joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f55bd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.100f4a0b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100f49c0
add esp, 0xc
mov dword [ebp - 0x39c], eax
invalid
in eax, dx

Function at 0x100f5715
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
dec dword [ecx]
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.100f4a0b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100f49c0
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
invalid
lea esp, [ecx - 7]
invalid
Function at 0x100f634a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
adc eax, 0xfafffff9
mov byte [ebp - 0x6ea], 0xd5
mov byte [ebp - 0x6e9], 0xd0
mov byte [ebp - 0x6e8], 0xd9
mov byte [ebp - 0x6e7], 0xbc
call fcn.100f49fb
sub byte [ecx + ebp*4 + 0x2c], bh
lea eax, [ebp - 0x6f4]
push eax
call fcn.100f4a0b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100f49c0
add esp, 0xc
mov dword [ebp - 0x730], eax
and dword [ebp - 0x6fc], 0
push 1
pop eax
test eax, eax
je 0x100f6aa1
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x100f6576
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
mov byte [ebp - 0x758], 0x88
mov byte [ebp - 0x757], 0x8f
mov byte [ebp - 0x756], 0x9e
mov byte [ebp - 0x755], 0x96
mov byte [ebp - 0x754], 0xa7
mov byte [ebp - 0x753], 0x88
mov byte [ebp - 0x752], 0x82
mov byte [ebp - 0x751], 0x96
mov byte [ebp - 0x750], 0x88
mov byte [ebp - 0x74f], 0x89
mov byte [ebp - 0x74e], 0x8d
invalid
invalid
Function at 0x1011de73
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1011e0bc

Function at 0x10125472
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1012547d
Function at 0x1001d43
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.01001d76
test eax, eax
je 0x100369b
push 0
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
push esi
push edi
add eax, eax
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, esi
je 0x10036e7
mov eax, dword [ebp + 0x10]
push esi
push esi
lea ecx, [eax + eax]
push ecx
push edi
push eax
push dword [ebp + 0xc]
push esi
push 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp + 0x10], eax
cmp eax, esi
je 0x10036e0
push esi
lea ecx, [ebp + 0x10]
push ecx
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
jmp 0x1001d6d
Function at 0x1002b5b
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push esi
mov esi, dword [0x1019010]
test esi, esi
je 0x1002b92
push edi
push dword [esi + 8]
push 0
push dword [esi]
call sub.msvcrt.dll_memset
mov edi, dword [esi + 4]
add esp, 0xc
cmp dword [esi + 0xc], 0
jne 0x1002e83
push esi
call fcn.01001e31
mov esi, edi
test edi, edi
jne 0x1002b69
pop edi
and dword [0x1019010], 0
xor esi, esi
mov eax, dword [esi + 0x101a6f0]
test eax, eax
je 0x1002bb6
push eax
call fcn.01002bea
add esi, 4
cmp esi, 0x400
jb 0x1002b9b
xor esi, esi
inc esi
cmp dword [0x1019008], esi
jbe 0x1002bd7
mov eax, dword [0x101900c]
push dword [eax + esi*4]
call fcn.010018dc
inc esi
cmp esi, dword [0x1019008]
jb 0x1002bc1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.01002bea
pop esi
ret
push dword [esi]
call fcn.01001e31
jmp 0x1002b85

Function at 0x10046f3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push 0x10047b0
push 0x80000002
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1004792
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push ebx
mov edi, 0x1004798
push edi
push dword [ebp - 8]
call esi
cmp eax, ebx
je 0x1004750
cmp eax, 0xea
jne 0x1004787
cmp dword [ebp - 0x10], 1
jne 0x1004787
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
call fcn.01001e26
test eax, eax
jne 0x1004787
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push dword [ebp - 8]
call esi
test eax, eax
je 0x1004787
push dword [ebp - 4]
call sub.netutils.dll_NetApiBufferFree
mov dword [ebp - 4], ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, dword [ebp - 4]
pop ebx
leave
ret
Function at 0x100539b
Capabilities:
Add user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0xe
push esi
lea eax, [ebp - 0x24]
push 0xf
push eax
call sub.msvcrt.dll_wcsncpy_s
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
push 0x1003744
push 0x104
push esi
call sub.msvcrt.dll_wcscat_s
xor ecx, ecx
add esp, 0x20
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ecx
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x48]
push ecx
mov dword [ebp - 0x40], eax
xor eax, eax
lea ecx, [ebp - 0x44]
inc eax
push ecx
push eax
push edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], 0x1001
call sub.samcli.dll_NetUserAdd
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01002d45
leave
ret 8

Function at 0x100542e
Capabilities:
Delete user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x1003744
push 0x104
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
pop ebp
jmp fcn.010154f9
Function at 0x1005ad6
Capabilities:
Add user account group

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
call fcn.0100f48b
xor ebx, ebx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], ebx
cmp dword [0x101fc80], ebx
je 0x1005bfb
mov esi, 0x101fc80
push edi
mov edi, dword [esi]
mov ecx, str._ADD
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1005b4a
cmp dx, bx
je 0x1005b46
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1005b4a
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x1005b24
xor eax, eax
jmp 0x1005b4f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x1005bdf
mov ecx, 0x1019530
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1005b84
cmp dx, bx
je 0x1005b80
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1005b84
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x1005b5e
xor eax, eax
jmp 0x1005b89
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x1005bdf
push edi
call fcn.01010270
mov edi, eax
cmp edi, ebx
jne 0x1005ba3
push 0xdb1
call fcn.0100295a
mov eax, dword [esi]
mov ecx, str._COMMENT
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1005bd0
cmp dx, bx
je 0x1005bcc
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1005bd0
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x1005baa
xor eax, eax
jmp 0x1005bd5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1005bdf
mov dword [ebp - 0x218], edi
inc dword [ebp - 0x214]
mov esi, dword [ebp - 0x214]
lea esi, [esi*4 + 0x101fc80]
cmp dword [esi], ebx
jne 0x1005b1b
pop edi
push 1
push ebx
push ebx
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0100f2b3
cmp eax, ebx
je 0x1005c1a
push eax
call fcn.0100295a
push ebx
lea eax, [ebp - 0x21c]
push eax
push 1
lea eax, [ebp - 0x210]
push eax
call sub.samcli.dll_NetGroupAdd
mov esi, eax
cmp esi, ebx
je 0x1005c52
cmp esi, 0x35
jne 0x1005c4c
lea eax, [ebp - 0x210]
push eax
push 0xe81
call fcn.0101081b
push esi
call fcn.0100295a
call fcn.010108de
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01002d45
leave
ret 4

Function at 0x1005de1
Capabilities:
Delete user account group

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
call fcn.0100f48b
push 1
push 0
push 0
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0100f2b3
test eax, eax
je 0x1005e20
push eax
call fcn.0100295a
push esi
lea eax, [ebp - 0x210]
push eax
call sub.samcli.dll_NetGroupDel
mov esi, eax
test esi, esi
je 0x1005e4f
cmp esi, 0x35
jne 0x1005e49
lea eax, [ebp - 0x210]
push eax
push 0xe81
call fcn.0101081b
push esi
call fcn.0100295a
call fcn.010108de
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01002d45
leave
ret 4
Function at 0x1005e68
Capabilities:
Add user account to group

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x214], ebx
call fcn.0100f48b
push 1
push ebx
push ebx
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0100f2b3
cmp eax, ebx
je 0x1005eae
push eax
call fcn.0100295a
mov dword [ebp - 0x218], 2
cmp dword [0x101a6f8], ebx
je 0x1005f8a
push esi
mov esi, 0x101a6f8
push dword [esi]
lea eax, [ebp - 0x210]
push edi
push eax
call sub.samcli.dll_NetGroupAddUser
mov ecx, eax
sub ecx, ebx
je 0x1005f42
sub ecx, 0x35
je 0x1005f31
sub ecx, 0x46
je 0x1005f28
sub ecx, 0x832
je 0x1005f1f
sub ecx, 0xf
je 0x1005efe
push eax
call fcn.0100295a
jmp 0x1005f42
push 2
mov dword [0x1019ddc], edi
push 0xeaa
mov eax, dword [esi]
mov dword [0x1019dd8], eax
call fcn.01001c11
inc dword [ebp - 0x214]
jmp 0x1005f42
push 1
push 0xeab
jmp 0x1005f0b
push 1
push 0xe9e
jmp 0x1005f0b
lea eax, [ebp - 0x210]
push eax
push 0xe81
call fcn.0101081b
inc dword [ebp - 0x218]
mov esi, dword [ebp - 0x218]
lea esi, [esi*4 + 0x101a6f0]
cmp dword [esi], ebx
jne 0x1005eca
pop esi
cmp dword [ebp - 0x214], ebx
je 0x1005f8a
mov eax, dword [ebp - 0x218]
add eax, 0xfffffffe
cmp dword [ebp - 0x214], eax
jge 0x1005f81
push 0xdb0
call fcn.010108f6
push 1
call fcn.01002992
jmp 0x1005f8f
call fcn.010108de
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.01002d45
leave
ret 4

Function at 0x1005fa4
Capabilities:
Delete user account from group

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x214], ebx
call fcn.0100f48b
push 1
push ebx
push ebx
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0100f2b3
cmp eax, ebx
je 0x1005fea
push eax
call fcn.0100295a
mov dword [ebp - 0x218], 2
cmp dword [0x101a6f8], ebx
je 0x10060c6
push esi
mov esi, 0x101a6f8
push dword [esi]
lea eax, [ebp - 0x210]
push edi
push eax
call sub.samcli.dll_NetGroupDelUser
mov ecx, eax
sub ecx, ebx
je 0x100607e
sub ecx, 0x35
je 0x100606d
sub ecx, 0x46
je 0x1006064
sub ecx, 0x832
je 0x100605b
sub ecx, 0x10
je 0x100603a
push eax
call fcn.0100295a
jmp 0x100607e
push 2
mov dword [0x1019ddc], edi
push 0xea9
mov eax, dword [esi]
mov dword [0x1019dd8], eax
call fcn.01001c11
inc dword [ebp - 0x214]
jmp 0x100607e
push 1
push 0xeab
jmp 0x1006047
push 1
push 0xe9e
jmp 0x1006047
lea eax, [ebp - 0x210]
push eax
push 0xe81
call fcn.0101081b
inc dword [ebp - 0x218]
mov esi, dword [ebp - 0x218]
lea esi, [esi*4 + 0x101a6f0]
cmp dword [esi], ebx
jne 0x1006006
pop esi
cmp dword [ebp - 0x214], ebx
je 0x10060c6
mov eax, dword [ebp - 0x218]
add eax, 0xfffffffe
cmp dword [ebp - 0x214], eax
jge 0x10060bd
push 0xdb0
call fcn.010108f6
push 1
call fcn.01002992
jmp 0x10060cb
call fcn.010108de
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.01002d45
leave
ret 4
Function at 0x10060e0
Capabilities:
List user account groups

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x428], ebx
call fcn.0100f48b
lea eax, [ebp - 0x42c]
push eax
push 0xa
call fcn.01010f03
mov esi, 0x105
test eax, eax
je 0x1006131
xor eax, eax
mov dword [ebp - 0x428], 1
mov word [ebp - 0x41c], ax
jmp 0x1006154
mov eax, dword [ebp - 0x42c]
push dword [eax]
lea eax, [ebp - 0x41c]
push esi
push eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
push dword [ebp - 0x42c]
call sub.netutils.dll_NetApiBufferFree
push ebx
push ebx
push ebx
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0100f2b3
cmp eax, ebx
je 0x100616e
push eax
call fcn.0100295a
push ebx
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x420]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x424]
push eax
push ebx
lea eax, [ebp - 0x210]
push eax
call sub.samcli.dll_NetGroupEnum
cmp eax, ebx
je 0x100619d
push eax
call fcn.0100295a
cmp dword [ebp - 0x420], ebx
jne 0x10061aa
call fcn.01010959
push 0x100cce1
push 4
push dword [ebp - 0x420]
push dword [ebp - 0x424]
call dword [sym.imp.msvcrt.dll_qsort]
add esp, 0x10
call fcn.010108a7
cmp word [ebp - 0x210], bx
je 0x10061f1
lea eax, [ebp - 0x210]
push 0x1003740
push eax
call dword [sym.imp.msvcrt.dll_wcsspn]
pop ecx
pop ecx
lea eax, [ebp + eax*2 - 0x210]
jmp 0x10061f7
lea eax, [ebp - 0x41c]
push eax
push 0x1130
call fcn.01010933
call fcn.01010842
mov edi, dword [ebp - 0x424]
xor esi, esi
cmp dword [ebp - 0x420], ebx
jbe 0x1006233
push ebx
push dword [edi]
push 0x1003754
call fcn.01010562
add esp, 0xc
inc esi
add edi, 4
cmp esi, dword [ebp - 0x420]
jb 0x1006217
cmp dword [ebp - 0x428], ebx
pop edi
pop esi
pop ebx
je 0x100624f
push 0xdb0
call fcn.010108f6
push 1
call fcn.01002992
push dword [ebp - 0x424]
call sub.netutils.dll_NetApiBufferFree
call fcn.010108de
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01002d45
leave
ret
Function at 0x1006270
Capabilities:
List user accounts for group

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.0100f48b
xor esi, esi
push esi
push esi
push esi
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0100f2b3
cmp eax, esi
je 0x10062b0
push eax
call fcn.0100295a
lea eax, [ebp - 0x214]
push eax
push 1
push edi
lea eax, [ebp - 0x210]
push eax
call sub.samcli.dll_NetGroupGetInfo
cmp eax, esi
je 0x1006308
cmp eax, 0x8ba
je 0x10062d9
push eax
call fcn.0100295a
jmp 0x1006308
mov eax, dword [ebp - 0x214]
push esi
push 3
push 0x101
push dword [eax]
push edi
call sub.netutils.dll_NetpwNameCanonicalize
cmp eax, esi
je 0x10062f9
push eax
call fcn.0100295a
mov eax, dword [ebp - 0x214]
mov ecx, dword [0x1020954]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x218]
push eax
push 0x1020370
push 2
call fcn.01010adf
add dword [ebp - 0x218], 5
mov eax, dword [ebp - 0x214]
push dword [eax]
push esi
push dword [0x1020374]
push dword [ebp - 0x218]
call fcn.010108bb
push eax
push dword [ebp - 0x218]
push esi
push dword [0x1020990]
call fcn.01010562
mov eax, dword [ebp - 0x214]
add esp, 0x14
push dword [eax + 4]
push esi
push dword [0x102037c]
push dword [ebp - 0x218]
call fcn.010108bb
push eax
push dword [ebp - 0x218]
push esi
push dword [0x1020990]
call fcn.01010562
add esp, 0x14
push dword [ebp - 0x214]
call sub.netutils.dll_NetApiBufferFree
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x214]
push eax
push esi
push edi
lea eax, [ebp - 0x210]
push eax
call sub.samcli.dll_NetGroupGetUsers
cmp eax, esi
je 0x10063be
push eax
call fcn.0100295a
push 0x100cce1
push 4
push dword [ebp - 0x21c]
push dword [ebp - 0x214]
call dword [sym.imp.msvcrt.dll_qsort]
add esp, 0x10
call fcn.010108a7
push 0x1133
call fcn.010108f6
call fcn.01010842
mov ebx, dword [ebp - 0x214]
xor edi, edi
cmp dword [ebp - 0x21c], esi
jbe 0x1006433
push esi
push dword [ebx]
push 0x19
call fcn.010108bb
push eax
push 0x1003748
call fcn.01010562
pop ecx
pop ecx
inc edi
push 3
xor edx, edx
mov eax, edi
pop ecx
div ecx
test edx, edx
jne 0x1006428
call fcn.010108a7
add ebx, 4
cmp edi, dword [ebp - 0x21c]
jb 0x10063fe
push 3
pop ecx
mov eax, edi
xor edx, edx
div ecx
pop edi
pop esi
pop ebx
test edx, edx
je 0x1006448
call fcn.010108a7
push dword [ebp - 0x214]
call sub.netutils.dll_NetApiBufferFree
call fcn.010108de
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01002d45
leave
ret 4
Function at 0x10076c1
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 1
push dword [0x1021ae0]
call sub.ADVAPI32.dll_LsaLookupSids
test eax, eax
jge 0x100771a
push eax
call fcn.01014393
cmp eax, 0x6fc
jb 0x1007715
cmp eax, 0x6fd
jbe 0x1007710
cmp eax, 0x8ab
jbe 0x1007715
cmp eax, 0x8ad
jbe 0x1007710
cmp eax, 0x2019
jne 0x1007715
mov eax, 0xf7b
pop esi
leave
ret 8
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
test ecx, ecx
jle 0x1007710
cmp ecx, 2
jle 0x1007730
add ecx, 0xfffffffc
cmp ecx, 1
ja 0x1007710
mov esi, dword [eax + 0xc]
test esi, esi
jl 0x1007710
imul esi, esi, 0xc
push ebx
movzx ebx, word [eax + 4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push edi
movzx edi, word [eax + esi]
lea eax, [ebp - 4]
mov dword [ebp - 0x14], edi
push eax
lea edi, [edi + ebx + 4]
push edi
call fcn.01001e19
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1007802
push edi
push eax
push dword [ebp - 4]
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
shr edi, 1
add eax, esi
add esp, 0xc
cmp word [eax], 0
mov dword [ebp - 0xc], edi
je 0x10077df
push dword [0x1021ae4]
mov edi, dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [eax + 8]
call edi
test eax, eax
jne 0x10077df
mov eax, dword [ebp - 8]
push dword [0x10190ac]
mov eax, dword [eax + 4]
push dword [eax + esi + 8]
call edi
test eax, eax
jne 0x10077df
mov eax, dword [ebp - 0x14]
shr eax, 1
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push dword [eax + esi + 4]
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.msvcrt.dll_wcsncpy_s
push 0x1003740
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.msvcrt.dll_wcscat_s
add esp, 0x1c
mov eax, dword [ebp - 0x10]
shr ebx, 1
push ebx
push dword [eax + 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.msvcrt.dll_wcsncat_s
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
add esp, 0x10
and dword [ebp - 0xc], 0
mov dword [eax], ecx
push dword [ebp - 0x10]
call sub.ADVAPI32.dll_LsaFreeMemory
push dword [ebp - 8]
call sub.ADVAPI32.dll_LsaFreeMemory
mov eax, dword [ebp - 0xc]
pop edi
pop ebx
jmp 0x1007715
Function at 0x1007d7a
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [esi], ebx
mov dword [edi], 8
call fcn.01007821
cmp eax, ebx
jne 0x1007e3e
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push ebx
push dword [0x1021ae0]
call sub.ADVAPI32.dll_LsaLookupNames2
cmp eax, ebx
jge 0x1007dd6
cmp eax, 0xc0000073
je 0x1007dde
push eax
call fcn.01014393
jmp 0x1007e3e
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], ebx
jge 0x1007de5
mov eax, 0xf7b
jmp 0x1007e3e
push dword [eax + 4]
call dword [sym.imp.ntdll.dll_RtlLengthSid]
lea ecx, [ebp + 0x10]
push ecx
push eax
mov dword [ebp + 8], eax
call fcn.01001e19
mov ebx, eax
test ebx, ebx
jne 0x1007e2c
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
jne 0x1007e1e
mov ebx, 0x85c
jmp 0x1007e2c
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [edi], eax
xor ebx, ebx
push dword [ebp + 0xc]
call sub.ADVAPI32.dll_LsaFreeMemory
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaFreeMemory
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100846f
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
call fcn.01007d7a
mov esi, eax
test esi, esi
jne 0x1008590
push edi
push dword [ebp - 4]
push dword [0x1021adc]
call sub.SAMLIB.dll_SamRemoveMemberFromAlias
push dword [ebp - 4]
mov edi, eax
call fcn.01001e31
cmp edi, 0xc0000152
jne 0x1008581
push 0x1003740
push ebx
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x1008585
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10084d4
sub eax, edx
sar eax, 1
add eax, 0x11
lea ecx, [ebp + 8]
mov dword [ebp - 8], eax
push ecx
add eax, eax
push eax
call fcn.01001e19
test eax, eax
je 0x1008500
push 8
pop eax
jmp 0x100858f
mov esi, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1008526
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 8]
mov esi, eax
call fcn.01001e31
jmp 0x100858d
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
push 0x5c
pop eax
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
sub esi, eax
push ebx
dec esi
lea eax, [ecx + eax*2 + 2]
push esi
push eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.01007d7a
push dword [ebp + 8]
mov esi, eax
call fcn.01001e31
test esi, esi
jne 0x100858d
push dword [ebp - 4]
push dword [0x1021adc]
call sub.SAMLIB.dll_SamRemoveMemberFromAlias
push dword [ebp - 4]
mov edi, eax
call fcn.01001e31
test edi, edi
jge 0x100858d
push edi
call fcn.01014393
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4