joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4093d4
Capabilities:
Set file attributes

Disassembly:
mov edx, 0x40c7a2
mov eax, 0x41b238
call fcn.00406908
mov dword [0x41b220], eax
test eax, eax
jne 0x40943d
push 0
push 0x41b238
call sub.KERNEL32.DLL_SetFileAttributesA
mov edx, 0x40c7a2
mov eax, 0x41b238
call fcn.00406908
mov dword [0x41b220], eax
test eax, eax
jne 0x40943d
mov eax, 0x40ccb4
mov edx, 9
call fcn.00406638
push 0x41b238
mov eax, 0x6e
call fcn.00402870
push eax
call fcn.00402e4c
add esp, 8
mov eax, 1
ret
xor eax, eax
ret

Function at 0x4095c8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
cmp dword [0x40eafc], 0
jg 0x4095e6
dec dword [0x40eafc]
xor eax, eax
mov dword [0x41b134], eax
or eax, 0xffffffff
pop esi
pop ebx
ret
cmp dword [0x41b134], 0
jg 0x40963b
push dword [0x41b150]
mov ecx, 0x2000
mov edx, 1
mov eax, dword [0x41b12c]
call fcn.004069b4
mov dword [0x41b134], eax
test eax, eax
jne 0x409620
xor edx, edx
or eax, 0xffffffff
mov dword [0x41b134], edx
pop esi
pop ebx
ret
add dword [0x41b158], 0x2000
mov edx, dword [0x41b12c]
mov dword [0x41b130], edx
call fcn.00409490
mov ecx, dword [0x40f120]
test byte [ecx + 0x14], 1
je 0x409672
mov esi, dword [0x41b134]
mov ebx, dword [0x41b130]
jmp 0x409669
call fcn.0040a828
xor byte [ebx], al
mov al, byte [ebx]
and eax, 0xff
call fcn.0040a84c
inc ebx
mov edx, esi
add esi, 0xffffffff
test edx, edx
jne 0x409655
dec dword [0x41b134]
mov ecx, dword [0x41b130]
inc dword [0x41b130]
xor eax, eax
mov al, byte [ecx]
pop esi
pop ebx
ret

Function at 0x40973c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x40974b
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x40a76e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, eax
mov eax, edx
call fcn.0040a8b8
mov eax, esp
mov ecx, 0xc
mov edx, ebx
call fcn.00406a38
xor ebx, ebx
call fcn.0040a828
xor byte [esp + ebx], al
mov al, byte [esp + ebx]
and eax, 0xff
call fcn.0040a84c
inc ebx
cmp ebx, 0xc
jl 0x40a78c
mov edx, dword [0x40f120]
xor eax, eax
mov al, byte [esp + 0xb]
test byte [edx + 0x14], 2
je 0x40a7c5
movzx ecx, word [0x41b17e]
sar ecx, 8
jmp 0x40a7d1
mov ecx, dword [0x41b184]
shr ecx, 0x18
movzx ecx, cx
movzx eax, ax
cmp ecx, eax
je 0x40a7dd
or eax, 0xffffffff
jmp 0x40a820
mov edx, dword [0x41b134]
cmp edx, dword [0x40eafc]
jle 0x40a7f3
mov ebx, dword [0x40eafc]
jmp 0x40a7f9
mov ebx, dword [0x41b134]
mov esi, dword [0x41b130]
jmp 0x40a815
call fcn.0040a828
xor byte [esi], al
mov al, byte [esi]
and eax, 0xff
call fcn.0040a84c
inc esi
mov edx, ebx
add ebx, 0xffffffff
test edx, edx
jne 0x40a801
xor eax, eax
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x40a84c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [0x41b344]
push ebx
mov ecx, edx
mov ebx, dword [0x41b124]
xor ecx, eax
and ecx, 0xff
shr edx, 8
mov ecx, dword [ebx + ecx*4]
xor ecx, edx
mov dword [0x41b344], ecx
and ecx, 0xff
add dword [0x41b348], ecx
imul edx, dword [0x41b348], 0x8088405
inc edx
mov dword [0x41b348], edx
shr edx, 0x18
mov ecx, dword [0x41b34c]
xor edx, ecx
mov ebx, dword [0x41b124]
and edx, 0xff
shr ecx, 8
mov edx, dword [ebx + edx*4]
xor edx, ecx
mov dword [0x41b34c], edx
pop ebx
ret

