joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407dd0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x124
xor eax, eax
mov dword [esp + 5], eax
push esi
lea ecx, [esp + 8]
mov dword [esp + 0xd], eax
mov dword [esp + 0x11], eax
push ecx
push 0x4d000001
xor esi, esi
mov byte [esp + 0x10], 0
mov dword [esp + 0x1d], eax
mov dword [esp + 0xc], eax
call fcn.00405230
lea edx, [esp + 0x18]
push edx
push 1
call fcn.00405230
mov ecx, dword [esp + 0x140]
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.00405230
add esp, 0x18
push 0xff
lea edx, [esp + 0x2c]
push edx
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x407f70
lea eax, [esp + 0x28]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x407e50
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov esi, dword [edx]
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00405230
mov edx, dword [esp + 0x134]
push 0x11
lea ecx, [esp + 0x14]
push ecx
push edx
mov byte [esp + 0x2c], 1
call fcn.00404b80
add esp, 0x14
test eax, eax
je 0x407e88
mov eax, 0xe40001
pop esi
add esp, 0x124
ret
push ebx
push ebp
lea eax, [esp + 0x24]
push edi
push eax
or ebx, 0xffffffff
call fcn.0041141f
add esp, 4
xor ebp, ebp
lea ecx, [ecx]
mov esi, dword [esp + 0x140]
mov eax, dword [esp + 0x138]
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x14]
push edx
push esi
push eax
call fcn.00404da0
add esp, 0x10
test eax, eax
jne 0x407f37
mov esi, dword [esp + 0x10]
push esi
call fcn.00405200
add esp, 4
cmp eax, 0x4d000003
jne 0x407f15
lea ecx, [esi + 4]
push ecx
call fcn.00405200
add esi, 8
push esi
mov edi, eax
call fcn.00405200
mov ecx, dword [esp + 0x144]
add esp, 8
cmp edi, ecx
jne 0x407f15
cmp eax, 0x10000
jne 0x407f07
xor ebx, ebx
jmp 0x407f10
cmp eax, 0x2bad2bad
jne 0x407f15
mov ebx, eax
mov ebp, 1
mov edx, dword [esp + 0x10]
push edx
call fcn.004051c0
add esp, 4
test ebp, ebp
je 0x407ea0
pop edi
pop ebp
mov eax, ebx
pop ebx
pop esi
add esp, 0x124
ret
cmp eax, 0xfffffff4
je 0x407f2a
cmp eax, 0xfffffff5
je 0x407f2a
cmp eax, 0xffffff9d
je 0x407f2a
lea eax, [esp + 0x2c]
push eax
call fcn.0041141f
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x2c]
add esp, 4
cmp ecx, esi
jle 0x407ea0
pop edi
pop ebp
mov eax, ebx
pop ebx
pop esi
add esp, 0x124
ret
or eax, 0xffffffff
pop esi
add esp, 0x124
ret
Function at 0x407f80
Capabilities:
Connect socket
Get socket status
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x2b0
mov eax, dword [esp + 0x2b4]
push ebx
push ebp
mov ebp, 1
xor ebx, ebx
test eax, eax
mov dword [esp + 8], ebp
je 0x4080f6
cmp byte [eax], 0
je 0x4080f6
push esi
push edi
push eax
call sub.WSOCK32.dll_inet_addr
push ebx
push ebp
push 2
mov edi, eax
call sub.WSOCK32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x407ffd
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x276d
jne 0x408063
lea eax, [esp + 0x130]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x408063
push eax
push ebp
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
je 0x40805e
mov ebx, ebp
lea ecx, [esp + 0x10]
push ecx
push 0x8004667e
push esi
mov dword [esp + 0x1c], ebp
call sub.WSOCK32.dll_ioctlsocket
mov edx, dword [esp + 0x2c8]
push edx
mov word [esp + 0x20], 2
mov dword [esp + 0x24], edi
call sub.WSOCK32.dll_htons
mov word [esp + 0x1e], ax
push 0x10
lea eax, [esp + 0x20]
push eax
push esi
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x408071
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x408071
push 2
push esi
call sub.WSOCK32.dll_shutdown
push esi
call sub.WSOCK32.dll_closesocket
test ebx, ebx
je 0x408063
call fcn.00410b82
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2b0
ret
mov eax, dword [esp + 0x2cc]
xor ecx, ecx
cmp eax, ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
jge 0x408096
mov dword [esp + 0x14], ebp
lea edx, [esp + 0x14]
push edx
push 0
lea eax, [esp + 0x34]
push eax
push 0
push 0
call sub.WSOCK32.dll_select
push 2
push esi
mov edi, eax
call sub.WSOCK32.dll_shutdown
push esi
call sub.WSOCK32.dll_closesocket
test ebx, ebx
je 0x4080c4
call fcn.00410b82
cmp edi, 0xffffffff
je 0x408063
lea ecx, [esp + 0x2c]
push ecx
push esi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x4080e9
test edi, edi
jle 0x4080e9
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x2b0
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2b0
ret
Function at 0x4098c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8c
push esi
push edi
mov ecx, 0xb
mov esi, str.SystemCurrentControlSetServicesVxDKaseya
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 8]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x20]
push ecx
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4099ca
mov eax, dword [0x41e96c]
mov ecx, dword [0x41e970]
mov edx, dword [str.ConfigurationFile]
mov esi, dword [esp + 0x98]
mov dword [esp + 0x18], eax
mov ax, word [0x41e978]
mov dword [esp + 0x1c], ecx
mov word [esp + 0x24], ax
mov dword [esp + 0x14], edx
mov edx, dword [0x41e974]
xor eax, eax
mov ecx, 0x41
mov edi, esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push esi
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
push edx
stosb byte es:[edi], al
push 0
lea eax, [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x24], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
push edx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x40999e
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409990
sub eax, edx
cmp eax, 1
jae 0x4099f4
mov eax, dword [str..kaseyad.ini]
mov dword [esi], eax
mov ecx, dword [0x41e95c]
mov dword [esi + 4], ecx
mov edx, dword [0x41e960]
mov dword [esi + 8], edx
mov ax, word [0x41e964]
pop edi
mov word [esi + 0xc], ax
pop esi
add esp, 0x8c
ret
mov edx, dword [str..kaseyad.ini]
mov ecx, dword [esp + 0x98]
mov dword [ecx], edx
mov eax, dword [0x41e95c]
mov dword [ecx + 4], eax
mov edx, dword [0x41e960]
mov dword [ecx + 8], edx
mov ax, word [0x41e964]
mov word [ecx + 0xc], ax
pop edi
pop esi
add esp, 0x8c
ret
Function at 0x409de0
Capabilities:
Check os version
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x160c
call fcn.004116a0
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x218], bl
mov ecx, 0x4ff
lea edi, [esp + 0x219]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 0x78]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x78]
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x7c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x409f9f
cmp dword [esp + 0x7c], 6
jb 0x409f9f
push str.Kernel32.dll
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
je 0x409f9f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WTSGetActiveConsoleSessionId
push esi
call edi
mov dword [esp + 0x1c], eax
call fcn.0040b0e0
test eax, eax
je 0x409eb3
push str.Wow64DisableWow64FsRedirection
push esi
call edi
push str.Wow64RevertWow64FsRedirection
push esi
mov ebx, eax
call edi
test ebx, ebx
mov dword [esp + 0xc], eax
je 0x409eb3
test eax, eax
je 0x409eb3
lea ecx, [esp + 0x14]
push ecx
call ebx
test eax, eax
je 0x409eb3
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x409f7c
call eax
mov ebx, eax
cmp ebx, 0xffffffff
je 0x409f7c
xor edx, edx
xor eax, eax
mov dword [esp + 0x20], edx
mov ecx, 0x11
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
mov word [esp + 0x60], ax
mov dword [esp + 0x24], edx
push 0x104
lea eax, [esp + 0x114]
mov dword [esp + 0x2c], edx
mov edi, 1
push eax
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x64], edi
mov dword [esp + 0x34], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x409f7c
mov ecx, dword [ebp + 8]
push ecx
push ebx
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0x224]
push str._smsg.exe__d__TIME:120__W__s
push eax
call fcn.00411276
add esp, 0x14
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x238]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x409f7c
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esp + 0x24]
push edx
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409f8d
mov eax, dword [esp + 0x14]
push eax
call dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a4e0
Capabilities:
Set registry value

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
lea eax, [esp]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push 0
or edx, 0xf003f
push edx
push 0
push 0
push 0
push eax
push ecx
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40a554
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push esi
push edx
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
sbb eax, eax
and eax, 0xfffffffe
pop esi
pop ecx
ret
or eax, 0xffffffff
pop ecx
ret

Function at 0x40a590
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x28]
mov eax, dword [esi]
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x14]
or edx, 0x20019
push edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
push 0
push eax
push ecx
mov dword [esp + 0x18], 0
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a669
mov ecx, dword [esi]
mov edx, dword [esp + 0x24]
push ebx
mov ebx, ecx
shr ecx, 2
push edi
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40a645
lea ecx, [esp + 0x10]
push ecx
push edx
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x30]
push ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40a62c
pop edi
pop ebx
mov eax, 0xfffffffe
pop esi
add esp, 8
ret
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
pop edi
mov dword [edx], eax
pop ebx
mov dword [esi], ecx
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], 0x1020001
pop ebx
mov dword [esi], 0
xor eax, eax
pop esi
add esp, 8
ret
or eax, 0xffffffff
pop esi
add esp, 8
ret
Function at 0x40a6b0
Capabilities:
Check os version
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea eax, [esp + 0xc]
push eax
or ecx, 0xf003f
push ecx
xor edi, edi
push edi
push ebx
push edx
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x40a81a
mov ecx, dword [esp + 0xc]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0x2c]
push eax
push edi
push edi
push edi
push ecx
mov dword [esp + 0x40], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov esi, eax
cmp esi, edi
jne 0x40a76d
mov edi, dword [esp + 0x10]
dec edi
js 0x40a76d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea esp, [esp]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x34]
push ecx
push edi
push edx
mov dword [esp + 0x34], 0x104
call ebx
mov esi, eax
test esi, esi
jne 0x40a76a
mov eax, dword [ebp + 0x10]
mov edx, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x24]
push ecx
push edx
call fcn.0040a6b0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40a76a
dec edi
jns 0x40a720
mov ebx, dword [ebp + 0xc]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40a818
mov eax, dword [0x426f58]
test eax, eax
jne 0x40a7e9
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
mov esi, 1
je 0x40a7e3
mov eax, dword [esp + 0x24]
cmp eax, 5
ja 0x40a7c3
jne 0x40a7e3
cmp dword [esp + 0x28], esi
jb 0x40a7e3
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x40a7e3
push str.RegDeleteKeyExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x426f5c], eax
mov dword [0x426f58], esi
mov eax, dword [0x426f5c]
test eax, eax
je 0x40a806
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push 0
push edx
push ebx
push ecx
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a830
Capabilities:
Delete registry value

Disassembly:
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x40a88d
cmp byte [esi], 0
je 0x40a88d
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0xc]
or ecx, 0x20006
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a888
mov ecx, dword [esp + 0x14]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40a8af
mov eax, 0xfffffffe
pop esi
ret
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
push eax
push ecx
push edx
call fcn.0040a6b0
add esp, 0xc
test eax, eax
je 0x40a8af
mov eax, 0xfffffffd
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x40aed0
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x2c]
test edi, edi
mov dword [esp + 4], 0
jg 0x40af03
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
add esp, 0x14
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
push esi
mov dword [esp + 0x10], edx
lea edx, [esp + 8]
push edx
push 0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push eax
push 0x40aea0
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x3c]
push 0
push 0
mov dword [esp + 0x30], ecx
call fcn.00411394
mov esi, eax
add esp, 0x18
test esi, esi
je 0x40afa1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
imul edi, edi, 0x3e8
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
jne 0x40af7f
lea ecx, [esp + 0x30]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x30]
pop esi
pop edi
add esp, 0x14
ret
push 0xffffffffffffff9c
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
mov dword [esp + 0x34], 0xffffff9c
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x30]
pop esi
pop edi
add esp, 0x14
ret
pop esi
or eax, 0xffffffff
pop edi
add esp, 0x14
ret

Function at 0x40afb0
Capabilities:
Delete file

Disassembly:
mov al, byte [0x426f60]
test al, al
jne 0x40b009
push 0x104
push 0x426f60
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40afe5
push 0x2e
push 0x426f60
call fcn.00410d80
add esp, 8
test eax, eax
je 0x40afe5
mov byte [eax], 0
push edi
mov edi, 0x426f60
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40aff0
mov eax, dword [str..log]
mov cl, byte [0x41eb38]
mov dword [edi], eax
mov byte [edi + 4], cl
pop edi
push 0x426f60
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret
Function at 0x40b020
Capabilities:
Write file on windows

Disassembly:
push ecx
mov al, byte [0x426f60]
test al, al
je 0x40b092
push esi
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push 0x426f60
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b091
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40b08a
mov edx, dword [esp + 0xc]
mov eax, edx
push edi
lea edi, [eax + 1]
jmp 0x40b070
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b070
push 0
lea ecx, [esp + 0xc]
push ecx
sub eax, edi
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret

Function at 0x40b0e0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc4
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x30]
push eax
xor ebx, ebx
mov dword [esp + 0x34], 0x9c
call esi
test eax, eax
jne 0x40b131
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], 0x94
call esi
test eax, eax
jne 0x40b131
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x34]
cmp eax, 6
jae 0x40b146
cmp eax, 5
jne 0x40b180
cmp dword [esp + 0x38], 2
jne 0x40b180
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b173
lea ecx, [esp + 0xc]
push ecx
call eax
cmp word [esp + 0xc], 9
jne 0x40b180
mov ebx, 1
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b190
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebp
push edi
mov edi, dword [esp + 0x14]
or ebp, 0xffffffff
test edi, edi
mov dword [esp + 8], 0
jne 0x40b1b3
pop edi
mov eax, 0x57
pop ebp
add esp, 8
ret
push ebx
push esi
lea eax, [esp + 0x10]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jbe 0x40b26e
push esi
call fcn.00411be5
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40b276
mov ecx, dword [esp + 0x10]
push ebx
push esi
push ecx
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40b253
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push 0x41e840
xor esi, esi
push ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40b253
cmp dword [esp + 0x1c], 0x34
jne 0x40b25b
mov ecx, dword [esp + 0x14]
cmp dword [ecx], 0xfeef04bd
jne 0x40b25b
mov eax, dword [esp + 0x20]
cmp eax, esi
je 0x40b231
mov edx, dword [ecx + 8]
mov dword [eax], edx
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x40b23e
mov ecx, dword [ecx + 0xc]
mov dword [eax], ecx
push ebx
xor ebp, ebp
call fcn.00411acd
add esp, 4
pop esi
pop ebx
pop edi
mov eax, ebp
pop ebp
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
push ebx
call fcn.00411acd
add esp, 4
pop esi
pop ebx
pop edi
mov eax, ebp
pop ebp
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
pop esi
pop ebx
pop edi
mov eax, ebp
pop ebp
add esp, 8
ret
Function at 0x40c130
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xcc4
push ebx
push esi
push edi
xor ebx, ebx
mov esi, eax
xor eax, eax
cmp esi, ebx
mov ecx, 0x104
lea edi, [esp + 0x429]
mov byte [esp + 0x428], bl
rep stosd dword es:[edi], eax
mov ecx, 0x104
lea edi, [esp + 0x11]
mov byte [esp + 0x10], bl
rep stosd dword es:[edi], eax
je 0x40c280
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x40c280
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40c280
cmp byte [edi], bl
je 0x40c280
cmp byte [eax], bl
je 0x40c280
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40c1a0
sub eax, edx
dec eax
cmp eax, ebx
jl 0x40c1ba
cmp byte [eax + esi], 0x5c
jne 0x40c1ba
mov byte [esp + 0xc], bl
jmp 0x40c1c3
mov byte [esp + 0xc], 0x5c
mov byte [esp + 0xd], bl
mov eax, dword [ebp + 0xc]
push edi
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
lea edx, [esp + 0x438]
push str._s_s_s_s
push edx
call fcn.00411276
push edi
lea eax, [esp + 0x28]
push eax
push esi
lea ecx, [esp + 0x34]
push str._s_s_s
push ecx
call fcn.00411276
add esp, 0x2c
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40c21d
test al, 1
je 0x40c21d
push 0x80
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x430]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x40c240
xor esi, esi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 8]
cmp edi, ebx
mov esi, 0xfffffffe
je 0x40c277
lea eax, [esp + 0x428]
push eax
lea ecx, [esp + 0x844]
push str.Failed_to_rename_K_VNC_file__s._r_n
push ecx
call fcn.00411276
lea edx, [esp + 0x84c]
push edx
push edi
call fcn.0040b0a0
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d370
Capabilities:
Get common file path

Disassembly:
sub esp, 0x110
push ebx
push esi
mov esi, dword [esp + 0x11c]
xor ebx, ebx
cmp esi, ebx
je 0x40d491
push 0x104
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x40d491
lea eax, [esp + 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d3a8
sub eax, edx
mov cl, byte [esp + eax + 0x13]
push edi
lea edi, [esp + 0x18]
dec edi
cmp cl, 0x5c
jne 0x40d3e5
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d3c0
mov ecx, dword [str.mstsc.exe]
mov edx, dword [0x41f02c]
mov ax, word [0x41f030]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov word [edi + 8], ax
jmp 0x40d411
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d3e5
mov ecx, dword [0x41f01c]
mov edx, dword [0x41f020]
mov ax, word [0x41f024]
mov dword [edi], ecx
mov cl, byte [0x41f026]
mov dword [edi + 4], edx
mov word [edi + 8], ax
mov byte [edi + 0xa], cl
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.0040b190
add esp, 0xc
test eax, eax
pop edi
jne 0x40d491
mov ecx, dword [esp + 0xc]
mov eax, ecx
movzx edx, cx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
shr ecx, 0x10
cmp eax, 6
jg 0x40d455
jne 0x40d491
cmp edx, ebx
jg 0x40d455
jne 0x40d491
cmp ecx, 0x1771
jl 0x40d491
push str.connect_to_console:i:
push esi
call fcn.0040b280
add esp, 8
cmp eax, ebx
je 0x40d491
lea edx, [esp + 8]
push edx
add eax, 0x15
push str._d_r
push eax
mov dword [esp + 0x14], ebx
call fcn.00412065
add esp, 0xc
cmp eax, 1
jne 0x40d491
cmp dword [esp + 8], ebx
jle 0x40d491
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
add esp, 0x110
ret