joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406068
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4060ce
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040470c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403024
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4060b8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4060d5
lea eax, [ebp - 0x10]
call fcn.0040449c
ret

Function at 0x40b794
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b7cd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040458c
jmp 0x40b7d6
mov eax, ebx
mov edx, esi
call fcn.004044f0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b7e0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b801
mov al, byte [esp]
jmp 0x40b803
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40be88
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bd00
mov eax, dword [0x46228c]
cmp byte [eax], 0
je 0x40bf04
mov eax, dword [0x462098]
call fcn.00402e78
call fcn.00402870
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408be8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bf4c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bf3a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x462044]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x463664]
call fcn.0040557c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c7a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c876
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404534
lea eax, [ebp - 8]
call fcn.004049c8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404978
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c860
mov eax, ebx
call fcn.004026fc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c859
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404978
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c843
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c888
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c843
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c860
mov eax, dword [ebp - 0x10]
call fcn.0040271c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c87d
lea eax, [ebp - 8]
call fcn.0040449c
ret

Function at 0x40ccf4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40cd58
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040470c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040855c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cd5f
lea eax, [ebp - 0xc]
call fcn.0040449c
ret

Function at 0x41af94
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x463884
cmp dword [edi], 0
jne 0x41b010
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x463880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4613f0
mov ecx, 2
call fcn.00402904
mov edx, 0x41af6c
lea eax, [esi + 5]
call fcn.0041af8c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041af8c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41afe5
mov dword [0x463880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41c5ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404968
mov eax, dword [ebp - 8]
call fcn.00404968
xor eax, eax
push ebp
push 0x41c6a9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x41c5fd
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x41c5fd
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00404a18
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00404978
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x41c68e
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404978
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x41c67e
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00404b04
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.00404978
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
push ebx
mov eax, dword [ebx]
call fcn.00404778
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.004049d8
jmp 0x41c685
mov eax, ebx
call fcn.0040449c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c6b0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044c0
ret
Function at 0x41cb7c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x34], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41cd25
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x2c], 0
lea edx, [ebp - 0x30]
xor ecx, ecx
mov eax, 0x41cd40
call fcn.0041c1a8
mov byte [ebp - 1], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x41bf84]
call fcn.0041ca30
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x41cced
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp word [ebp - 4], 0x5a4d
jne 0x41ccd7
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.004161c4
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp dword [ebp - 8], 0
je 0x41ccd7
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.004161c4
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp dword [ebp - 0xc], 0x4550
jne 0x41ccd7
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
test byte [ebp - 0x15], 0x20
je 0x41ccd3
push 2
push 0
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.0041ca78
mov eax, dword [ebp - 0x34]
call fcn.00404978
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x41cccc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x41cd50
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x41ccb1
push 0xa
push 0x41cd5c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x41ccb1
mov byte [ebp - 1], 2
jmp 0x41ccb5
mov byte [ebp - 1], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ccd7
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ccf4
mov eax, dword [ebp - 0x10]
call fcn.00403744
ret

Function at 0x41ce1c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
push esp
push 0x40
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, ebx
mov eax, edi
mov ecx, esi
call fcn.00402904
push esp
mov eax, dword [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41cfbc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7fc
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404968
xor eax, eax
push ebp
push 0x41d06b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x41d040
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404978
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00404978
push eax
mov eax, esi
call fcn.00404978
push eax
mov eax, ebx
call fcn.00404978
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x804]
mov eax, dword [ebp + 8]
call fcn.0040458c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41d055
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d072
lea eax, [ebp - 4]
call fcn.0040449c
ret

Function at 0x41d8e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov edx, esp
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
xor edx, edx
mov dl, byte [esp]
mov eax, ebx
call fcn.00402b30
xor ecx, ecx
mov cl, byte [esp]
lea edx, [ebx + 1]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0xc]
xor edx, edx
mov dl, byte [ebx]
test edx, edx
jle 0x41d927
lea eax, [ebx + 1]
xor byte [eax], 0x62
inc eax
dec edx
jne 0x41d920
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x421660
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
mov ebx, eax
push 0x800
lea eax, [ebp - 0x800]
push eax
mov eax, dword [ebx]
call fcn.00404978
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
lea edx, [ebp - 0x800]
mov ecx, ebx
xchg ecx, eax
call fcn.0040458c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4223e8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
mov eax, dword [0x4638f0]
test byte [eax + 0xd], 0x10
je 0x42242a
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.0040470c
jmp 0x422431
mov eax, ebx
call fcn.0040449c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422498
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x422530
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4638f0]
test byte [eax + 0xd], 2
je 0x422510
mov esi, pe_nt_image_headers32
push esi
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x422507
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.0040470c
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.0042232c
jmp 0x422517
mov eax, ebx
call fcn.0040449c
jmp 0x422517
mov eax, ebx
call fcn.0040449c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422537
lea eax, [ebp - 0x104]
call fcn.0040449c
ret

Function at 0x4225a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x422638
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4638f0]
test byte [eax + 0xd], 8
je 0x422618
mov esi, pe_nt_image_headers32
push esi
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x42260f
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.0040470c
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.0042232c
jmp 0x42261f
mov eax, ebx
call fcn.0040449c
jmp 0x42261f
mov eax, ebx
call fcn.0040449c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42263f
lea eax, [ebp - 0x104]
call fcn.0040449c
ret
Function at 0x422648
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4227c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4638f0]
test byte [eax + 0xc], 4
je 0x4227a0
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x18]
mov eax, dword [0x4620c0]
mov eax, dword [eax]
call fcn.0041ca78
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404978
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jbe 0x422797
mov eax, ebx
call fcn.004026fc
mov edi, eax
push edi
push ebx
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404978
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x422785
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4227d0
push edi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x42277c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
call fcn.00406e7c
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0xc]
mov ax, word [eax + 8]
mov word [ebp - 0x10], ax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
call fcn.00406e7c
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0xc]
mov ax, word [eax + 0xc]
mov word [ebp - 0x14], ax
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0xe]
call fcn.004083b4
push dword [ebp - 0x1c]
push 0x4227dc
lea edx, [ebp - 0x20]
movzx eax, word [ebp - 0x10]
call fcn.004083b4
push dword [ebp - 0x20]
push 0x4227dc
lea edx, [ebp - 0x24]
movzx eax, word [ebp - 0x12]
call fcn.004083b4
push dword [ebp - 0x24]
push 0x4227dc
lea edx, [ebp - 0x28]
movzx eax, word [ebp - 0x14]
call fcn.004083b4
push dword [ebp - 0x28]
mov eax, esi
mov edx, 7
call fcn.00404838
jmp 0x42278c
mov eax, esi
call fcn.0040449c
jmp 0x42278c
mov eax, esi
call fcn.0040449c
mov edx, ebx
mov eax, edi
call fcn.0040271c
jmp 0x4227a7
mov eax, esi
call fcn.0040449c
jmp 0x4227a7
mov eax, esi
call fcn.0040449c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4227c9
lea eax, [ebp - 0x28]
mov edx, 5
call fcn.004044c0
ret

Function at 0x422dcc
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x422e54
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4638f0]
test byte [eax + 0xd], 0x20
je 0x422e37
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fdiv dword [0x422e60]
call fcn.00402b4c
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.004084a0
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x422e6c
call fcn.004047c4
jmp 0x422e3e
mov eax, ebx
call fcn.0040449c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422e5b
lea eax, [ebp - 0x24]
call fcn.0040449c
ret
Function at 0x422e70
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x422ef8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4638f0]
test byte [eax + 0xd], 0x40
je 0x422edb
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fdiv dword [0x422f04]
call fcn.00402b4c
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.004084a0
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x422f10
call fcn.004047c4
jmp 0x422ee2
mov eax, ebx
call fcn.0040449c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422eff
lea eax, [ebp - 0x24]
call fcn.0040449c
ret

Function at 0x423194
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4232db
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov eax, dword [0x4620c0]
mov eax, dword [eax]
call fcn.0041ca78
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404978
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jbe 0x4232b8
mov eax, ebx
call fcn.004026fc
mov esi, eax
push esi
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4232a5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4232ec
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x42329b
push 0x423310
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
mov edx, 4
call fcn.004084c8
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.004084c8
push dword [ebp - 0x20]
push 0x42332c
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404838
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404978
push eax
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4232ad
cmp dword [ebp - 0xc], 1
jbe 0x4232ad
mov ecx, dword [ebp - 0xc]
dec ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.0040458c
jmp 0x4232ad
mov eax, dword [ebp - 4]
call fcn.0040449c
jmp 0x4232ad
mov eax, dword [ebp - 4]
call fcn.0040449c
mov edx, ebx
mov eax, esi
call fcn.0040271c
jmp 0x4232c0
mov eax, dword [ebp - 4]
call fcn.0040449c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4232e2
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004044c0
ret
Function at 0x4263f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404968
xor eax, eax
push ebp
push 0x4264cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x4264e8
call fcn.00404abc
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404778
dec eax
cmp ebx, eax
jne 0x42644e
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.00404778
mov ecx, eax
sub ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004049d8
mov eax, dword [ebp - 4]
call fcn.00404778
mov ebx, eax
test ebx, ebx
jle 0x426485
mov dword [ebp - 8], 1
lea eax, [ebp - 4]
call fcn.004049d0
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov cl, byte [ecx + edi - 1]
xor cl, 0x62
mov byte [eax + edx - 1], cl
inc dword [ebp - 8]
dec ebx
jne 0x426463
mov eax, dword [ebp - 4]
call fcn.00404778
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
mov ecx, 4
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [ebp - 8], 0
jle 0x4264b9
lea eax, [ebp - 4]
call fcn.004049d0
mov edx, eax
mov ecx, dword [ebp - 8]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4264d6
lea eax, [ebp - 4]
call fcn.0040449c
ret

Function at 0x426728
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
lea edx, [ebp - 4]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404b04
cmp dword [ebp - 4], 0
jle 0x426765
mov eax, ebx
call fcn.004049d0
mov edx, eax
mov ecx, dword [ebp - 4]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx]
call fcn.00404778
mov esi, eax
test esi, esi
jle 0x426799
mov dword [ebp - 4], 1
mov eax, ebx
call fcn.004049d0
mov edx, dword [ebp - 4]
mov ecx, dword [ebx]
mov edi, dword [ebp - 4]
mov cl, byte [ecx + edi - 1]
xor cl, 0x62
mov byte [eax + edx - 1], cl
inc dword [ebp - 4]
dec esi
jne 0x426779
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x42853c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x428542
ret

Function at 0x42aa78
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x42aac9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x42aab0
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x42aaa0
jmp 0x42aac9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x42aab1
pop ebx
mov esp, ebp
pop ebp
ret