Function at 0x40aa94
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
jne 0x40aaa8
xor eax, eax
jmp 0x40aba0
call fcn.0040aa8c
xor ebx, 0xffffffff
cmp edi, 8
jb 0x40ab7d
xor edx, edx
sub edi, 8
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
cmp edi, 8
mov ebx, ecx
jae 0x40aab9
test edi, edi
je 0x40ab9b
xor edx, edx
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
dec edi
mov ebx, ecx
jne 0x40ab81
mov eax, ebx
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
Function at 0x4027f0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x40281f
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040357c
jmp 0x40283d
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402784
mov edi, eax
test ebx, ebx
je 0x40283d
cmp dword [esi], 0
je 0x40283d
dec ebx
jmp 0x402826
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402a28
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x495030], 0x8088405
inc edx
mov dword [0x495030], edx
mul edx
mov eax, edx
ret

Function at 0x4040f0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x40414c
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_ReadFile
dec eax
pop eax
pop ecx
jne 0x40413e
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x404133
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x40412e
mov eax, 0x64
jmp 0x404143
call sub.kernel32.dll_GetLastError
call fcn.004026e4
xor eax, eax
jmp 0x40412e
mov eax, 0x67
jmp 0x404143

Function at 0x404190
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x4041d3
push 0
push dword [ebx]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x4041ca
push eax
push 1
push 0
push 0
push dword [ebx]
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x4041ca
pop edx
cmp eax, edx
setae al
pop ebx
ret
call fcn.004026f4
mov al, 1
jmp 0x4041c8
mov eax, 0x67
call fcn.004026e4
mov al, 0xff
jmp 0x4041c8

Function at 0x4041e4
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x404214
push 0
push dword [ebx]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x40420a
xor edx, edx
div dword [ebx + 8]
pop ebx
ret
call fcn.004026f4
or eax, 0xffffffff
jmp 0x404208
mov eax, 0x67
call fcn.004026e4
or eax, 0xffffffff
jmp 0x404208

Function at 0x404368
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
mov ecx, dword [ebx + 4]
sub ecx, 0xd7b1
je 0x40437b
sub ecx, 2
jne 0x4043a4
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_ReadFile
pop edx
dec eax
jne 0x404398
cmp edx, dword [ebx + 8]
jne 0x4043ab
pop ebx
ret
call sub.kernel32.dll_GetLastError
call fcn.004026e4
jmp 0x404396
mov eax, 0x67
jmp 0x40439d
mov eax, 0x64
jmp 0x40439d
Function at 0x404540
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x40457b
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_WriteFile
pop edx
dec eax
jne 0x40456f
cmp edx, dword [ebx + 8]
jne 0x404582
mov eax, ebx
pop ebx
ret
call sub.kernel32.dll_GetLastError
call fcn.004026e4
jmp 0x40456b
mov eax, 5
jmp 0x404574
mov eax, 0x65
jmp 0x404574

Function at 0x406acc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x406b05
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040357c
jmp 0x406b0e
mov eax, ebx
mov edx, esi
call fcn.00403530
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406b18
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x406b39
mov al, byte [esp]
jmp 0x406b3b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ef18
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0040349c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x40ef79
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x40ef79
cmp byte [ebp - 0x102], 0
je 0x40ef79
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004035f8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4101ac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x24], 0
je 0x41022d
xor eax, eax
mov al, byte [ebx + 4]
mov word [ebp - 6], ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4101de
add word [ebp - 6], 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4101f0
add word [ebp - 6], 0x4000
test byte [ebx + 0xb], 0x20
je 0x4101fc
add word [ebp - 6], 0x8000
xor ebx, ebx
movzx edx, word [ebp - 6]
mov cl, 2
mov eax, dword [ebp - 0xc]
call fcn.00410084
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x410221
push ebp
mov eax, dword [ebp - 4]
call fcn.00410120
pop ecx
mov ebx, eax
cmp bl, 2
je 0x4101fc
cmp dword [ebp - 4], 0
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418b34
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x418b3a
ret
Function at 0x41f7f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x49564c
cmp dword [edi], 0
jne 0x41f86c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x495648]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x493580
mov ecx, 2
call fcn.00402744
mov edx, 0x41f7c8
lea eax, [esi + 5]
call fcn.0041f7e8
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041f7e8
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41f841
mov dword [0x495648], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41f970
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41f9c0]
test si, 4
je 0x41f984
or bl, 1
test si, 8
je 0x41f98e
or bl, 4
test si, 1
je 0x41f998
or bl, 8
test si, 2
je 0x41f9a2
or bl, 0x10
test si, 0x10
je 0x41f9ac
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41f9bb
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x41f9c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41f9fc]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41f9dd
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41f9ec
or bl, 4
test esi, 0x20000000
je 0x41f9f7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4239d0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x495624]
cmp byte [eax + 0x7f], 0
jne 0x423a23
cmp dword [0x495650], 0
jne 0x4239ff
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, 0x42398c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x495650], eax
cmp dword [0x495654], 0
jne 0x423a23
push esp
push 0
push 0
push 0x42393c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x495654], eax
pop edx
ret

Function at 0x423a28
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x495650], 0
je 0x423a3c
mov eax, dword [0x495650]
push eax
call sub.user32.dll_UnhookWindowsHookEx
xor eax, eax
mov dword [0x495650], eax
cmp dword [0x495654], 0
je 0x423a59
push 0
mov eax, dword [0x495654]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
mov dword [0x495654], eax
ret
Function at 0x423af8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x423b0f
add esp, 0xfffffff0
call fcn.00402de8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0040e018
mov dl, 1
mov eax, 0x408740
call fcn.00402be8
mov dword [ebx + 0x70], eax
mov dl, 1
mov eax, 0x408740
call fcn.00402be8
mov dword [ebx + 0x80], eax
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x3c], 0x80000018
mov dword [ebx + 0x54], 0x1f4
mov dword [ebx + 0x58], 0x32
mov dword [ebx + 0x5c], 0x9c4
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x7d], 1
mov dl, 1
mov eax, 0x418a2c
call fcn.0041d898
mov esi, eax
mov dword [ebx + 0x78], esi
push 0x423c50
mov eax, dword [0x495014]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041dc24
mov eax, dword [ebx + 0x78]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x424f00
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x495014]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.004063ac
test eax, eax
je 0x423bec
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004062c0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040638c
test eax, eax
je 0x423c00
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x6c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004035f8
cmp byte [0x495034], 0
jne 0x423c30
mov eax, ebx
call fcn.00423ce0
mov byte [ebx + 0x39], 1
mov byte [ebx + 0x3a], 1
cmp byte [ebp - 1], 0
je 0x423c48
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4246e8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x7e], 0
je 0x42471a
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x20]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040357c
jmp 0x424724
mov eax, esi
mov edx, dword [ebx + 0x6c]
call fcn.00403530
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4250d8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x60]
test esi, esi
je 0x425110
mov eax, esi
call fcn.00416454
test al, al
je 0x425110
mov eax, dword [ebx + 0x60]
call fcn.004162bc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x425110
push 0
mov eax, dword [ebx + 0x60]
call fcn.004162bc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x42e280
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, eax
mov eax, 4
call fcn.00402604
mov ebx, eax
push 0
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push ebx
push 0
push 0
push 0x42e2cc
call sub.kernel32.dll_GetVolumeInformationA
mov edx, esi
mov eax, ebx
mov ecx, 4
call fcn.00402744
mov eax, ebx
call fcn.0040261c
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432003
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, reloc.kernel32.dll_GetSystemTimeAsFileTime
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x409c40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x409c48
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x409c5b
test al, 0x10
je 0x409c5b
mov al, 1
ret
xor al, al
ret

Function at 0x40df90
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
cmp eax, 2
je 0x40dff7
cmp eax, 1
je 0x40dff7
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
shrd ecx, eax, 0x14
shr eax, 0x14
test eax, eax
jne 0x40e091
cmp ecx, 0x2200
ja 0x40e091
push eax
push ecx
call fcn.00440d40
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443810
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
shrd ecx, eax, 0x14
shr eax, 0x14
test eax, eax
jne 0x40e091
cmp ecx, 0x2200
ja 0x40e091
test eax, eax
jne 0x40e07e
cmp ecx, 0x1c00
ja 0x40e07e
test eax, eax
jne 0x40e06b
cmp ecx, 0xe00
ja 0x40e06b
test eax, eax
jne 0x40e058
cmp ecx, 0xa00
ja 0x40e058
mov eax, 0x300
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443810
mov esp, ebp
pop ebp
ret
mov eax, 0x400
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443810
mov esp, ebp
pop ebp
ret
mov eax, 0x800
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443810
mov esp, ebp
pop ebp
ret
mov eax, 0xc00
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443810
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x1000
xor ecx, ebp
call fcn.00443810
mov esp, ebp
pop ebp
ret

Function at 0x40e4e0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [eax + 0x14], 8
mov edi, edx
mov ebx, ecx
jb 0x40e502
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCR120.dll__wtoi]
mov esi, eax
add esp, 4
cmp esi, 0x100
jb 0x40e577
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x2000
push eax
mov dword [ebp - 0x4c], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x40]
shrd ecx, eax, 0x14
shr eax, 0x14
cmp ecx, 0x2000
lea eax, [ebp - 0x50]
mov dword [ebp - 0xc], ecx
cmovle eax, edx
cmp esi, dword [eax]
ja 0x40e577
mov ecx, dword [ebx]
lea eax, [ebp - 0xc]
push eax
push str.advancedSettings.memorySize
mov dword [ebp - 0xc], esi
call fcn.0040c430
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00443810
mov esp, ebp
pop ebp
ret
push 0x10
push str.parameter_error_
mov ecx, edi
call fcn.004059b0
mov ecx, dword [ebp - 8]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443810
mov esp, ebp
pop ebp
ret