joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48507a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4a3350]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.0041f4e5
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x401676
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.0042405b
push 0x4a18d8
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.004241ad
push edi
push esi
call fcn.0041fb32
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042419e
mov esp, ebp
pop ebp
ret 4

Function at 0x401cc0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x485108
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4a3350]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00406850
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.00401bf0
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x401d31
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.0042405b
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x401d5a
push dword [esp + 0xc]
call fcn.004235a4
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x411080
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48647f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4a3350]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.Json::BuiltStyledStreamWriter.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], 0
mov byte [esi + 0x14], 0
push 0xffffffffffffffff
mov byte [ebp - 4], 2
lea ecx, [esi + 0x30]
mov dword [esi + 0x2c], 0x4a
push 0
push dword [ebp + 8]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00406850
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x4c]
push 0xffffffffffffffff
mov byte [ebp - 4], 3
mov dword [esi + 0x48], eax
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00406850
push 0xffffffffffffffff
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
push 0
push dword [ebp + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00406850
push 0xffffffffffffffff
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 5
push 0
push dword [ebp + 0x18]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00406850
mov ecx, dword [ebp + 0x1c]
mov al, byte [esi + 0x94]
and cl, 1
and al, 0xf8
shl cl, 2
or cl, al
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x98], eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x9c], eax
mov eax, esi
mov byte [esi + 0x94], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x20

Function at 0x413180
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov byte [esi + 0x68], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x4131c1
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.00413eb0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x4131e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4868d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4a3350]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x413305
cmp byte [ebx + 0x45], 0
je 0x413305
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x413234
xor al, al
jmp 0x413307
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x40]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x41329e
dec eax
je 0x4132a2
sub eax, 2
je 0x4132ee
xor bl, bl
jmp 0x4132f0
mov byte [ebx + 0x45], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x4132d4
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00423925
add esp, 0x10
cmp esi, eax
jne 0x41329a
cmp byte [ebx + 0x45], 0
je 0x4132ee
test esi, esi
jne 0x413264
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.004067a0
jmp 0x413264
mov bl, 1
cmp dword [ebp - 0x14], 0x10
jb 0x413301
push dword [ebp - 0x28]
call fcn.004235a4
add esp, 4
mov al, bl
jmp 0x413307
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042419e
mov esp, ebp
pop ebp
ret
Function at 0x415680
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
call fcn.0043f290
mov edi, eax
test edi, edi
jne 0x41569b
lea eax, [edi + 2]
pop edi
pop esi
pop ebp
ret 0x10
cmp byte [esi], 0
je 0x4156bd
push 1
push 0x29
push edi
call fcn.0043f380
push 0x4157c0
push 0x4e7e
push edi
call fcn.0043f380
add esp, 0x18
push ebx
push str.User_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_43.0.2357.130_Safari_537.36
push 0
call fcn.0043f150
mov ebx, eax
push str.Accept_Language:_zh_CN_zh_q0.8_en_US_q0.6_en_q0.5_q0.4
push ebx
call fcn.0043f150
push ebx
push 0x2727
push edi
call fcn.0043f380
push 0
push 0x29
push edi
call fcn.0043f380
push 0x49bc14
push 0x272f
push edi
call fcn.0043f380
mov eax, dword [ebp + 8]
add esp, 0x34
cmp dword [eax + 0x14], 0x10
jb 0x41570b
mov eax, dword [eax]
push eax
push 0x2712
push edi
call fcn.0043f380
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov edx, dword [eax + 0x14]
cmp edx, 0x10
jb 0x415729
mov ecx, dword [eax]
jmp 0x41572b
mov ecx, eax
cmp ecx, 0x49bc14
je 0x415749
cmp edx, 0x10
jb 0x41573a
mov eax, dword [eax]
push eax
push 0x2726
push edi
call fcn.0043f380
add esp, 0xc
push 0
push 0x4e2c
push edi
call fcn.0043f380
push 0x415830
push 0x4e2b
push edi
call fcn.0043f380
push dword [ebp + 0x10]
push 0x2711
push edi
call fcn.0043f380
push 1
push 0x63
push edi
call fcn.0043f380
push 8
push 0x4e
push edi
call fcn.0043f380
push 0xa
push 0xd
push edi
call fcn.0043f380
add esp, 0x48
push edi
call fcn.0043f2d0
push ebx
mov esi, eax
call fcn.0043f1c0
push edi
call fcn.0043f250
add esp, 0xc
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x417f20
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486d54
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4a3350]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
mov byte [ebx], 0
mov dword [ebx + 0x2c], 0xf
mov dword [ebx + 0x28], 0
mov dword [ebp - 4], 0
mov byte [ebx + 0x18], 0
mov dword [ebx + 0x44], 0xf
mov dword [ebx + 0x40], 0
mov byte [ebx + 0x30], 0
mov dword [ebx + 0x78], 0
push 0
push 0
lea ecx, [ebx + 0x7c]
mov byte [ebp - 4], 3
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x80], 0
call fcn.004186b0
mov dword [ebx + 0x7c], eax
xor ecx, ecx
mov byte [ebx + 0x54], 0
cmp byte [str.._log_], cl
mov eax, 6
mov byte [ebp - 4], 4
cmove eax, ecx
lea ecx, [ebx + 0x30]
push eax
push str.._log_
call fcn.00406980
mov dword [ebx + 0x48], 1
mov eax, ebx
mov word [ebx + 0x4c], 0x101
mov byte [ebx + 0x4e], 0
mov dword [ebx + 0x50], 0x64
mov byte [ebx + 0x55], 1
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419310
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486e68
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4a3350]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0x18], 0
mov dword [ebp - 4], 0
je 0x419449
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
call fcn.00419da0
add esp, 4
mov byte [ebp - 0x14], 0x2f
lea eax, [ebp - 0x14]
lea ecx, [ebp + 8]
push 1
push 0
push eax
call fcn.00412b60
mov esi, eax
cmp esi, 0xffffffff
je 0x419449
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
push 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp + 8]
call fcn.0041cc80
cmp dword [ebp - 0x1c], 0
mov byte [ebp - 4], 2
jbe 0x419413
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x48], 0xf
push eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
call fcn.00406850
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
cmovae eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
setne bl
cmp dword [ebp - 0x48], 0x10
jb 0x4193f6
push dword [ebp - 0x5c]
call fcn.004235a4
add esp, 4
test bl, bl
jne 0x419413
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push 0
cmovae eax, dword [ebp - 0x2c]
push eax
call edi
test eax, eax
setne al
test al, al
je 0x41947a
push 1
lea eax, [esi + 1]
mov byte [ebp - 0x14], 0x2f
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 8]
call fcn.00412b60
cmp dword [ebp - 0x18], 0x10
mov esi, eax
mov byte [ebp - 4], 1
jb 0x419440
push dword [ebp - 0x2c]
call fcn.004235a4
add esp, 4
cmp esi, 0xffffffff
jne 0x419393
mov bl, 1
cmp dword [ebp + 0x1c], 0x10
jb 0x41945c
push dword [ebp + 8]
call fcn.004235a4
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042419e
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x18], 0x10
jb 0x41948b
push dword [ebp - 0x2c]
call fcn.004235a4
add esp, 4
xor bl, bl
jmp 0x41944b
Function at 0x41bd20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48714b
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x4a3350]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x214], 0xf
mov dword [ebp - 0x218], 0
mov byte [ebp - 0x228], 0
cmp dword [ebx], 0
mov dword [ebp - 4], 0
je 0x41bdc5
jmp 0x41bd90
push dword [ebx]
lea eax, [ebp - 0x210]
push 0x200
push 1
push eax
call fcn.00426900
add esp, 0x10
lea ecx, [ebp - 0x228]
mov esi, eax
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00406670
cmp esi, 0x200
je 0x41bd90
lea eax, [ebp - 0x228]
mov ecx, edi
push eax
call fcn.00405200
cmp dword [ebp - 0x214], 0x10
jb 0x41bdea
push dword [ebp - 0x228]
call fcn.004235a4
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042419e
mov esp, ebp
pop ebp
ret 4
Function at 0x41cb80
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x41cb9c
push 6
push str.log4z_already_start__r_n
lea ecx, [esi - 0x10]
call fcn.0041c9a0
xor al, al
pop esi
ret
push edi
push 0
push 0x40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 0
lea edi, [esi - 0x10]
mov dword [esi + 0xc], eax
push edi
push 0x41cd20
push 0
push 0
call fcn.00427176
xor ecx, ecx
add esp, 0x18
cmp ecx, 0xffffffff
je 0x41cbf9
mov ecx, eax
or ecx, 0
je 0x41cbf9
push 0xbb8
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41cc06
pop edi
mov eax, 1
pop esi
ret
push str.log4z:_create_log4z_thread_error___r_n
call fcn.004262a8
add esp, 4
pop edi
xor eax, eax
pop esi
ret

Function at 0x41d5a0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4a3350]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x41d5de
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042419e
mov esp, ebp
pop ebp
ret
push 0x100
push 0x4a9150
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x41d5cd
push 0x4a9150
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x41d5cd
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
sub esi, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [esi + eax - 1], cl
test cl, cl
jne 0x41d611
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0042419e
mov esp, ebp
pop ebp
ret
Function at 0x41d630
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x487352
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x4a3350]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xd0]
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xd4], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x18
mov dword [ebp - 0xac], 0x9c
mov ecx, esi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push str.unknown_OperatingSystem.
mov byte [esi], 0
call fcn.00406980
lea eax, [ebp - 0xac]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0xd4], 1
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je case.default.0x41d7c1
mov eax, dword [ebp - 0xa8]
add eax, 0xfffffffc
cmp eax, 6
ja case.default.0x41d7c1
jmp dword [eax*4 + 0x41d860]
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x41d717
cmp eax, 0xa
je 0x41d70d
cmp eax, 0x5a
jne case.default.0x41d7c1
push str.Microsoft_Windows_Me
jmp 0x41d83b
push str.Microsoft_Windows_98
jmp 0x41d83b
mov eax, dword [ebp - 0x9c]
cmp eax, 2
jne 0x41d72c
push str.Microsoft_Windows_NT_4.0
jmp 0x41d83b
cmp eax, 1
jne case.default.0x41d7c1
push str.Microsoft_Windows_95
jmp 0x41d83b
mov eax, dword [ebp - 0xa4]
sub eax, 0
je 0x41d7a8
dec eax
je 0x41d79e
dec eax
jne case.default.0x41d7c1
cmp byte [ebp - 0x12], 1
jne 0x41d76e
cmp word [ebp - 0xd0], 9
jne 0x41d76e
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x41d83b
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x41d784
push str.Microsoft_Windows_Server_2003
jmp 0x41d83b
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je case.default.0x41d7c1
push str.Microsoft_Windows_Server_2003_R2
jmp 0x41d83b
push str.Microsoft_Windows_XP
jmp 0x41d83b
push str.Microsoft_Windows_2000
jmp 0x41d83b
mov eax, dword [ebp - 0xa4]
cmp eax, 3
ja case.default.0x41d7c1
jmp dword [eax*4 + 0x41d87c]
cmp byte [ebp - 0x12], 1
mov ecx, esi
jne 0x41d7d7
push str.Microsoft_Windows_Vista
jmp 0x41d83d
push str.Microsoft_Windows_Server_2008
jmp 0x41d83d
cmp byte [ebp - 0x12], 1
mov ecx, esi
jne 0x41d7ed
push str.Microsoft_Windows_7
jmp 0x41d83d
push str.Microsoft_Windows_Server_2008_R2
jmp 0x41d83d
cmp byte [ebp - 0x12], 1
mov ecx, esi
jne 0x41d803
push str.Microsoft_Windows_8
jmp 0x41d83d
push str.Microsoft_Windows_Server_2012
jmp 0x41d83d
cmp byte [ebp - 0x12], 1
mov ecx, esi
jne 0x41d819
push str.Microsoft_Windows_8.1
jmp 0x41d83d
push str.Microsoft_Windows_Server_2012_R2
jmp 0x41d83d
cmp dword [ebp - 0xa4], 0
jne case.default.0x41d7c1
cmp byte [ebp - 0x12], 1
jne 0x41d836
push str.Microsoft_Windows_10
jmp 0x41d83b
push str.Microsoft_Windows_Server_2016_Technical_Preview
mov ecx, esi
call fcn.004129f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042419e
mov esp, ebp
pop ebp
ret
Function at 0x41d9c0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4a3350]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push esi
push eax
push 0
mov dword [ebp - 8], 0
call sub.IPHLPAPI.DLL_GetAdaptersInfo
push dword [ebp - 8]
call fcn.00426a3c
add esp, 4
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 8]
push ecx
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov ecx, dword [ebp - 0xc]
xor esi, esi
test ecx, ecx
je 0x41da5e
push edi
xor edi, edi
cmp dword [ecx + 0x190], esi
jle 0x41da5d
lea edx, [ecx + 0x194]
lea esp, [esp]
lea eax, [ebx + esi]
push eax
movzx eax, byte [edx + edi]
push eax
call fcn.0041d980
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, dword [ecx + 0x190]
dec eax
cmp edi, eax
jge 0x41da46
mov byte [ebx + esi + 2], 0x3a
jmp 0x41da4b
mov byte [ebx + esi + 2], 0x23
inc edi
lea edx, [ecx + 0x194]
add esi, 3
cmp edi, dword [ecx + 0x190]
jl 0x41da20
pop edi
push ecx
call fcn.004239a7
add esp, 4
test esi, esi
jle 0x41da82
mov byte [ebx + esi - 1], 0
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042419e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call fcn.0042419e
mov esp, ebp
pop ebp
ret

Function at 0x41daa0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4a3350]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor bl, bl
push 0x288
mov dword [ebp - 0x1c], 0x288
call fcn.00426a3c
mov esi, eax
add esp, 4
test esi, esi
jne 0x41dae5
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042419e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x41db0b
push esi
call fcn.004239a7
push dword [ebp - 0x1c]
call fcn.00426a3c
mov esi, eax
add esp, 8
test esi, esi
je 0x41dad2
lea eax, [ebp - 0x1c]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x41dba9
mov eax, esi
test esi, esi
je 0x41dba9
cmp dword [eax + 0x1a0], 6
jne 0x41db39
cmp dword [eax + 0x190], 6
je 0x41db41
mov eax, dword [eax]
test eax, eax
jne 0x41db27
jmp 0x41dba9
movzx ecx, byte [eax + 0x199]
xorps xmm0, xmm0
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
movdqu xmmword [ebp - 0x17], xmm0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
call fcn.00425315
movdqu xmm0, xmmword [ebp - 0x18]
mov eax, dword [ebp - 8]
add esp, 0x20
mov bl, 1
movdqu xmmword [edi], xmm0
mov dword [edi + 0x10], eax
push esi
call fcn.004239a7
mov ecx, dword [ebp - 4]
add esp, 4
mov al, bl
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0042419e
mov esp, ebp
pop ebp
ret
Function at 0x41dbd0
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4a3350]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor bl, bl
push 0x178
mov dword [ebp - 0x1c], 0x178
call fcn.00426a3c
mov esi, eax
add esp, 4
test esi, esi
jne 0x41dc15
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042419e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
push eax
push esi
push 0
push 0
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x41dc41
push esi
call fcn.004239a7
push dword [ebp - 0x1c]
call fcn.00426a3c
mov esi, eax
add esp, 8
test esi, esi
je 0x41dc02
lea eax, [ebp - 0x1c]
push eax
push esi
push 0
push 0
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x41dcc5
mov eax, esi
test esi, esi
je 0x41dcc5
jmp 0x41dc60
cmp dword [eax + 0x34], 6
je 0x41dc6f
mov eax, dword [eax + 8]
test eax, eax
jne 0x41dc60
jmp 0x41dcc5
movzx ecx, byte [eax + 0x31]
xorps xmm0, xmm0
push ecx
movzx ecx, byte [eax + 0x30]
push ecx
movzx ecx, byte [eax + 0x2f]
push ecx
movzx ecx, byte [eax + 0x2e]
push ecx
movzx ecx, byte [eax + 0x2d]
movzx eax, byte [eax + 0x2c]
push ecx
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
movdqu xmmword [ebp - 0x17], xmm0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
call fcn.00425315
movdqu xmm0, xmmword [ebp - 0x18]
mov eax, dword [ebp - 8]
add esp, 0x20
mov bl, 1
movdqu xmmword [edi], xmm0
mov dword [edi + 0x10], eax
push esi
call fcn.004239a7
mov ecx, dword [ebp - 4]
add esp, 4
mov al, bl
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0042419e
mov esp, ebp
pop ebp
ret

Function at 0x41dd70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4a3350]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x107]
push 0x103
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.00424c50
push 0x103
lea eax, [ebp - 0x20b]
mov byte [ebp - 0x20c], 0
push 0
push eax
call fcn.00424c50
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x20c]
push eax
push 5
lea eax, [ebp - 0x108]
push str._echo_off_nchoice__t__d__d_y__n__nul_ndel___s__ndel___0_n
push eax
call fcn.00425315
push 0x48b5c8
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push esi
push eax
call fcn.00425d40
mov eax, dword [ebp - 0x210]
add esp, 0x1c
pop esi
test eax, eax
jne 0x41de24
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042419e
mov esp, ebp
pop ebp
ret
push eax
push 1
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00423925
push dword [ebp - 0x210]
call fcn.00423755
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
mov eax, 1
call fcn.0042419e
mov esp, ebp
pop ebp
ret