joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b850
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x161c
call fcn.0042d850
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, ecx
push 0x7fe
push eax
lea ecx, [ebp - 0xe0a]
push ecx
mov dword [ebp - 0x1614], esi
mov word [ebp - 0xe0c], ax
call fcn.00422ed0
lea edx, [ebp - 0xe0c]
push edx
mov ecx, str.NewoneOpenUpdateX
call fcn.004065e0
add esp, 0x10
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x40b8d3
push 0x43f4e8
push 0x43ea88
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
push 0x208
lea ecx, [ebp - 0x60c]
push 0
push ecx
mov dword [ebp - 0x1610], 0
call fcn.00422ed0
add esp, 0xc
lea edx, [ebp - 0x1610]
push edx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x161c], 0x104
mov dword [ebp - 0x1618], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp - 0x161c]
push eax
mov eax, dword [ebp - 0x1610]
lea ecx, [ebp - 0x60c]
push ecx
lea edx, [ebp - 0x1618]
push edx
push 0
push str.NewoneOpenUpdateX
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40b964
push 0x43f4e8
push 0x43ea88
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40ba6d
push 0x3ff
lea ecx, [ebp - 0x403]
push 0
push ecx
mov byte [ebp - 0x404], 0
call fcn.00422ed0
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x60c]
push edx
push 0
push 0
call esi
push 0
push 0
push eax
lea eax, [ebp - 0x404]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x60c]
push ecx
push 0
push 0
call esi
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b9c2
sub eax, edx
lea edx, [ebp - 0x404]
push edx
mov edx, eax
call fcn.00406910
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x160a]
push ecx
mov word [ebp - 0x160c], ax
call fcn.00422ed0
lea eax, [ebp - 0x404]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ba00
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [ebp - 0x404]
push edx
push 0
push 0
call esi
lea ecx, [ebp - 0x404]
lea edi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40ba30
push eax
sub ecx, edi
lea eax, [ebp - 0x160c]
push eax
inc ecx
push ecx
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0
call esi
mov eax, dword [ebp - 0x1614]
lea edx, [ebp - 0x160c]
push edx
push 0x43ea88
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
pop edi
mov ecx, dword [ebp - 0x1610]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
Function at 0x40ba90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x161c
call fcn.0042d850
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, ecx
push 0x7fe
push eax
lea ecx, [ebp - 0xe0a]
push ecx
mov dword [ebp - 0x1614], esi
mov word [ebp - 0xe0c], ax
call fcn.00422ed0
lea edx, [ebp - 0xe0c]
push edx
mov ecx, str.PLS_lolocckB
call fcn.004065e0
add esp, 0x10
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x40bb13
push str.....
push 0x43ea88
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
push 0x208
lea ecx, [ebp - 0x60c]
push 0
push ecx
mov dword [ebp - 0x1610], 0
call fcn.00422ed0
add esp, 0xc
lea edx, [ebp - 0x1610]
push edx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x161c], 0x104
mov dword [ebp - 0x1618], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp - 0x161c]
push eax
mov eax, dword [ebp - 0x1610]
lea ecx, [ebp - 0x60c]
push ecx
lea edx, [ebp - 0x1618]
push edx
push 0
push str.PLS_lolocckB
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40bba4
push str.....
push 0x43ea88
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40bcad
push 0x3ff
lea ecx, [ebp - 0x403]
push 0
push ecx
mov byte [ebp - 0x404], 0
call fcn.00422ed0
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x60c]
push edx
push 0
push 0
call esi
push 0
push 0
push eax
lea eax, [ebp - 0x404]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x60c]
push ecx
push 0
push 0
call esi
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bc02
sub eax, edx
lea edx, [ebp - 0x404]
push edx
mov edx, eax
call fcn.00406910
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x160a]
push ecx
mov word [ebp - 0x160c], ax
call fcn.00422ed0
lea eax, [ebp - 0x404]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bc40
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [ebp - 0x404]
push edx
push 0
push 0
call esi
lea ecx, [ebp - 0x404]
lea edi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40bc70
push eax
sub ecx, edi
lea eax, [ebp - 0x160c]
push eax
inc ecx
push ecx
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0
call esi
mov eax, dword [ebp - 0x1614]
lea edx, [ebp - 0x160c]
push edx
push 0x43ea88
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
pop edi
mov ecx, dword [ebp - 0x1610]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
Function at 0x40c140
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x161c
call fcn.0042d850
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x43f1f4
mov esi, ecx
push 0x44b370
mov dword [ebp - 0x1614], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x40c37c
push 0x7fe
push eax
lea ecx, [ebp - 0xe0a]
push ecx
mov word [ebp - 0xe0c], ax
call fcn.00422ed0
lea edx, [ebp - 0xe0c]
push edx
mov ecx, str.KscBuffeCCR
call fcn.004065e0
add esp, 0x10
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x40c1d9
push 0x44b2e4
push 0x43ea88
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
push 0x208
lea ecx, [ebp - 0x60c]
push 0
push ecx
mov dword [ebp - 0x1610], 0
call fcn.00422ed0
add esp, 0xc
lea edx, [ebp - 0x1610]
push edx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x161c], 0x104
mov dword [ebp - 0x1618], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp - 0x161c]
push eax
mov eax, dword [ebp - 0x1610]
lea ecx, [ebp - 0x60c]
push ecx
lea edx, [ebp - 0x1618]
push edx
push 0
push str.KscBuffeCCR
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40c26a
push 0x43f53c
push 0x43ea88
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40c36f
push 0x3ff
lea ecx, [ebp - 0x403]
push 0
push ecx
mov byte [ebp - 0x404], 0
call fcn.00422ed0
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x60c]
push edx
push 0
push 0
call esi
push 0
push 0
push eax
lea eax, [ebp - 0x404]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x60c]
push ecx
push 0
push 0
call esi
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c2c8
sub eax, edx
lea edx, [ebp - 0x404]
push edx
mov edx, eax
call fcn.00406910
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x160a]
push ecx
mov word [ebp - 0x160c], ax
call fcn.00422ed0
lea eax, [ebp - 0x404]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c306
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [ebp - 0x404]
push edx
push 0
push 0
call esi
lea ecx, [ebp - 0x404]
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40c332
push eax
sub ecx, edi
lea eax, [ebp - 0x160c]
push eax
inc ecx
push ecx
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0
call esi
mov eax, dword [ebp - 0x1614]
lea edx, [ebp - 0x160c]
push edx
push 0x43ea88
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
pop edi
mov ecx, dword [ebp - 0x1610]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
Function at 0x40c390
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push 0x1fc
push ecx
lea edx, [ebp - 0x202]
push edx
mov dword [ebp - 0x410], eax
mov word [ebp - 0x204], cx
call fcn.00422ed0
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push 0xf003f
push 0
push str.SoftwareTencentPluginVAS
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c52e
push eax
push eax
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp - 0x408]
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x40c]
push edx
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40c573
push ebx
mov ebx, dword [ebp - 0x40c]
push edi
mov edi, dword [ebp - 0x414]
inc edi
test ebx, ebx
je 0x40c52c
cmp edi, 1
jbe 0x40c52c
push esi
push 0x1fe
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.00422ed0
add esp, 0xc
xor esi, esi
test ebx, ebx
je 0x40c51e
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x40c480
push 0xff
lea edx, [ebp - 0x404]
push 0
push edx
call fcn.00422ed0
mov edx, dword [ebp - 0x408]
add esp, 0xc
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x404]
push ecx
push esi
push edx
mov dword [ebp - 0x418], edi
call ebx
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xc
jge 0x40c511
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jle 0x40c511
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x204]
push 0xff
push eax
call fcn.00421716
push 0x43f57c
lea ecx, [ebp - 0x204]
push 0xff
push ecx
call fcn.00421716
add esp, 0x18
inc esi
cmp esi, dword [ebp - 0x40c]
jb 0x40c480
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebx
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 4
jle 0x40c573
mov edx, dword [ebp - 0x410]
push 0xd6
lea ecx, [ebp - 0x204]
push ecx
push 0xd7
push edx
call fcn.00420a34
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
Function at 0x40c590
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x10]
push eax
push 0x43d6a4
push 1
push edi
push 0x43d674
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x40c5c4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 0
lea edx, [ebp - 4]
push edx
push 0x43d684
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x40c5bc
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 8]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x40c67d
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push 0x43a590
push 0
push 0
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
js 0x40c659
mov eax, dword [ebp - 0xc]
mov ecx, 8
mov word [ebp - 0x28], cx
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push 0
lea ecx, [ebp - 0x28]
push ecx
push str.FriendlyName
push eax
call edx
test eax, eax
jne 0x40c64e
mov eax, dword [ebp - 0x20]
push eax
inc edi
call esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 8]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x40c608
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c690
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x10]
push eax
push 0x43d6a4
push 1
push edi
push 0x43d674
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x40c6c4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 0
lea edx, [ebp - 4]
push edx
push 0x43d694
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x40c6bc
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 8]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x40c77d
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push 0x43a590
push 0
push 0
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
js 0x40c759
mov eax, dword [ebp - 0xc]
mov ecx, 8
mov word [ebp - 0x28], cx
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push 0
lea ecx, [ebp - 0x28]
push ecx
push str.FriendlyName
push eax
call edx
test eax, eax
jne 0x40c74e
mov eax, dword [ebp - 0x20]
push eax
inc edi
call esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 8]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x40c708
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ca40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push eax
lea eax, [esi + 0xcc8]
push 0x43e9f4
push eax
call edi
push 0x11c
xor ebx, ebx
lea ecx, [ebp - 0x120]
push ebx
push ecx
call fcn.00422ed0
add esp, 0x18
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40cb9b
cmp dword [ebp - 0x110], 2
jne 0x40cb9b
cmp dword [ebp - 0x11c], 5
jbe 0x40cb9b
lea eax, [ebp - 0x124]
push eax
push 8
mov dword [ebp - 0x124], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40cb9b
mov edx, dword [ebp - 0x124]
lea ecx, [ebp - 0x128]
push ecx
push ebx
push ebx
push 0x19
push edx
mov dword [ebp - 0x128], ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40cb71
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40cb71
mov eax, dword [ebp - 0x128]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x40cb6b
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp - 0x124]
lea ecx, [ebp - 0x128]
push ecx
push edx
push edi
push 0x19
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40cb64
mov ecx, dword [edi]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx edx, byte [eax]
mov eax, dword [edi]
dec edx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ebx, dword [eax]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x2000
ja 0x40cba9
je 0x40cba2
test ebx, ebx
je 0x40cb9b
cmp ebx, 0x1000
jne 0x40cbd1
push 0x43f5b8
jmp 0x40cbc5
push str.None
jmp 0x40cbc5
push 0x43f48c
jmp 0x40cbc5
cmp ebx, 0x3000
je 0x40cbc0
cmp ebx, 0x4000
jne 0x40cbd1
push 0x43f5c8
jmp 0x40cbc5
push 0x43f5c0
add esi, 0x2216
push esi
call edi
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
Function at 0x40cbf0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3c
mov edi, ecx
call fcn.0041de98
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [edi + 0xcc8]
push 0x43e9f4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push esi
call fcn.0040c910
push 0x11c
xor ebx, ebx
lea ecx, [ebp - 0x120]
push ebx
push ecx
call fcn.00422ed0
add esp, 0x1c
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40cd66
cmp dword [ebp - 0x110], 2
jne 0x40cd66
cmp dword [ebp - 0x11c], 5
jbe 0x40cd66
lea eax, [ebp - 0x124]
push eax
push 8
mov dword [ebp - 0x124], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40cd66
mov edx, dword [ebp - 0x124]
lea ecx, [ebp - 0x128]
push ecx
push ebx
push ebx
push 0x19
push edx
mov dword [ebp - 0x128], ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40cd3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40cd3b
mov eax, dword [ebp - 0x128]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x12c], eax
test eax, eax
je 0x40cd3b
mov edx, dword [ebp - 0x128]
lea ecx, [ebp - 0x128]
push ecx
push edx
push eax
mov eax, dword [ebp - 0x124]
push 0x19
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40cd2e
mov ebx, dword [ebp - 0x12c]
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx edx, byte [eax]
mov eax, dword [ebx]
dec edx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ebx, dword [eax]
mov ecx, dword [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x2000
ja 0x40cd76
je 0x40cd6e
test ebx, ebx
je 0x40cd66
cmp ebx, 0x1000
jne 0x40cda4
push esi
push 0x43f5dc
jmp 0x40cd94
push esi
push str.None__s
jmp 0x40cd94
push esi
push 0x43f5e8
jmp 0x40cd94
cmp ebx, 0x3000
je 0x40cd8e
cmp ebx, 0x4000
jne 0x40cda4
push esi
push 0x43f600
jmp 0x40cd94
push esi
push 0x43f5f4
add edi, 0xa70
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test esi, esi
je 0x40cdb1
push esi
call fcn.0042066e
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
Function at 0x40cdd0
Capabilities:
Get disk information
Get disk size
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x70], edx
mov edx, dword [ebp + 0x14]
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x5c], esi
xor edi, edi
lea ecx, [ecx]
lea eax, [esi + 0x42]
mov word [ebp - 0x18], ax
lea ecx, [ebp - 0x18]
xor eax, eax
push ecx
mov dword [ebp - 0x16], 0x5c003a
mov word [ebp - 0x12], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x40ce7e
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x18]
push edx
inc edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x88]
shrd eax, ecx, 0x1e
add ebx, eax
mov eax, dword [ebp - 0x84]
shrd edx, eax, 0x1e
shr ecx, 0x1e
shr eax, 0x1e
add dword [ebp - 0x5c], edx
inc esi
cmp esi, 0x1a
jl 0x40ce10
push 0x40
lea ecx, [ebp - 0x58]
push 0
push ecx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], edi
call fcn.00422ed0
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
mov dword [ebp - 0x58], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov esi, dword [ebp - 0x50]
mov edi, dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x78]
shrd esi, edi, 0x1e
shr edi, 0x1e
add esi, 1
adc edi, 0
shrd ebx, eax, 0x1e
shr eax, 0x1e
add ebx, 1
adc eax, 0
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x60]
push eax
push 0x43e9f4
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x7c]
push edx
push 0x43f61c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x70]
push ecx
push 0x43f61c
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x74]
push edi
push esi
push 0x43f61c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x68]
push ecx
push ebx
push 0x43f61c
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x60]
add esp, 0x44
push edi
push esi
mov esi, dword [ebp - 0x6c]
push eax
push ecx
push edx
push 0x43f628
push 0xc8
push esi
call fcn.00420304
mov eax, dword [ebp - 0x94]
push eax
push ebx
push esi
push 0x43f65c
push 0xc8
push esi
call fcn.00420304
add esp, 0x38
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret