joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101c4e8f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.101c50fc
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x101c4ecb
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x101d8ff4], 0xc6c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov dword [0x101d8ff8], 0x241c
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x101c4ffd
jmp 0x101c4f4a
mov al, byte [ebp - 0x31]
test al, 1
jne 0x101c4fce
jmp 0x101c4fa8
mov eax, dword [ebp - 0x38]
add eax, 1
mov cl, byte [ebp - 0x39]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x31]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x40], eax
jne 0x101c4f76
jmp 0x101c4f10
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x54]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x39], bh
mov byte [ebp - 0x31], cl
je 0x101c4f10
jmp 0x101c4f20
xor eax, eax
mov ecx, dword [ebp - 0x50]
add ecx, 2
mov edx, dword [ebp - 0x4c]
add edx, 1
mov esi, dword [ebp - 0x2c]
cmp edx, esi
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x30], eax
jb 0x101c4f5c
jmp 0x101c4ffd
mov eax, dword [ebp - 0x50]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov dword [0x101d8ff8], 0x22be
mov ecx, dword [edx + ecx*4]
mov dword [0x101d8ff4], 0x4c8
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101c526c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x101d8ffc], 0
mov dword [0x101d9000], 0
mov dword [0x101d900c], 0
mov ebx, dword [0x101d8ff4]
add ebx, 0xffffec41
mov dword [0x101d8ff8], ebx
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x101c52fc
mov dword [0x101d8ff8], 0x22fd
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x101d9000]
mov ecx, dword [0x101d8ffc]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov edi, edx
add edi, 1
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101d8ffc], edx
mov ecx, dword [ebp - 0x20]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x30]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x101d9000], edx
mov dword [0x101d8ff8], 0x63e
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x101d9004], cl
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x101d9004]
mov edx, dword [0x101d9000]
mov byte [ebx + edx], cl
mov edx, dword [0x101d8ffc]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x101d9000]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x101d900c], ecx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x34]
mov ch, byte [edx + esi]
mov dword [0x101d8ff8], 0xff5
mov dword [0x101d8ff4], 0xc9e
xor ch, cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x2c], edi
je 0x101c52d3
jmp 0x101c52e5
Function at 0x101c53d1
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov edx, dword [0x101d8ff4]
mov esi, edx
add esi, 0xffffddef
mov dword [0x101d8ff8], esi
add edx, 0xfffff1ae
mov dword [0x101d8ff4], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.101c4bcb
lea ecx, [0x101c40e5]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x70], edx
mov dword [esp + 0x50], 0x156e00
mov edx, dword [0x101d8fe0]
mov dword [esp + 0x40], edx
mov edx, dword [0x101d8fe4]
mov dword [esp + 0x28], edx
mov dword [0x101d8ff4], 0x1a6c
mov edx, dword [0x101d8fe8]
mov dword [esp + 0x6c], edx
mov edx, dword [0x101d8fec]
mov dword [esp + 0x64], edx
mov edx, dword [0x101d8ff0]
mov dword [esp + 0x38], edx
mov edx, dword [0x101d8ff8]
add edx, 0xc86
mov dword [0x101d8ff8], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x101c54c2
mov eax, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [0x101d8ff8], 0x8e8
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x60], edx
mov dword [0x101d8ff4], 0x1277
call fcn.101c497f
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
je 0x101c54f9
jmp 0x101c5530
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x101c54e5
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x101c5486
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x101c54c2
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.101c4511
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x101d8ff8], 0xd4a
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401029
or eax, 0xffffffff
jmp 0x40103c
mov edx, dword [ebp - 4]
and edx, 1
je 0x40103a
mov eax, 1
jmp 0x40103c
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4010e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0xfffffc19
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xffffffff
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 0xc], 0
jle 0x4011a9
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401b20
add esp, 0xc
push 0
push 0x8000080
push 3
push 0
push 3
push SysReAllocString
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x40115d
mov dword [ebp - 0xc], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x4011a9
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40118b
mov dword [ebp - 0xc], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x4011a9
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 4]
je 0x40119c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
jmp 0x4011a9
cmp dword [ebp - 0x10], 0xffffffff
je 0x4011b9
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4011d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0xfffffc19
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xffffffff
cmp dword [ebp + 0xc], 0
jle 0x401289
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x401233
mov dword [ebp - 0xc], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x401289
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401261
mov dword [ebp - 0xc], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x401289
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 4]
je 0x40127b
mov dword [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x401282
mov dword [ebp - 0xc], 0
jmp 0x401289
cmp dword [ebp - 0x10], 0xffffffff
je 0x401299
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4012b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0xfffffc19
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xffffffff
cmp dword [ebp + 0xc], 0
jle 0x40138e
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x401313
mov dword [ebp - 0xc], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x40138e
push 2
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40133a
mov dword [ebp - 0xc], 0xfffffffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x40138e
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401366
mov dword [ebp - 0xc], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 4]
je 0x401380
mov dword [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x401387
mov dword [ebp - 0xc], 0
jmp 0x40138e
cmp dword [ebp - 0x10], 0xffffffff
je 0x40139e
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x401b06
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43e2c4]
jne 0x401b10
repz ret
jmp fcn.00403d6b
Function at 0x40a0e0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404a90
and dword [ebp - 4], 0
cmp dword [0x440338], 0
mov ebx, eax
jne 0x40a191
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a242
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42e754
push edi
call esi
test eax, eax
je 0x40a242
push eax
call fcn.00404a1e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x440338], eax
call esi
push eax
call fcn.00404a1e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44033c], eax
call esi
push eax
call fcn.00404a1e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x440340], eax
call esi
push eax
call fcn.00404a1e
pop ecx
mov dword [0x440348], eax
test eax, eax
je 0x40a191
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404a1e
pop ecx
mov dword [0x440344], eax
mov eax, dword [0x440344]
cmp eax, ebx
je 0x40a1e9
cmp dword [0x440348], ebx
je 0x40a1e9
push eax
call fcn.00404a99
push dword [0x440348]
mov esi, eax
call fcn.00404a99
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a1e9
test edi, edi
je 0x40a1e9
call esi
test eax, eax
je 0x40a1e0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a1e0
test byte [ebp - 0xc], 1
jne 0x40a1e9
or dword [ebp + 0x10], 0x200000
jmp 0x40a222
mov eax, dword [0x44033c]
cmp eax, ebx
je 0x40a222
push eax
call fcn.00404a99
pop ecx
test eax, eax
je 0x40a222
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a222
mov eax, dword [0x440340]
cmp eax, ebx
je 0x40a222
push eax
call fcn.00404a99
pop ecx
test eax, eax
je 0x40a222
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x440338]
call fcn.00404a99
pop ecx
test eax, eax
je 0x40a242
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a244
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b2f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x43e2c4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x43ef50], 0xffffffff
je 0x40b3ea
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x40c]
push ecx
movzx edx, word [ebp - 0x40e]
push edx
movzx eax, word [ebp - 0x410]
push eax
movzx ecx, word [ebp - 0x412]
push ecx
movzx edx, word [ebp - 0x416]
push edx
movzx eax, word [ebp - 0x418]
push eax
push str.__04d__02d__02d__02d:_02d:_02d__
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
lea edx, [ebp + 0xc]
mov dword [ebp - 0x420], edx
mov eax, dword [ebp - 0x420]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x3f2]
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jle 0x40b3d9
mov dword [ebp - 0x424], 0
push 0x42ef40
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0x408]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [0x43ef50]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x420], 0
jmp 0x40b3ea
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b06
mov esp, ebp
pop ebp
ret

Function at 0x40b400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc24
mov eax, dword [0x43e2c4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x43ef50], 0xffffffff
je 0x40b533
lea eax, [ebp - 0xc18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x400
push 0
lea ecx, [ebp - 0xc08]
push ecx
call fcn.00401b20
add esp, 0xc
movzx edx, word [ebp - 0xc0c]
push edx
movzx eax, word [ebp - 0xc0e]
push eax
movzx ecx, word [ebp - 0xc10]
push ecx
movzx edx, word [ebp - 0xc12]
push edx
movzx eax, word [ebp - 0xc16]
push eax
movzx ecx, word [ebp - 0xc18]
push ecx
push 0x42eed8
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc20], eax
mov ecx, dword [ebp - 0xc20]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x7dc]
push eax
call dword [sym.imp.USER32.dll_wvsprintfW]
mov dword [ebp - 0xc1c], eax
cmp dword [ebp - 0xc1c], 0
jle 0x40b522
mov dword [ebp - 0xc24], 0
push 0
push 0
push 0x3ff
lea ecx, [ebp - 0xc08]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x808]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x42eed4
lea eax, [ebp - 0xc08]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea ecx, [ebp - 0xc24]
push ecx
lea edx, [ebp - 0xc08]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xc08]
push eax
mov ecx, dword [0x43ef50]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc20], 0
jmp 0x40b533
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b06
mov esp, ebp
pop ebp
ret
Function at 0x40b9f0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 1
jne 0x40ba16
mov dword [ebp - 4], str.RootCIMV2
jmp 0x40ba1d
mov dword [ebp - 4], str.RootWMI
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x210], 0
jne 0x40ba70
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x40ba70
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 1
je 0x40ba70
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._CoInitializeEx_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
jmp 0x40bbe5
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x210], 0
jne 0x40bae7
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x40bada
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 0x80010119
je 0x40bada
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._CoInitializeSecurity_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 2
jmp 0x40bbe5
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x210], 1
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x214], 0
jne 0x40bb4b
mov dword [ebp - 0x10], 7
mov ecx, dword [ebp - 0x18]
add ecx, 0x214
push ecx
push 0x42d46c
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0x42d53c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x40bb4b
mov eax, dword [ebp - 0x18]
mov dword [eax], str._CoCreateInstance_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 3
jmp 0x40bbe5
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x218], 0
jne 0x40bbde
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
add eax, 0x218
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x214]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x214]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0xc]
call ecx
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x20c], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 0
je 0x40bbd4
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._ConnectServer_Call_Error
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x218], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 4
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x40bbe5
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x40bd90
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x40bde3
mov dword [ebp - 0x14], 0xffffffff
jmp 0x40bead
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
jmp 0x40bdfe
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jae 0x40bea6
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 5
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
push edx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x40be3c
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x40bea6
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
cmp edx, dword [ebp - 4]
jne 0x40be64
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x4585a8
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x40be8b
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x4585a0]
shl eax, 8
add eax, 0x4586a8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [0x4585a0]
add ecx, 1
mov dword [0x4585a0], ecx
cmp dword [ebp - 0x10], 0
je 0x40bea1
mov edx, dword [ebp - 0x10]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x10], 0
jmp 0x40bdf5
jmp 0x40bead
cmp dword [ebp - 0x10], 0
je 0x40bebc
mov eax, dword [ebp - 0x10]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
cmp dword [ebp - 0x18], 0
je 0x40becb
mov ecx, dword [ebp - 0x18]
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x40c190
Capabilities:
Prepare http request
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], str.Accept:___r_nPragma:_no_cache_r_nCache_Control:_no_cache_r_n
mov dword [ebp - 0x20], str.Content_Type:_application_x_www_form_urlencoded_r_n
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0x42f274
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40c1e6
mov edx, dword [ebp - 0x20]
mov dword [ebp - 4], edx
cmp dword [ebp + 0x10], 0
je 0x40c20c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 8], eax
mov eax, dword [0x43ef6c]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x248
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x40c254
mov dword [ebp - 0x1c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x40c2b5
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x40c28b
mov dword [ebp - 0x1c], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x40c2b5
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x40c2ae
mov dword [ebp - 0x1c], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x40c2b5
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 0xc