eb8c]
call fcn.00402cd8
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00408e78
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x42eb98
call fcn.00404b10
jmp 0x42eb6a
mov eax, ebx
call fcn.004047e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42eb87
lea eax, [ebp - 0x24]
call fcn.004047e8
ret

Function at 0x42eb9c
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42ec24
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x48e92c]
test byte [eax + 0x25], 0x40
je 0x42ec07
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fdiv dword [0x42ec30]
call fcn.00402cd8
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00408e78
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x42ec3c
call fcn.00404b10
jmp 0x42ec0e
mov eax, ebx
call fcn.004047e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ec2b
lea eax, [ebp - 0x24]
call fcn.004047e8
ret