joyce8/EMBER2024-capa huggingface dataset:
Function at 0xdafa20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7d2000]
push edi
or ebp, 0xffffffff
jmp 0xdafa42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xdafa49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdafa38
mov eax, 1
add ebx, ebx
jne 0xdafa5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xdafa6c
jne 0xdafa8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdafa8b
dec eax
add ebx, ebx
jne 0xdafa78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xdafa50
add ebx, ebx
jne 0xdafa87
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xdafadd
xor ecx, ecx
sub eax, 3
jb 0xdafaa3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xdafb12
sar eax, 1
mov ebp, eax
jmp 0xdafaae
add ebx, ebx
jne 0xdafaae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdafa7c
inc ecx
add ebx, ebx
jne 0xdafabc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdafa7c
add ebx, ebx
jne 0xdafac9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xdafabe
jne 0xdafada
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xdafabe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xdafafc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xdafaee
jmp 0xdafa3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xdafafc
add edi, ecx
jmp 0xdafa3e
pop esi
mov edi, esi
mov ecx, 0x93d581
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0xdafb37
cmp byte [edi], 0x86
jne 0xdafb1c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0xdafb1a
lea edi, [esi + 0x9ad000]
mov eax, dword [edi]
or eax, eax
je 0xdafb88
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9aff90]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9affcc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xdafb3d
mov ecx, edi
jns 0xdafb6c
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9affd0]
or eax, eax
je 0xdafb82
mov dword [ebx], eax
add ebx, 4
jmp 0xdafb5a
call dword [esi + 0x9affe0]
mov ebp, dword [esi + 0x9affd4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xdafbbc
sub esp, 0xffffff80
jmp 0x401434

Function at 0x710c89
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x7109ec
mov eax, ecx
call fcn.00710cbb
add eax, 1
and ecx, eax
sub ecx, 0x9b2af093
xor dword [esi], edx
sub eax, eax
inc esi
sub ecx, eax
add ecx, eax
mov ecx, ecx
cmp esi, edi
jne fcn.00710c89
add ecx, eax
dec ecx
ret
Function at 0x70111340
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
test byte [0x70116014], 8
jne 0x70111411
mov dword [esp + 8], 0
mov dword [esp + 4], sym._ServiceControlHandler_16
mov dword [esp], section..data
call sym._RegisterServiceCtrlHandlerExW_12
sub esp, 0xc
mov dword [0x7011c020], eax
test eax, eax
je 0x70111460
mov eax, 2
call sym._UpdateServiceStatus
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._RpcThreadRoutine_4
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
test eax, eax
je 0x701113e0
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, 4
call sym._UpdateServiceStatus
leave
ret 8
test byte [0x70116014], 2
jne 0x701114b0
call sym._GetLastError_0
test eax, eax
je 0x701113cf
test byte [0x70116014], 2
jne 0x701114f0
mov eax, 1
call sym._UpdateServiceStatus
leave
ret 8
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], 0x70117180
mov dword [esp + 0x10], 0x87
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], str.NlNetlogonMain
mov dword [esp + 0x18], eax
mov dword [esp + 8], 0x70117055
mov dword [esp + 4], 0x70116014
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x70111353
test byte [0x70116014], 2
je 0x701113d9
call sym._GetLastError_0
mov dword [esp + 0x14], str.RegisterServiceCtrlHandlerExW___failed___Error__lu__n
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0x8e
mov dword [esp + 0xc], str.NlNetlogonMain
mov dword [esp + 8], 0x70117055
mov dword [esp + 4], 0x70116014
mov dword [esp], 1
call sym._ros_dbg_log
leave
ret 8
mov dword [esp + 0x14], str.Cant_create_PortThread_n
mov dword [esp + 0x10], 0x73
mov dword [esp + 0xc], str.ServiceInit
mov dword [esp + 8], 0x70117055
mov dword [esp + 4], 0x70116014
mov dword [esp], 1
call sym._ros_dbg_log
jmp 0x701113ed
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.Service_stopped__dwError:__lu_n
mov dword [esp + 0x10], 0x97
mov dword [esp + 0xc], str.NlNetlogonMain
mov dword [esp + 8], 0x70117055
mov dword [esp + 4], 0x70116014
mov dword [esp], 1
call sym._ros_dbg_log
jmp 0x70111403
Function at 0x70111570
Capabilities:
Listen for remote procedure calls

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x70117240
mov dword [esp + 4], 0x14
mov dword [esp], 0x7011725e
call sym._RpcServerUseProtseqEpW_16
sub esp, 0x10
test eax, eax
je 0x701115b4
test byte [0x70116024], 2
jne 0x70111642
leave
xor eax, eax
ret 4
mov eax, dword [0x70116100]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._RpcServerRegisterIf_12
sub esp, 0xc
test eax, eax
je 0x70111600
test byte [0x70116024], 2
je 0x701115ae
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.RpcServerRegisterIf___failed__Status__lx__n
mov dword [esp + 0x10], 0x23
jmp 0x70111656
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4d2
mov dword [esp], 1
call sym._RpcServerListen_12
sub esp, 0xc
test eax, eax
je 0x701115ae
test byte [0x70116024], 2
je 0x701115ae
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.RpcServerListen___failed__Status__lx__n
mov dword [esp + 0x10], 0x2a
jmp 0x70111656
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.RpcServerUseProtseqEpW___failed__Status__lx__n
mov dword [esp + 0x10], 0x1c
mov dword [esp + 0xc], str.RpcThreadRoutine
mov dword [esp + 8], 0x701172d9
mov dword [esp + 4], 0x70116024
mov dword [esp], 1
call sym._ros_dbg_log
xor eax, eax
leave
ret 4

Function at 0x701128a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_DsGetDcCache___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_DsGetDcCache
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112900
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetLogonAddressToSiteName___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetLogonAddressToSiteName
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112960
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetLogonAppendChangeLog___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetLogonAppendChangeLog
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x701129c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetLogonCloseChangeLog___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetLogonCloseChangeLog
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112a20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetLogonFree___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetLogonFree
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112a80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetLogonGetAuthDataEx___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetLogonGetAuthDataEx
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112ae0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetLogonGetDirectDomain___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetLogonGetDirectDomain
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112b40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetLogonGetIpAddresses___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetLogonGetIpAddresses
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112ba0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetLogonGetSerialNumber___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetLogonGetSerialNumber
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x70112c00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetLogonLdapLookup___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetLogonLdapLookup
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112c60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetLogonLdapLookupEx___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetLogonLdapLookupEx
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112cc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetLogonMixedDomain___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetLogonMixedDomain
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112d20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetLogonNewChangeLog___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetLogonNewChangeLog
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112d80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetLogonReadChangeLog___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetLogonReadChangeLog
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112de0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetLogonSendToSamOnPdc___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetLogonSendToSamOnPdc
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x70112e40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetLogonSetServiceBits___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetLogonSetServiceBits
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112ea0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetNotifyDelta___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetNotifyDelta
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112f00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetNotifyDsChange___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetNotifyDsChange
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112f60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetNotifyMachineAccount___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetNotifyMachineAccount
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70112fc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetNotifyNetlogonDllHandle___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetNotifyNetlogonDllHandle
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x70113020
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetNotifyNtdsDsaDeletion___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetNotifyNtdsDsaDeletion
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70113080
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetNotifyRole___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetNotifyRole
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x701130e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_I_NetNotifyTrustedDomain___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.I_NetNotifyTrustedDomain
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x70113140
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_InitSecurityInterfaceW___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7011a588
mov dword [ebp - 0x40], str.InitSecurityInterfaceW
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x70114e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp + 0xc]
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], 0x7011ad50
call sym._fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_vfprintf]
call sym._abort
lea esi, [esi]
Function at 0x402eb2
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x402ecf
mov dword [ebp - 8], RegDeleteKeyA
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x402ede
mov ebx, 0x40f0f0
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402ef3
mov ecx, dword [0x424798]
add ecx, eax
push ecx
call fcn.004030e1
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.004030af
test eax, eax
je 0x40305a
test byte [ebp + 0x17], 0x80
je 0x403043
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40b020
mov dword [ebp - 0xc], eax
call fcn.00405d79
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x4030a5
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402f43
mov esi, dword [ebp + 0x14]
mov edi, 0x40b0f0
push esi
push edi
call fcn.004030af
test eax, eax
je 0x40305a
sub dword [ebp + 0x14], esi
mov dword [0x40b038], edi
mov dword [0x40b03c], esi
mov eax, dword [ebp - 8]
mov ecx, 0x40b020
mov dword [0x40b040], ebx
mov dword [0x40b044], eax
call fcn.00405d99
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x40303b
mov esi, dword [0x40b040]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x40929c], 1
mov edi, eax
je 0x402fe5
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x402fb2
cmp dword [ebp + 0x14], 0
jne 0x402fe5
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x54]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.00404d48
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x403030
cmp dword [ebp + 0x10], eax
jne 0x40300e
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40303f
cmp dword [ebp - 0x10], esi
jne 0x40303f
add dword [ebp - 4], esi
jmp 0x403024
sub dword [ebp - 8], esi
add dword [ebp - 4], esi
cmp dword [ebp - 8], 1
mov ebx, dword [0x40b040]
jl 0x4030a5
cmp dword [ebp - 0x14], 1
jne 0x402f66
jmp 0x4030a5
cmp dword [ebp + 0x14], eax
jg 0x402f36
jmp 0x4030a5
push 0xfffffffffffffffc
jmp 0x40305c
push 0xfffffffffffffffe
jmp 0x40305c
test edi, edi
je 0x40309a
cmp dword [ebp + 0x14], esi
jge 0x40304f
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.004030af
test eax, eax
jne 0x4030a2
push 0xfffffffffffffffd
pop eax
jmp 0x4030a8
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x40306a
mov esi, dword [ebp + 0x14]
mov edi, 0x40b0f0
push esi
push edi
call fcn.004030af
test eax, eax
je 0x40305a
lea eax, [ebp + 0x10]
push 0
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40303f
cmp esi, dword [ebp + 0x10]
jne 0x40303f
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x40305f
jmp 0x4030a5
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40522c
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x422d48], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x405250
test al, 0x10
jne 0x405253
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x422d48
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40527e
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8