joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f1a9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f1c2e
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push 0x4f1c48
push edi
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404438
mov dword [ebp - 0x14], 0xc
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], 0xc
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor ebx, ebx
mov dword [ebp - 0x64], 0x44
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x38], 1
mov word [ebp - 0x32], 0
xor eax, eax
mov dword [ebp - 0x30], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
mov eax, esi
call fcn.0040453c
push eax
push ebx
push 0x20
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.0040453c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
neg eax
sbb eax, eax
neg eax
mov ebx, eax
test bl, bl
jne 0x4f1bb1
lea edx, [ebp - 0x7c]
mov eax, dword [0x663c8c]
mov eax, dword [eax]
call fcn.004af6b8
push dword [ebp - 0x7c]
push 0x4f1c54
push dword [ebp - 4]
push 0x4f1c54
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x80]
call fcn.0040f60c
push dword [ebp - 0x80]
lea eax, [ebp - 0x78]
mov edx, 5
call fcn.00404438
mov eax, dword [ebp - 0x78]
mov edx, 1
call fcn.004f1c5c
mov dword [ebp - 8], 0x103
jmp 0x4f1bdd
mov eax, dword [0x663c8c]
mov eax, dword [eax]
call fcn.004af044
push 0x3e8
call sub.kernel32.dll_Sleep
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp bl, 1
jne 0x4f1bf1
cmp dword [ebp - 8], 0x103
jne 0x4f1bf1
cmp byte [ebp + 8], 1
je 0x4f1bba
mov esi, dword [ebp - 8]
cmp bl, 1
jne 0x4f1c0b
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1c35
lea eax, [ebp - 0x80]
mov edx, 3
call fcn.00404100
lea eax, [ebp - 4]
call fcn.004040dc
ret
Function at 0x4f2584
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f269d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004040dc
mov esi, 0x4f26ac
lea edi, [ebp - 0x201]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x201]
push eax
push 0x200
push 0x200
mov ecx, 0x4f28b0
mov edx, 0x4f28b4
mov eax, 0x4f28c0
call fcn.00502d20
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x201]
mov ecx, 0x201
call fcn.0040430c
cmp dword [ebp - 0x208], 0
jne 0x4f2646
mov eax, 0x90
call fcn.004027dc
mov esi, eax
push 0x90
push esi
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x20c]
mov edx, esi
call fcn.00404294
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040c6ec
mov eax, esi
call fcn.004027f4
jmp 0x4f2658
mov eax, ebx
lea edx, [ebp - 0x201]
mov ecx, 0x201
call fcn.0040430c
mov eax, dword [ebx]
call fcn.00404378
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
jne 0x4f267f
push ebx
mov eax, dword [ebx]
call fcn.00404378
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.00404580
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f26a4
lea eax, [ebp - 0x20c]
mov edx, 2
call fcn.00404100
ret

Function at 0x4f28f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f29f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004040dc
mov esi, 0x4f2a04
lea edi, [ebp - 0x201]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x201]
push eax
push 0x200
push 0x200
mov ecx, 0x4f2c08
mov edx, 0x4f2c0c
mov eax, 0x4f2c14
call fcn.00502d20
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x201]
mov ecx, 0x201
call fcn.0040430c
cmp dword [ebp - 0x208], 0
jne 0x4f29a3
mov eax, 0x90
call fcn.004027dc
mov esi, eax
push esi
push 0x90
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esi
call fcn.00404294
mov eax, esi
call fcn.004027f4
jmp 0x4f29b5
mov eax, ebx
lea edx, [ebp - 0x201]
mov ecx, 0x201
call fcn.0040430c
mov eax, dword [ebx]
call fcn.00404378
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
jne 0x4f29dc
push ebx
mov eax, dword [ebx]
call fcn.00404378
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.00404580
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f29fc
lea eax, [ebp - 0x208]
call fcn.004040dc
ret
Function at 0x4f43e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4f4529
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
call fcn.004f40f8
cmp dword [ebp - 0xc], 0
je 0x4f4434
push 1
push 0x4f4538
mov eax, esi
call fcn.0040453c
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040453c
push eax
push 0x4f453c
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4f450e
push 1
push 0x4f4538
push 0x4f4538
mov eax, esi
call fcn.0040453c
push eax
push 0x4f453c
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
je 0x4f4462
cmp eax, 2
jne 0x4f450c
lea edx, [ebp - 4]
mov eax, 0x4f454c
call fcn.004f45dc
