joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40421c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
push esi
push edi
mov dword [ebp - 0x10], eax
cmp dword [eax + 4], 0xffffffff
je 0x4042b8
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4042b8
cmp dword [ebp + 0x10], 0
ja 0x404246
cmp dword [ebp + 0xc], 1
jb 0x4042b8
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
and dword [ebp - 8], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub edx, esi
sbb eax, edi
test eax, eax
jb 0x404277
ja 0x404270
cmp edx, 0xfffffff
jbe 0x404277
mov eax, 0xfffffff
jmp 0x40427c
mov eax, dword [ebp + 0xc]
sub eax, esi
push 0
lea edx, [ebp - 8]
push edx
push eax
lea eax, [esi + ecx]
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4042b2
cmp dword [ebp - 8], 0
je 0x4042b2
add esi, dword [ebp - 8]
mov ecx, dword [ebp + 8]
adc edi, 0
cmp edi, dword [ebp + 0x10]
jb 0x404254
ja 0x4042b2
cmp esi, dword [ebp + 0xc]
jb 0x404254
mov eax, esi
mov edx, edi
jmp 0x4042bc
xor eax, eax
xor edx, edx
pop edi
pop esi
leave
ret 0xc

Function at 0x4043ed
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
mov ebp, ecx
and dword [esp + 0x10], esi
mov ebx, edx
push edi
xor edi, edi
test ebp, ebp
je 0x404514
mov edx, dword [esp + 0x20]
test edx, edx
je 0x404514
mov byte [edx], 0
test ebx, ebx
je 0x40450b
mov eax, dword [esp + 0x24]
add eax, 0xfffffff8
mov dword [esp + 0x18], eax
cmp esi, eax
jae 0x40450b
mov ch, byte [edi + ebp]
inc edi
cmp edi, ebx
jb 0x40444c
xor al, al
mov dword [esp + 0x14], 2
xor cl, cl
mov byte [esp + 0x11], cl
jmp 0x40446a
mov al, byte [edi + ebp]
inc edi
mov byte [esp + 0x11], al
mov cl, al
cmp edi, ebx
jae 0x404460
mov al, byte [edi + ebp]
inc edi
jmp 0x40446a
xor al, al
mov dword [esp + 0x14], 1
mov byte [esp + 0x12], al
and cl, 0xf
shr al, 6
shl cl, 2
or cl, al
movzx eax, ch
shr eax, 2
and ch, 3
shl ch, 4
mov byte [esp + 0x13], cl
movzx ecx, ch
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx], al
movzx eax, byte [esp + 0x11]
shr eax, 4
or ecx, eax
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx + 1], al
add esi, 2
mov eax, dword [esp + 0x14]
sub eax, 0
je 0x4044dc
sub eax, 1
je 0x4044c7
sub eax, 1
jne 0x4044ff
mov word [esi + edx], 0x3d3d
jmp 0x4044fc
movzx eax, byte [esp + 0x13]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx], al
mov byte [esi + edx + 1], 0x3d
jmp 0x4044fc
movzx eax, byte [esp + 0x13]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx], al
movzx eax, byte [esp + 0x12]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx + 1], al
add esi, 2
mov eax, dword [esp + 0x18]
cmp edi, ebx
jb 0x40442a
mov byte [esi + edx], 0
lea eax, [esi + 1]
jmp 0x404516
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x404733
Capabilities:
Decrypt data via sspi

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xb9c]
test ecx, ecx
je 0x404935
mov edi, dword [esi + 0xba0]
test edi, edi
je 0x404935
mov eax, dword [esi + 0xba8]
xorps xmm0, xmm0
sub edi, eax
movlpd qword [esp + 0x38], xmm0
push 4
pop ebp
lea ebx, [eax + ecx]
movlpd qword [esp + 0x44], xmm0
xor eax, eax
mov dword [esp + 0x2c], ebx
inc eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], eax
xor ecx, ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], eax
lea eax, [esi + 0xb74]
push eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea eax, [esi + 0xb8c]
push eax
call dword [sym.imp.Secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x4048c7
cmp eax, 0x90317
jne 0x40482b
cmp dword [esi + 8], 0xffffffff
mov eax, dword [esi + 0xba8]
mov dword [esi + 0xba0], eax
je 0x40486c
push str.tls___socket_closed_in_decrypt_message
lea ecx, [esi + 0x228]
mov edx, 0xff
call fcn.00403b43
push 2
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 8], 0xffffffff
jmp 0x40486c
cmp eax, 0x80090308
jne 0x404849
push str.tls___invalid_token_in_decrypt_message
lea ecx, [esi + 0x228]
mov edx, 0xff
call fcn.00403b43
jmp 0x404867
test eax, eax
je 0x404880
push eax
push str.tls___decrypt_message_failed___d_status
lea eax, [esi + 0x228]
push 0xff
push eax
call fcn.0040397c
add esp, 0x10
mov byte [esp + 0x10], 0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, dword [esp + 0x10]
jmp 0x404937
xor ebx, ebx
lea edi, [esp + 0x24]
inc ebx
cmp dword [edi + 4], ebx
jne 0x4048ae
push dword [edi]
mov eax, dword [esi + 0xba8]
push dword [edi + 8]
add eax, dword [esi + 0xb9c]
push eax
call fcn.0041be70
mov eax, dword [edi]
add esp, 0xc
add dword [esi + 0xba8], eax
add edi, 0xc
sub ebp, 1
jne 0x404887
push 5
pop eax
cmp dword [esp + 0x28], eax
jne 0x404901
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
test edi, edi
je 0x4048e2
mov eax, dword [esi + 0xba8]
add eax, dword [esi + 0xb9c]
push edi
push ebx
push eax
call fcn.0041be70
add esp, 0xc
mov ecx, dword [esi + 0xba8]
lea eax, [esi + 0xb74]
add ecx, edi
push eax
mov dword [esi + 0xba0], ecx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov al, 1
jmp 0x404937
cmp dword [esp + 0x34], eax
jne 0x404911
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
jmp 0x4048c7
cmp dword [esp + 0x40], eax
jne 0x404921
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
jmp 0x4048c7
cmp dword [esp + 0x4c], eax
jne 0x404931
mov ebx, dword [esp + 0x50]
mov edi, dword [esp + 0x48]
jmp 0x4048c7
xor edi, edi
jmp 0x4048e2
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x404bf7
Capabilities:
Encrypt data via sspi

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x50]
mov esi, ecx
test edi, edi
je 0x404cd4
mov ecx, dword [esi + 0xbb4]
mov edx, dword [esi + 0xbb0]
lea eax, [edx + ecx]
cmp dword [esp + 0x54], eax
jb 0x404cd4
mov ebp, dword [esp + 0x58]
lea eax, [edx + edi]
mov dword [esp + 0x30], eax
xor ebx, ebx
mov eax, dword [esp + 0x54]
sub eax, edx
mov dword [esp + 0x40], ebx
sub eax, ecx
mov dword [ebp], ebx
mov dword [esp + 0x28], eax
mov eax, edi
sub eax, ecx
mov dword [esp + 0x48], ebx
add eax, dword [esp + 0x54]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x10], ebx
lea ebx, [esi + 0xb74]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 7
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 6
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push 0
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esi + 0xb8c]
push eax
call dword [sym.imp.Secur32.dll_EncryptMessage]
test eax, eax
je 0x404ce0
push str.tls___encrypt_message_failed
lea ecx, [esi + 0x228]
mov edx, 0xff
call fcn.00403b43
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0xc
mov eax, dword [esp + 0x1c]
cmp eax, dword [esi + 0xbb0]
jae 0x404d1b
push dword [esp + 0x28]
add eax, edi
push dword [esp + 0x34]
push eax
call fcn.0041be70
push dword [esp + 0x40]
mov eax, dword [esp + 0x38]
add eax, dword [esp + 0x2c]
push dword [esp + 0x4c]
add eax, edi
push eax
call fcn.0041be70
mov eax, dword [esp + 0x34]
add esp, 0x18
mov ecx, dword [esp + 0x34]
add ecx, dword [esp + 0x28]
add ecx, eax
push ebx
mov dword [ebp], ecx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov al, 1
jmp 0x404cd6
Function at 0x404e69
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
push ebp
push esi
push edi
cmp dword [ebx + 8], 0xffffffff
je 0x404f9c
mov edi, dword [esp + 0x24]
test edi, edi
je 0x404f9c
mov esi, dword [esp + 0x2c]
xor eax, eax
test esi, esi
je 0x404e94
mov dword [esi], eax
push 0x1d4c0
mov dword [esp + 0x18], eax
mov ebp, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], edi
call fcn.00405f59
jmp 0x404f66
mov ecx, ebx
call fcn.00405cd4
test eax, eax
jne 0x404eda
mov ecx, ebx
call fcn.00405d4f
test al, al
jne 0x404fa8
push 1
jmp 0x404f60
xor eax, eax
push eax
push eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
push 1
lea eax, [esp + 0x2c]
push eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x404f44
cmp dword [esp + 0x24], 1
jne 0x404f44
push 0x1d4c0
mov ecx, ebx
xor ebp, ebp
call fcn.00405f59
mov eax, dword [esp + 0x1c]
mov cl, byte [eax]
cmp cl, 0xd
je 0x404f66
cmp cl, 0xa
je 0x404fbf
mov ecx, dword [esp + 0x28]
cmp ecx, 1
jbe 0x404f66
add eax, dword [esp + 0x24]
sub ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], ecx
jmp 0x404f66
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 0x2c], eax
cmp eax, 0x2733
jne 0x404f73
inc ebp
cmp ebp, 0x7d0
je 0x404f73
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp byte [ebx + 0x435], 0
je 0x404eb9
push str.raw___read_string_failed
lea ecx, [ebx + 0x228]
mov edx, 0xff
call fcn.00403b43
test esi, esi
je 0x404f92
mov eax, dword [esp + 0x2c]
mov dword [esi], eax
mov ecx, ebx
mov byte [edi], 0
call fcn.00403828
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
push str.raw___read_string_timeout
lea ecx, [ebx + 0x228]
mov edx, 0xff
call fcn.00403b43
jmp 0x404f9c
mov byte [eax], 0
mov esi, dword [ebx + 0x438]
mov edi, dword [ebx + 0x43c]
call dword [sym.imp.KERNEL32.DLL_GetTickCount64]
add eax, esi
mov dword [ebx + 0x440], eax
mov al, 1
adc edx, edi
mov dword [ebx + 0x444], edx
jmp 0x404f9e
Function at 0x405cd4
Capabilities:
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push edi
mov esi, ecx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
cmp dword [esi + 8], 0xffffffff
je 0x405d48
lea ecx, [ebp - 4]
push ecx
push 0x4004667f
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x405d0e
mov ecx, esi
call fcn.00403828
mov eax, edi
jmp 0x405d4b
mov eax, dword [ebp - 4]
test eax, eax
jne 0x405d4b
mov eax, dword [esi + 8]
xor ecx, ecx
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0xc]
push eax
push ecx
push ecx
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], edi
push eax
push ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x3e8
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x405d0a
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x405d85
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x14
xor edx, edx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
mov ebx, ecx
test edi, edi
je 0x405d9a
mov dword [edi], edx
mov eax, dword [esp + 0x30]
mov dword [eax], edx
mov eax, dword [esp + 0x28]
test eax, eax
je 0x405efe
cmp dword [ebx + 8], 0xffffffff
je 0x405efe
push dword [esp + 0x38]
mov dword [esp + 0x18], edx
mov ebp, edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
call fcn.00405f59
mov esi, dword [esp + 0x2c]
jmp 0x405ebb
cmp byte [ebx + 0x435], 0
jne 0x405f2f
mov ecx, ebx
call fcn.00405cd4
mov ecx, eax
test ecx, ecx
jne 0x405e0a
mov ecx, ebx
call fcn.00405d4f
test al, al
jne 0x405ee9
push 1
jmp 0x405eb5
mov edx, 0x400000
mov eax, esi
cmp esi, edx
cmova eax, edx
cmp eax, ecx
cmova eax, ecx
mov dword [esp + 0x18], eax
xor eax, eax
push eax
push eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x40]
push eax
push 1
lea eax, [esp + 0x2c]
push eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x405e93
cmp dword [esp + 0x34], eax
je 0x405e93
push dword [esp + 0x38]
xor ecx, ecx
mov dword [esp + 0x2c], ecx
mov ecx, ebx
call fcn.00405f59
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
sub esi, eax
add dword [esp + 0x1c], eax
add dword [ecx], eax
cmp byte [esp + 0x3c], 0
je 0x405ebb
mov ecx, dword [ebx + 0x428]
test ecx, ecx
je 0x405ebb
push eax
push dword [ebx + 0x430]
push dword [ebx + 0x42c]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x405ebb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x405f0a
mov eax, dword [esp + 0x28]
inc eax
mov dword [esp + 0x28], eax
cmp eax, 0x7d0
je 0x405f2b
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
test esi, esi
jne 0x405dda
mov esi, dword [ebx + 0x438]
mov edi, dword [ebx + 0x43c]
call dword [sym.imp.KERNEL32.DLL_GetTickCount64]
add eax, esi
mov dword [ebx + 0x440], eax
mov al, 1
adc edx, edi
mov dword [ebx + 0x444], edx
jmp 0x405f00
push str.raw___read_timeout
lea ecx, [ebx + 0x228]
mov edx, 0xff
call fcn.00403b43
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x18
mov eax, dword [ebx + 8]
push dword [esp + 0x18]
lea eax, [ebx + 0x228]
push ebp
push str.raw___receive_failed___u_error___u_bytes_requested
push 0xff
push eax
call fcn.0040397c
add esp, 0x14
test esi, esi
je 0x405ec3
push esi
push ebp
push str.raw___read_failed___u_error___zu_bytes_needed
lea eax, [ebx + 0x228]
push 0xff
push eax
call fcn.0040397c
add esp, 0x14
test edi, edi
je 0x405f50
mov dword [edi], ebp
mov ecx, ebx
call fcn.00403828
jmp 0x405efe
Function at 0x405f92
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebx, ecx
push edi
xor edi, edi
test esi, esi
je 0x405fa7
mov dword [esi], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4060de
cmp dword [ebx + 8], 0xffffffff
je 0x4060de
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x24], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
test ebp, ebp
je 0x406089
cmp byte [ebx + 0x435], 0
jne 0x4060af
mov esi, dword [ebx + 0x438]
mov dword [esp + 0x28], edi
mov edi, dword [ebx + 0x43c]
call dword [sym.imp.KERNEL32.DLL_GetTickCount64]
add eax, esi
mov esi, 0x200000
mov dword [ebx + 0x440], eax
mov eax, ebp
adc edx, edi
cmp ebp, esi
mov dword [ebx + 0x444], edx
cmova eax, esi
xor edi, edi
push edi
push edi
push edi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x34]
push eax
push 1
lea eax, [esp + 0x2c]
push eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x40606b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov dword [esp + 0x24], edi
cmp edi, 0x2733
jne 0x406085
mov esi, dword [esp + 0x14]
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x7d0
je 0x406081
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
xor edi, edi
jmp 0x406079
mov eax, dword [esp + 0x28]
sub ebp, eax
add dword [esp + 0x1c], eax
mov dword [esp + 0x14], edi
test ebp, ebp
jne 0x405fd9
mov edi, dword [esp + 0x24]
test ebp, ebp
jne 0x4060b3
mov esi, dword [ebx + 0x438]
mov edi, dword [ebx + 0x43c]
call dword [sym.imp.KERNEL32.DLL_GetTickCount64]
add eax, esi
mov dword [ebx + 0x440], eax
mov al, 1
adc edx, edi
mov dword [ebx + 0x444], edx
jmp 0x4060e0
mov edi, dword [esp + 0x24]
push ebp
push str.raw___send_failed___zu_bytes_needed
lea eax, [ebx + 0x228]
push 0xff
push eax
call fcn.0040397c
mov esi, dword [esp + 0x3c]
add esp, 0x10
test esi, esi
je 0x4060d7
mov dword [esi], edi
mov ecx, ebx
call fcn.00403828
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x406f55
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x338
push ebx
push esi
push edi
push str.Windows
mov edi, edx
mov esi, ecx
call fcn.00402fc9
push 0x118
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.0041c3f0
add esp, 0xc
mov dword [ebp - 0x124], 0x11c
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
jne 0x406fa7
xor al, al
jmp 0x4071a3
test edi, edi
je 0x406fba
imul eax, dword [ebp - 0x120], 0x64
add eax, dword [ebp - 0x11c]
mov dword [edi], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x406fc9
mov eax, dword [ebp - 0x118]
mov dword [ecx], eax
lea ecx, [ebp - 0x334]
call fcn.0040117c
mov eax, dword [ebp - 0x114]
push 1
pop ebx
sub eax, 1
je 0x40717a
sub eax, ebx
je 0x406ff4
push str.Microsoft_Win32s
jmp 0x40719a
mov eax, dword [ebp - 0x120]
cmp eax, 4
ja 0x407009
push str.Microsoft_Windows_NT
jmp 0x4070f7
cmp eax, 5
jne 0x40703a
mov eax, dword [ebp - 0x11c]
sub eax, 0
je 0x40702f
sub eax, 1
je 0x407028
sub eax, 1
mov eax, str.Windows_2003
jmp 0x407034
mov eax, str.Windows_XP
jmp 0x407034
mov eax, str.Windows_2000
push eax
jmp 0x4070f7
cmp eax, 6
jne 0x407096
mov eax, dword [ebp - 0x11c]
sub eax, 0
je 0x407084
sub eax, 1
je 0x407078
sub eax, 1
je 0x40706c
sub eax, 1
je 0x407060
mov eax, str.Windows_8.x
jmp 0x407034
mov eax, str.Windows_8.1
mov ecx, str.Windows_Server_2012_R2
jmp 0x40708e
mov eax, str.Windows_8
mov ecx, str.Windows_Server_2012
jmp 0x40708e
mov eax, str.Windows_7
mov ecx, str.Windows_Server_2008_R2
jmp 0x40708e
mov eax, str.Windows_Vista
mov ecx, str.Windows_Server_2008
cmp byte [ebp - 0xa], bl
cmovne eax, ecx
jmp 0x407034
cmp eax, 0xa
jne 0x4070fe
cmp dword [ebp - 0x11c], 0
je 0x4070ab
push str.Windows_10.x
jmp 0x4070f7
cmp byte [ebp - 0xa], bl
jne 0x4070cc
cmp dword [ebp - 0x118], 0x55f0
mov eax, str.Windows_10
mov ecx, str.Windows_11
cmovae eax, ecx
jmp 0x407034
cmp dword [ebp - 0x118], 0x55f0
jb 0x4070df
push str.Windows_Server_2022
jmp 0x4070f7
cmp dword [ebp - 0x118], 0x3839
jbe 0x4070f2
push str.Windows_Server_2019
jmp 0x4070f7
push str.Windows_Server_2016
mov ecx, esi
call fcn.00402fc9
cmp word [ebp - 0x110], 0
movzx eax, word [ebp - 0x118]
push eax
jne 0x407126
lea eax, [ebp - 0x334]
push str._build__d
push eax
call fcn.004011fb
add esp, 0xc
jmp 0x407141
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x334]
push str.__s_build__d
push eax
call fcn.004011fb
add esp, 0x10
lea eax, [ebp - 0x334]
mov ecx, esi
push eax
call fcn.00401262
lea ecx, [ebp - 0x334]
call fcn.00406f1a
test al, al
je 0x4071a1
push str._on
mov ecx, esi
call fcn.004034ba
lea eax, [ebp - 0x334]
mov ecx, esi
push eax
call fcn.00401262
jmp 0x4071a1
cmp dword [ebp - 0x120], 4
ja 0x407195
jne 0x40718e
cmp dword [ebp - 0x11c], 0
ja 0x407195
push str.Microsoft_Windows_95
jmp 0x40719a
push str.Microsoft_Windows_98
mov ecx, esi
call fcn.004034ba
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40755e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00403195
push dword [esp + 0x14]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x40758c
xor al, al
jmp 0x4075b6
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4075aa
push dword [esp + 0x14]
push ecx
call fcn.0041e1ec
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
jmp 0x4075af
and dword [esp + 0x10], 0
mov edx, esi
call fcn.004071a8
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4077bc
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x4014
call fcn.0041b500
push ebx
push ebp
push esi
push edi
mov edi, edx
xor ebp, ebp
mov eax, dword [edi + 4]
mov dword [edi + 8], ebp
test eax, eax
je 0x4077dd
xor edx, edx
mov word [eax], dx
push ebp
push ebp
push 3
push ebp
push 3
push ebp
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x407861
mov ebx, 0x4000
mov dword [esp + 0x10], ebp
push ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x20], ebp
push ebp
push eax
call fcn.0041c3f0
add esp, 0xc
mov dword [esp + 0x14], ebp
lea eax, [esp + 0x10]
mov dword [esp + 0x18], ebp
push ebp
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
push 0xc
lea eax, [esp + 0x28]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x40785a
mov eax, dword [esp + 0x10]
cmp eax, 0x28
jb 0x40785a
lea edx, [esp + 0x20]
lea ecx, [esp + 0x20]
add edx, eax
add ecx, dword [esp + 0x38]
push edi
call fcn.0040798d
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4014
ret

Function at 0x40806c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00403195
push dword [esp + 0x14]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x40809a
xor al, al
jmp 0x4080c4
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4080b8
push dword [esp + 0x14]
push ecx
call fcn.0041e1ec
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
jmp 0x4080bd
and dword [esp + 0x10], 0
mov edx, esi
call fcn.00407cb6
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4080c9
Capabilities:
Generate random numbers via winapi

Disassembly:
push ecx
push ecx
push ebp
push esi
mov esi, ecx
mov ebp, edx
test esi, esi
je 0x4081a2
push ebx
push edi
push 0
call fcn.00429e44
pop ecx
push 2
mov edi, eax
mov ebx, edx
push 8
lea eax, [esp + 0x18]
add edi, 0xab5b7200
push eax
push 0
adc ebx, 0xffffffff
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
je 0x408117
call dword [sym.imp.KERNEL32.DLL_GetTickCount64]
mov ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
jmp 0x40811b
mov ecx, dword [esp + 0x10]
and ecx, 0x1ffffff
xor eax, eax
or ecx, ebx
or eax, edi
or ecx, 0x44000000
push ecx
push eax
push str._I64u
push 0xffffffffffffffff
push ebp
push esi
call fcn.00401e4a
add esp, 0x18
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, ebx
call fcn.00403a97
mov edi, str.SOFTWAREMetaQuotes_Software
test al, al
jne 0x408160
push ecx
mov edx, edi
mov ecx, ebx
call fcn.00403a3f
pop ecx
push ecx
push esi
push ecx
mov ebp, 0x467fd0
mov edx, edi
push ebp
mov ecx, ebx
call fcn.004039b8
add esp, 0x10
mov ebx, SysReAllocStringLen
mov ecx, ebx
call fcn.00403a97
test al, al
jne 0x408190
push ecx
mov edx, edi
mov ecx, ebx
call fcn.00403a3f
pop ecx
push ecx
push esi
push ecx
push ebp
mov edx, edi
mov ecx, ebx
call fcn.004039b8
add esp, 0x10
pop edi
pop ebx
pop esi
pop ebp
pop ecx
pop ecx
ret

Function at 0x4081f6
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
xor eax, eax
push esi
mov dword [ebp - 4], eax
mov esi, 0x100
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x214]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
je 0x408268
push 3
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.00428a3a
add esp, 0x10
xor eax, eax
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x214]
push esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x408bb0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, ecx
push edi
test esi, esi
je 0x408be6
xor edi, edi
cmp word [esi], di
je 0x408be6
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408bda
test al, 0x10
jne 0x408beb
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
je 0x408be6
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x408bfa
xor al, al
pop edi
pop esi
ret
test al, 1
je 0x408bfa
xor eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov al, 1
jmp 0x408be8