joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x606f6f30
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3f7d63ac
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x42eb10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov esi, ecx
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [esp + 0xf8], eax
push 0
call fcn.004cfe20
add esp, 4
test al, al
jne 0x42ebfc
pxor xmm0, xmm0
movdqu xmmword [esp + 0x44], xmm0
movdqu xmmword [esp + 0x34], xmm0
movdqu xmmword [esp + 0x24], xmm0
movdqu xmmword [esp + 0x14], xmm0
mov dword [esp + 0x10], 0x44
pcmpeqd xmm0, xmm0
movdqa xmmword [esp], xmm0
add esi, 4
lea edi, [esp + 0x54]
mov ecx, esi
push 0x15
push 0x5d4566
push edi
call fcn.004cf1f0
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x42eb90
mov eax, dword [esp + 0x54]
sub esp, 0x28
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
pxor xmm0, xmm0
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov ecx, edi
call fcn.004ceef0
test esi, esi
jne 0x42ebdf
push 2
call fcn.004cfe20
add esp, 4
test al, al
jne 0x42ec33
test esi, esi
setne bl
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [esp + 0x54]
mov ecx, edi
push 0
push 0xf2
push str.....operadesktopwindows_assistantinstaller_assistant_installer.cc
call fcn.00458830
lea eax, [esp + 0x5c]
push 0x11
push str.Running_Assistant
push eax
call fcn.0053f210
add esp, 0xc
mov ecx, edi
call fcn.00458c70
jmp 0x42eb41
lea edi, [esp + 0x54]
mov ecx, edi
push 2
push 0xfd
push str.....operadesktopwindows_assistantinstaller_assistant_installer.cc
call fcn.00458830
lea eax, [esp + 0x5c]
push 0x1b
push str.CreateProcess_failed_w_err
push eax
call fcn.0053f210
add esp, 0xc
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
push eax
call fcn.0042ad20
mov ecx, edi
call fcn.00458c70
jmp 0x42ebdf

Function at 0x438100
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x218]
mov dword [esi], 0x101
lea ebx, [ebp - 0x212]
push 0x202
push 0xff
push ebx
call fcn.00510dc0
add esp, 0xc
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov esi, eax
test eax, eax
jne 0x438165
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 8]
push ebx
call fcn.0052a854
add esp, 4
mov ecx, edi
push eax
push ebx
call fcn.00451610
jmp 0x438149

Function at 0x438180
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, 2
pop ebp
jmp fcn.004381a0
Function at 0x4c96f0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x4c9707
mov edx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x4c970a
and edx, 0x7f
mov ecx, edx
cmp edx, 4
jb 0x4c9746
nop word cs:[eax + eax]
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x4c9720
cmp edx, 1
je 0x4c9767
cmp edx, 2
je 0x4c975e
cmp edx, 3
jne 0x4c9772
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4

Function at 0x4c9c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg esp, eax
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004c98e0
push eax
push esi
push dword [ebp + 8]
call fcn.004c9895
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004c98e0
push eax
push esi
push dword [ebp + 8]
call fcn.004c9895
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004c98d0
retf 0xdd61
Function at 0x4ca570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.004c98d0
mov bh, 0x82
xchg ecx, eax
xchg esp, eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x4ca5c4
cmp dword [ebp - 0x398], 0
je 0x4ca78e
cmp dword [ebp + 0xc], 1
je 0x4ca78e
cmp dword [ebp + 0xc], 8
jne 0x4ca756
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.004c98e0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004c9895
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.004c98d0
mov bh, 0x4c
dec esi
pushfd
push dword [ebp - 0x698]
lea eax, [ebp - 0x6c0]
push eax
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004c9aac
add esp, 0x14
call fcn.004c98d0
les ebx, [ecx]
fldcw word [edi + edi*8 - 0x6974b]
jmp [edx + 1]
call fcn.004c98d0
dec esi
pop esp
push ebx
enter 0xffffffffffffa580, 0xffffffffffffffbc
cli
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004c98ae
or byte [eax + 0x2ff845c6], ah
mov al, byte [0x2ff845c6]

Function at 0x4ca770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or byte [eax + 4], ch
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax + 0x6a]
add bh, bh
xchg ebp, eax
enter 0xfffffffffffffffa, 0xffffffffffffffff
call fcn.004c98d0
popal
shl dword [ecx + ebx*4], 1
Function at 0x4ca7f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov al, byte [0x2ff845c6]
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.004c98e0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004c9895
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.004c98d0
and byte [0x4681479], bl
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b004]
jne 0x40100a
repz ret
jmp fcn.00401587

Function at 0x40444b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00401e3b
and dword [ebp - 0x14], 0
cmp dword [0x42d5a8], 0
mov dword [ebp - 0x18], eax
jne 0x4044fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4045a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4045a6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42d5a8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42d5ac], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42d5b0], eax
call edi
push eax
call esi
mov dword [0x42d5b8], eax
test eax, eax
je 0x4044fe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42d5b4], eax
mov eax, dword [0x42d5b4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404557
cmp dword [0x42d5b8], ecx
je 0x404557
push eax
call esi
push dword [0x42d5b8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404557
test ebx, ebx
je 0x404557
call edi
test eax, eax
je 0x40454e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40454e
test byte [ebp - 8], 1
jne 0x404557
or dword [ebp + 0x10], 0x200000
jmp 0x40458a
mov eax, dword [0x42d5ac]
cmp eax, dword [ebp - 0x18]
je 0x40458a
push eax
call esi
test eax, eax
je 0x40458a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40458a
mov eax, dword [0x42d5b0]
cmp eax, dword [ebp - 0x18]
je 0x40458a
push eax
call esi
test eax, eax
je 0x40458a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42d5a8]
call esi
test eax, eax
je 0x4045a6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4045a8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x41c04c], 1
mov dword [0x41c050], 1
mov dword [0x41c054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret

Function at 0x401950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call fcn.00402968
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call fcn.00402968
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x402524
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x402543
mov eax, 0
jmp 0x402587
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x402566
mov eax, 0
jmp 0x402587
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x402582
mov eax, 0
jmp 0x402587
mov eax, 1
leave
ret
Function at 0x402589
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x4025e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x4025e0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x4025e0
mov eax, dword [ebp - 4]
jmp 0x4025fc
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x4025bd
mov eax, 0
leave
ret
Function at 0x10015b7
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
mov esi, ecx
cmp dword [esi + 4], ebx
push edi
mov dword [ebp - 4], ebx
jne 0x100165f
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x100165f
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push ebx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push eax
push dword [esi + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x100165f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov dword [ebp - 4], eax
jne 0x100165f
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
mov dword [ebp - 4], ebx
call edi
cmp eax, ebx
mov dword [esi + 4], eax
je 0x1001631
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0x10], eax
jne 0x1001636
push 8
pop eax
jmp 0x100166a
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push dword [esi + 4]
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x100165f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10016d6
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 4], 0x40
jb 0x10016eb
push 0x6f
pop eax
jmp 0x10017ac
push ebx
push edi
push 0x24
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
xor edi, edi
cmp eax, edi
pop ecx
je 0x100170a
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
call fcn.01001420
jmp 0x100170c
xor eax, eax
cmp eax, edi
mov ecx, dword [esi + 4]
mov dword [esi + ecx*8 + 8], eax
jne 0x100171f
push 8
pop eax
jmp 0x10017aa
cmp dword [ebp + 0x14], edi
mov eax, dword [ebp + 8]
jne 0x1001739
cmp eax, 1
jne 0x1001739
mov eax, dword [esi + 4]
mov dword [esi + eax*8 + 0xc], 4
jmp 0x1001740
mov ecx, dword [esi + 4]
mov dword [esi + ecx*8 + 0xc], eax
mov eax, dword [esi + 4]
push dword [ebp + 0x14]
mov ecx, dword [esi + eax*8 + 8]
call fcn.01001445
mov ebx, eax
cmp ebx, edi
jne 0x10017a8
mov eax, dword [esi + 4]
mov ecx, dword [esi + eax*8 + 8]
lea eax, [ebp - 4]
push eax
call fcn.010015b7
mov ebx, eax
cmp ebx, edi
jne 0x10017a8
cmp dword [esi + 4], edi
mov dword [ebp + 0x14], edi
jbe 0x10017a5
lea edi, [esi + 8]
mov ecx, dword [edi]
lea eax, [ebp + 0x10]
push eax
call fcn.010015b7
mov ebx, eax
test ebx, ebx
jne 0x1001797
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10017b1
inc dword [ebp + 0x14]
mov eax, dword [ebp + 0x14]
add edi, 8
cmp eax, dword [esi + 4]
jb 0x1001776
inc dword [esi + 4]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret 0x10
mov eax, 0xa0
jmp 0x10017aa
Function at 0x10017b8
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 8
pop esi
mov ebx, ecx
xor edx, edx
mov dword [eax], esi
cmp dword [ebx + 4], edx
jbe 0x10017e5
lea ecx, [ebx + 8]
mov eax, dword [ecx]
mov edi, dword [eax + 0x14]
inc edx
mov dword [eax + 0x18], edi
add ecx, esi
cmp edx, dword [ebx + 4]
jb 0x10017d5
mov eax, dword [ebp + 0xc]
xor esi, esi
cmp eax, esi
je 0x10019d2
cmp word [eax + 4], si
je 0x10019d2
cmp dword [ebx + 4], esi
mov dword [ebp - 0x10], esi
jbe 0x1001928
lea edi, [ebx + 8]
mov eax, dword [edi + 4]
cmp eax, 8
jne 0x10018e6
and dword [ebp - 0xc], 0
push eax
push dword [ebp + 0xc]
call fcn.010025af
and dword [ebp - 8], 0
mov esi, eax
mov eax, dword [ebp + 0xc]
cmp word [eax + 4], 0
jbe 0x1001903
mov ecx, dword [edi]
lea eax, [ebp - 4]
push eax
jmp section..htext
cmp eax, 1
je 0x10018f0
cmp eax, 4
jne 0x1001916
mov ecx, dword [edi]
lea eax, [ebp - 4]
push eax
call fcn.010015b7
test eax, eax
jne 0x1001a07
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, eax
mov eax, dword [ebp + 8]
add ecx, 8
add dword [eax], ecx
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add edi, 8
cmp eax, dword [ebx + 4]
jb 0x100180b
push 8
push dword [ebp + 0xc]
call fcn.010025af
mov ecx, dword [ebp + 0xc]
mov esi, eax
xor eax, eax
cmp word [ecx + 4], ax
mov dword [ebp - 0x10], eax
jbe 0x1001a05
jmp 0x1001952
xor eax, eax
cmp dword [ebx + 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp + 0x10], eax
jbe 0x10019a5
lea edi, [ebx + 0xc]
test byte [edi], 7
je 0x1001991
mov ecx, dword [edi - 4]
lea eax, [ebp - 0x14]
push eax
call fcn.010015b7
test eax, eax
jne 0x1001a07
lea eax, [esi + 8]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1001991
mov dword [ebp - 0xc], 1
inc dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
add edi, 8
cmp eax, dword [ebx + 4]
jb 0x1001960
cmp dword [ebp - 0xc], 0
jne 0x10019b0
movzx ecx, word [esi + 2]
mov eax, dword [ebp + 8]
add dword [eax], ecx
jmp 0x10019b4
and dword [esi + 4], 0
movzx eax, word [esi + 2]
inc dword [ebp - 0x10]
push eax
push esi
call fcn.010025af
mov esi, eax
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + 4]
cmp dword [ebp - 0x10], eax
jb 0x1001950
jmp 0x1001a05
cmp dword [ebx + 4], esi
jbe 0x1001a05
lea edi, [ebx + 8]
mov ecx, dword [edi]
lea eax, [ebp + 0xc]
push eax
call fcn.010015b7
test eax, eax
jne 0x1001a07
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, eax
mov eax, dword [ebp + 8]
add ecx, 8
add dword [eax], ecx
inc esi
add edi, 8
cmp esi, dword [ebx + 4]
jb 0x10019da
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc