joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e8f4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41e9f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004085e4
lea eax, [ebp - 4]
call fcn.0040878c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00408f0c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x41e9e0
mov eax, ebx
call fcn.00404594
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x41e9d9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00408f0c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x41e9c1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x41ea0c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x41e9c1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e9e0
mov eax, dword [ebp - 0x10]
call fcn.004045b0
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e9ff
lea eax, [ebp - 4]
call fcn.004081c8
pop eax
jmp eax

Function at 0x41f8e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004086cc
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040e0d0
mov edi, eax
cmp edi, 0x104
jbe 0x41f88b
mov eax, edi
add eax, eax
call fcn.00404594
mov esi, eax
jmp 0x41f88d
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040e0d0
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x41f8c6
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x41f8b0
mov eax, esp
cmp esi, eax
je 0x41f8d3
mov eax, esi
call fcn.004045b0
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x41f90c
cmp bl, 0
je 0x41f908
cmp bl, 0x41
jl 0x41f903
cmp bl, 0x5a
jg 0x41f903
or bl, 0x20
xor al, bl
inc esi
jmp 0x41f8e7
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x41f84c

Function at 0x41fc74
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00408f9c
add esp, 0x800
pop ebx
ret
Function at 0x421324
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffdfc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x421355
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00408c64
jmp 0x421361
mov eax, ebx
mov edx, 0x421370
call fcn.00408610
add esp, 0x204
pop ebx
ret

Function at 0x422114
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4221c4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.00408c64
lea edx, [ebp - 0x20c]
mov eax, dword [ebx]
call fcn.004187d4
mov edx, dword [ebp - 0x20c]
mov eax, ebx
call fcn.00408610
mov edx, dword [ebx]
mov eax, edx
test eax, eax
je 0x422182
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
je 0x4221a9
mov eax, edx
test eax, eax
je 0x422193
sub eax, 4
mov eax, dword [eax]
shr eax, 1
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4221a9
mov eax, ebx
mov edx, 0x4221d4
call fcn.00408cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4221cb
lea eax, [ebp - 0x20c]
call fcn.00408210
pop eax
jmp eax

Function at 0x4222b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x422360
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, ebx
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.00408c64
lea edx, [ebp - 0x20c]
mov eax, dword [ebx]
call fcn.004187d4
mov edx, dword [ebp - 0x20c]
mov eax, ebx
call fcn.00408610
mov edx, dword [ebx]
mov eax, edx
test eax, eax
je 0x42231e
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
je 0x422345
mov eax, edx
test eax, eax
je 0x42232f
sub eax, 4
mov eax, dword [eax]
shr eax, 1
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x422345
mov eax, ebx
mov edx, 0x422370
call fcn.00408cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422367
lea eax, [ebp - 0x20c]
call fcn.00408210
pop eax
jmp eax

Function at 0x4232cc
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.0040506c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x423510
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x11
call fcn.00408c64
add esp, 0x28
pop ebx
ret
Function at 0x4237d8
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp], eax
lea esi, [esp + 8]
lea ebp, [esp + 0x18]
mov eax, dword [esp]
mov byte [eax], 0
mov edi, 0x3e8
mov byte [ebp], 0
mov ebx, 8
shl byte [ebp], 1
push esi
call sub.kernel32.dll_QueryPerformanceCounter
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
mov eax, dword [esi]
mov edx, dword [esi + 4]
sub eax, dword [esp + 0x10]
sbb edx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], edx
push 0
push 2
mov eax, dword [esi]
mov edx, dword [esi + 4]
call fcn.0040aaa4
cmp edx, 0
jne 0x42384a
cmp eax, 0
jne 0x42384a
mov dword [esi], 0
mov dword [esi + 4], 0
jmp 0x423857
mov dword [esi], 1
mov dword [esi + 4], 0
movzx eax, byte [esi]
add byte [ebp], al
dec ebx
jne 0x4237fe
mov eax, dword [esp]
movzx edx, byte [ebp]
xor byte [eax], dl
dec edi
jne 0x4237f5
mov edi, 8
push esi
call sub.kernel32.dll_QueryPerformanceCounter
push 1
call sub.kernel32.dll_Sleep
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, dword [esi]
sbb edx, dword [esi + 4]
mov dword [esi], eax
mov dword [esi + 4], edx
movzx eax, byte [esi]
mov byte [ebp], al
mov eax, dword [esp]
movzx edx, byte [ebp]
xor byte [eax], dl
dec edi
jne 0x423871
mov dword [esi], 0
mov dword [esi + 4], 0
mov edx, ebp
mov eax, esi
mov ecx, 1
call fcn.00404738
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4250d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, cl
dec ebx
test ebx, ebx
jb 0x425122
inc ebx
xor eax, eax
mov ecx, eax
add ecx, ecx
add ecx, ecx
movzx esi, byte [edx + ecx]
mov esi, dword [esi*4 + 0x443780]
movzx edi, byte [edx + ecx + 1]
xor esi, dword [edi*4 + 0x443b80]
movzx edi, byte [edx + ecx + 2]
xor esi, dword [edi*4 + 0x443f80]
movzx edi, byte [edx + ecx + 3]
xor esi, dword [edi*4 + 0x444380]
mov dword [edx + ecx], esi
inc eax
dec ebx
jne 0x4250e6
pop edi
pop esi
pop ebx
ret
Function at 0x4254d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4254e2
sub ecx, 4
mov ecx, dword [ecx]
mov edi, dword [edx]
mov esi, edi
test esi, esi
je 0x4254ef
sub esi, 4
mov esi, dword [esi]
cmp ecx, esi
jle 0x4254fe
mov ecx, edi
test ecx, ecx
je 0x4254fe
sub ecx, 4
mov ecx, dword [ecx]
mov esi, ecx
dec esi
test esi, esi
jl 0x425517
inc esi
xor ecx, ecx
mov ebx, dword [edx]
movzx ebx, byte [ebx + ecx]
mov edi, dword [eax]
xor byte [edi + ecx], bl
inc ecx
dec esi
jne 0x425508
pop edi
pop esi
pop ebx
ret

Function at 0x42655c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
call sub.kernel32.dll_FindResourceW
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
je 0x4265b3
push edi
push esi
call sub.kernel32.dll_LoadResource
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0xc], 0
je 0x4265b3
mov eax, dword [ebx + 8]
push eax
push esi
call sub.kernel32.dll_SizeofResource
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, ebx
pop ecx
call fcn.00426554
mov byte [ebx + 4], 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x426c3c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004082dc
xor eax, eax
push ebp
push 0x426d0f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov edi, eax
cmp edi, 0xffffffff
je 0x426cf7
lea eax, [ebp - 0x10]
push eax
push edi
call sub.kernel32.dll_GetFileSizeEx
test eax, eax
jne 0x426c9f
push edi
call sub.kernel32.dll_CloseHandle
jmp 0x426cf7
mov eax, esi
mov edx, dword [0x420cf8]
call fcn.0040b244
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
mov ecx, 1
mov edx, dword [0x420cf8]
call fcn.0040b120
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0
push edi
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
je 0x426cef
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [esi]
push eax
push edi
call sub.kernel32.dll_ReadFile
push edi
call sub.kernel32.dll_CloseHandle
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426d16
lea eax, [ebp - 4]
call fcn.00408210
pop eax
jmp eax

Function at 0x427654
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, eax
jmp 0x427672
mov eax, dword [0x44488c]
mov edx, 0x427698
call fcn.00406074
call fcn.00406178
call fcn.004046e8
push 0
push ebx
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x427659
pop ebx
ret
Function at 0x4285e8
Capabilities:
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4285f0
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x428758
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4448c4]
mov edx, dword [edx + 0x90]
lea eax, [ebp - 8]
mov ecx, 0x42876c
call fcn.00408d28
mov eax, dword [ebp - 8]
call fcn.00421730
test al, al
je 0x428726
lea eax, [ebp - 4]
push eax
push 0x428794
push 0x80000001
call sub.advapi32.dll_RegOpenKeyW
mov eax, dword [0x4448c4]
mov eax, dword [eax + 0x44]
mov ebx, eax
test ebx, ebx
je 0x428657
sub ebx, 4
mov ebx, dword [ebx]
lea ecx, [ebp - 0x20]
mov eax, dword [0x4448c4]
mov eax, dword [eax + 0x44]
mov edx, ebx
call fcn.00423484
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x10]
call fcn.004233f8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00408c80
mov eax, dword [ebp - 0xc]
call fcn.00408ca0
mov esi, eax
mov edx, dword [0x4448c4]
mov edx, dword [edx + 0x90]
lea eax, [ebp - 0x24]
mov ecx, 0x42876c
call fcn.00408d28
mov eax, dword [ebp - 0x24]
mov ebx, eax
test ebx, ebx
je 0x4286b4
sub ebx, 4
mov eax, dword [ebx]
shr eax, 1
mov ebx, eax
mov eax, ebx
add eax, eax
push eax
mov edx, dword [0x4448c4]
mov edx, dword [edx + 0x90]
lea eax, [ebp - 0x28]
mov ecx, 0x42876c
call fcn.00408d28
mov eax, dword [ebp - 0x28]
call fcn.00408ca0
push eax
push 1
push 0
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
push 5
push 0
push 0
mov edx, dword [0x4448c4]
mov edx, dword [edx + 0x90]
lea eax, [ebp - 0x2c]
mov ecx, 0x42876c
call fcn.00408d28
mov eax, dword [ebp - 0x2c]
call fcn.00408ca0
push eax
push 0x4287f0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42875f
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00408298
lea eax, [ebp - 0x10]
call fcn.004081ec
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00408298
pop eax
jmp eax
Function at 0x4287fc
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov esi, dword [0x4448c4]
lea edi, [ebp - 4]
xor eax, eax
push ebp
push 0x428a11
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 0x50]
mov edx, dword [0x420cf8]
call fcn.0040b244
cmp byte [esi + 0xa4], 0
je 0x428870
push 0x428a24
push dword [esi + 0x90]
push 0x428a58
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00408da4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.00408fd8
mov eax, dword [ebp - 0x14]
mov dl, 1
call fcn.00427c54
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov edx, dword [esi + 0x90]
lea eax, [ebp - 0x1c]
mov ecx, 0x428a58
call fcn.00408d28
mov eax, dword [ebp - 0x1c]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4288cf
cmp byte [esi + 0xa4], 0
je 0x4289ec
mov dl, 1
mov eax, 0x428a8c
call fcn.00427c54
xor eax, eax
call fcn.00427e54
jmp 0x4289ec
cmp byte [esi + 0xa4], 0
je 0x4288e4
mov dl, 1
mov eax, 0x428ad4
call fcn.00427c54
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_GetFileSizeEx
test al, al
jne 0x428919
cmp byte [esi + 0xa4], 0
je 0x42890e
mov dl, 1
mov eax, 0x428b10
call fcn.00427c54
xor eax, eax
call fcn.00427e54
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x4289ec
mov eax, dword [ebp - 0x10]
push eax
lea eax, [esi + 0x50]
mov ecx, 1
mov edx, dword [0x420cf8]
call fcn.0040b120
add esp, 4
xor eax, eax
mov dword [edi], eax
jmp 0x4289c6
xor eax, eax
mov dword [edi], eax
push 0
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x428970
cmp byte [esi + 0xa4], 0
je 0x4289c6
mov dl, 1
mov eax, 0x428b60
call fcn.00427c54
xor eax, eax
call fcn.00427e54
jmp 0x4289c6
push 0
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [esi + 0x50]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x4289a3
cmp byte [esi + 0xa4], 0
je 0x4289c6
mov dl, 1
mov eax, 0x428bcc
call fcn.00427c54
xor eax, eax
call fcn.00427e54
jmp 0x4289c6
mov eax, dword [ebp - 0x10]
cmp eax, dword [edi]
je 0x4289c6
cmp byte [esi + 0xa4], 0
je 0x4289c6
mov dl, 1
mov eax, 0x428c28
call fcn.00427c54
xor eax, eax
call fcn.00427e54
mov eax, dword [ebp - 0x10]
cmp eax, dword [edi]
jne 0x42893c
push ebx
call sub.kernel32.dll_CloseHandle
cmp byte [esi + 0xa4], 0
je 0x4289ec
mov dl, 1
mov eax, 0x428c94
call fcn.00427c54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428a18
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00408298
lea eax, [ebp - 0x14]
call fcn.004081c8
pop eax
jmp eax
Function at 0x42913c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004082dc
xor eax, eax
push ebp
push 0x429367
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4448c4]
cmp byte [eax + 0xa4], 0
je 0x4291ae
push 0x42937c
mov eax, dword [0x4448c4]
push dword [eax + 0x90]
push 0x4293c4
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00408da4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.00408fd8
mov eax, dword [ebp - 0x1c]
mov dl, 1
call fcn.00427c54
push 0
push 0x80
push 1
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x24]
mov ecx, 0x4293c4
mov edx, dword [ebp - 4]
call fcn.00408d28
mov eax, dword [ebp - 0x24]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x429211
mov eax, dword [0x4448c4]
cmp byte [eax + 0xa4], 0
je 0x42933a
mov dl, 1
mov eax, 0x4293f8
call fcn.00427c54
xor eax, eax
call fcn.00427e54
jmp 0x42933a
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4292f5
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x42925f
mov eax, dword [0x4448c4]
cmp byte [eax + 0xa4], 0
je 0x4292f5
mov dl, 1
mov eax, 0x429454
call fcn.00427c54
xor eax, eax
call fcn.00427e54
jmp 0x4292f5
mov eax, dword [0x4448c4]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x429276
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [0x4448c4]
mov eax, dword [eax + 0x50]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x4292b6
mov eax, dword [0x4448c4]
cmp byte [eax + 0xa4], 0
je 0x4292f5
mov dl, 1
mov eax, 0x4294c0
call fcn.00427c54
xor eax, eax
call fcn.00427e54
jmp 0x4292f5
mov eax, dword [0x4448c4]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x18], eax
mov edi, dword [ebp - 0x18]
test edi, edi
je 0x4292cd
sub edi, 4
mov edi, dword [edi]
mov eax, dword [ebp - 0xc]
cmp eax, edi
je 0x4292f5
mov eax, dword [0x4448c4]
cmp byte [eax + 0xa4], 0
je 0x4292f5
mov dl, 1
mov eax, 0x429518
call fcn.00427c54
xor eax, eax
call fcn.00427e54
mov eax, dword [0x4448c4]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x42930c
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jne 0x42921b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4448c4]
cmp byte [eax + 0xa4], 0
je 0x42933a
mov dl, 1
mov eax, 0x429584
call fcn.00427c54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42936e
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00408298
lea eax, [ebp - 0x1c]
call fcn.004081c8
lea eax, [ebp - 4]
call fcn.00408210
pop eax
jmp eax
Function at 0x42ccbc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
xor edx, edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x148], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42cf60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x42cf78
call fcn.00408640
lea eax, [ebp - 0x140]
push eax
call sub.kernel32.dll_GetSystemInfo
mov dword [ebp - 0x11c], 0x11c
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_GetVersionExW
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x42cf17
mov eax, dword [ebp - 0x118]
sub eax, 5
je 0x42cd40
dec eax
je 0x42cddf
sub eax, 4
je 0x42ce8b
jmp 0x42ced9
mov eax, dword [ebp - 0x114]
sub eax, 1
jb 0x42cd52
je 0x42cd63
dec eax
je 0x42cd74
jmp 0x42cd91
mov eax, ebx
mov edx, 0x42cf8c
call fcn.00408640
jmp 0x42ced9
mov eax, ebx
mov edx, 0x42cfa8
call fcn.00408640
jmp 0x42ced9
cmp word [ebp - 4], 0x8000
jne 0x42ced9
mov eax, ebx
mov edx, 0x42cfc0
call fcn.00408640
jmp 0x42ced9
cmp byte [ebp - 2], 1
jne 0x42cdb2
cmp word [ebp - 0x140], 9
jne 0x42cdb2
mov eax, ebx
mov edx, 0x42cfd8
call fcn.00408640
jmp 0x42ced9
push 0x59
call sub.user32.dll_GetSystemMetrics
test eax, eax
je 0x42cdce
mov eax, ebx
mov edx, 0x42d000
call fcn.00408640
jmp 0x42ced9
mov eax, ebx
mov edx, 0x42d024
call fcn.00408640
jmp 0x42ced9
mov eax, dword [ebp - 0x114]
sub eax, 1
jb 0x42cdf7
je 0x42ce1f
dec eax
je 0x42ce47
dec eax
je 0x42ce69
jmp 0x42ced9
cmp byte [ebp - 2], 1
jne 0x42ce0e
mov eax, ebx
mov edx, 0x42d044
call fcn.00408640
jmp 0x42ced9
mov eax, ebx
mov edx, 0x42d060
call fcn.00408640
jmp 0x42ced9
cmp byte [ebp - 2], 1
jne 0x42ce36
mov eax, ebx
mov edx, 0x42d080
call fcn.00408640
jmp 0x42ced9
mov eax, ebx
mov edx, 0x42d098
call fcn.00408640
jmp 0x42ced9
cmp byte [ebp - 2], 1
jne 0x42ce5b
mov eax, ebx
mov edx, 0x42d0bc
call fcn.00408640
jmp 0x42ced9
mov eax, ebx
mov edx, 0x42d0d4
call fcn.00408640
jmp 0x42ced9
cmp byte [ebp - 2], 1
jne 0x42ce7d
mov eax, ebx
mov edx, 0x42d0f4
call fcn.00408640
jmp 0x42ced9
mov eax, ebx
mov edx, 0x42d10c
call fcn.00408640
jmp 0x42ced9
cmp dword [ebp - 0x110], 0x55f0
jae 0x42ceb9
cmp byte [ebp - 2], 1
jne 0x42ceab
mov eax, ebx
mov edx, 0x42d130
call fcn.00408640
jmp 0x42ced9
mov eax, ebx
mov edx, 0x42d148
call fcn.00408640
jmp 0x42ced9
cmp byte [ebp - 2], 1
jne 0x42cecd
mov eax, ebx
mov edx, 0x42d170
call fcn.00408640
jmp 0x42ced9
mov eax, ebx
mov edx, 0x42d188
call fcn.00408640
push dword [ebx]
push 0x42d1a8
lea edx, [ebp - 0x148]
movzx eax, word [ebp - 8]
call fcn.00418c1c
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 0x144]
mov ecx, 0
call fcn.00408ba8
push dword [ebp - 0x144]
mov eax, ebx
mov edx, 3
call fcn.00408928
call fcn.0042cc20
test al, al
je 0x42cf2e
mov eax, ebx
mov edx, 0x42d1b8
call fcn.0040884c
jmp 0x42cf3a
mov eax, ebx
mov edx, 0x42d1cc
call fcn.0040884c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cf67
lea eax, [ebp - 0x148]
call fcn.004081c8
lea eax, [ebp - 0x144]
call fcn.004081ec
pop eax
jmp eax