joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56cf10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5819fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x56d002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00570dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x56d002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.005686e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0057120b
push 0x10
call fcn.005711d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x56cfc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.0055d1c0
jmp 0x56cfc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.0056cb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x56cff0
mov ecx, edi
call fcn.0055d2c0
push edi
call fcn.005711c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x56d021
inc ebx
cmp ebx, 0x20
jb 0x56cf3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x56e250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x582808
push 0x572288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x56e329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x56e329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.005711d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x56e329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x56e329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x56e32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0056e351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56ed20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x56ed58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x56ed60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x56ed94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x56ed94
push eax
push esi
call fcn.0057120b
add esp, 8
pop esi
ret 0x10

Function at 0x56eda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x56ee22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x56ee15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x587320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00570dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x56edda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x56ee30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x56eec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x56eeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x587320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00570dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x56eeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x56ee6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x56f000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x56f131
push esi
call fcn.00572145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00561080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x56f131
push 0
push ebp
call fcn.005613a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00561260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x56f08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.005612f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x56f121
push 0x587918
push edi
call fcn.005703f0
push eax
push ebx
push esi
call fcn.0056ef60
push 0x5878f8
push edi
call fcn.005703f0
push eax
push ebx
push esi
call fcn.0056ef60
push 0x5878d8
push edi
call fcn.005703f0
push eax
push ebx
push esi
call fcn.0056ef60
push 0x5878c0
push edi
call fcn.005703f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0056ef60
push 0x5878a0
push edi
call fcn.005703f0
push eax
push ebx
push esi
call fcn.0056ef60
push 0x587888
push edi
call fcn.005703f0
push eax
push ebx
push esi
call fcn.0056ef60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x5701b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00570140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00570140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00570140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00570140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x570bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x570c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x58287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x570c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x570c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4010f0
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0x44]
mov dword [esi], 0x479440
test al, al
je 0x40114c
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.WINMM.dll_waveInStop]
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.WINMM.dll_waveInReset]
mov ebp, dword [sym.imp.WINMM.dll_waveInUnprepareHeader]
lea edi, [esi + 0x30]
mov ebx, 2
mov edx, dword [edi]
mov eax, dword [esi + 0x18]
push 0x20
push edx
push eax
call ebp
add edi, 4
dec ebx
jne 0x401125
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.WINMM.dll_waveInClose]
mov edx, dword [esi + 0x2c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov al, byte [esi + 0x45]
test al, al
je 0x401186
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.WINMM.dll_waveOutReset]
mov ebp, dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
lea edi, [esi + 0x30]
mov ebx, 2
mov ecx, dword [edi]
mov edx, dword [esi + 0x40]
push 0x20
push ecx
push edx
call ebp
add edi, 4
dec ebx
jne 0x40116b
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.WINMM.dll_waveOutClose]
lea edi, [esi + 0x30]
mov ebx, 2
mov ecx, dword [edi - 0x28]
push ecx
call fcn.0046210e
mov edx, dword [edi]
push edx
call fcn.0046210e
mov eax, dword [edi - 0x20]
push eax
call fcn.0046210e
mov ecx, dword [edi + 8]
push ecx
call fcn.0046210e
add esp, 0x10
add edi, 4
dec ebx
jne 0x40118e
mov edx, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esi + 0x28]
push eax
call edi
mov ecx, dword [esi + 0x2c]
push ecx
call edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4012c0
Capabilities:
Capture microphone audio
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
mov edi, ecx
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
test eax, eax
jne 0x4012dc
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
nop
mov dword [ebp - 4], 0
nop
lea eax, [ebp - 4]
push eax
push 4
push edi
push 0x401440
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
push 0x20000
push 0
lea edx, [edi + 0x46]
push ecx
lea ebx, [edi + 0x18]
push edx
push 0xffff
push ebx
mov dword [edi + 0x2c], eax
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
je 0x401328
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea esi, [edi + 0x30]
mov dword [ebp - 8], 2
mov eax, dword [esi]
mov ecx, dword [esi - 0x28]
push 0x20
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi]
xor eax, eax
mov dword [ecx + 0x10], eax
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [esi]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov eax, dword [ebp - 8]
add esi, 4
dec eax
mov dword [ebp - 8], eax
jne 0x401333
mov edx, dword [edi + 0x1c]
mov ecx, dword [ebx]
push 0x20
mov eax, dword [edi + edx*4 + 0x30]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov edx, dword [edi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebx]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
mov al, 1
pop esi
mov byte [edi + 0x44], al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401c40
Capabilities:
Enumerate devices by category

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x474e9b
push eax
mov dword fs:[0], esp
sub esp, 0x824
lea eax, [esp + 0xc]
push ebp
push eax
xor ebp, ebp
push 0x480398
push 1
push ebp
push 0x480438
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x401c82
or eax, 0xffffffff
jmp 0x401db3
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
lea edx, [esp + 4]
push 0
push edx
mov ecx, dword [eax]
push 0x480428
push eax
mov dword [esp + 0x840], 0
call dword [ecx + 0xc]
test eax, eax
je 0x401cd0
mov eax, dword [esp + 4]
mov dword [esp + 0x830], 0xffffffff
test eax, eax
je 0x401cc8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or eax, 0xffffffff
jmp 0x401db3
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0xc]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x401d98
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x480e64
mov ecx, dword [eax]
push 0
push 0
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x401d6e
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push 0
mov word [esp + 0x24], 8
mov ecx, dword [eax]
push edx
push str.FriendlyName
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x401d64
mov ecx, dword [esp + 0x28]
push eax
push eax
lea eax, [esp + 0x38]
push 0x800
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
inc ebp
call esi
mov edx, dword [esp + 0x28]
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x401d06
pop edi
pop esi
mov eax, dword [esp + 4]
mov dword [esp + 0x830], 0xffffffff
test eax, eax
je 0x401db1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebp
mov ecx, dword [esp + 0x828]
pop ebp
mov dword fs:[0], ecx
add esp, 0x830
ret 4
Function at 0x4022c0
Capabilities:
Enumerate devices by category

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x474ee0
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push edi
mov edi, dword [esp + 0x34]
xor ebx, ebx
cmp edi, ebx
jge 0x4022f9
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 8], ebx
lea eax, [esp + 8]
mov dword [esp + 0x2c], ebx
push eax
push 0x480398
push 1
push ebx
push 0x480438
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
je 0x402348
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x402392
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 8]
lea ecx, [esp + 0x34]
push ebx
push ecx
mov edx, dword [eax]
push 0x480428
push eax
mov byte [esp + 0x3c], 1
call dword [edx + 0xc]
cmp eax, ebx
je 0x4023a7
mov eax, dword [esp + 0x34]
mov byte [esp + 0x2c], bl
cmp eax, ebx
je 0x40237c
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x402392
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov eax, dword [esp + 0x34]
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push 1
push eax
xor esi, esi
call dword [ecx + 0xc]
cmp edi, ebx
jl 0x402466
push ebp
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x40]
push edx
push 0x480e64
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x24]
cmp eax, ebx
jl 0x40243c
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x1c]
push ebx
mov word [esp + 0x20], 8
mov ecx, dword [eax]
push edx
push str.FriendlyName
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jne 0x402432
cmp esi, edi
jne 0x402427
mov eax, dword [esp + 0x14]
push ebp
push 0x480388
push ebx
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x20]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x40]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x18]
mov ecx, dword [eax]
push edx
push 1
push eax
inc esi
call dword [ecx + 0xc]
cmp esi, edi
jle 0x4023d7
pop ebp
mov eax, dword [esp + 0x38]
mov byte [esp + 0x30], bl
cmp eax, ebx
pop esi
je 0x402479
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x40248f
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x24]
pop edi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x4053b0
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push esi
lea edx, [ecx + 0x20]
push edi
mov dword [esp + 0x10], ecx
mov ebx, dword [esp + 0x18]
mov ecx, 0x41
xor eax, eax
mov edi, edx
push 0
rep stosd dword es:[edi], eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov eax, ecx
mov esi, edi
mov edi, edx
push 3
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 1
push 0x80000000
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x405414
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4
lea ecx, [esp + 0xc]
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, eax
add ebp, 0xa
push ebp
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, ebp
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov byte [ebx], 0x69
mov eax, dword [esp + 0x10]
mov dword [ebx + 5], esi
mov esi, dword [esp + 0x1c]
push esi
mov dword [ebx + 1], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
lea edi, [ebx + 9]
inc ecx
push ebp
mov edx, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
call fcn.004064b0
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret 4
Function at 0x406660
Capabilities:
List user accounts

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor ebx, ebx
mov byte [eax], 0x7f
mov dword [esp + 0x10], eax
mov ebp, 1
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
lea eax, [esp + 0x20]
push 0xffffffffffffffff
push eax
push 2
push 1
push ebx
call sub.NETAPI32.dll_NetUserEnum
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x28], esi
je 0x4066cc
cmp esi, 0xea
jne 0x4067df
mov eax, dword [esp + 0x14]
mov edi, eax
cmp eax, ebx
mov dword [esp + 0x18], edi
je 0x4067f9
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ebx
cmp ecx, ebx
jbe 0x4067e7
jmp 0x4066f8
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4067e3
mov ecx, dword [edi]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
push esi
call fcn.00462100
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x406731
push eax
call fcn.0046210e
add esp, 4
mov edx, dword [edi]
push 0
push 0
push esi
push ebx
push 0xffffffffffffffff
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 4
lea esi, [eax + ebp]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
cmp eax, esi
jae 0x406774
mov ecx, dword [esp + 0x10]
push 0x42
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov edx, dword [edi + 0xc]
push ebx
mov dword [eax + ebp], edx
add ebp, 4
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x10]
mov ecx, eax
inc ecx
mov esi, ebx
mov eax, ecx
lea edi, [edx + ebp]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x18]
lea ebp, [eax + ebp + 1]
mov eax, dword [esp + 0x20]
add ecx, 0x20
inc eax
push ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], eax
call fcn.0046210e
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
add esp, 4
inc eax
cmp eax, ecx
mov dword [esp + 0x24], eax
jb 0x4066f0
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x28]
xor ebx, ebx
cmp eax, ebx
je 0x4067f9
push eax
call sub.NETAPI32.dll_NetApiBufferFree
xor eax, eax
mov dword [esp + 0x14], eax
cmp esi, 0xea
je 0x406696
cmp eax, ebx
je 0x40680f
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [esp + 0x10]
push 0x42
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret