joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2daf4
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x2daff
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x2dbb3
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x47200]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x47200]
movzx ebx, byte [ecx + 2]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x47200]
movzx ebx, byte [ecx + 3]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x47200]
movzx ebx, byte [ecx + 4]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x47200]
movzx ebx, byte [ecx + 5]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x47200]
movzx ebx, byte [ecx + 6]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x47200]
movzx ebx, byte [ecx + 7]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x47200]
add ecx, 8
sub edi, 8
dec esi
jne 0x2db16
pop ebx
test edi, edi
je 0x2dbcc
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x47200]
inc ecx
dec edi
jne 0x2dbb7
pop esi
not eax
pop edi
ret

Function at 0x2dbd1
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x47200]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x47200]
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x2dd73
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4e078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x38]
mov edi, ecx
push eax
mov esi, edx
push edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x50], esi
call dword [0x4112c]
test eax, eax
jne 0x2ddbb
mov eax, 0x200
jmp 0x2df3f
mov ecx, dword [ebp - 0x38]
xor eax, eax
xor ebx, ebx
inc eax
mov dword [ebp - 0x40], ecx
and dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ebx
je 0x2ddd1
mov dword [ebp - 0x3c], eax
test cl, 2
je 0x2ddda
or dword [ebp - 0x3c], 2
test cl, 4
je 0x2dde3
or dword [ebp - 0x3c], 4
mov eax, ecx
and eax, 0x10
je 0x2ddee
or dword [ebp - 0x3c], 0x10
test cl, 0x20
je 0x2ddf7
or dword [ebp - 0x3c], 0x20
cmp eax, ebx
je 0x2de04
or dword [ebp - 0x3c], 0x40000000
jmp 0x2de0b
or dword [ebp - 0x3c], 0x80000000
or dword [ebp - 0x3c], 0x1000000
cmp dword [ebp - 0x40], ebx
jne 0x2de1e
or dword [ebp - 0x3c], 0x800000
push ebx
push edi
call dword [0x410bc]
mov dword [ebp - 0x48], eax
cmp eax, 0x28
jbe 0x2dec2
mov esi, dword [0x4110c]
push ebx
push ebx
push ebx
push edi
call esi
push ebx
lea eax, [ebp - 0x54]
push eax
push 2
lea eax, [ebp - 0x40]
push eax
push edi
mov edi, dword [0x41078]
call edi
push ebx
push ebx
push 0x24
push dword [ebp - 0x44]
call esi
push ebx
lea eax, [ebp - 0x54]
push eax
push 4
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x44]
call edi
mov eax, 0x54ad
cmp word [ebp - 0x40], ax
jne 0x2debf
mov eax, dword [ebp - 0x64]
lea ecx, [eax + 0x34]
cmp dword [ebp - 0x48], ecx
jbe 0x2debf
push ebx
push ebx
push eax
push dword [ebp - 0x44]
call esi
push ebx
lea eax, [ebp - 0x54]
push eax
push 4
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x44]
call edi
mov eax, dword [ebp - 0x58]
cmp eax, 0x5a4d
je 0x2deb8
cmp eax, 0x454e
je 0x2deb8
cmp eax, 0x454c
je 0x2deb8
cmp eax, 0x4550
jne 0x2debf
or dword [ebp - 0x3c], 0x400000
mov esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x60]
cmp eax, ebx
je 0x2dece
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
cmp eax, ebx
je 0x2deda
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
cmp esi, ebx
je 0x2df13
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0002dce8
push dword [ebp - 0x20]
mov dword [esi], eax
push dword [ebp - 0x24]
mov dword [esi + 4], edx
call fcn.0002dce8
push dword [ebp - 0x30]
mov dword [esi + 8], eax
push dword [ebp - 0x34]
mov dword [esi + 0xc], edx
call fcn.0002dce8
add esp, 0x18
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
cmp dword [ebp - 0x4c], ebx
je 0x2df3d
push dword [ebp - 0x20]
lea edi, [ebp - 0x3c]
push dword [ebp - 0x24]
lea esi, [ebp - 0x40]
call fcn.0002dd0c
movzx eax, word [ebp - 0x40]
pop ecx
pop ecx
movzx ecx, word [ebp - 0x3c]
shl eax, 0x10
or eax, ecx
mov ecx, dword [ebp - 0x4c]
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0002f48c
leave
ret
Function at 0x403370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcslen
pop ecx
add eax, eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
leave
ret

