joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ac004]
jne 0x401116
repz ret
jmp fcn.004016e4

Function at 0x4050fb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4ac004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402688
and dword [ebp - 0x14], 0
cmp dword [0x4aea04], 0
mov dword [ebp - 0x18], eax
jne 0x4051ae
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405256
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405256
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4aea04], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4aea08], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4aea0c], eax
call edi
push eax
call esi
mov dword [0x4aea14], eax
test eax, eax
je 0x4051ae
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4aea10], eax
mov eax, dword [0x4aea10]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405207
cmp dword [0x4aea14], ecx
je 0x405207
push eax
call esi
push dword [0x4aea14]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405207
test ebx, ebx
je 0x405207
call edi
test eax, eax
je 0x4051fe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4051fe
test byte [ebp - 8], 1
jne 0x405207
or dword [ebp + 0x10], 0x200000
jmp 0x40523a
mov eax, dword [0x4aea08]
cmp eax, dword [ebp - 0x18]
je 0x40523a
push eax
call esi
test eax, eax
je 0x40523a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40523a
mov eax, dword [0x4aea0c]
cmp eax, dword [ebp - 0x18]
je 0x40523a
push eax
call esi
test eax, eax
je 0x40523a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4aea04]
call esi
test eax, eax
je 0x405256
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405258
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040110c
leave
ret
Function at 0x49b0b0
Capabilities:
Create pipe

Disassembly:
mov eax, dword [0x4acb30]
sub esp, 0x14
push ebx
mov ebx, dword [0x2c51fb4]
push edi
mov edi, dword [0x2c54434]
call fcn.0049b030
cmp dword [0x2c54434], 0x2f
jne 0x49b112
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.0049b060
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x49b400
Capabilities:
Get disk information
Manipulate console buffer
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x4ac004]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
jmp 0x49b425
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x49b46e
mov dword [0x2c5409c], 0x8e46a6f0
cmp dword [0x2c54434], 0x3dc
jne 0x49b46c
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x49b41c
mov dword [ebp - 0x10], 0
jmp 0x49b480
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x49b51b
cmp dword [0x2c54434], 0xa5f
jne 0x49b4d2
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x820]
push ecx
push str.lewujuyenehuzehiji
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 0x10], 0x84620b
jne 0x49b4f6
mov edx, dword [0x4ad950]
mov dword [0x2c54434], edx
mov eax, dword [0x2c54434]
add eax, 0xa231
mov dword [0x2c54434], eax
cmp dword [0x2c54434], 0x141
jne 0x49b516
mov dword [0x4aef20], 0xec58acac
mov dword [0x4aef24], 0xffffffff
jmp 0x49b477
call fcn.0049b120
jmp dword [0x2c51fb4]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100465a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019f4e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101f9834]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x100465e9
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
cmp dword [0x101f354c], 0
jne 0x10046600
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
je 0x1004664d
mov eax, dword [esi]
test eax, eax
je 0x100465d2
cmp dword [esi + 4], 0
je 0x100465d2
push eax
call fcn.10084950
add esp, 4
push dword [esi + 4]
call fcn.10084950
mov eax, dword [esi + 0xc]
add esp, 4
test eax, eax
je 0x1004663e
push eax
call fcn.10084950
add esp, 4
mov eax, dword [esi + 8]
test eax, eax
je 0x10046685
push eax
call fcn.10084950
jmp 0x10046682
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call fcn.10084950
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
call fcn.10084950
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
call fcn.10084950
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.10084950
add esp, 4
push 8
call fcn.10084950
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x100466c0
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.10084950
mov dword [edi], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10084950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1008495f
pop dword [ebp - 0x28]
mov eax, 0xdc6c3a94
add eax, 0x339c0ecb
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x360eb1a2
add dword [ebp - 0x38], 0x184393a9
mov dword [ebp - 0x34], 0x472412f
add dword [ebp - 0x34], 0x2dc10b16
mov dword [ebp - 0x30], 0x2f637b47
add dword [ebp - 0x30], 0x1ce8c8e7
mov dword [ebp - 0x2c], 0x832d19a1
sub dword [ebp - 0x2c], 0x832d19a1
lea eax, [ebp - 0x38]
push eax
mov eax, 0xa589413c
sub eax, 0x956ef114
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xe701489f
add dword [ebp - 0x38], 0x8d7120b7
mov dword [ebp - 0x34], 0xa1bdd651
sub dword [ebp - 0x34], 0x605174dc
mov dword [ebp - 0x30], 0x38b91c4f
sub dword [ebp - 0x30], 0xd549afe3
mov dword [ebp - 0x2c], 0x39b20c44
add dword [ebp - 0x2c], 0xc64df3bc
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x4cc163c5
add eax, 0xc358ec5f
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x63dab
push 0
call eax
mov ecx, 0x31c141f0
sub ecx, 0x31c104cc
mov edx, eax
mov esi, 0x10219e00
add esi, dword [ebp - 0x28]
mov ebx, 0x1c780e13
sub ebx, 0xb70fbd27
sub dword [ebp - 0x18], 0xb118d723
mov edi, dword [esi]
add dword [ebp - 0xc], edx
sub edi, ebx
sub dword [ebp - 0x1c], edi
mov dword [edx], edi
xor dword [ebp - 0x24], ecx
add edx, 0xc8151b56
sub edx, 0xc8151b52
add esi, 0x4edf77b9
add esi, 0xb120884b
loop 0x10084a7b
add eax, 0xe4e135ef
sub eax, 0xe4e04e8c
xor ebx, ebx
add ebx, eax
add eax, 0xf89a183a
sub eax, 0xf89a1835
mov ecx, 0xc42d1393
sub ecx, 0xb42d1393
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x100e1380
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a102e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f9834]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call sym.AIDE.dll_public:_void___thiscall_AIDE::PaletteInfo::constructor_void_
mov ecx, dword [edi + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.100e2a90
mov dword [esi], eax
lea ecx, [edi + 0x28]
mov dword [esi + 4], 3
mov dword [esi + 8], 0
mov dword [ecx], 8
mov dword [edi + 0x30], 8
mov dword [edi + 0x2c], 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 8
mov ecx, dword [edi + 0x14]
call fcn.100e2a70
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100e5e80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a125d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101f9834]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov ecx, esi
call sym.AIDE.dll_public:_void___thiscall_AIDE::AIDEDimension::constructor_void_
lea ebx, [esi + 8]
mov dword [ebp - 4], 0
mov ecx, ebx
call sym.AIDE.dll_public:_void___thiscall_AIDE::AIDEDimension::constructor_void_
mov eax, dword [edi + 0x14]
mov dword [esi], eax
mov eax, dword [edi + 0x30]
mov edi, dword [edi + 0x2c]
mov esi, dword [ebp - 0x10]
lea ecx, [edi + eax]
mov edx, dword [esi + 0x18]
sub edx, eax
cmp ecx, dword [esi + 0x18]
mov eax, dword [ebp + 8]
mov ecx, esi
cmova edi, edx
mov dword [ebx], 0
mov dword [eax + 4], edi
mov ecx, dword [ecx + 0x30]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10145f90
Capabilities:
Terminate process

Disassembly:
cmp dword [str._AdobeIP0000539_], 0
jne 0x10145fa1
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x10175c50
push 0x100
push 0
push 0x101fc648
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
nop word [eax + eax]
mov byte [eax + 0x101fc748], al
inc eax
cmp eax, 0x100
jl 0x10175c70
push esi
push edi
push 0x100
push 0xff
push 0x101fc848
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, 0xfe317780
mov edx, 0xfc403180
mov esi, 0xf6b26d80
mov edi, 0xf8a3b8c0
xor eax, eax
nop dword [eax]
mov dword [eax + 0x101fc948], edi
add edi, 0x166e9
mov dword [eax + 0x101ff348], esi
add esi, 0x1c5a2
mov dword [eax + 0x10201d48], edx
add edx, 0xb6d2
mov dword [eax + 0x10204748], ecx
add eax, 4
add ecx, 0x581a
cmp eax, 0x29e0
jle 0x10175cb0
xorps xmm0, xmm0
mov dword [0x10205c58], 0
pop edi
movups xmmword [0x10205c38], xmm0
mov dword [0x10203258], 0
movups xmmword [0x10205c48], xmm0
mov dword [0x10200858], 0
movups xmmword [0x10203238], xmm0
mov dword [0x101fde58], 0
movups xmmword [0x10203248], xmm0
pop esi
movups xmmword [0x10200838], xmm0
movups xmmword [0x10200848], xmm0
movups xmmword [0x101fde38], xmm0
movups xmmword [0x101fde48], xmm0
ret
Function at 0x10159fd0
Capabilities:
Terminate process

Disassembly:
cmp dword [str._AdobeIP0000539_], 0
jne 0x10159fe1
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x1019d030
movss xmm5, dword [0x101e25d4]
movss xmm4, dword [0x101e25dc]
movss xmm6, dword [0x101e25d0]
movss xmm7, dword [0x101e25c8]
movss xmm3, dword [0x101a83c8]
push esi
xor esi, esi
nop dword [eax + eax]
movd xmm0, esi
mov eax, esi
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
sub esp, 8
addsd xmm0, qword [eax*8 + 0x101e5600]
cvtpd2ps xmm2, xmm0
movaps xmm0, xmm4
movaps xmm1, xmm2
mulss xmm1, xmm5
subss xmm0, xmm1
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10084950
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, xmm6
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10084950
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, xmm7
add ecx, eax
mov dword [esi*4 + 0x10207160], ecx
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10084950
movaps xmm0, xmm2
mov edx, eax
mulss xmm0, dword [0x101e25d8]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10084950
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x101e25c0]
add eax, edx
mov dword [esi*4 + 0x10207960], eax
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10084950
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, dword [0x101e25cc]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10084950
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x101e25c4]
add eax, ecx
mov dword [esi*4 + 0x10207560], eax
mulss xmm0, xmm3
subss xmm0, xmm4
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10084950
movaps xmm0, xmm2
mov dword [esi*4 + 0x10207d60], eax
mulss xmm0, dword [0x101e25e4]
mov dword [esi*4 + 0x10208560], edx
mov dword [esi*4 + 0x10208160], ecx
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10084950
movaps xmm0, xmm2
mov dword [esi*4 + 0x10208960], eax
mulss xmm0, dword [0x101e25e8]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10084950
movaps xmm0, xmm2
mov dword [esi*4 + 0x10208d60], eax
mulss xmm0, dword [0x101e25ec]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10084950
mov dword [esi*4 + 0x10209160], eax
mulss xmm2, dword [0x101e25e0]
cvtps2pd xmm0, xmm2
movsd qword [esp], xmm0
call fcn.10084950
mov dword [esi*4 + 0x10209560], eax
add esp, 8
inc esi
cmp esi, 0x100
jb 0x1019d060
pop esi
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x46912937
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x788a6ea0
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x402470
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 4]
push 0
call fcn.0041d6f0
push dword [ebp - 0x14]
push 0
call fcn.0041d600
mov dword [ebp - 0xc], eax
push dword [ebp - 0x18]
push 0
call fcn.0041d600
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
push 0
call fcn.0041d6f0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov esp, ebp
pop ebp
ret

Function at 0x402640
Capabilities:
Manipulate user privileges

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x64]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
lea eax, [ebp - 8]
call fcn.0040a1e0
xor eax, eax
push fcn.00402630
push ebp
push 0x412ee0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x5c], 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x402678
mov eax, 0x44e3e0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x402687
mov eax, dword [eax - 4]
shr eax, 1
shl eax, 1
mov word [ebp - 0x34], ax
mov eax, dword [ebp - 8]
test eax, eax
je 0x402699
mov eax, dword [eax - 4]
shr eax, 1
lea eax, [eax + eax + 2]
mov word [ebp - 0x32], ax
mov dword [ebp - 0x4c], 0x18
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x58], 0xc
mov dword [ebp - 0x54], 2
mov word [ebp - 0x50], 0xff
lea eax, [ebp - 0x60]
push eax
push 0x2000000
lea eax, [ebp - 0x4c]
push eax
push 0
call fcn.0041d790
mov dword [ebp - 0x64], 0
push 1
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 4]
push dword [ebp - 0x60]
call fcn.0041d7b0
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00402630
mov esp, ebp
pop ebp
ret

Function at 0x402720
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [0x4408c0]
mov dword [ebp - 0x18], eax
mov ax, word [0x4408c4]
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call fcn.0041d6a0
test eax, eax
jne 0x402780
call fcn.0041d640
mov dword [ebp - 0xc], eax
jmp 0x4027a0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push 0
call fcn.0041d740
test eax, eax
jne 0x4027a0
call fcn.0041d640
mov dword [ebp - 0xc], eax
nop word [eax + eax]
cmp dword [ebp - 0x10], 0
je 0x4027b5
push dword [ebp - 0x10]
call fcn.0041d6b0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4027e0
Capabilities:
Add user account
Add user account to group

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x80]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x80], 0
xor eax, eax
push fcn.004027d0
push ebp
push 0x412ee0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x80]
xor edx, edx
call fcn.0040a440
lea eax, [ebp - 0x70]
xor cl, cl
mov edx, 0x60
call fcn.00403690
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40282f
mov eax, 0x44e3e0
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40283e
mov eax, 0x44e3e0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x40284d
mov eax, 0x44e3e0
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x80]
test eax, eax
jne 0x40285c
mov eax, 0x44e3e0
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x58], 0x10001
mov eax, dword [ebp - 0x80]
test eax, eax
jne 0x402879
mov eax, 0x44e3e0
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x80]
test eax, eax
jne 0x402888
mov eax, 0x44e3e0
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x34], 0xffffffff
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40289e
mov eax, 0x44e3e0
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push 1
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4028b7
mov eax, 0x44e3e0
push eax
call fcn.0041d7d0
mov dword [ebp - 0x74], eax
test eax, eax
sete byte [ebp - 0x10]
cmp byte [ebp - 0x10], 0
je 0x4028fc
push 1
lea eax, [ebp - 0x7c]
push eax
push 3
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4028e0
mov eax, 0x44e3e0
push eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4028ed
mov eax, 0x44e3e0
push eax
call fcn.0041d7e0
mov dword [ebp - 0x74], eax
test eax, eax
sete byte [ebp - 0x10]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004027d0
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4

Function at 0x402a10
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
call fcn.00408940
mov eax, dword [ebp - 8]
call fcn.00408940
xor eax, eax
push fcn.004029f0
push ebp
push 0x412ee0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
push 5
mov eax, dword [ebp - 8]
test eax, eax
jne 0x402a54
mov eax, 0x44e3e0
push eax
mov eax, 0x442264
push eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x402a67
mov eax, 0x44e3e0
push eax
call fcn.0041d710
push 0
mov eax, str.logon_user_success
push eax
mov eax, str.logon_user_success
push eax
push 0
call sub.user32.dll_MessageBoxA
mov dword [ebp - 0x30], 0x20
mov eax, dword [ebp - 4]
test eax, eax
jne 0x402a95
mov eax, 0x44e3e0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
push dword [ebp - 0x10]
call fcn.0041d720
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004029f0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x40f8c0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x43f2e0]
cmp ax, 0xcb
je 0x40f9bf
cmp ax, 0xcc
je 0x40f9bf
mov edx, dword [0x44e7a0]
test edx, edx
je 0x40f8f2
mov eax, dword [0x44e650]
call edx
mov ebx, eax
jmp 0x40f8f7
mov ebx, 0x44e654
cmp word [0x44e640], 0
jle 0x40f91a
mov eax, 0x44e620
call fcn.0040fb30
mov eax, ebx
call fcn.0040f4a0
mov eax, ebx
call fcn.0040f520
mov esi, dword [ebx]
jmp 0x40f93d
mov edi, dword [esi + 4]
test byte [esi], 1
jne 0x40f938
mov edx, esi
mov eax, ebx
call fcn.0040e920
jmp 0x40f93b
and dword [esi], 0xfffffffe
mov esi, edi
test esi, esi
jne 0x40f920
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x44e640], 0
jle 0x40f9bf
mov edx, 0x44e560
mov eax, ebx
call fcn.0040ea70
mov esi, eax
test eax, eax
je 0x40f992
mov eax, dword [0x44e5f4]
mov dword [esi + 0xc], eax
cmp dword [0x44e5f4], 0
je 0x40f987
mov eax, dword [0x44e5f4]
mov dword [eax + 8], esi
mov eax, dword [ebx + 0x94]
mov dword [0x44e5f4], eax
sub word [0x44e640], 1
cmp word [0x44e640], 0
sete bl
mov eax, 0x44e620
call fcn.0040fb50
test bl, bl
je 0x40f9bf
mov eax, 0x44e620
call fcn.0040fb20
pop edi
pop esi
pop ebx
ret