joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4606a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4b3fa0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0x4a5e8c
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4606d2
mov eax, dword [ebp - 4]
jmp 0x460859
push str.WNCHOME_LS
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x46081d
push 0x200
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x460711
xor eax, eax
jmp 0x460859
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x46072e
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x460754
mov edx, dword [ebp - 0x21c]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x460752
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], 0x2f
jmp 0x46071f
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00460870
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x460775
xor eax, eax
jmp 0x460859
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00460870
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4607a5
xor eax, eax
jmp 0x460859
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00460870
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4607d5
xor eax, eax
jmp 0x460859
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
push 0x4a5ea0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
jne 0x460810
push 0x4a5ea4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x460814
xor eax, eax
jmp 0x460859
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp + 8]
test edx, edx
je 0x460856
push str.WNCHOME
push 0x73dda0
call sub.MSVCR100.dll_strcpy
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x73dda0
call sub.MSVCR100.dll_strcat
add esp, 8
push 0x73dda0
call dword [sym.imp.MSVCR100.dll__putenv]
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00480dbe
mov esp, ebp
pop ebp
ret

Function at 0x4609d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.WNC_WNCFILES_VERBOSE
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x460a09
push 0x4a5ecc
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
je 0x460a09
mov eax, 1
jmp 0x460a0b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x480dbe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b3fa0]
jne 0x480dc8
repz ret
jmp fcn.00481444

Function at 0x4838a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4b3fa0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00488910
test eax, eax
je 0x4838d3
call fcn.00488870
push eax
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x48391c
push 0x4a8f84
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x483906
push 0x4a8f8c
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x48391c
mov edx, dword [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
push 0x4a8f90
push 0x4a8f98
push 0x5c
lea ecx, [ebp - 0x210]
push ecx
push 0x4a8fa0
push 0x77fc80
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov byte [0x77fe80], 0
push 0x4a8fac
push 0x77fc80
call dword [sym.imp.MSVCR100.dll_strcspn]
add esp, 8
mov byte [eax + 0x77fc80], 0
push 0x201
push 0x77fc80
call fcn.00483730
add esp, 8
push 0x4a8fb0
push str.zone
push 0x5c
lea edx, [ebp - 0x210]
push edx
push str._s_c_s_s
push 0x77fe88
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov byte [0x780088], 0
push 0x4a8fcc
push 0x77fe88
call dword [sym.imp.MSVCR100.dll_strcspn]
add esp, 8
mov byte [eax + 0x77fe88], 0
push 0x201
push 0x77fe88
call fcn.00483730
add esp, 8
cmp dword [0x780094], 0
jne 0x4839ee
push 0x483850
call fcn.00480fad
add esp, 4
mov dword [0x780094], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00480dbe
mov esp, ebp
pop ebp
ret

Function at 0x4882f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4b3fa0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x78552c], 0
je 0x488356
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s___d__:__d_n
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
mov ecx, dword [0x785528]
push ecx
lea edx, [ebp - 0x408]
push edx
call sub.MSVCR100.dll_strlen
add esp, 4
push eax
push 1
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00480dbe
mov esp, ebp
pop ebp
ret

Function at 0x488870
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x4a91e0
cmp dword [0x781064], 0
je 0x48888f
mov eax, 0x781068
jmp 0x4888b0
push 0x4a91e4
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4888ad
mov eax, dword [ebp - 8]
jmp 0x4888b0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x488920
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x781064], 0
je 0x488941
push 0x781068
push 0x7852f0
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x48897d
push str.WNCZONE
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x48896c
push 0x4a9200
push 0x7852f0
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x48897d
mov eax, dword [ebp - 4]
push eax
push 0x7852f0
call sub.MSVCR100.dll_strcpy
add esp, 8
push 0x4a9204
mov ecx, dword [ebp + 8]
push ecx
call fcn.00499f50
add esp, 8
push eax
push 0x5c
push 0x7852f0
push str._s_c_s
push 0x7850e8
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
push 0x201
push 0x7850e8
call fcn.004572a0
add esp, 8
cmp dword [0x7854fc], 0
jne 0x4889db
push 0x488810
call fcn.00480fad
add esp, 4
mov dword [0x7854fc], 1
mov esp, ebp
pop ebp
ret

Function at 0x491ff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x785640]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR100.dll_strlen
add esp, 4
push eax
push 1
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100.dll_strlen
add esp, 4
cmp esi, eax
je 0x49204a
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffe6
jmp 0x492080
mov dx, word [0x4a9ad0]
mov word [ebp - 8], dx
mov al, byte [0x4a9ad2]
mov byte [ebp - 6], al
mov ecx, dword [ebp - 4]
push ecx
push 2
push 1
lea edx, [ebp - 8]
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 2
je 0x492080
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xffffffe6
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x492170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x785640]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
push eax
push 1
push 1
lea ecx, [ebp - 5]
push ecx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x4921c5
mov edx, dword [ebp + 0x14]
mov dword [edx], 0xffffffe7
mov byte [ebp - 5], 0
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
jmp 0x4921d9
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
mov dl, byte [ebp - 5]
mov byte [ecx], dl
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 1
cmp dword [ebp - 4], ecx
jge 0x4921f5
movsx edx, byte [ebp - 5]
cmp edx, 0xa
je 0x4921f5
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
je 0x492193
mov ecx, dword [ebp + 0x10]
sub ecx, 1
cmp dword [ebp - 4], ecx
jne 0x492270
movsx edx, byte [ebp - 5]
cmp edx, 0xa
je 0x492270
mov eax, dword [ebp + 0x14]
mov dword [eax], 0xffffffd6
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 1]
cmp edx, 0xa
je 0x49222c
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0xa
jmp 0x492235
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0xd
je 0x492251
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0xa
jne 0x49226b
cmp dword [ebp - 4], 0
jl 0x49226b
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x492235
jmp 0x492307
mov edx, dword [ebp + 0x14]
cmp dword [edx], 0xffffffe7
je 0x492281
movsx eax, byte [ebp - 5]
cmp eax, 0xa
jne 0x492292
cmp dword [ebp - 4], 0
jne 0x492292
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0xffffffe9
jmp 0x492307
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0xd
je 0x4922be
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0xa
jne 0x492307
cmp dword [ebp - 4], 0
jl 0x492307
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0xa
jne 0x4922f3
cmp dword [ebp - 0x10], 0
jne 0x4922f1
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x492305
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x4922a2
mov esp, ebp
pop ebp
ret

Function at 0x4925b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
pop ebp
ret
Function at 0x493f70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
pop ebp
ret
Function at 0x495b60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.00495650
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x495b85
mov eax, 0xfffffff5
jmp 0x495cb9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x320]
and edx, 1
jne 0x495b9d
mov eax, 0xfffffff4
jmp 0x495cb9
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
shr ecx, 2
and ecx, 1
je 0x495bcb
mov edx, dword [ebp - 4]
push edx
call fcn.004925e0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x495bcb
mov eax, dword [ebp - 8]
jmp 0x495cb9
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 4]
cmp ecx, 1
je 0x495c3a
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.004958e0
add esp, 4
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x495c3a
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2aa]
test edx, edx
jne 0x495c3a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
push 1
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0x316]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2d0
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2c4], 0
je 0x495c76
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c4]
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c4], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2cc], 0
je 0x495ca2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2cc]
push ecx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2cc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffe
mov edx, dword [ebp - 4]
mov dword [edx + 0x320], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x496a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffd
mov edx, dword [ebp + 8]
mov dword [edx + 0x320], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [str.WKNC_Id:_fbseek.cpp_7003_2011_05_16_16:32:53Z_jsturton___WORKNC]
mov dword [eax + 0x210], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x214], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x21c], 0xa0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x218], 0xa0
mov edx, dword [ebp + 8]
mov dword [edx + 0x220], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x224], 0
call fcn.00495460
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x228
push ecx
call sub.MSVCR100.dll_strcpy
add esp, 8
mov edx, dword [ebp + 8]
mov byte [edx + 0x2a8], 1
mov eax, dword [ebp + 8]
mov byte [eax + 0x2a9], 1
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2aa], 1
mov edx, dword [ebp + 8]
mov byte [edx + 0x2ac], 0
call fcn.004953b0
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2ab], al
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
push 0xa0
push 1
mov ecx, dword [ebp + 8]
add ecx, 0x210
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 0xa0
je 0x496b1b
mov eax, 0xffffffe6
jmp 0x496b1d
xor eax, eax
pop ebp
ret

Function at 0x499320
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x4b3fa0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00499450
add esp, 8
cmp eax, 0xffffffff
je 0x49941f
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
je 0x4993fe
push 0x101
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR100.dll__read]
add esp, 0xc
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x4993d4
lea edx, [ebp - 0x148]
push edx
call dword [sym.imp.MSVCR100.dll_atol]
add esp, 4
cmp dword [ebp + 0xc], eax
jne 0x4993b0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x4993d2
cmp dword [0x7857d8], 0
je 0x4993d2
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x4a9b10
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
jmp 0x4993ef
cmp dword [0x7857d8], 0
je 0x4993ef
mov eax, dword [ebp - 0x40]
push eax
push str._nread_error_:_nblu___d_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
jmp 0x49941d
cmp dword [0x7857d8], 0
je 0x49941d
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x3c]
push eax
push str._nopen_error_:_handle___d___nomfic___s_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
jmp 0x49943a
cmp dword [0x7857d8], 0
je 0x49943a
mov ecx, dword [ebp + 8]
push ecx
push str._nstat_error_:_nomfic___s_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00480dbe
mov esp, ebp
pop ebp
ret
Function at 0x499470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b3fa0]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
push 0x180
push 0x502
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x4994f2
mov ecx, dword [ebp - 4]
push ecx
push 0x4a9ba4
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call sub.MSVCR100.dll_strlen
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.MSVCR100.dll__write]
add esp, 0xc
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
jmp 0x499588
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 0x11
jne 0x499581
push 0x100
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x49957f
push 0x14
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x13
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.MSVCR100.dll__read]
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x49955c
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR100.dll_atol]
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x499563
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
je 0x49957f
mov dword [ebp - 0x28], 0xffffffff
jmp 0x499588
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00480dbe
mov esp, ebp
pop ebp
ret
Function at 0x49b3c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x4b3fa0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffd
mov edx, dword [ebp + 8]
mov dword [edx + 0x320], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [str.WKNC]
mov dword [eax + 0x210], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x214], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x21c], 0xa0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x220], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x224], 0
call fcn.00495460
push eax
mov eax, dword [ebp + 8]
add eax, 0x228
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2a8], 1
mov edx, dword [ebp + 8]
mov byte [edx + 0x2a9], 1
mov eax, dword [ebp + 8]
mov byte [eax + 0x2aa], 0
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2ac], 0
call fcn.004953b0
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp + 8]
mov al, byte [ebp - 0x8c]
mov byte [edx + 0x2ab], al
movsx ecx, byte [ebp - 0x8c]
test ecx, ecx
je 0x49b4b5
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0x316]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x21c]
lea eax, [eax + edx + 1]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x21c], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x21c]
add eax, 0x80
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x218], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
push 0xa0
push 1
mov ecx, dword [ebp + 8]
add ecx, 0x210
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 0xa0
je 0x49b4fb
mov eax, 0xffffffe6
jmp 0x49b579
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x49b54b
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
movsx ecx, word [eax + 0x316]
add ecx, 1
push ecx
push 1
mov edx, dword [ebp + 8]
add edx, 0x2d0
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp + 8]
movsx edx, word [ecx + 0x316]
add edx, 1
cmp eax, edx
je 0x49b54b
mov eax, 0xffffffe6
jmp 0x49b579
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
push 0x80
push 1
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 0x80
je 0x49b577
mov eax, 0xffffffe6
jmp 0x49b579
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00480dbe
mov esp, ebp
pop ebp
ret
Function at 0x10016b2
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100a21c]
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp eax, 2
push edi
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x1b], bl
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], 5
mov dword [ebp - 8], ebx
jne 0x10017e0
lea eax, [ebp - 4]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10017e0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.0100162a
test eax, eax
jne 0x10017c5
lea eax, [ebp - 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push eax
push ebx
push ebx
push 2
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1001740
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1001740
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x10017d4
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push esi
push 2
push dword [ebp - 4]
call edi
test eax, eax
je 0x10017b8
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea eax, [ebp - 0x1c]
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10017b8
cmp dword [esi], ebx
mov dword [ebp - 0x10], ebx
jbe 0x10017af
lea edi, [esi + 4]
push dword [ebp - 0x14]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10017a4
inc dword [ebp - 0x10]
add edi, 8
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi]
jb 0x1001786
jmp 0x10017af
push 1
pop eax
mov dword [0x100a21c], eax
mov dword [ebp - 8], eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp esi, ebx
je 0x10017d4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10017d4
cmp dword [ebp - 8], ebx
je 0x10017d4
mov dword [0x100a21c], 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001c43
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1001c6f
xor esi, esi
push esi
push 0x10
push esi
push esi
push 0x4f5
jmp 0x1001cc6
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x1001320
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
push esi
jne 0x1001cb0
push 0x10
push esi
push esi
push 0x4f6
jmp 0x1001cc6
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1001cd0
push esi
push 0x10
push esi
push esi
push 0x4f7
push esi
call fcn.01003dda
xor eax, eax
jmp 0x1001cd3
push 1
pop eax
pop esi
leave
ret