joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416311
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x41644b
cmp dword [edi + 4], 0
je 0x41644b
cmp dword [ebp + 0xc], 0
je 0x416447
cmp dword [ebp + 0x10], 0
je 0x416447
push esi
push 0x64
pop esi
cmp dword [ebp + 0x14], esi
cmovae esi, dword [ebp + 0x14]
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41636f
push 0xffffffffffffff9c
pop esi
push 0xffffffffffffffeb
cmp eax, 0x102
pop ecx
cmovne esi, ecx
jmp 0x416442
cmp dword [edi], 0xffffffff
jne 0x41637c
push 0xffffffffffffffe2
pop esi
jmp 0x416439
push ebx
lea ebx, [edi + 0x10]
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4163a8
cmp dword [ebp - 4], 0
push 0xffffffffffffffea
pop esi
cmovne esi, dword [ebp - 4]
jmp 0x416438
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4163c8
sub eax, 0x6d
je 0x416430
sub eax, 0x7b
je 0x416430
sub eax, 1
je 0x41642c
push 0xffffffffffffffe9
jmp 0x416423
push esi
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4163e6
push 0xffffffffffffff9c
pop esi
push 0xffffffffffffffe7
cmp eax, 0x102
pop ecx
cmovne esi, ecx
jmp 0x416438
cmp dword [edi], 0xffffffff
jne 0x4163ef
push 0xffffffffffffffe2
jmp 0x416432
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
lea eax, [ebp - 4]
push eax
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x416435
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x6d
je 0x416430
sub eax, 0x7b
je 0x416430
sub eax, 1
je 0x41642c
push 0xffffffffffffffe8
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x416438
push 0xffffffffffffffe3
jmp 0x416432
push 0xffffffffffffffe4
pop esi
jmp 0x416438
mov esi, dword [ebp - 4]
pop ebx
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
pop esi
jmp 0x41644e
xor eax, eax
jmp 0x41644e
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x416660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x416796
cmp dword [edi + 4], 0
je 0x416796
cmp dword [ebp + 0xc], 0
je 0x416792
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x416792
and dword [ebp - 4], 0
push esi
push 0x64
pop esi
cmp dword [ebp + 0x14], esi
cmovae esi, dword [ebp + 0x14]
push esi
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4166c0
push 0xffffffffffffff9c
pop esi
push 0xfffffffffffffff5
cmp eax, 0x102
pop ecx
cmovne esi, ecx
jmp 0x41678d
cmp dword [edi], 0xffffffff
jne 0x4166cd
push 0xffffffffffffffe2
pop esi
jmp 0x416784
lea eax, [edi + 0x24]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4166ed
push 0xfffffffffffffff4
jmp 0x41677b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x41671c
sub eax, 0x6d
je 0x416718
sub eax, 0x7b
je 0x416718
sub eax, 1
je 0x416714
push 0xfffffffffffffff3
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x416784
push 0xffffffffffffffed
jmp 0x4166c7
push 0xffffffffffffffee
jmp 0x4166c7
push esi
push dword [edi + 0x34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41673a
push 0xffffffffffffff9c
pop esi
push 0xfffffffffffffff0
cmp eax, 0x102
pop ecx
cmovne esi, ecx
jmp 0x416784
cmp dword [edi], 0xffffffff
je 0x4166c5
push dword [edi + 0x34]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x24]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x416779
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
je 0x416775
cmp eax, 0x6d
je 0x416775
push 0xfffffffffffffff2
jmp 0x41670b
push 0xffffffffffffffee
jmp 0x41670b
push 0xfffffffffffffff1
xor eax, eax
cmp ebx, dword [ebp - 4]
pop esi
cmove esi, eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
pop esi
jmp 0x416799
xor eax, eax
jmp 0x416799
or eax, 0xffffffff
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41679f
Capabilities:
Create directory

Disassembly:
push 0x2d8
mov eax, 0x44c362
call fcn.00423e41
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0x20a
xor ebx, ebx
push ebx
push eax
call fcn.00425c30
add esp, 0xc
lea ecx, [ebp - 0x2e4]
push 1
push 3
call fcn.004154c6
mov dword [ebp - 4], ebx
test esi, esi
je 0x416938
push ebx
push esi
call fcn.0042f53f
pop ecx
pop ecx
test eax, eax
je 0x416936
push 0x105
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.0042d385
add esp, 0xc
lea eax, [ebp - 0x21c]
cmp word [ebp - 0x21c], 0x5c
mov edi, 0x4658d0
push ebx
push edi
push eax
jne 0x41686a
call fcn.0043116e
add esp, 0xc
test eax, eax
je 0x416848
push eax
lea eax, [ebp - 0x2d4]
push 0x44fff8
push eax
call fcn.00409cb1
pop ecx
pop ecx
push eax
call fcn.00409cb1
pop ecx
pop ecx
push ebx
push edi
push ebx
call fcn.0043116e
add esp, 0xc
test eax, eax
je 0x41688e
push edi
push eax
lea eax, [ebp - 0x2d4]
push edi
push eax
call fcn.00409cb1
pop ecx
pop ecx
jmp 0x41687e
call fcn.0043116e
add esp, 0xc
test eax, eax
je 0x41688e
push edi
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.00409cb1
pop ecx
pop ecx
push eax
call fcn.00409cb1
pop ecx
pop ecx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2cc]
call fcn.0040be89
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
push ebx
cmovae eax, dword [ebp - 0x234]
push eax
call fcn.0042f53f
pop ecx
pop ecx
lea ecx, [ebp - 0x234]
mov esi, eax
call fcn.004086f1
test esi, esi
jne 0x416938
jmp 0x416927
push edi
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.00409cb1
pop ecx
pop ecx
push eax
call fcn.00409cb1
pop ecx
pop ecx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2cc]
call fcn.0040be89
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push eax
call fcn.00431193
pop ecx
lea ecx, [ebp - 0x234]
mov esi, eax
call fcn.004086f1
cmp esi, 2
je 0x416938
push ebx
push edi
push ebx
call fcn.0043116e
add esp, 0xc
test eax, eax
jne 0x4168d0
mov bl, 1
lea ecx, [ebp - 0x2e4]
call fcn.00415699
mov al, bl
call fcn.00423deb
ret
Function at 0x417602
Capabilities:
Check os version
Get file version info
Get system information on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x46b880]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x46cad8
mov dword [0x46cad8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [0x46cadc], 0xa
jne 0x41770e
cmp dword [0x46cae0], 0
jne 0x41770e
push ebx
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00425c30
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push str._SystemRoot__system32kernel32.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ebx, ebx
lea eax, [ebp - 0x210]
push ebx
push eax
xor esi, esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
push eax
mov dword [ebp - 0x214], eax
call fcn.0042d6fb
mov edi, eax
pop ecx
test edi, edi
je 0x41770d
push edi
push dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4176e6
and dword [ebp - 0x214], ebx
lea eax, [ebp - 0x218]
and dword [ebp - 0x218], ebx
push eax
lea eax, [ebp - 0x214]
push eax
push 0x4658d0
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4176e6
mov eax, dword [ebp - 0x214]
mov esi, dword [eax + 8]
movzx ebx, word [eax + 0xe]
push edi
call fcn.0042d6f6
pop ecx
cmp esi, 0xa0000
jb 0x41770d
mov eax, esi
mov dword [0x46cae4], ebx
shr eax, 0x10
mov dword [0x46cadc], eax
movzx eax, si
mov dword [0x46cae0], eax
pop ebx
push str.GetNativeSystemInfo
mov edi, str.kernel32.dll
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x46cbf4
test esi, esi
je 0x41773d
mov ecx, esi
call dword [0x44d42c]
call esi
jmp 0x417743
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x46cadc], 6
jb 0x417784
push str.GetProductInfo
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x417784
push 0x46cc18
push 0
push 0
push dword [0x46cae0]
mov ecx, esi
push dword [0x46cadc]
call dword [0x44d42c]
call esi
push 0x100
push 0x46cc20
call fcn.004171be
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00423dc5
mov esp, ebp
pop ebp
ret
Function at 0x41785c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x46b880]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp word [esi], 0x5c
jne 0x4178e3
push 4
push 0x45019c
push esi
call fcn.0042ded1
add esp, 0xc
test eax, eax
jne 0x41789a
push dword [ebp + 0x10]
lea eax, [esi + 8]
push eax
jmp 0x4178e7
push 0xc
push str.SystemRoot_
push esi
call fcn.0042d53d
add esp, 0xc
test eax, eax
jne 0x4178e3
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [esi + 0x16]
push eax
lea eax, [ebp - 0x20c]
push eax
push str._s_s
push dword [ebp + 0x10]
push edi
call fcn.00408fc5
add esp, 0x14
jmp 0x4178f0
push dword [ebp + 0x10]
push esi
push edi
call fcn.0042d385
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00423dc5
mov esp, ebp
pop ebp
ret

Function at 0x417900
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x46b880]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x218], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
xor esi, esi
xor edx, edx
mov ecx, esi
inc edx
shl edx, cl
test ebx, edx
je 0x417992
push 0x3a
lea eax, [esi + 0x41]
movzx edi, ax
pop eax
mov word [ebp - 0xa], ax
xor eax, eax
push 0x208
push eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x214]
push eax
mov word [ebp - 0xc], di
call fcn.00425c30
add esp, 0xc
lea eax, [ebp - 0x214]
push 0x103
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x417992
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x218]
call fcn.0042d3c8
pop ecx
pop ecx
test eax, eax
je 0x4179ab
inc esi
cmp esi, 0x20
jb 0x417929
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423dc5
mov esp, ebp
pop ebp
ret
mov ax, di
jmp 0x41799a
Function at 0x417a6e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x46b880]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [0x46ce28]
mov dword [ebp - 8], ebx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x417b22
and dword [ebp - 0x420], 0
lea eax, [ebp - 0x420]
push eax
push 0
push 0
push ebx
mov ecx, esi
call dword [0x44d42c]
call esi
test eax, eax
jne 0x417bdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x417bdd
mov esi, dword [ebp - 0x420]
lea eax, [esi + esi]
call fcn.00423ef0
mov ebx, esp
test ebx, ebx
je 0x417bdd
lea eax, [ebp - 0x420]
push eax
push esi
mov esi, dword [0x46ce28]
mov ecx, esi
push ebx
push dword [ebp - 8]
call dword [0x44d42c]
call esi
test eax, eax
je 0x417bdd
push dword [ebp + 0x10]
push ebx
push edi
call fcn.0042d385
add esp, 0xc
xor eax, eax
inc eax
jmp 0x417bdf
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x420], eax
xor esi, esi
xor edx, edx
mov ecx, esi
inc edx
shl edx, cl
test eax, edx
je 0x417bd3
push 0x3a
lea eax, [esi + 0x41]
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x417bcd
push 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x417bcd
lea eax, [ebp - 0x214]
push ebx
push eax
call fcn.0042d3c8
pop ecx
pop ecx
test eax, eax
je 0x417c25
push 0x208
lea eax, [ebp - 0x41c]
push 0
push eax
call fcn.00425c30
push 0x104
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
call fcn.00417ca5
add esp, 0x1c
test al, al
jne 0x417bf6
mov eax, dword [ebp - 0x420]
inc esi
cmp esi, 0x20
jb 0x417b30
xor eax, eax
lea esp, [ebp - 0x42c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423dc5
mov esp, ebp
pop ebp
ret
mov ebx, 0x104
lea eax, [ebp - 0xc]
push ebx
push eax
push edi
call fcn.0042d385
xor ecx, ecx
mov word [edi + 0x206], cx
lea ecx, [ebp - 0x41c]
push ebx
push ecx
push edi
call fcn.0042d340
add esp, 0x18
jmp 0x417b1a
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
jmp 0x417b11
Function at 0x417ca5
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x46b880]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0x628], eax
lea eax, [ebp - 0x418]
push ebx
push eax
call fcn.00425c30
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x104
push eax
push dword [ebp - 0x628]
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov dword [ebp - 0x630], eax
cmp eax, 0xffffffff
je 0x417e40
push 0x20a
lea eax, [ebp - 0x624]
push ebx
push eax
call fcn.00425c30
push 0x20a
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.00425c30
push 0x104
push dword [ebp - 0x628]
lea eax, [ebp - 0x210]
push eax
call fcn.0042d385
lea eax, [ebp - 0x210]
push eax
call fcn.0042d325
mov ecx, 0x104
sub ecx, eax
lea eax, [ebp - 0x418]
push ecx
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0042d340
add esp, 0x34
lea eax, [ebp - 0x624]
push 0x104
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x417dd0
push dword [ebp - 0x62c]
lea eax, [ebp - 0x624]
push eax
call fcn.0042d3c8
pop ecx
pop ecx
test eax, eax
je 0x417e21
push 0x104
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x624]
push eax
push dword [ebp - 0x62c]
call fcn.00417ca5
add esp, 0x10
test al, al
jne 0x417df2
push 0x104
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
test eax, eax
jne 0x417d11
jmp 0x417e34
push edi
lea eax, [ebp - 0x418]
push eax
push esi
call fcn.0042d385
xor eax, eax
mov word [esi + edi*2 - 2], ax
lea eax, [ebp - 0x210]
push edi
push eax
push esi
call fcn.0042d340
add esp, 0x18
xor eax, eax
mov word [esi + edi*2 - 2], ax
jmp 0x417e32
push edi
lea eax, [ebp - 0x418]
push eax
push esi
call fcn.0042d385
add esp, 0xc
mov bl, 1
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423dc5
mov esp, ebp
pop ebp
ret
Function at 0x418286
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x46b880]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov word [ebp - 8], 0x500
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push 0x200
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4182ea
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00423dc5
mov esp, ebp
pop ebp
ret

Function at 0x4182f9
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x46b880]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov word [ebp - 8], 0x500
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x41835d
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00423dc5
mov esp, ebp
pop ebp
ret

Function at 0x41836c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x46b880]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, 0x11c
mov dword [ebp - 0x128], eax
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00425c30
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jae 0x4183c0
xor eax, eax
jmp 0x418439
mov eax, dword [ebp - 0x128]
mov esi, eax
and dword [ebp - 0x124], 0
test esi, esi
jne 0x4183f3
lea eax, [ebp - 0x128]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x418433
mov eax, dword [ebp - 0x128]
and dword [ebp - 0x12c], 0
lea ecx, [ebp - 0x12c]
push ecx
push 4
lea ecx, [ebp - 0x124]
push ecx
push 0x12
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x124]
mov dword [ebp - 0x124], eax
test esi, esi
jne 0x418439
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00423dc5
mov esp, ebp
pop ebp
ret
Function at 0x418448
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x46b880]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x100
push eax
lea eax, [ebp - 0x204]
xor esi, esi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x41849c
lea eax, [ebp - 0x204]
push str.SYSTEM
push eax
call fcn.0042d3c8
pop ecx
pop ecx
test eax, eax
jne 0x41849c
push 2
pop esi
jmp 0x4184b5
push esi
call fcn.004182f9
pop ecx
test eax, eax
jne 0x4184b2
push esi
call fcn.00418286
pop ecx
test eax, eax
je 0x4184b5
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00423dc5
mov esp, ebp
pop ebp
ret

Function at 0x418889
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x46b880]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push 0x105
xor ebx, ebx
push ebx
push eax
call fcn.00425c30
add esp, 0xc
lea eax, [ebp - 0x10c]
push ebx
push ebx
push 0x104
push eax
push 0xffffffffffffffff
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x10c]
mov byte [ebp - 9], bl
push ecx
call sub.WS2_32.dll_gethostbyname
pop esi
pop ebx
test eax, eax
jne 0x4188eb
or eax, 0xffffffff
jmp 0x4188f2
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423dc5
mov esp, ebp
pop ebp
ret

Function at 0x418943
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x46b880]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x14]
push 0
push 1
push 2
pop eax
push eax
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x418983
push 0x452284
call fcn.004311e1
pop ecx
or eax, 0xffffffff
jmp 0x418a0b
push dword [ebp + 0x10]
push esi
call fcn.00418900
pop ecx
pop ecx
test edi, edi
je 0x4189cb
push 0x10
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00425c30
push 2
pop eax
push edi
mov word [ebp - 0x14], ax
call fcn.00418816
add esp, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
call sub.WS2_32.dll_bind
cmp eax, 0xffffffff
jne 0x4189cb
push esi
call sub.WS2_32.dll_closesocket
jmp 0x41897b
push 0x10
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00425c30
add esp, 0xc
push 2
pop eax
push dword [ebp + 0xc]
mov word [ebp - 0x14], ax
call sub.WS2_32.dll_htons
push ebx
mov word [ebp - 0x12], ax
call fcn.00418816
pop ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
je 0x4189c3
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423dc5
mov esp, ebp
pop ebp
ret
Function at 0x418ac7
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
xor edi, edi
push edi
push 0x4523ec
call fcn.00418c26
test eax, eax
je 0x418aec
xor eax, eax
jmp 0x418b97
mov eax, dword [esi + 0x10]
push ebx
inc eax
shr eax, 1
push 1
push eax
mov dword [ebp - 4], eax
call fcn.0042de7b
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x418b94
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
mov dword [ebp - 8], eax
jb 0x418b18
mov esi, dword [esi]
push 0x4523ec
call fcn.0042d325
pop ecx
lea esi, [esi + eax*2]
lea eax, [ebp - 4]
push eax
push ebx
push 0x4523ec
call fcn.0042d325
pop ecx
mov ecx, dword [ebp - 8]
sub ecx, eax
push ecx
push esi
call fcn.00403030
add esp, 0x10
test eax, eax
jne 0x418b94
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xc]
push eax
push 1
push edi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
push eax
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], 0x46b380
push eax
mov dword [ebp - 0x14], 0x40
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call sub.CRYPT32.dll_CryptUnprotectData
cmp eax, 1
jne 0x418b94
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov eax, dword [ebp - 8]
inc edi
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret