joyce8/EMBER2024-capa huggingface dataset:
Function at 0x715ec
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014218
xor eax, eax
push ebp
push 0x717c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0
mov byte [ebp - 0x21], 0
call sub.kernel32.dll_GetCurrentProcess
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
call fcn.0006a6ec
push eax
push 0
call fcn.00072a54
test eax, eax
je 0x717b2
lea eax, [ebp - 0xc]
push eax
push 0x400e8
push ebx
call sub.advapi32.dll_OpenProcessToken_1
test eax, eax
jne 0x71654
call fcn.0006a3f8
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
mov edi, dword [ebp - 0x10]
add edi, 0xc
mov eax, edi
call fcn.000127e0
mov dword [ebp - 0x18], eax
mov eax, edi
call fcn.000127e0
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x717ab
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x716c0
call fcn.0001387c
jmp 0x717b2
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
test eax, eax
jbe 0x7171a
mov esi, eax
dec esi
test esi, esi
jb 0x7171a
inc esi
xor ebx, ebx
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x18]
lea edx, [edx + eax*4 + 4]
lea eax, [ebp - 0x20]
mov ecx, 8
call fcn.0001b4f8
test eax, eax
jne 0x71716
cmp byte [ebp - 5], 0
je 0x71704
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x18]
mov dword [edx + eax*4 + 0xc], 2
jmp 0x71710
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov dword [edx + eax*4 + 0xc], ecx
mov byte [ebp - 0x21], 1
jmp 0x7171a
inc ebx
dec esi
jne 0x716d3
mov al, byte [ebp - 0x21]
xor al, 1
and al, byte [ebp - 5]
je 0x71766
mov eax, dword [ebp - 0x18]
inc dword [eax]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
lea eax, [edx + eax*4 - 8]
push eax
lea eax, [ebp - 4]
call fcn.0006a6ec
push eax
push 0
call fcn.00072a54
test eax, eax
jne 0x71754
call fcn.0001387c
jmp 0x717b2
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov dword [edx + eax*4], 2
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push edi
mov eax, dword [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges_1
test eax, eax
jne 0x71789
call fcn.0001387c
jmp 0x717b2
mov byte [ebp - 6], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x717b2
mov eax, dword [ebp - 0x14]
call fcn.000127f8
mov eax, dword [ebp - 0x18]
call fcn.000127f8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x717cf
lea eax, [ebp - 4]
call fcn.00013de4
ret
Function at 0x728dc
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov eax, esp
xor ecx, ecx
mov edx, 0x94
call fcn.00012cd0
mov dword [esp], 0x94
push 0
call sub.kernel32.dll_SetLastError
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
jne 0x7290d
call fcn.0006a3f8
cmp dword [esp + 0x10], 2
jne 0x7291b
cmp dword [esp + 4], 5
je 0x7291f
xor eax, eax
jmp 0x72921
mov al, 1
add esp, 0x94
ret
Function at 0x82728
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014218
xor eax, eax
push ebp
push 0x82855
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x8286c
call fcn.00065094
xor edx, edx
push ebp
push 0x8280e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x82890
call fcn.00014350
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0001426c
mov eax, dword [ebp - 0x14]
call fcn.00014228
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 8]
call fcn.00019318
movzx eax, ax
lea ecx, [ebp - 0x18]
mov edx, 4
call fcn.0001aa80
push dword [ebp - 0x18]
push 0x8289c
lea ecx, [ebp - 0x1c]
movzx eax, word [ebp - 8]
mov edx, 4
call fcn.0001aa80
push dword [ebp - 0x1c]
mov eax, ebx
mov edx, 3
call fcn.00014124
mov eax, dword [0x149c70]
mov eax, dword [eax]
call fcn.000650e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x82832
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8285c
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00013e08
lea eax, [ebp - 4]
call fcn.00013de4
ret
Function at 0x82edc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014218
xor eax, eax
push ebp
push 0x83051
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x83068
call fcn.00065094
xor edx, edx
push ebp
push 0x83005
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 0x10
call fcn.00012cd0
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.00012cd0
mov dword [ebp - 0x5c], 0x44
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00014228
push eax
push 0
call sub.kernel32.dll_CreateProcessA
neg eax
sbb eax, eax
neg eax
test al, al
je 0x82fba
push 0xffffffffffffffff
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 4]
mov edx, 0x83094
call fcn.000140b0
mov edx, dword [ebp - 0x60]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
jmp 0x82fef
lea eax, [ebp - 0x64]
mov ecx, dword [ebp - 4]
mov edx, 0x830b4
call fcn.000140b0
mov edx, dword [ebp - 0x64]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov ecx, 0x830d0
mov dl, 1
mov eax, dword [0x1989c]
call fcn.0001e178
call fcn.000137dc
mov eax, dword [0x149c70]
mov eax, dword [eax]
call fcn.000650e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8302e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x83058
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.00013e08
lea eax, [ebp - 4]
call fcn.00013de4
ret

Function at 0x831c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00014218
mov eax, dword [ebp - 8]
call fcn.00014218
xor eax, eax
push ebp
push 0x832a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x832b8
call fcn.00065094
xor edx, edx
push ebp
push 0x83261
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x832d8
push dword [ebp - 4]
push 0x832ec
push dword [ebp - 8]
push 0x832f8
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00014124
mov eax, dword [ebp - 0xc]
call fcn.00014228
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x149c70]
mov eax, dword [eax]
call fcn.000650e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x83285
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x832a7
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00013e08
ret
Function at 0x83308
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014218
mov eax, dword [ebp - 8]
call fcn.00014218
mov eax, dword [ebp - 0xc]
call fcn.00014218
mov eax, dword [ebp + 8]
call fcn.00014218
xor eax, eax
push ebp
push 0x83413
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x8342c
call fcn.00065094
xor edx, edx
push ebp
push 0x833cc
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x8344c
push dword [ebp - 4]
push 0x83460
push dword [ebp - 8]
push 0x8346c
push dword [ebp + 8]
push 0x8346c
push 0x83478
push dword [ebp - 4]
push 0x83460
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
mov edx, 0xb
call fcn.00014124
mov eax, dword [ebp - 0x10]
call fcn.00014228
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x149c70]
mov eax, dword [eax]
call fcn.000650e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x833f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8341a
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00013e08
lea eax, [ebp + 8]
call fcn.00013de4
ret
Function at 0x843b4
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0x184], ebx
mov dword [ebp - 0x17c], ebx
mov dword [ebp - 0x178], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014218
xor eax, eax
push ebp
push 0x84654
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x8466c
call fcn.00065094
xor edx, edx
push ebp
push 0x84605
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
call fcn.00013de4
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x18], 0xffffffff
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_CreatePipe
xor eax, eax
push ebp
push 0x8459f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x44
call fcn.00012cd0
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x101
mov word [ebp - 0x34], 0
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle_1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x178]
mov ecx, dword [ebp - 4]
mov edx, 0x84684
call fcn.000140b0
mov eax, dword [ebp - 0x178]
call fcn.00014228
push eax
push 0
call sub.kernel32.dll_CreateProcessA
neg eax
sbb ebx, ebx
neg ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x84588
xor eax, eax
push ebp
push 0x84581
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x14]
push eax
push 0xff
lea eax, [ebp - 0x174]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
neg eax
sbb ebx, ebx
neg ebx
cmp dword [ebp - 0x14], 0
jbe 0x8453f
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x174], 0
lea eax, [ebp - 0x17c]
lea edx, [ebp - 0x174]
mov ecx, pe_nt_image_headers32
call fcn.00014014
mov edx, dword [ebp - 0x17c]
mov eax, esi
call fcn.0001406c
test bl, bl
je 0x84549
cmp dword [ebp - 0x14], 0
jne 0x844ea
push 0xffffffffffffffff
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_GetExitCodeProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x84588
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x845a6
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x84fac
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x850c8
call fcn.00065094
xor edx, edx
push ebp
push 0x8508d
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00012cd0
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 0
lea eax, [ebp - 8]
push eax
push 0
push 2
mov eax, dword [ebp + 0xc]
call fcn.00014228
push eax
mov eax, ebx
call fcn.00014228
push eax
mov eax, esi
call fcn.00014228
push eax
call sub.advapi32.dll_LogonUserA
test eax, eax
jne 0x8502e
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x85077
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp + 8]
call fcn.00014228
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateProcessAsUserA
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp dword [ebp - 0x54], 0
jne 0x85073
mov byte [ebp - 1], 0
jmp 0x85077
mov byte [ebp - 1], 1
mov eax, dword [0x149c70]
mov eax, dword [eax]
call fcn.000650e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x850b1
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x867d4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x86947
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x86960
call fcn.00065094
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x24
call fcn.00012cd0
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x44]
call fcn.000127e0
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x86925
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x868eb
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x868e1
mov esi, 0x1c
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, esi
call fcn.00012cd0
push esi
lea eax, [ebp - 0x24]
push eax
push 0x20000
push ebx
call sub.kernel32.dll_VirtualQueryEx
cmp esi, eax
jne 0x868e1
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x24]
push eax
push ebx
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x868e1
mov ebx, dword [ebp - 4]
add ebx, 0x498
lea eax, [ebp - 0x4c]
mov edx, ebx
call fcn.000145e0
mov eax, dword [ebp - 0x4c]
call fcn.0001463c
add eax, 2
add eax, eax
add ebx, eax
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.000145e0
mov eax, dword [ebp - 0x50]
call fcn.0001463c
add eax, 2
add eax, eax
add ebx, eax
mov eax, edi
mov edx, ebx
call fcn.00013fcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8690f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8692c
mov eax, dword [ebp - 4]
call fcn.000127f8
ret
Function at 0x86980
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014218
xor eax, eax
push ebp
push 0x86a99
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x86ab0
call fcn.00065094
xor edx, edx
push ebp
push 0x86a7c
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x86a42
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00014228
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jbe 0x86a38
mov eax, ebx
call fcn.0001a430
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x86acc
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x86a38
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov ecx, 0x34
call fcn.00012948
mov edi, esi
lea esi, [ebp - 0x48]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x86a66
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x86a83
mov eax, dword [ebp - 8]
call fcn.000127f8
ret

Function at 0x86eb8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014218
xor eax, eax
push ebp
push 0x86f67
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00012cd0
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00012cd0
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x228
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00014228
push eax
push 0
call sub.kernel32.dll_CreateProcessA
neg eax
sbb eax, eax
neg eax
test al, al
je 0x86f3f
test bl, bl
je 0x86f3f
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x86f6e
lea eax, [ebp - 4]
call fcn.00013de4
ret
Function at 0x898d8
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov edx, ebx
mov eax, esi
call fcn.00089808
cmp dword [ebx], 0
je 0x89941
push pe_nt_image_headers32
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push pe_nt_image_headers32
lea eax, [esp + 0x24]
push eax
mov eax, dword [ebx]
call fcn.00014228
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
jne 0x8992e
call fcn.0006a3f8
mov eax, ebx
lea edx, [esp + 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.00014014
add esp, 0x20c
pop esi
pop ebx
ret
Function at 0x8bdc0
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x8bbf0
push ebx
push esi
push edi
mov ebx, edx
xor eax, eax
push ebp
push 0x8be4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x8be64
call fcn.00065094
xor edx, edx
push ebp
push 0x8be02
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x8be94
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0001aa1c
push dword [ebp - 0x20]
push 0x8beb4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00014124
mov eax, dword [ebp - 0x1c]
call fcn.0008546c
xor eax, eax
push ebp
push 0x8bde5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x30d40
lea eax, [ebp - 4]
push eax
push 2
push 3
push 0
call sub.netapi32.dll_NetUserEnum
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub eax, 1
jb 0x8bc9e
sub eax, 0xe9
jne 0x8bdc0
xor eax, eax
push ebp
push 0x8bdb9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
jbe 0x8bda2
mov edi, dword [ebp - 0xc]
dec edi
test edi, edi
jb 0x8bda2
inc edi
xor ebx, ebx
imul esi, ebx, 0x1d
mov eax, dword [ebp - 4]
mov eax, dword [eax + esi*4 + 8]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
fild qword [ebp - 0x28]
fdiv dword [0x8beb8]
call fcn.00012b28
mov dword [ebp - 0x18], eax
push 0x8bec4
mov eax, dword [ebp - 4]
mov eax, dword [eax + esi*4 + 0x60]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.0001aa4c
push dword [ebp - 0x30]
push 0x8beb4
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00014124
mov eax, dword [ebp - 0x2c]
call fcn.0008546c
push 0x8bed8
lea eax, [ebp - 0x3c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + esi*4]
call fcn.00013fcc
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00082d74
push dword [ebp - 0x38]
push 0x8bee8
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00014124
mov eax, dword [ebp - 0x34]
call fcn.0008546c
push 0x8bef8
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0001aa1c
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
call fcn.00082d74
push dword [ebp - 0x44]
push 0x8bf08
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.00014124
mov eax, dword [ebp - 0x40]
call fcn.0008546c
mov eax, 0x8bf1c
call fcn.0008546c
inc ebx
dec edi
jne 0x8bcc5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8bdc0
mov eax, dword [ebp - 4]
push eax
call sub.netapi32.dll_NetApiBufferFree
ret
cmp dword [ebp - 8], 0xea
je 0x8bc68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8bdec
mov eax, 0x8bf2c
call fcn.0008546c
ret
Function at 0xb3d30
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
test dl, dl
je 0xb3d43
add esp, 0xfffffff0
call fcn.00013384
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x14906c]
call fcn.00014228
push eax
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], ebx
test ebx, ebx
jne 0xb3d81
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov al, 0x3a
call fcn.000a6a34
mov eax, dword [ebp - 4]
call fcn.000b3f84
xor ecx, ecx
push ebp
push 0xb3ea2
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor edx, edx
mov eax, 2
call fcn.000b3ce0
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov dl, 1
mov eax, 3
call fcn.000b3ce0
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
xor edx, edx
mov eax, 4
call fcn.000b3ce0
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
xor edx, edx
mov eax, 5
call fcn.000b3ce0
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [0x149070]
call fcn.00014228
push eax
push 0x400
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
test ebx, ebx
jne 0xb3e20
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov al, 0x3a
call fcn.000a6a34
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], ebx
mov eax, ebx
add eax, 0x400
sub eax, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov edx, eax
sub edx, 4
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, edx
sub eax, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
sub eax, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
xor edx, edx
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb3ea9
mov eax, dword [ebp - 4]
call fcn.000b3f90
ret