Function at 0x4034e5
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
test ebp, ebp
je 0x403542
push ebx
push edi
push ebp
call sub.msvcrt.dll_wcslen
pop ecx
lea ebx, [eax + eax + 2]
push ebx
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x403540
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push ebx
push ebp
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, eax
neg esi
sbb esi, esi
neg esi
pop edi
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
pop ebp
ret

Function at 0x403707
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x403894
Capabilities:
Get common file path

Disassembly:
cmp word [0x414198], 0
push esi
mov esi, 0x414198
jne 0x4038b5
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov dword [0x4143a4], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_wcscpy
mov eax, dword [0x4143a4]
pop ecx
pop ecx
pop esi
ret

Function at 0x4038c8
Capabilities:
Get common file path

Disassembly:
cmp word [0x4143a8], 0
push esi
mov esi, 0x4143a8
jne 0x4038e9
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov dword [0x4145b4], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_wcscpy
mov eax, dword [0x4145b4]
pop ecx
pop ecx
pop esi
ret

Function at 0x403bf4
Capabilities:
Create process on windows

Disassembly:
push 5
mov eax, 0x40f99c
push eax
push eax
push dword [esp + 0x14]
push 0x40fd10
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret

Function at 0x404e46
Capabilities:
Read .ini file

Disassembly:
and word [esi], 0
push 0x413b88
push dword [esp + 0xc]
push esi
push 0x40f99c
push dword [esp + 0x14]
push 0x413d98
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov eax, esi
ret

Function at 0x404e6b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040e140
and word [ebp - 0x2004], 0
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x413b88
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x40f99c
push dword [ebp + 8]
push 0x413d98
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x404eda
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcscpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x404ede
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040e140
and word [ebp - 0x2004], 0
push esi
push edi
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x413b88
push edi
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x40f99c
push dword [ebp + 8]
mov esi, 0x413d98
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x404f45
cmp dword [ebp + 0x10], 0
jne 0x404f45
xor eax, eax
jmp 0x404f53
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
pop edi
pop esi
leave
ret

Function at 0x4052fe
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.00403707
test eax, eax
pop ecx
je 0x405385
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x413b88
push edi
call sub.msvcrt.dll_wcscpy
push str.general
mov esi, 0x413d98
push esi
call sub.msvcrt.dll_wcscpy
add esp, 0x10
push edi
push 0
push 0x40fddc
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push str.charset
mov esi, 0x413e20
mov dword [0x413e1c], eax
call fcn.00404e46
push 0x3f
push str.TranslatorName
mov esi, 0x413ea0
call fcn.00404e46
push 0xff
push str.TranslatorURL
mov esi, 0x413f20
call fcn.00404e46
add esp, 0x18
pop edi
pop esi
ret

Function at 0x406379
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, eax
mov edi, ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, edi
call fcn.00405965
and dword [ebp - 4], 0
test eax, eax
mov dword [ebp - 8], eax
jle 0x406406
cmp dword [ebp + 8], 0
je 0x4063c4
mov eax, dword [ebp - 4]
push 0x64
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x4063c4
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 0x10]
cmp eax, 0x1f4
ja 0x406406
mov ebx, dword [esi + 0xc]
add ebx, dword [ebp - 4]
cmp ebx, dword [ebp - 8]
jl 0x4063d8
test byte [esi + 0x10], 0x20
je 0x406406
sub ebx, dword [ebp - 8]
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, ebx
call fcn.00406138
test eax, eax
je 0x4063fb
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.004062ea
test eax, eax
jne 0x406410
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x4063a1
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, ebx
jmp 0x406409
Function at 0x40695b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8004
call fcn.0040e140
push ebx
push esi
mov esi, 0x7fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x8003]
push ebx
push eax
mov byte [ebp - 0x8004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x8004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x8004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x8004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
pop ebx
leave
ret

