joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401cd0
Capabilities:
Capture screenshot

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov esi, dword [esp + 0x70]
mov dword [esp], esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esp, 4
mov edi, eax
mov dword [esp], 0
call ebx
sub esp, 4
mov ebp, eax
mov dword [esp + 0x44], eax
mov dword [esp], 1
call ebx
sub esp, 4
mov dword [esp + 0x48], eax
lea eax, [eax + 1]
mov dword [esp + 0x4c], eax
lea eax, [ebp + 1]
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], 0x32
mov dword [esp + 0x70], esi
lea esi, [esi]
nop
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
idiv dword [esp + 0x40]
mov esi, edx
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
idiv dword [esp + 0x4c]
mov ebp, edx
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
mov ebx, eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
mov dword [esp + 0x20], 0xcc0020
mov ecx, eax
mov eax, 0x63e7063f
mov dword [esp + 0x14], edi
imul ecx
mov eax, ecx
mov dword [esp + 8], ebp
sar eax, 0x1f
mov dword [esp + 4], esi
mov dword [esp], edi
sar edx, 4
sub edx, eax
lea eax, [edx + edx*4]
lea eax, [edx + eax*8]
sub ecx, eax
lea eax, [ebp + ecx - 0x14]
mov dword [esp + 0x1c], eax
mov eax, 0x63e7063f
imul ebx
mov eax, ebx
sar eax, 0x1f
sar edx, 4
sub edx, eax
lea eax, [edx + edx*4]
lea eax, [edx + eax*8]
sub ebx, eax
lea eax, [esi + ebx - 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], eax
call dword [sym.imp.GDI32.dll_BitBlt]
sub esp, 0x24
mov dword [esp], 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
sub dword [esp + 0x3c], 1
jne 0x401d30
mov esi, dword [esp + 0x70]
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.USER32.dll_ReleaseDC]
sub esp, 8
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4020b8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00403094
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
Function at 0x402c8c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x402cab
mov eax, 0
jmp 0x402cef
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x402cce
mov eax, 0
jmp 0x402cef
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x402cea
mov eax, 0
jmp 0x402cef
mov eax, 1
leave
ret

Function at 0x402cf1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x402d50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x402d48
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x402d48
mov eax, dword [ebp - 4]
jmp 0x402d64
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x402d25
mov eax, 0
leave
ret
Function at 0x403430
Capabilities:
Create thread
Set console window title

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
call fcn.00401eec
mov dword [esp], 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov dword [esp], eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_srand
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401ca0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401590
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401890
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401940
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4016c0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401620
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4017b0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x4c], eax
call edi
lea edx, [ebp - 0x40]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
sub ebx, dword [ebp - 0x40]
sub esi, dword [ebp - 0x3c]
sub esp, 8
call edi
mov dword [ebp - 0x50], eax
lea eax, [esi + 1]
lea esi, [ebp - 0x19]
mov dword [ebp - 0x58], eax
lea eax, [ebx + 1]
mov ebx, 0xac769185
mov dword [ebp - 0x54], eax
lea esi, [esi]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
idiv dword [ebp - 0x54]
mov edi, edx
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
mov dword [esp + 4], edi
mov edi, dword [ebp - 0x4c]
cdq
idiv dword [ebp - 0x58]
mov dword [esp], edi
mov dword [esp + 8], edx
call fcn.00401a40
mov dword [esp], edi
lea edi, [ebp - 0x2d]
call fcn.00401cd0
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call fcn.00401cd0
lea esi, [esi]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
add edi, 1
mov ecx, eax
imul ebx
mov eax, ecx
sar eax, 0x1f
add edx, ecx
sar edx, 6
sub edx, eax
imul edx, edx, 0x5f
sub ecx, edx
add ecx, 0x20
mov byte [edi - 1], cl
cmp edi, esi
jne 0x403648
lea eax, [ebp - 0x2d]
mov byte [ebp - 0x19], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
sub esp, 4
call fcn.00401b70
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x403608
Function at 0x4012f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0xfffffc19
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 0xc], 0
jle 0x4013d9
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401e30
add esp, 0xc
push 0
push 0x8000080
push 3
push 0
push 3
push SysReAllocString
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x40137b
mov dword [ebp - 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x4013d9
push 0
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4013bb
mov dword [ebp - 0x14], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x4013d9
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0xc]
je 0x4013cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
jmp 0x4013d9
cmp dword [ebp - 0x18], 0xffffffff
je 0x4013e9
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x401540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0xfffffc19
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0xc], 0
jle 0x401641
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x4015b4
mov dword [ebp - 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x401641
push 0
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push 2
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4015ed
mov dword [ebp - 0x14], 0xfffffffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x401641
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401619
mov dword [ebp - 0x14], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
je 0x401633
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x40163a
mov dword [ebp - 0x14], 0
jmp 0x401641
cmp dword [ebp - 0x18], 0xffffffff
je 0x401651
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x401e17
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43b2c4]
jne 0x401e21
repz ret
jmp fcn.00404072
Function at 0x40a3e0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004050e9
and dword [ebp - 4], 0
cmp dword [0x43d338], 0
mov ebx, eax
jne 0x40a491
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a542
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x430584
push edi
call esi
test eax, eax
je 0x40a542
push eax
call fcn.00405077
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43d338], eax
call esi
push eax
call fcn.00405077
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43d33c], eax
call esi
push eax
call fcn.00405077
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43d340], eax
call esi
push eax
call fcn.00405077
pop ecx
mov dword [0x43d348], eax
test eax, eax
je 0x40a491
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405077
pop ecx
mov dword [0x43d344], eax
mov eax, dword [0x43d344]
cmp eax, ebx
je 0x40a4e9
cmp dword [0x43d348], ebx
je 0x40a4e9
push eax
call fcn.004050f2
push dword [0x43d348]
mov esi, eax
call fcn.004050f2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a4e9
test edi, edi
je 0x40a4e9
call esi
test eax, eax
je 0x40a4e0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a4e0
test byte [ebp - 0xc], 1
jne 0x40a4e9
or dword [ebp + 0x10], 0x200000
jmp 0x40a522
mov eax, dword [0x43d33c]
cmp eax, ebx
je 0x40a522
push eax
call fcn.004050f2
pop ecx
test eax, eax
je 0x40a522
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a522
mov eax, dword [0x43d340]
cmp eax, ebx
je 0x40a522
push eax
call fcn.004050f2
pop ecx
test eax, eax
je 0x40a522
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43d338]
call fcn.004050f2
pop ecx
test eax, eax
je 0x40a542
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a544
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0x55b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x57a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x57b
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x57c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x57d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 4], 0
jmp 0x40d18e
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x43bf88], 0
je 0x40d1d9
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x43bf88]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x43bfd8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40d185
mov esp, ebp
pop ebp
ret

Function at 0x40d1e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 5
push 0x55b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 0x57a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 0x57b
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 0x57c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 0x57d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 4], 0
jmp 0x40d26e
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x43bf88], 0
je 0x40d2b9
push 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x43bf88]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x43bfd8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40d265
mov esp, ebp
pop ebp
ret
Function at 0x40e640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40e686
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jmp 0x40e6c2
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40e6b4
mov dword [ebp - 8], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40e6c2
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40eb30
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
mov eax, dword [0x43b2c4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1b0], 0x94
lea eax, [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x1a0], 2
jne 0x40eb81
cmp dword [ebp - 0x1ac], 5
jb 0x40eb81
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x114], eax
jmp 0x40ebf3
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.winhlp32.exe
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40ebe0
push 0x6a
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [ebp - 0x114], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40ebf3
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401e17
mov esp, ebp
pop ebp
ret
Function at 0x4197b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x43b2c4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x238], ax
push 0x22e
push 0
lea ecx, [ebp - 0x236]
push ecx
call fcn.00401e30
add esp, 0xc
mov dword [ebp - 0x240], 0xffffffff
cmp dword [ebp + 0xc], 0
jle 0x419851
lea edx, [ebp - 0x238]
push edx
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x238]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x238]
push ecx
call fcn.00401400
add esp, 0x10
test eax, eax
jne 0x41984d
mov dword [ebp - 0x240], 0
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x419851
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401e17
mov esp, ebp
pop ebp
ret 0x10
Function at 0x429300
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 1
jne 0x429326
mov dword [ebp - 4], str.RootCIMV2
jmp 0x42932d
mov dword [ebp - 4], str.RootWMI
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x210], 0
jne 0x429380
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x429380
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 1
je 0x429380
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._CoInitializeEx_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
jmp 0x4294f5
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x210], 0
jne 0x4293f7
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x4293ea
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 0x80010119
je 0x4293ea
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._CoInitializeSecurity_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 2
jmp 0x4294f5
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x210], 1
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x214], 0
jne 0x42945b
mov dword [ebp - 0x10], 7
mov ecx, dword [ebp - 0x18]
add ecx, 0x214
push ecx
push 0x430d50
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0x430e20
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x42945b
mov eax, dword [ebp - 0x18]
mov dword [eax], str._CoCreateInstance_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 3
jmp 0x4294f5
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x218], 0
jne 0x4294ee
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
add eax, 0x218
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x214]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x214]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0xc]
call ecx
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x20c], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 0
je 0x4294e4
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._ConnectServer_Call_Error
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x218], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 4
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x4294f5
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4