lea edx, [ebp - 8]
mov eax, 0x4f4598
call fcn.004f45dc
cmp dword [ebp - 4], 0
je 0x4f44db
push 3
push 0x4f4538
mov eax, esi
call fcn.0040453c
mov ebx, eax
push ebx
mov eax, dword [ebp - 4]
call fcn.0040453c
push eax
push 0x4f453c
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 2
jne 0x4f44d7
push 3
push 0x4f4538
push ebx
mov eax, dword [ebp - 8]
call fcn.0040453c
push eax
push 0x4f453c
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 2
jne 0x4f44d3
xor ebx, ebx
jmp 0x4f450e
mov bl, 1
jmp 0x4f450e
mov bl, 1
jmp 0x4f450e
push 3
push 0x4f4538
mov eax, esi
call fcn.0040453c
push eax
mov eax, dword [ebp - 8]
call fcn.0040453c
push eax
push 0x4f453c
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 2
jne 0x4f4508
xor ebx, ebx
jmp 0x4f450e
mov bl, 1
jmp 0x4f450e
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f4530
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404100
ret

Function at 0x4f8714
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f87d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004040dc
mov eax, pe_nt_image_headers32
mov edx, 0x4f87e4
mov ebx, 0x4f87ec
mov ecx, 0x4f87f4
mov dword [ebp - 8], ecx
mov esi, 0x4f87fc
lea edi, [ebp - 0x10c]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
push edx
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_GetPrivateProfileStringA
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.0040430c
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x4f8904
call fcn.00404664
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00404580
cmp dword [ebp - 0xc], 0
je 0x4f87be
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00404130
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f87db
lea eax, [ebp - 0xc]
call fcn.004040dc
ret
Function at 0x4f9e30
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040452c
xor eax, eax
push ebp
push 0x4f9ecc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404174
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040c65c
cmp dword [ebp - 0xc], 0
jne 0x4f9e8f
lea eax, [ebp - 0x10]
call fcn.004f2554
push dword [ebp - 0x10]
push 0x4f9ee0
push dword [ebp - 8]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404438
mov eax, dword [ebp - 8]
call fcn.0040453c
mov ebx, eax
push ebx
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0x80
je 0x4f9eb1
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9ed3
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404100
ret

Function at 0x4f9f50
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040452c
xor eax, eax
push ebp
push 0x4f9ff4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404174
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040c65c
cmp dword [ebp - 0xc], 0
jne 0x4f9fb2
lea eax, [ebp - 0x10]
call fcn.004f2554
push dword [ebp - 0x10]
push 0x4fa00c
push dword [ebp - 8]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404438
mov eax, dword [ebp - 8]
call fcn.0040c3e0
test al, al
je 0x4f9fd9
mov eax, dword [ebp - 8]
call fcn.0040453c
mov esi, eax
push esi
call sub.kernel32.dll_GetFileAttributesA
cmp ebx, eax
je 0x4f9fd9
push ebx
push esi
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9ffb
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404100
ret
Function at 0x4fb348
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff6ac
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040452c
xor eax, eax
push ebp
push 0x4fb48a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040c3e0
test al, al
je 0x4fb474
xor edx, edx
push ebp
push 0x4fb46a
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.00406cca
mov eax, dword [0x663d7c]
mov byte [eax], 2
mov eax, dword [ebp - 4]
call fcn.0040453c
mov esi, eax
push esi
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
test bl, 1
je 0x4fb3c4
mov ebx, 0x20
push ebx
push esi
call sub.kernel32.dll_SetFileAttributesA
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.00407105
call fcn.004028fc
lea eax, [ebp - 0x154]
call fcn.00406e40
call fcn.004028fc
mov esi, eax
lea eax, [ebp - 0x954]
mov edx, 0x800
call fcn.00408b38
xor ebx, ebx
cmp esi, ebx
jle 0x4fb450
mov eax, esi
sub eax, ebx
cmp eax, 0x800
jl 0x4fb42d
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x954]
mov ecx, 0x800
lea eax, [ebp - 0x154]
call fcn.00406d6c
call fcn.004028fc
jmp 0x4fb449
lea edx, [ebp - 8]
push edx
mov ecx, eax
lea edx, [ebp - 0x954]
lea eax, [ebp - 0x154]
call fcn.00406d6c
call fcn.004028fc
add ebx, dword [ebp - 8]
cmp esi, ebx
jg 0x4fb401
lea eax, [ebp - 0x154]
call fcn.00406dd0
