joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e1b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40e21a
push dword fs:[eax]
mov dword fs:[eax], esp
push 7
lea eax, [ebp - 0xf]
push eax
push 0x1004
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xf]
mov ecx, 7
call fcn.004047dc
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408c68
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e221
lea eax, [ebp - 0x14]
call fcn.0040456c
ret

Function at 0x419c58
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindResourceA
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x419c8e
push ebp
call fcn.00419be8
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0
jne 0x419cb4
push ebp
call fcn.00419be8
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SizeofResource
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
push eax
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp - 8]
pop ecx
call fcn.0041981c
mov esp, ebp
pop ebp
ret 4

Function at 0x41dc28
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setge dl
mov eax, dword [ebp - 4]
call fcn.0041da30
cmp dword [ebp - 8], 1
jne 0x41dc5c
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 0
pop ecx
pop ecx
pop ebp
ret
Function at 0x41f520
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
cmp dword [0x490888], 0
jne 0x41f5cd
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
mov eax, dword [0x490884]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, 0x48e470
mov ecx, 2
call fcn.00402914
mov edx, 0x41f4dc
mov eax, dword [ebp - 8]
add eax, 5
call fcn.0041f4fc
mov edx, dword [ebp - 8]
mov dword [edx + 6], eax
mov eax, dword [ebp - 8]
add eax, 0xa
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe8
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, dword [ebp - 0xc]
call fcn.0041f4fc
mov edx, dword [ebp - 0xc]
mov dword [edx + 1], eax
mov eax, dword [0x490888]
mov edx, dword [ebp - 0xc]
mov dword [edx + 5], eax
mov eax, dword [ebp - 0xc]
mov dword [0x490888], eax
add dword [ebp - 0xc], 0xd
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cmp eax, 0xffc
jl 0x41f587
mov eax, dword [ebp - 8]
mov dword [0x490884], eax
mov eax, dword [0x490888]
mov dword [ebp - 4], eax
mov eax, dword [0x490888]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 5]
mov dword [0x490888], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 9], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x420c18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404a38
mov eax, dword [ebp - 8]
call fcn.00404a38
xor eax, eax
push ebp
push 0x420d15
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x420c69
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x420c69
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00404ae8
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00404a48
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x420cfa
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404a48
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x420cea
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00404bd4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.00404a48
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
push ebx
mov eax, dword [ebx]
call fcn.00404848
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.00404aa8
jmp 0x420cf1
mov eax, ebx
call fcn.0040456c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420d1c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404590
ret
Function at 0x42127c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x34], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x421425
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x2c], 0
lea edx, [ebp - 0x30]
xor ecx, ecx
mov eax, 0x421440
call fcn.004207a4
mov byte [ebp - 1], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x420580]
call fcn.00421130
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4213ed
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp word [ebp - 4], 0x5a4d
jne 0x4213d7
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.004190c0
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp dword [ebp - 8], 0
je 0x4213d7
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.004190c0
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp dword [ebp - 0xc], 0x4550
jne 0x4213d7
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
test byte [ebp - 0x15], 0x20
je 0x4213d3
push 2
push 0
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.00421178
mov eax, dword [ebp - 0x34]
call fcn.00404a48
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4213cc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x421450
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x4213b1
push 0xa
push 0x42145c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x4213b1
mov byte [ebp - 1], 2
jmp 0x4213b5
mov byte [ebp - 1], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4213d7
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4213f4
mov eax, dword [ebp - 0x10]
call fcn.00403778
ret

Function at 0x4216c4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
push esp
push 0x40
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, ebx
mov eax, edi
mov ecx, esi
call fcn.00402914
push esp
mov eax, dword [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x421710
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7fc
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a38
xor eax, eax
push ebp
push 0x4217bf
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x421794
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404a48
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00404a48
push eax
mov eax, esi
call fcn.00404a48
push eax
mov eax, ebx
call fcn.00404a48
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x804]
mov eax, dword [ebp + 8]
call fcn.0040465c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4217a9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4217c6
lea eax, [ebp - 4]
call fcn.0040456c
ret

Function at 0x421f64
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov edx, esp
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
xor edx, edx
mov dl, byte [esp]
mov eax, ebx
call fcn.00402b40
xor ecx, ecx
mov cl, byte [esp]
lea edx, [ebx + 1]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0xc]
xor edx, edx
mov dl, byte [ebx]
test edx, edx
jle 0x421fa7
lea eax, [ebx + 1]
xor byte [eax], 0x62
inc eax
dec edx
jne 0x421fa0
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4256c4
Capabilities:
Query environment variable

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, eax
push 0x800
lea eax, [esp + 4]
push eax
mov eax, dword [ebx]
call fcn.00404a48
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov edx, esp
mov ecx, ebx
xchg ecx, eax
call fcn.0040465c
add esp, 0x800
pop ebx
ret
Function at 0x426538
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
mov eax, dword [0x4908f4]
test byte [eax + 0xd], 0x10
je 0x42657a
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.004047dc
jmp 0x426581
mov eax, ebx
call fcn.0040456c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4265e8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x426680
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4908f4]
test byte [eax + 0xd], 2
je 0x426660
mov esi, pe_nt_image_headers32
push esi
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x426657
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.004047dc
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.0042647c
jmp 0x426667
mov eax, ebx
call fcn.0040456c
jmp 0x426667
mov eax, ebx
call fcn.0040456c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426687
lea eax, [ebp - 0x104]
call fcn.0040456c
ret

Function at 0x4266f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x426788
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4908f4]
test byte [eax + 0xd], 8
je 0x426768
mov esi, pe_nt_image_headers32
push esi
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x42675f
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.004047dc
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.0042647c
jmp 0x42676f
mov eax, ebx
call fcn.0040456c
jmp 0x42676f
mov eax, ebx
call fcn.0040456c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42678f
lea eax, [ebp - 0x104]
call fcn.0040456c
ret
Function at 0x426798
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], edx
mov esi, eax
xor eax, eax
push ebp
push 0x426912
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4908f4]
test byte [eax + 0xc], 4
je 0x4268f0
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x18]
mov eax, dword [0x48f8bc]
mov eax, dword [eax]
call fcn.00421178
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404a48
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jbe 0x4268e7
mov eax, ebx
call fcn.0040270c
mov edi, eax
push edi
push ebx
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404a48
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4268d5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x426920
push edi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4268cc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
call fcn.004070b8
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0xc]
mov ax, word [eax + 8]
mov word [ebp - 0x10], ax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
call fcn.004070b8
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0xc]
mov ax, word [eax + 0xc]
mov word [ebp - 0x14], ax
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0xe]
call fcn.00408abc
push dword [ebp - 0x1c]
push 0x42692c
lea edx, [ebp - 0x20]
movzx eax, word [ebp - 0x10]
call fcn.00408abc
push dword [ebp - 0x20]
push 0x42692c
lea edx, [ebp - 0x24]
movzx eax, word [ebp - 0x12]
call fcn.00408abc
push dword [ebp - 0x24]
push 0x42692c
lea edx, [ebp - 0x28]
movzx eax, word [ebp - 0x14]
call fcn.00408abc
push dword [ebp - 0x28]
mov eax, esi
mov edx, 7
call fcn.00404908
jmp 0x4268dc
mov eax, esi
call fcn.0040456c
jmp 0x4268dc
mov eax, esi
call fcn.0040456c
mov edx, ebx
mov eax, edi
call fcn.0040272c
jmp 0x4268f7
mov eax, esi
call fcn.0040456c
jmp 0x4268f7
mov eax, esi
call fcn.0040456c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426919
lea eax, [ebp - 0x28]
mov edx, 5
call fcn.00404590
ret

Function at 0x426f1c
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x426fa4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4908f4]
test byte [eax + 0xd], 0x20
je 0x426f87
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fdiv dword [0x426fb0]
call fcn.00402b5c
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00408ba8
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x426fbc
call fcn.00404894
jmp 0x426f8e
mov eax, ebx
call fcn.0040456c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426fab
lea eax, [ebp - 0x24]
call fcn.0040456c
ret
Function at 0x426fc0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x427048
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4908f4]
test byte [eax + 0xd], 0x40
je 0x42702b
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fdiv dword [0x427054]
call fcn.00402b5c
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00408ba8
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x427060
call fcn.00404894
jmp 0x427032
mov eax, ebx
call fcn.0040456c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42704f
lea eax, [ebp - 0x24]
call fcn.0040456c
ret

Function at 0x4272e4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42742b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov eax, dword [0x48f8bc]
mov eax, dword [eax]
call fcn.00421178
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404a48
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jbe 0x427408
mov eax, ebx
call fcn.0040270c
mov esi, eax
push esi
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4273f5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x42743c
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4273eb
push 0x427460
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
mov edx, 4
call fcn.00408bd0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.00408bd0
push dword [ebp - 0x20]
push 0x42747c
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404908
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404a48
push eax
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4273fd
cmp dword [ebp - 0xc], 1
jbe 0x4273fd
mov ecx, dword [ebp - 0xc]
dec ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.0040465c
jmp 0x4273fd
mov eax, dword [ebp - 4]
call fcn.0040456c
jmp 0x4273fd
mov eax, dword [ebp - 4]
call fcn.0040456c
mov edx, ebx
mov eax, esi
call fcn.0040272c
jmp 0x427410
mov eax, dword [ebp - 4]
call fcn.0040456c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427432
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404590
ret
Function at 0x42a4fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404a38
xor eax, eax
push ebp
push 0x42a5db
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x42a5f4
call fcn.00404b8c
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404848
dec eax
cmp ebx, eax
jne 0x42a55a
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.00404848
mov ecx, eax
sub ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404aa8
mov eax, dword [ebp - 4]
call fcn.00404848
mov ebx, eax
test ebx, ebx
jle 0x42a591
mov dword [ebp - 8], 1
lea eax, [ebp - 4]
call fcn.00404aa0
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov cl, byte [ecx + edi - 1]
xor cl, 0x62
mov byte [eax + edx - 1], cl
inc dword [ebp - 8]
dec ebx
jne 0x42a56f
mov eax, dword [ebp - 4]
call fcn.00404848
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
mov ecx, 4
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [ebp - 8], 0
jle 0x42a5c5
lea eax, [ebp - 4]
call fcn.00404aa0
mov edx, eax
mov ecx, dword [ebp - 8]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a5e2
lea eax, [ebp - 4]
call fcn.0040456c
ret

Function at 0x42a834
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
lea edx, [ebp - 4]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404bd4
cmp dword [ebp - 4], 0
jle 0x42a871
mov eax, ebx
call fcn.00404aa0
mov edx, eax
mov ecx, dword [ebp - 4]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx]
call fcn.00404848
mov esi, eax
test esi, esi
jle 0x42a8a5
mov dword [ebp - 4], 1
mov eax, ebx
call fcn.00404aa0
mov edx, dword [ebp - 4]
mov ecx, dword [ebx]
mov edi, dword [ebp - 4]
mov cl, byte [ecx + edi - 1]
xor cl, 0x62
mov byte [eax + edx - 1], cl
inc dword [ebp - 4]
dec esi
jne 0x42a885
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x42b028
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
lea edi, [ebp - 8]
call fcn.00421588
mov edx, dword [eax]
mov dword [edi], edx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ebx, dword [edi]
dec ebx
jmp 0x42b049
dec ebx
test ebx, ebx
jl 0x42b056
mov eax, dword [edi + 4]
cmp dword [eax + ebx*8], 0
je 0x42b048
mov esi, dword [edi + 4]
mov eax, dword [esi + ebx*8]
test eax, eax
je 0x42b083
mov dword [0x490918], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
lea eax, [esi + ebx*8]
call fcn.0042af60
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, 0x42b008
mov dword [esi + ebx*8], eax
mov ebx, dword [edi]
dec ebx
jmp 0x42b089
dec ebx
test ebx, ebx
jl 0x42b097
mov eax, dword [edi + 4]
cmp dword [eax + ebx*8 + 4], 0
je 0x42b088
mov esi, dword [edi + 4]
mov eax, dword [esi + ebx*8 + 4]
test eax, eax
je 0x42b0c7
mov dword [0x49091c], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
lea eax, [esi + ebx*8 + 4]
call fcn.0042af60
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, 0x42b018
mov dword [esi + ebx*8 + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42cb54
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42cb5a
ret

Function at 0x42f7d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x42f821
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x42f808
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x42f7f8
jmp 0x42f821
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x42f809
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439bd0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404a38
xor eax, eax
push ebp
push 0x439d03
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x439cd6
xor eax, eax
push ebp
push 0x439ccf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404848
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x439ca4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x439c93
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404848
inc eax
push eax
mov eax, dword [ebp - 8]
call fcn.00404a48
mov edx, dword [ebp - 0x10]
pop ecx
call fcn.00402914
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 0xc]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439c9a
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x48f764]
mov dl, 1
mov eax, dword [0x4077a0]
call fcn.0040d020
call fcn.00403f04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439d0a
lea eax, [ebp - 8]
call fcn.0040456c
ret