Function at 0x4069ca
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040e140
push ebx
push esi
mov esi, 0x1fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x2003]
push ebx
push eax
mov byte [ebp - 0x2004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x2004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
pop ebx
leave
ret
Function at 0x407c59
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x4cc
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push esi
mov esi, eax
xor ebp, ebp
cmp dword [esi + 0x2e8], ebp
push edi
je 0x407d29
cmp dword [esi + 0x2f0], ebp
je 0x407cea
push 0x2b0
lea eax, [esp + 0x230]
push ebp
push eax
mov dword [esp + 0x234], ebp
call sub.msvcrt.dll_memset
push 0x208
lea eax, [esp + 0x2e]
push ebp
push eax
mov word [esp + 0x34], bp
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x104
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
push 0x4001
push 0x2b4
lea eax, [esp + 0x230]
push eax
push ebp
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [esi + 0x2dc], eax
push eax
jmp 0x407d1a
call fcn.004041ac
push 0x60
pop ecx
shl eax, 4
xor edx, edx
div ecx
push 1
push 1
push 0x19
push eax
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
push 1
lea edi, [esi + 0x2dc]
push eax
mov dword [edi], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [edi]
push 1
push 0x1003
push dword [esi + 0x2d4]
call ebx
cmp dword [esi + 0x2ec], ebp
je 0x407d6f
call fcn.004041ac
push 0x60
pop ecx
shl eax, 5
xor edx, edx
div ecx
push 1
push 1
push 0x19
push eax
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
push 1
lea edi, [esi + 0x2e0]
push eax
mov dword [edi], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [edi]
push ebp
push 0x1003
push dword [esi + 0x2d4]
call ebx
call fcn.004041ac
push 0x60
pop ecx
shl eax, 4
xor edx, edx
div ecx
push 1
push 1
push 0x19
mov edi, eax
push edi
push edi
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
push ebp
mov dword [esi + 0x2d8], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push 0x1000
push edi
push edi
push ebp
push 0x85
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push ebp
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push 0x1000
push edi
push edi
push ebp
push 0x86
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push ebp
push dword [esi + 0x2d8]
mov dword [esp + 0x1c], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov edi, dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x20], eax
push dword [esi + 0x2d8]
call edi
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x2d8]
call edi
push dword [esp + 0x10]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
call edi
push dword [esp + 0x14]
call edi
mov eax, dword [esi + 0x2d8]
mov esi, dword [esi + 0x2d4]
push eax
push ebp
push 0x1208
push esi
call fcn.0040232b
pop ecx
push eax
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4cc
ret
Function at 0x408457
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
mov esi, eax
movzx eax, word [esi + 0x2d0]
cmp word [esp + 0x10], ax
push edi
jb 0x4084aa
movzx edi, word [esp + 0x14]
movzx eax, ax
add eax, dword [esi + 0x30c]
cmp edi, eax
jge 0x4084aa
push 0x10
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x40848d
inc ebx
movzx ecx, word [esi + 0x2d0]
push ebx
mov eax, edi
push 0
sub eax, ecx
call fcn.00405eb5
call fcn.004084b3
xor eax, eax
inc eax
jmp 0x4084ac
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x409303
Capabilities:
Open clipboard

Disassembly:
push esi
push 1
push 2
push 2
mov esi, eax
mov eax, dword [esi + 0x69c]
push 0x40f99c
push eax
call fcn.004091ed
test eax, eax
je 0x40934d
mov eax, dword [esi + 0x69c]
mov eax, dword [eax + 0x2f8]
push edi
call fcn.00404323
push dword [esi + 0x208]
mov edi, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40934c
push edi
call fcn.004034e5
pop ecx
pop edi
pop esi
ret
Function at 0x4094d2
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa40
push esi
push edi
mov edi, eax
xor esi, esi
cmp dword [edi + 0x27c], esi
jne 0x409698
push ebx
mov ebx, 0x208
push ebx
lea eax, [ebp - 0x20a]
push esi
push eax
mov word [ebp - 0x20c], si
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x20c]
push eax
call fcn.00403736
lea eax, [ebp - 0x20c]
push 0x2e
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 0x18
cmp eax, esi
je 0x40952c
mov word [eax], si
lea eax, [ebp - 0x20c]
push str..cfg
push eax
call sub.msvcrt.dll_wcscat
mov esi, dword [edi + 0x12e8]
pop ecx
pop ecx
push str._cfg
call fcn.0040463a
test eax, eax
jl 0x40962f
mov esi, 0x104
push esi
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [eax + 1]
mov eax, dword [edi + 0x12e8]
call fcn.0040462a
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
jne 0x40962f
and word [ebp - 0x418], ax
push ebx
push eax
lea eax, [ebp - 0x416]
push eax
call sub.msvcrt.dll_memset
and word [ebp - 0x624], 0
push ebx
lea eax, [ebp - 0x622]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0x418]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
lea eax, [ebp - 0x418]
push eax
call sub.msvcrt.dll_wcslen
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcslen
lea eax, [esi + eax + 1]
cmp eax, 0x1ff
pop ecx
pop ecx
jae 0x409612
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x624]
call fcn.00403870
pop ecx
pop ecx
jmp 0x40961a
and word [ebp - 0x624], 0
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
mov eax, dword [ebp + 8]
and word [ebp - 0xa38], 0
and word [ebp - 0x82e], 0
mov dword [ebp - 0xa3c], eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa38]
push eax
mov dword [ebp - 0xa40], 0x411220
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
lea eax, [ebp - 0xa40]
call fcn.0040c80c
mov eax, dword [edi + 0x698]
lea esi, [ebp - 0xa40]
call fcn.00401d01
mov eax, edi
call fcn.00401a23
mov edi, dword [edi + 0x69c]
mov ebx, esi
call fcn.004059d0
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x40af01
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
and word [ebp - 0x810], 0
push ebx
push esi
push edi
mov esi, 0x3fe
push esi
lea eax, [ebp - 0x80e]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x810]
push eax
call fcn.004038c8
add esp, 0x10
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
mov edi, str.WindowsSystem32configSoftware
mov edx, dword [ebp - 0x10]
xor eax, eax
inc eax
shl eax, cl
test edx, eax
je 0x40b002
mov eax, dword [0x410cac]
mov dword [ebp - 8], eax
mov eax, dword [0x410cb0]
mov dword [ebp - 4], eax
push 3
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 8]
add ecx, 0x41
push eax
mov word [ebp - 8], cx
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x40b002
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 3
je 0x40af9f
cmp eax, 2
jne 0x40b002
and word [ebp - 0x410], 0
push esi
lea eax, [ebp - 0x40e]
push 0
push eax
call sub.msvcrt.dll_memset
push edi
call sub.msvcrt.dll_wcslen
mov ebx, eax
lea eax, [ebp - 8]
push eax
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 1]
add esp, 0x14
cmp eax, 0x1ff
jae 0x40afe9
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 0x410]
call fcn.00403870
pop ecx
pop ecx
jmp 0x40aff1
and word [ebp - 0x410], 0
lea eax, [ebp - 0x410]
push eax
call fcn.00403707
test eax, eax
pop ecx
jne 0x40b019
mov ecx, dword [ebp - 0xc]
inc ecx
cmp ecx, 0x1a
mov dword [ebp - 0xc], ecx
jb 0x40af4b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 8]
call sub.msvcrt.dll_wcscpy
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x40b014

Function at 0x40b858
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor ecx, ecx
lea edx, [ebp - 4]
push edx
push ecx
push eax
push 0x40b848
push ecx
push ecx
mov dword [eax + 0x414], ecx
mov dword [eax + 4], ecx
xor esi, esi
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x40b88c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
mov eax, esi
pop esi
leave
ret
Function at 0x40b892
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1e10
call fcn.0040e140
push esi
xor esi, esi
push edi
push 0x7fe
xor edi, edi
lea eax, [ebp - 0x1e0e]
inc edi
push esi
push eax
mov word [ebp - 0x400], si
mov word [ebp - 0x200], si
mov word [ebp - 0x1610], si
mov word [ebp - 0xe10], si
mov dword [ebp - 0x610], edi
mov dword [ebp - 0x60c], 0x3a98
mov word [ebp - 0x604], si
mov dword [ebp - 0x404], esi
mov dword [ebp - 0x608], edi
mov word [ebp - 0x1e10], si
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1610]
push str.rootCIMV2
push eax
call sub.msvcrt.dll_wcscpy
cmp dword [ebp - 0x608], edi
pop ecx
pop ecx
je 0x40b97b
cmp word [ebp - 0x604], si
je 0x40b97b
push 0x5c
pop ecx
cmp word [ebp - 0x1610], cx
jne 0x40b93a
cmp word [ebp - 0x160e], cx
je 0x40b97b
cmp word [ebp - 0x604], cx
lea eax, [ebp - 0x604]
jne 0x40b958
cmp word [ebp - 0x602], cx
jne 0x40b958
lea eax, [ebp - 0x600]
lea ecx, [ebp - 0x1610]
push ecx
push eax
push str._s_s
lea eax, [ebp - 0x1e10]
push 0x3ff
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x14
jmp 0x40b990
lea eax, [ebp - 0x1610]
push eax
lea eax, [ebp - 0x1e10]
push eax
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
lea eax, [ebp - 0x1e10]
push eax
lea esi, [ebx + 0x730]
push ebx
mov eax, str.SELECT__FROM_SoftwareLicensingProduct_WHERE_PartialProductKey_IS_NOT_NULL
mov dword [esi], edi
call fcn.0040db52
lea eax, [ebp - 0x1e10]
push eax
push ebx
mov eax, str.SELECT__FROM_SoftwareLicensingService_WHERE_OA3xOriginalProductKey_IS_NOT_NULL
mov dword [esi], 2
call fcn.0040db52
pop edi
pop esi
leave
ret