call fcn.004028fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fb474
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fb491
lea eax, [ebp - 4]
call fcn.004040dc
ret

Function at 0x4fd05c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040452c
xor eax, eax
push ebp
push 0x4fd0ec
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004f3584
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404174
mov eax, dword [ebp - 4]
call fcn.0040453c
push eax
call sub.kernel32.dll_GetFileAttributesA
test al, 0x80
jne 0x4fd0d1
push 0
push 1
mov ecx, dword [0x663a9c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 4]
mov eax, 0x4fd104
call fcn.004f1a9c
mov edx, 0x80
mov eax, dword [ebp - 4]
call fcn.004f9f50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd0f3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404100
ret
Function at 0x4fe284
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4fe28c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4fe3f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004040dc
xor eax, eax
push ebp
push 0x4fe3ce
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402c1c
mov eax, dword [ebp - 0x14]
call fcn.0040453c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x4fe2eb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fe3d8
mov eax, esi
call fcn.004027dc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402c1c
mov eax, dword [ebp - 0x18]
call fcn.0040453c
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4fe404
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0040c1a4
push dword [ebx]
push 0x4fe410
mov eax, dword [edi + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040c1a4
push dword [ebp - 0x1c]
mov eax, ebx
mov edx, 3
call fcn.00404438
push dword [ebx]
push 0x4fe410
mov eax, dword [edi + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0040c1a4
push dword [ebp - 0x20]
mov eax, ebx
mov edx, 3
call fcn.00404438
push dword [ebx]
push 0x4fe410
mov eax, dword [edi + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.0040c1a4
push dword [ebp - 0x24]
mov eax, ebx
mov edx, 3
call fcn.00404438
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004027f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fe3d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fe3fa
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00404100
ret
Function at 0x4fe7ec
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov eax, dword [0x663ef0]
cmp dword [eax], 2
je 0x4fe809
mov byte [ebp - 1], 1
jmp 0x4fe9d9
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x662298
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x4fe9d9
xor eax, eax
push ebp
push 0x4fe9d2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x4fe86b
push 0x4fe9e4
push 0x4fe9fc
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x4fe894
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x4fe9bb
mov eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 1], al
jmp 0x4fe9bb
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x4fe8e5
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
je 0x4fe8c6
call fcn.00403bac
jmp 0x4fe9d9
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4fe8e5
call fcn.00403bac
jmp 0x4fe9d9
xor eax, eax
push ebp
push 0x4fe9b4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4fe928
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
je 0x4fe928
call fcn.00403bac
call fcn.00403bac
jmp 0x4fe9d9
mov eax, dword [ebp - 0x14]
call fcn.004027dc
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4fe95a
call fcn.00403bac
call fcn.00403bac
jmp 0x4fe9d9
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x4fe995
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4fe991
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x4fe991
mov byte [ebp - 1], 1
jmp 0x4fe995
inc ebx
dec esi
jne 0x4fe967
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fe9bb
mov eax, dword [ebp - 0x18]
call fcn.004027f4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fe9d9
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ff8a4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040452c
mov eax, dword [ebp - 8]
call fcn.0040452c
xor eax, eax
push ebp
push 0x4ff975
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.004fc2a4
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004fcbd4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00404174
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.004043c4
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004043c4
xor eax, eax
push ebp
push 0x4ff950
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040c3e0
test al, al
je 0x4ff946
push 0
mov eax, dword [ebp - 8]
call fcn.0040453c
push eax
mov eax, dword [ebp - 4]
call fcn.0040453c
push eax
call sub.kernel32.dll_CopyFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ff95a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff97c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404100
ret
Function at 0x4ff984
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x184], ebx
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0x17c], ebx
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040452c
mov eax, dword [ebp - 8]
call fcn.0040452c
mov eax, dword [ebp - 0xc]
call fcn.0040452c
lea eax, [ebp - 0x16c]
mov edx, dword [0x40aed0]
call fcn.00404bec
xor eax, eax
push ebp
push 0x4ffb8e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.004fc2a4
lea edx, [ebp - 0x170]
mov eax, dword [ebp - 0x10]
call fcn.004fcbd4
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 0x10]
call fcn.00404174
lea eax, [ebp - 0x178]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004043c4
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.004fcbd4
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 4]
call fcn.00404174
lea eax, [ebp - 0x180]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.004043c4
mov eax, dword [ebp - 0x180]
lea edx, [ebp - 0x17c]
call fcn.004fcbd4
mov edx, dword [ebp - 0x17c]
lea eax, [ebp - 8]
call fcn.00404174
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004043c4
xor edx, edx
push ebp
push 0x4ffb48
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004f18d4
test al, al
je 0x4ffb3e
mov eax, dword [ebp - 8]
call fcn.004f18d4
test al, al
jne 0x4ffac6
mov eax, dword [ebp - 8]
call fcn.0040cf74
lea ecx, [ebp - 0x16c]
mov edx, 0x3f
mov eax, dword [ebp - 0x14]
call fcn.0040c47c
test eax, eax
jne 0x4ffb33
push 0
lea eax, [ebp - 0x184]
mov ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 8]
call fcn.004043c4
mov eax, dword [ebp - 0x184]
call fcn.0040453c
push eax
lea eax, [ebp - 0x188]
mov ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 4]
call fcn.004043c4
mov eax, dword [ebp - 0x188]
call fcn.0040453c
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x16c]
call fcn.0040c4cc
test eax, eax
je 0x4ffadd
lea eax, [ebp - 0x16c]
call fcn.0040c4f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ffb52
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ffb95
lea eax, [ebp - 0x188]
mov edx, 7
call fcn.00404100
lea eax, [ebp - 0x16c]
mov edx, dword [0x40aed0]
call fcn.00404cb8
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404100
ret
Function at 0x4ffb9c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe80
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0x180], edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040452c
lea eax, [ebp - 0x16c]
mov edx, dword [0x40aed0]
call fcn.00404bec
xor eax, eax
push ebp
push 0x4ffd60
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004fc2a4
lea edx, [ebp - 0x170]
mov eax, dword [ebp - 8]
call fcn.004fcbd4
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 8]
call fcn.00404174
lea eax, [ebp - 0x178]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004043c4
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.004fcbd4
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 4]
call fcn.00404174
lea eax, [ebp - 0xc]
mov ecx, 0x4ffd78
mov edx, dword [ebp - 4]
call fcn.004043c4
xor edx, edx
push ebp
push 0x4ffd1a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004f18d4
test al, al
je 0x4ffd10
lea ecx, [ebp - 0x16c]
mov edx, 0x3f
mov eax, dword [ebp - 0xc]
call fcn.0040c47c
test eax, eax
jne 0x4ffd05
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x160]
call fcn.00404174
lea ecx, [ebp - 0x14]
mov edx, 0x4ffd88
mov eax, dword [ebp - 0x10]
call fcn.0040c5c8
push 0
lea eax, [ebp - 0x17c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.004043c4
mov eax, dword [ebp - 0x17c]
call fcn.0040453c
push eax
lea eax, [ebp - 0x180]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.004043c4
mov eax, dword [ebp - 0x180]
call fcn.0040453c
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x16c]
call fcn.0040c4cc
test eax, eax
je 0x4ffc97
lea eax, [ebp - 0x16c]
call fcn.0040c4f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ffd24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ffd67
lea eax, [ebp - 0x180]
mov edx, 5
call fcn.00404100
lea eax, [ebp - 0x16c]
mov edx, dword [0x40aed0]
call fcn.00404cb8
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404100
ret