joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428c54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push 0x64
add eax, 0x1f90
push eax
lea edx, [ebp - 0x68]
push edx
call fcn.0049fa50
lea edx, [ebp - 0x68]
add esp, 0xc
mov eax, edx
mov ecx, dword [eax + 0x30]
add ecx, 0xfffffd45
mov eax, ecx
lea ecx, [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
push 4
push ecx
push edx
call fcn.0049fa50
mov eax, dword [ebp + 0xc]
add esp, 0xc
xor edi, edi
lea esi, [ebp - 0x68]
lea ecx, [eax + 0xa]
mov bl, byte [ecx]
xor edx, edx
xor bl, byte [esi]
movsx eax, bl
mov ebx, 0xa
inc esi
div ebx
add dl, 0x30
inc edi
mov byte [ecx], dl
inc ecx
cmp edi, 4
jl 0x428ca4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428dac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
mov eax, dword [ebp + 8]
push 0x64
add eax, 0x1f80
push eax
lea edx, [ebp - 0x64]
push edx
call fcn.0049fa50
add esp, 0xc
lea edx, [ebp - 0x64]
mov eax, edx
mov ecx, dword [eax + 0x1c]
add ecx, 0xffffffbb
mov eax, ecx
push 0x18
push eax
push edx
call fcn.0049fa50
add esp, 0xc
lea eax, [ebp - 0x64]
xor dword [eax], 0x382
mov ecx, 1
lea edx, [eax + 4]
mov ebx, dword [edx]
add edx, 4
xor dword [eax], ebx
inc ecx
cmp ecx, 6
jl 0x428df4
push 4
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0049fa50
add esp, 0xc
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429364
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edx, esi
xor eax, eax
mov bl, byte [edx]
inc edx
xor bl, 0x32
inc eax
mov byte [ecx], bl
inc ecx
cmp eax, 0x19
jl 0x429375
mov eax, 0x19
mov edx, dword [ebp + 0x10]
lea ecx, [edx + 0x19]
lea edx, [esi + 0x19]
mov bl, byte [edx]
inc edx
xor bl, 0x32
inc eax
mov byte [ecx], bl
inc ecx
cmp eax, 0x32
jl 0x429392
pop esi
pop ebx
pop ebp
ret

Function at 0x4293a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ecx, ecx
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ebx, eax
cmp esi, ecx
jle 0x4293d1
lea eax, [ecx + 0x32]
mov edi, 0x65
cdq
idiv edi
mov eax, edx
inc ecx
xor byte [ebx], al
inc ebx
cmp esi, ecx
jg 0x4293bc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4293d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
cmp eax, dword [ebp + 0x14]
mov esi, edx
jge 0x42943a
xor eax, eax
lea ecx, [ebp - 0x18]
mov edx, esi
mov ebx, eax
inc eax
xor bl, byte [edx]
inc edx
mov byte [ecx], bl
inc ecx
cmp eax, 0x14
jl 0x4293f9
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.0049fced
add esp, 8
test eax, eax
je 0x42942c
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1d68], 2
mov al, 1
jmp 0x42943c
inc dword [ebp - 4]
add esi, 0x14
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x14]
jl 0x4293f2
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429478
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x3c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
xor edi, edi
mov eax, esi
jmp 0x4294b3
mov edx, dword [eax]
inc edi
add eax, 4
mov byte [edx], 0
cmp edi, dword [esi + 0x9c40]
jl 0x4294aa
mov dword [ebp - 4], ebx
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x34]
add eax, dword [ebx + 0x28]
adc edx, dword [ebx + 0x2c]
add dword [ebp - 0xc], eax
adc dword [ebp - 8], edx
mov eax, dword [ebx]
test eax, eax
je 0x4294da
add ebx, eax
jmp 0x4294be
cmp dword [ebp - 0x18], 1
jle 0x4294f7
mov eax, dword [ebp - 0x18]
cdq
push edx
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004a663f
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
mov edi, eax
mov eax, dword [esi + 0x9c48]
sub edi, eax
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x34]
add eax, dword [ebx + 0x28]
adc edx, dword [ebx + 0x2c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
mov eax, dword [ebx + 0x44]
push eax
push esi
call fcn.0042a0b0
add esp, 0x14
mov eax, dword [ebx]
test eax, eax
je 0x429537
add ebx, eax
jmp 0x429507
mov edx, dword [ebp - 0xc]
xor edi, edi
mov dword [esi + 0x9c48], edx
mov ebx, esi
mov edx, dword [ebp - 8]
mov dword [esi + 0x9c4c], edx
jmp 0x42956e
mov eax, dword [ebx]
cmp byte [eax], 0
jne 0x42956a
push edi
push esi
call fcn.0042a204
add esp, 8
dec edi
add ebx, 0xfffffffc
dec dword [esi + 0x9c40]
inc edi
add ebx, 4
cmp edi, dword [esi + 0x9c40]
jl 0x42954f
mov byte [esi + 0x9c54], 0
mov byte [esi + 0x9c64], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4299bc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x4ca774
push ebx
call fcn.0049fef4
mov dword [ebp - 8], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.004adb88
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
mov eax, dword [ebp + 0xc]
call fcn.004adb48
mov ebx, eax
test bl, bl
jne 0x429a1b
push 0x80
cmp dword [ebp + 0xc], 0
je 0x429a06
mov eax, dword [ebp + 0xc]
jmp 0x429a0b
mov eax, 0x4c6046
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp + 0xc]
call fcn.004adb48
mov ebx, eax
mov eax, ebx
mov edx, 2
push eax
lea eax, [ebp + 0xc]
dec dword [ebp - 8]
call fcn.004adc4c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429ae4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
mov eax, 0x4ca7f8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.0049fef4
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x3c], edx
lea edx, [ebp - 0x158]
mov word [ebp - 0x28], 8
mov dword [ebp - 4], ecx
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 0x14
mov eax, dword [ebx + 0x3dc]
push eax
push 0x4c6047
push edx
call fcn.004a3230
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x144]
push ecx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x4c604a
lea eax, [ebp - 0x144]
push eax
call fcn.0049fb64
add esp, 8
lea edx, [ebp - 0x158]
push edx
lea ecx, [ebp - 0x144]
push ecx
call fcn.0049fb64
add esp, 8
push 0x4c6056
lea eax, [ebp - 0x144]
push eax
call fcn.0049fb64
add esp, 8
push 0x4c605b
lea edx, [ebp - 0x144]
push edx
call fcn.0049fb64
mov word [ebp - 0x28], 0x20
add esp, 8
lea edx, [ebp - 0x144]
lea eax, [ebp - 8]
call fcn.004adb50
mov edx, eax
inc dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.004adc7c
dec dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004adc4c
mov dl, 1
mov eax, dword [0x488ef0]
call fcn.00405e40
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
call fcn.00496ba8
test al, al
jne 0x429beb
push 0
push ebx
call fcn.00423214
add esp, 8
mov word [ebp - 0x28], 0x2c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov word [ebp - 0x28], 0x38
xor edx, edx
mov dword [ebp - 0xc], edx
lea ecx, [ebp - 0xc]
inc dword [ebp - 0x1c]
mov edx, 4
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0xc]
call fcn.004adf98
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004adc4c
mov word [ebp - 0x28], 0x14
jmp 0x429c48
mov ebx, dword [ebp - 0x40]
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x429c70
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
mov word [ebp - 0x28], 0x50
mov edx, 3
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x28], 0x44
mov eax, dword [ebp - 0x3c]
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x1c]
call fcn.004adc4c
pop eax
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b848
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x8005
push edi
call fcn.0042b9e8
add esp, 8
xor eax, eax
cmp eax, dword [ebp + 0x10]
jae 0x42b88b
movzx edx, bx
sar edx, 8
xor ecx, ecx
mov cl, byte [esi]
inc esi
xor edx, ecx
inc eax
shl ebx, 8
mov dx, word [edi + edx*4 + 0x30]
xor dx, bx
cmp eax, dword [ebp + 0x10]
mov ebx, edx
jb 0x42b86b
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x42b894
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
push 0
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x42b8cf
mov eax, dword [ebp + 0x14]
add eax, eax
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
push eax
push 0
mov edx, dword [ebp + 0x10]
push edx
call fcn.0049fac0
add esp, 0xc
xor eax, eax
jmp 0x42b9df
push ebx
call fcn.0049f2bc
pop ecx
mov edi, eax
push edi
push ebx
push 0
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 4], edx
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
push 0x4c611c
push edi
call sub.VERSION.DLL_VerQueryValueA
cmp dword [ebp - 8], 4
jb 0x42b917
push 4
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 0xc]
push ecx
call fcn.0049fa50
add esp, 0xc
movzx eax, word [ebp - 0xa]
push eax
lea ecx, [ebp - 0x40]
movzx edx, word [ebp - 0xc]
push edx
push 0x4c6135
push ecx
call fcn.004a3230
add esp, 0x10
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov esi, eax
cmp ebx, dword [ebp + 0x14]
jge 0x42b9d6
xor eax, eax
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push esi
push edi
lea edi, [ebp - 0x74]
mov esi, 0x4c613e
mov eax, edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x74]
push edx
push ecx
call fcn.0049fb64
add esp, 8
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
add eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 0x74]
push edx
call fcn.0049fb64
add esp, 8
mov byte [esi], 0
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x74]
push edx
push edi
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x42b9c9
cmp dword [ebp - 8], 0x32
jae 0x42b9c9
mov edx, ebx
mov ecx, dword [ebp - 8]
add edx, edx
push ecx
mov eax, dword [ebp - 4]
push eax
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
add edx, dword [ebp + 0x10]
push edx
call fcn.0049fa50
add esp, 0xc
inc ebx
add esi, 0x32
cmp ebx, dword [ebp + 0x14]
jl 0x42b942
push edi
call fcn.0049f0f4
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4418bc
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x442494
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov eax, 0x4cec6c
call fcn.0049fef4
mov word [ebp - 0x14], 8
push ebx
mov eax, 0x564d5868
mov ebx, 0x8685d465
mov ecx, 0xa
mov dx, 0x5658
in eax, dx
mov dword [ebp - 0x28], ebx
pop ebx
mov word [ebp - 0x14], 0
jmp 0x4424db
cmp dword [ebp - 0x28], 0x564d5868
sete al
and eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4424f8
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov eax, 0x4cec80
call fcn.0049fef4
mov word [ebp - 0x14], 8
mov eax, 1
invalid

Function at 0x442548
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov eax, 0x4cec94
call fcn.0049fef4
mov byte [ebp - 0x25], 0
mov word [ebp - 0x14], 8
push ebx
mov ebx, 0
mov eax, 1
invalid

Function at 0x4427f4
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
mov eax, 0x4cedf8
push ebx
push esi
mov esi, dword [ebp + 0xc]
call fcn.0049fef4
mov dword [ebp - 0x158], 0x128
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x442879
mov word [ebp - 0x20], 8
mov edx, str.error1
lea eax, [ebp - 4]
call fcn.004adb50
inc dword [ebp - 0x14]
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.004adc7c
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x14
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x14]
call fcn.004adc4c
pop eax
mov word [ebp - 0x20], 8
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x442948
lea ecx, [ebp - 0x158]
push ecx
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4428f4
cmp esi, dword [ebp - 0x150]
jne 0x4428e3
mov word [ebp - 0x20], 0x20
lea edx, [ebp - 0x134]
lea eax, [ebp - 8]
call fcn.004adb50
inc dword [ebp - 0x14]
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
call fcn.004adc7c
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x2c
push eax
lea eax, [ebp - 8]
dec dword [ebp - 0x14]
call fcn.004adc4c
pop eax
mov word [ebp - 0x20], 0x20
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x442948
lea ecx, [ebp - 0x158]
push ecx
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x44288a
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov word [ebp - 0x20], 0x38
mov edx, 0x4cec67
lea eax, [ebp - 0xc]
call fcn.004adb50
inc dword [ebp - 0x14]
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.004adc7c
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x44
push eax
lea eax, [ebp - 0xc]
dec dword [ebp - 0x14]
call fcn.004adc4c
pop eax
mov word [ebp - 0x20], 0x38
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443fd4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcf4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
test eax, eax
jne 0x443fff
xor eax, eax
jmp 0x44410f
lea edx, [ebp - 0x104]
push edx
push ebx
call fcn.00444118
mov ecx, dword [ebp + 0xc]
add esp, 8
mov edi, ecx
xor eax, eax
or ecx, 0xffffffff
lea esi, [ebp - 0x30c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x30c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0049fbf4
pop ecx
dec eax
lea edx, [ebp + eax - 0x30c]
test eax, eax
jle 0x44405e
movsx ecx, byte [edx]
cmp ecx, 0x5c
je 0x44405e
dec eax
dec edx
test eax, eax
jg 0x444050
mov byte [ebp + eax - 0x30c], 0
lea eax, [ebp - 0x104]
push eax
lea edx, [ebp - 0x30c]
push edx
call fcn.0049fced
add esp, 8
lea ecx, [ebp - 0x30c]
cmp eax, ecx
jne 0x44408d
mov al, 1
jmp 0x44410f
lea edi, [ebp - 0x208]
mov esi, 0x4cf743
mov eax, edi
lea edx, [ebp - 0x104]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
lea ecx, [ebp - 0x208]
push ecx
call fcn.0049fb64
add esp, 8
lea eax, [ebp - 0x30c]
lea edx, [ebp - 0x208]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4440e0
test cl, cl
je 0x4440da
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4440e0
add eax, 2
add edx, 2
test cl, cl
jne 0x4440be
jne 0x4440e0
mov al, 1
jmp 0x44410f
lea eax, [ebp - 0x30c]
mov edx, str._systemroot_system32
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x44410d
test cl, cl
je 0x444107
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x44410d
add eax, 2
add edx, 2
test cl, cl
jne 0x4440eb
jne 0x44410d
mov al, 1
jmp 0x44410f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44414c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
mov ecx, 0x23
push ebx
push esi
push edi
lea edi, [ebp - 0x190]
mov eax, dword [ebp + 8]
mov esi, 0x4cf52c
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
push edx
push eax
call fcn.00443fd4
add esp, 8
test al, al
jne 0x444185
xor eax, eax
jmp 0x444220
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0049fbf4
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x4441ab
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x4441ab
dec ebx
dec eax
test ebx, ebx
jg 0x44419d
inc ebx
mov edi, esi
sub edi, ebx
push edi
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.0049fa50
sub esi, ebx
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov byte [ebp + edi - 0x104], 0
lea eax, [ebp - 0x104]
jle 0x4441e8
mov dl, 0x64
sub dl, bl
inc ebx
xor byte [eax], dl
inc eax
cmp esi, ebx
jg 0x4441dc
xor ebx, ebx
mov edx, ebx
push esi
shl edx, 2
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x190]
push eax
lea edx, [edx + edx*4]
add edx, ecx
push edx
call fcn.0049fcf4
add esp, 0xc
test eax, eax
je 0x444215
inc ebx
cmp ebx, 7
jl 0x4441ea
cmp ebx, 7
jge 0x44421e
mov al, 1
jmp 0x444220
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x444228
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
mov ecx, 0x23
push ebx
push esi
push edi
lea edi, [ebp - 0x190]
mov eax, dword [ebp + 8]
mov esi, 0x4cf5b8
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
push edx
push eax
call fcn.00443fd4
add esp, 8
test al, al
jne 0x444261
xor eax, eax
jmp 0x4442fc
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0049fbf4
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x444287
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x444287
dec ebx
dec eax
test ebx, ebx
jg 0x444279
inc ebx
mov edi, esi
sub edi, ebx
push edi
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.0049fa50
sub esi, ebx
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov byte [ebp + edi - 0x104], 0
lea eax, [ebp - 0x104]
jle 0x4442c4
mov dl, 0x64
sub dl, bl
inc ebx
xor byte [eax], dl
inc eax
cmp esi, ebx
jg 0x4442b8
xor ebx, ebx
mov edx, ebx
push esi
shl edx, 2
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x190]
push eax
lea edx, [edx + edx*4]
add edx, ecx
push edx
call fcn.0049fcf4
add esp, 0xc
test eax, eax
je 0x4442f1
inc ebx
cmp ebx, 4
jl 0x4442c6
cmp ebx, 4
jge 0x4442fa
mov al, 1
jmp 0x4442fc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x444304
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
push 0
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x444325
xor eax, eax
jmp 0x444435
push ebx
call fcn.0049f2bc
pop ecx
mov edi, eax
push edi
push ebx
push 0
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 4], edx
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.DLL_VerQueryValueA
cmp dword [ebp - 8], 4
jb 0x44436d
push 4
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 0xc]
push ecx
call fcn.0049fa50
add esp, 0xc
movzx eax, word [ebp - 0xa]
push eax
lea ecx, [ebp - 0x40]
movzx edx, word [ebp - 0xc]
push edx
push str._04X_04X
push ecx
call fcn.004a3230
add esp, 0x10
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov esi, eax
cmp ebx, dword [ebp + 0x14]
jge 0x44442c
xor eax, eax
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push esi
push edi
lea edi, [ebp - 0x74]
mov esi, str.StringFileInfo_
mov eax, edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x74]
push edx
push ecx
call fcn.0049fb64
add esp, 8
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
add eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 0x74]
push edx
call fcn.0049fb64
add esp, 8
mov byte [esi], 0
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x74]
push edx
push edi
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x44441f
cmp dword [ebp - 8], 0x32
jae 0x44441f
mov edx, ebx
mov ecx, dword [ebp - 8]
add edx, edx
push ecx
mov eax, dword [ebp - 4]
push eax
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
add edx, dword [ebp + 0x10]
push edx
call fcn.0049fa50
add esp, 0xc
inc ebx
add esi, 0x32
cmp ebx, dword [ebp + 0x14]
jl 0x444398
push edi
call fcn.0049f0f4
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44443c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe48
push ebx
push esi
push edi
mov esi, 0x4cf644
lea edi, [ebp - 0x154]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4cf694
lea edi, [ebp - 0x1b8]
mov ecx, 0x19
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00443fd4
add esp, 8
test al, al
jne 0x444487
xor eax, eax
jmp 0x444575
mov edx, dword [ebp + 0xc]
push edx
call fcn.0049fbf4
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x4444ad
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x4444ad
dec ebx
dec eax
test ebx, ebx
jg 0x44449f
inc ebx
mov edi, esi
sub edi, ebx
push edi
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.0049fa50
sub esi, ebx
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov byte [ebp + edi - 0x104], 0
lea eax, [ebp - 0x104]
jle 0x4444ea
mov dl, 0x64
sub dl, bl
inc ebx
xor byte [eax], dl
inc eax
cmp esi, ebx
jg 0x4444de
xor ebx, ebx
mov edx, ebx
push esi
shl edx, 2
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x154]
push eax
lea edx, [edx + edx*4]
add edx, ecx
push edx
call fcn.0049fcf4
add esp, 0xc
test eax, eax
je 0x444517
inc ebx
cmp ebx, 4
jl 0x4444ec
cmp ebx, 4
jge 0x444573
push 2
lea eax, [ebp - 0x1b8]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00444304
add esp, 0x10
test al, al
jne 0x44453d
xor eax, eax
jmp 0x444575
lea eax, [ebp - 0x1b8]
cmp byte [eax], 0x4d
jne 0x444558
cmp byte [eax + 2], 0x63
jne 0x444558
cmp byte [eax + 4], 0x6f
jne 0x444558
mov al, 1
jmp 0x444575
lea eax, [ebp - 0x1b8]
cmp byte [eax], 0x57
jne 0x444573
cmp byte [eax + 1], 0x69
jne 0x444573
cmp byte [eax + 2], 0x6e
jne 0x444573
mov al, 1
jmp 0x444575
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret