joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bf00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503fec
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor bl, bl
cmp byte [esi + 4], bl
jne 0x42bf43
mov byte [esi + 4], 1
call fcn.00429f80
mov byte [esi + 5], al
mov al, byte [esi + 5]
test al, al
je 0x42c145
push 0x20019
push str.SoftwareAdobeAcrobat_ReaderDCFEATcFeatDir
xorps xmm0, xmm0
lea ecx, [ebp - 0x238]
push 0x80000001
movq qword [ebp - 0x238], xmm0
call fcn.0040baf0
xor eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x23c], 7
mov dword [ebp - 0x240], 0
mov word [ebp - 0x250], ax
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 1
push eax
push str.tDIText
lea ecx, [ebp - 0x238]
call fcn.00423870
test eax, eax
jne 0x42c0ff
cmp dword [ebp - 0x240], eax
je 0x42c0ff
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00469fa0
add esp, 8
cmp dword [ebp - 0x220], 0
mov byte [ebp - 4], 2
je 0x42c0e8
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42c0e8
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x42c0e8
cmp dword [ebp - 0x220], 0x104
jae 0x42c0e8
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00403887
add esp, 0xc
test eax, eax
jne 0x42c0d6
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
jmp 0x42c080
lea eax, [ebp - 0x218]
push eax
call fcn.004a11f0
add esp, 4
test al, al
lea eax, [ebp - 0x218]
push eax
jne 0x42c0a2
call edi
test eax, eax
jne 0x42c080
jmp 0x42c0d6
lea ecx, [ebp - 0x268]
call fcn.00407370
push 1
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 3
push eax
mov ecx, esi
call fcn.0042bc00
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 2
mov bl, al
call fcn.00408450
test bl, bl
jne 0x42c0e8
push 1
lea eax, [ebp - 0x230]
mov ecx, esi
push eax
call fcn.0042bc00
mov bl, al
cmp dword [ebp - 0x21c], 8
jb 0x42c0ff
push dword [ebp - 0x230]
call fcn.0040823e
add esp, 4
cmp dword [ebp - 0x23c], 8
jb 0x42c116
push dword [ebp - 0x250]
call fcn.0040823e
add esp, 4
xor eax, eax
mov dword [ebp - 0x23c], 7
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x240], 0
mov word [ebp - 0x250], ax
mov dword [ebp - 4], 0xffffffff
call fcn.0040beb0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
Function at 0x42dfe0
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504395
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x20], 0
mov ecx, ebx
push eax
push 0x511a98
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], ebx
mov word [ebx], ax
call fcn.004073d0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 0xf01ff
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42e1a4
mov eax, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 0x24], esi
test eax, eax
je 0x42e090
cmp eax, 0xffffffff
je 0x42e090
mov esi, eax
mov dword [ebp - 0x24], esi
call fcn.0040e530
push 0x4c
mov dword [ebp - 4], 2
mov dword [ebp - 0x1c], 0x4c
call fcn.0041fe68
mov edi, eax
add esp, 4
mov dword [ebp - 0x2c], edi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 3
push eax
push dword [ebp - 0x1c]
push edi
push 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x42e0e2
push edi
call fcn.00419db5
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004185b0
jmp 0x42e1a4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push dword [edi]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x42e0c8
mov edx, dword [ebp - 0x18]
cmp word [edx], 0
jne 0x42e105
xor ecx, ecx
jmp 0x42e120
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x28], eax
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42e110
sub ecx, dword [ebp - 0x28]
sar ecx, 1
push ecx
push edx
mov ecx, ebx
call fcn.004073d0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call fcn.00419db5
add esp, 4
mov byte [ebp - 4], 0
test esi, esi
je 0x42e1a4
cmp esi, 0xffffffff
je 0x42e1a4
call fcn.0040e530
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x42e1a4
push 4
push 0x61
push str.D:CBAcrobatImportsOpenChromeChrome_src_base_win_scoped_handle.h
lea ecx, [ebp - 0xe0]
call fcn.00461ff0
add eax, 8
mov dword [ebp - 4], 4
push str.Check_failed:_false.
push eax
mov dword [ebp - 0x20], 5
call fcn.004506c0
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x20], 1
call fcn.00462150
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
Function at 0x432c90
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x18], 0
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp byte [eax + 0x2c], 0
mov dword [ebp - 0x1c], edi
jne 0x432ccf
mov eax, 0x3f0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 2
push dword [eax + 0x24]
mov dword [ebp - 8], 0
call esi
mov eax, dword [ebp - 8]
test eax, eax
jne 0x432d0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret 4
push ebx
push eax
call fcn.0041fe68
add esp, 4
mov ebx, eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], ebx
push eax
push dword [ebp - 8]
mov eax, dword [ebp - 0x20]
push ebx
push 2
push dword [eax + 0x24]
call esi
test eax, eax
jne 0x432d52
push ebx
call fcn.00419db5
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x18]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [eax], ebx
jbe 0x432e1e
lea esi, [eax + 4]
mov eax, dword [esi + 4]
test al, 0x20
jne 0x432e0c
test eax, 0xc0000000
jne 0x432e0c
xor al, al
mov byte [ebp - 9], al
test edi, edi
je 0x432def
mov ebx, dword [edi]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, 0x78787879
mov ecx, dword [edi + 4]
sub ecx, ebx
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x432de9
xor edi, edi
push dword [esi]
lea ecx, [edi + ebx]
call fcn.004071b0
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x432de2
mov eax, dword [ebp - 0x1c]
add edi, 0x44
inc dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
sub ecx, ebx
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x14], eax
jb 0x432da5
jmp 0x432de6
mov byte [ebp - 9], 1
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x10]
mov al, byte [ebp - 9]
test al, al
jne 0x432e0c
push dword [esi]
lea ecx, [ebp - 0x64]
call fcn.0040c260
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x64]
push eax
lea ecx, [ecx + 0x18]
call fcn.00432860
mov eax, dword [ebp - 0x18]
inc ebx
add esi, 8
mov dword [ebp - 0x10], ebx
cmp ebx, dword [eax]
jb 0x432d65
push eax
call fcn.00419db5
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop ebx
pop esi
pop edi
call fcn.00401580
mov esp, ebp
pop ebp
ret 4
Function at 0x432e40
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x20], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], eax
cmp byte [eax + 0x2c], 0
mov dword [ebp - 0x1c], ebx
jne 0x432e7f
mov eax, 0x3f0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 3
push dword [eax + 0x24]
mov dword [ebp - 0x10], 0
call esi
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x432ebb
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret 4
push edi
push eax
call fcn.0041fe68
add esp, 4
mov edi, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], edi
push eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
push edi
push 3
push dword [eax + 0x24]
call esi
test eax, eax
jne 0x432f02
push edi
call fcn.00419db5
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret 4
cmp dword [edi], 0
mov dword [ebp - 0x20], 0
jbe 0x432fc7
lea esi, [edi + 4]
test ebx, ebx
je 0x432fa1
mov edi, dword [ebx]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, 0x2aaaaaab
mov ecx, dword [ebx + 4]
sub ecx, edi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x432f9e
xor ebx, ebx
mov edi, edi
lea eax, [ebx + edi]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
cmp dword [eax + 0x14], 8
jb 0x432f59
mov eax, dword [eax]
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esi + 4]
cmp eax, dword [ebp - 8]
jne 0x432f75
mov eax, dword [esi]
cmp eax, dword [ebp - 0xc]
je 0x432faf
mov eax, dword [ebp - 0x1c]
add ebx, 0x18
inc dword [ebp - 0x18]
mov ecx, dword [eax + 4]
mov edi, dword [eax]
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x18], eax
jb 0x432f40
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
push esi
lea ecx, [ecx + 0xc]
call fcn.00432ff0
jmp 0x432fb5
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
add esi, 0xc
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [edi]
jb 0x432f15
push edi
call fcn.00419db5
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00401580
mov esp, ebp
pop ebp
ret 4
Function at 0x4334e0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x30], ecx
xor bl, bl
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], eax
push ecx
push 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], ebx
push ecx
push 0
push 0
push 4
push 6
push eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x433641
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x433641
push 2
push 0xc
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], 0
push ecx
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x433641
push esi
mov esi, dword [ebp - 0xc]
add esi, 8
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x43363d
push 2
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x433635
mov eax, dword [ebp - 0x10]
push edi
xor edi, edi
test eax, eax
je 0x433609
jmp 0x4335a0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push edi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x433606
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x433606
cmp byte [ecx], 0
mov eax, ecx
mov dword [ebp - 0x2c], eax
jne 0x4335e7
lea esi, [ecx + 8]
mov ecx, dword [ebp - 0x30]
call fcn.004071b0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4335fc
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
movzx eax, word [eax + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x433606
mov eax, dword [ebp - 0x10]
inc edi
cmp edi, eax
jb 0x4335a0
jmp 0x433609
mov eax, dword [ebp - 0x10]
cmp edi, eax
pop edi
jne 0x433635
push 0
push ebx
push 0
push 0
push 4
push 6
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov ecx, dword [ebp - 0x20]
test eax, eax
movzx ecx, cl
mov edx, 1
cmove ecx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call eax
mov ebx, dword [ebp - 0x20]
pop esi
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x43364f
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00401580
mov esp, ebp
pop ebp
ret
Function at 0x433e70
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
call fcn.00433fe0
test eax, eax
jne 0x433fd8
movdqa xmm0, xmmword [0x531000]
push ebx
mov ebx, dword [sym.imp.USER32.dll_LoadIconW]
push esi
movdqu xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x7f03
xor esi, esi
mov dword [ebp - 8], 0x7f01
mov dword [ebp - 4], 0x7f04
lea esp, [esp]
push dword [ebp + esi*4 - 0x1c]
push 0
call ebx
push eax
mov ecx, edi
call fcn.00433fe0
test eax, eax
jne 0x433fd6
inc esi
cmp esi, 7
jb 0x433ec0
movdqa xmm0, xmmword [0x530ff0]
xor esi, esi
mov ebx, dword [sym.imp.USER32.dll_LoadCursorW]
movdqu xmmword [ebp - 0x38], xmm0
mov dword [ebp - 8], 0x7f84
movdqa xmm0, xmmword [0x531020]
movdqu xmmword [ebp - 0x28], xmm0
mov dword [ebp - 4], 0x7f04
movdqa xmm0, xmmword [0x531010]
movdqu xmmword [ebp - 0x18], xmm0
jmp 0x433f20
push dword [ebp + esi*4 - 0x38]
push 0
call ebx
push eax
mov ecx, edi
call fcn.00433fe0
test eax, eax
jne 0x433fd6
inc esi
cmp esi, 0xe
jb 0x433f20
push str._AcroAppTimer
push str.apptimer.exe
call fcn.00434020
add esp, 8
test eax, eax
je 0x433f60
push eax
mov ecx, edi
call fcn.00433fe0
test eax, eax
jne 0x433fd6
push str.SafeNet_Borderless_Single_Sign_On.....
push str.DKAXSvr.exe
call fcn.00434020
add esp, 8
test eax, eax
je 0x433f82
push eax
mov ecx, edi
call fcn.00433fe0
test eax, eax
jne 0x433fd6
push 0
call fcn.00417c90
add esp, 4
test al, al
je 0x433fd4
push str.PrivateOutputChannelHelperWindow
push str.QTPro.exe
call fcn.00434020
add esp, 8
test eax, eax
je 0x433fb2
push eax
mov ecx, edi
call fcn.00433fe0
test eax, eax
jne 0x433fd6
push str.ZinorKnisaPatuach
push str.QTPro.exe
call fcn.00434020
add esp, 8
test eax, eax
je 0x433fd4
push eax
mov ecx, edi
call fcn.00433fe0
test eax, eax
jne 0x433fd6
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x435400
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x28], eax
xor bl, bl
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x15], bl
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24], esi
test eax, eax
je 0x435541
mov dword [eax], 0
test esi, esi
je 0x435541
push 2
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
push esi
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x435541
push edi
mov edi, dword [ebp - 0xc]
add edi, 8
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x43552d
push 2
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x435526
mov eax, dword [ebp - 0x10]
xor edi, edi
test eax, eax
je 0x43550a
lea ebx, [ebx]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x435507
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x435507
cmp byte [ecx], 0
mov eax, ecx
mov dword [ebp - 0x1c], eax
jne 0x4354e5
lea esi, [ecx + 8]
mov ecx, dword [ebp - 0x28]
call fcn.004071b0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4354fa
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x435507
mov eax, dword [ebp - 0x10]
inc edi
mov esi, dword [ebp - 0x24]
cmp edi, eax
jb 0x4354a0
jmp 0x43550a
mov eax, dword [ebp - 0x10]
cmp edi, eax
jne 0x435526
mov ecx, dword [ebp - 0x20]
mov al, 1
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, byte [ebp - 0x15]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00401580
mov esp, ebp
pop ebp
ret
Function at 0x43a2a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], 0
jne 0x43a2d9
cmp dword [ebx + 8], 0
jne 0x43a30b
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret 4
push 0
push 0x401720
push 1
push str.NtMapViewOfSection
push 0x517f04
call fcn.00436b90
push 1
push 0x405150
push 1
push str.NtUnmapViewOfSection
push 0x517f04
mov ecx, ebx
call fcn.00436b90
mov eax, dword [ebx]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov eax, dword [eax]
push 1
push 0x2000
push 0x10000
push 0
push eax
mov dword [ebp - 0x60], eax
call edi
mov esi, eax
mov eax, dword [ebx + 8]
shl eax, 6
add eax, 0x50
push eax
mov dword [ebp - 0x64], eax
call fcn.0043a450
add esp, 4
mov ecx, eax
and ecx, 0xfffff000
and eax, 0xfff
add esi, ecx
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x64]
push 0x40
push 0x1000
add ecx, 0xfff
and ecx, 0xfffff000
push ecx
push esi
push dword [ebp - 0x60]
call edi
mov esi, eax
test esi, esi
jne 0x43a37c
call fcn.0040db10
mov eax, dword [ebp - 0x68]
lea edi, [eax + esi]
test edi, edi
je 0x43a42e
mov esi, dword [ebp - 0x64]
push 0x4b4
push 0
push 0x55b628
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x58], 0x10
call fcn.004dead0
add esp, 0xc
lea eax, [ebp - 0x5c]
mov ecx, ebx
push eax
push esi
push edi
call fcn.0043a4d0
test al, al
je 0x43a42e
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x10
lea eax, [ebp - 0x5c]
push eax
push edi
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x43a42e
cmp dword [ebp - 8], 0x10
jne 0x43a42e
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0x20
push esi
push edi
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebx]
push 0x4b4
push 0x55b628
push str.g_originals
call fcn.00435b30
pop edi
test eax, eax
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401580
mov esp, ebp
pop ebp
ret 4
Function at 0x43b3d0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5050fb
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x18], eax
add eax, dword [ebp + 0x14]
push eax
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
mov eax, dword [edi + 0x18]
cmp eax, esi
je 0x43b46d
test eax, eax
je 0x43b45c
cmp eax, 0xffffffff
je 0x43b45c
call fcn.0040e530
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x43b455
call fcn.0040db10
mov dword [edi + 0x18], 0
test esi, esi
je 0x43b46d
cmp esi, 0xffffffff
je 0x43b46d
mov dword [edi + 0x18], esi
call fcn.0040e530
mov eax, dword [edi + 0x18]
test eax, eax
je 0x43b5dc
cmp eax, 0xffffffff
je 0x43b5dc
push 0
push 0
push 6
lea ecx, [ebp - 0x14]
push ecx
push dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x43b5dc
push 0
push 0
push 0
push 6
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x43b5dc
mov esi, dword [ebp - 0x18]
add eax, esi
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x20]
call fcn.0043b600
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov ecx, edi
mov dword [0x55b4c4], eax
push 4
push 0x55b4c4
push str.g_shared_section
call fcn.00435b30
mov dword [0x55b4c4], 0
test eax, eax
je 0x43b50f
cmp eax, 1
je 0x43b5dc
mov eax, 1
jmp 0x43b5e2
push 4
push 0x55b5a8
push str.g_shared_IPC_size
mov ecx, edi
mov dword [0x55b5a8], esi
call fcn.00435b30
mov dword [0x55b5a8], 0
test eax, eax
jne 0x43b4fc
mov eax, dword [ebp + 0x14]
mov ecx, edi
push 4
push 0x55b5ac
push str.g_shared_policy_size
mov dword [0x55b5ac], eax
call fcn.00435b30
mov dword [0x55b5ac], 0
test eax, eax
jne 0x43b4fc
push 0x20
call fcn.00405f0d
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x43b59a
push dword [ebp - 0x24]
xorps xmm0, xmm0
mov ecx, eax
movdqu xmmword [eax], xmm0
movdqu xmmword [eax + 0x10], xmm0
push dword [edi + 0x24]
push dword [edi + 0x1c]
push dword [edi + 8]
push dword [edi]
call fcn.0043b640
jmp 0x43b59c
xor eax, eax
push eax
lea ecx, [edi + 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.0043b710
mov ecx, dword [edi + 0x20]
push 0x20000
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0043b740
test al, al
jne 0x43b5ca
mov eax, 8
jmp 0x43b5e2
mov ecx, edi
call fcn.0043ba70
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x43b5e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43bed0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004dead0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x101
ja 0x43bf3c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x43bf3c
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
Function at 0x43f030
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
cmp esi, 0x804
ja 0x43f06d
je case.0x43f066.1027
lea eax, [esi - 0x403]
cmp eax, 0x2a
ja case.0x43f066.1032
movzx eax, byte [eax + 0x43f0c0]
jmp dword [eax*4 + 0x43f0b8]
cmp esi, 0xc0a
je case.0x43f066.1027
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.004dead0
add esp, 0xc
lea eax, [ebp - 0x404]
push 0x200
push eax
push 3
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x43f0a6
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00401580
mov esp, ebp
pop ebp
ret