joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42cee0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 1
jne 0x42cf06
mov dword [ebp - 4], str.RootCIMV2
jmp 0x42cf0d
mov dword [ebp - 4], str.RootWMI
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x210], 0
jne 0x42cf60
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x42cf60
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 1
je 0x42cf60
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._CoInitializeEx_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
jmp 0x42d0d5
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x210], 0
jne 0x42cfd7
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x42cfca
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 0x80010119
je 0x42cfca
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._CoInitializeSecurity_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 2
jmp 0x42d0d5
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x210], 1
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x214], 0
jne 0x42d03b
mov dword [ebp - 0x10], 7
mov ecx, dword [ebp - 0x18]
add ecx, 0x214
push ecx
push 0x434df0
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0x434ec0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x42d03b
mov eax, dword [ebp - 0x18]
mov dword [eax], str._CoCreateInstance_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 3
jmp 0x42d0d5
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x218], 0
jne 0x42d0ce
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
add eax, 0x218
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x214]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x214]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0xc]
call ecx
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x20c], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 0
je 0x42d0c4
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._ConnectServer_Call_Error
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x218], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 4
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x42d0d5
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x42d520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x4602fc
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x37
mov byte [ebp - 3], 0x3c
mov byte [ebp - 2], 0x2f
mov byte [ebp - 1], 0x49
push 4
lea ecx, [ebp - 4]
push ecx
push 0x460300
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x44
mov byte [ebp - 3], 0x3e
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
push 4
lea edx, [ebp - 4]
push edx
push 0x460304
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x46030c
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x34
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], 0x3c
mov byte [ebp - 1], 0x2f
push 4
lea ecx, [ebp - 4]
push ecx
push 0x460310
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x49
mov byte [ebp - 3], 0x44
mov byte [ebp - 2], 0x3e
mov byte [ebp - 1], 0
push 4
lea edx, [ebp - 4]
push edx
push 0x460314
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x46031c
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x31
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], 0x31
mov byte [ebp - 1], 0x3c
push 4
lea ecx, [ebp - 4]
push ecx
push 0x460320
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x2f
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea edx, [ebp - 4]
push edx
push 0x460324
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x46032c
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x35
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], 0x33
mov byte [ebp - 1], 0x3c
push 4
lea ecx, [ebp - 4]
push ecx
push 0x460330
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x2f
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea edx, [ebp - 4]
push edx
push 0x460334
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x46033c
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x31
mov byte [ebp - 3], 0x34
mov byte [ebp - 2], 0x3c
mov byte [ebp - 1], 0x2f
push 4
lea ecx, [ebp - 4]
push ecx
push 0x460340
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x49
mov byte [ebp - 3], 0x44
mov byte [ebp - 2], 0x3e
mov byte [ebp - 1], 0
push 4
lea edx, [ebp - 4]
push edx
push 0x460344
call fcn.00403f60
add esp, 0xc
call fcn.0042d490
mov esp, ebp
pop ebp
ret 4
Function at 0x42d740
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x42d793
mov dword [ebp - 0x14], 0xffffffff
jmp 0x42d85d
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
jmp 0x42d7ae
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jae 0x42d856
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 5
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
push edx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x42d7ec
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x42d856
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
cmp edx, dword [ebp - 4]
jne 0x42d814
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x45f7a0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42d83b
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x45f798]
shl eax, 8
add eax, 0x45f8a0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [0x45f798]
add ecx, 1
mov dword [0x45f798], ecx
cmp dword [ebp - 0x10], 0
je 0x42d851
mov edx, dword [ebp - 0x10]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x10], 0
jmp 0x42d7a5
jmp 0x42d85d
cmp dword [ebp - 0x10], 0
je 0x42d86c
mov eax, dword [ebp - 0x10]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
cmp dword [ebp - 0x18], 0
je 0x42d87b
mov ecx, dword [ebp - 0x18]
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x42db40
Capabilities:
Prepare http request
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], str.Accept:___r_nPragma:_no_cache_r_nCache_Control:_no_cache_r_n
mov dword [ebp - 0x20], str.Content_Type:_application_x_www_form_urlencoded_r_n
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0x4432b4
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x42db96
mov edx, dword [ebp - 0x20]
mov dword [ebp - 4], edx
cmp dword [ebp + 0x10], 0
je 0x42dbbc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 8], eax
mov eax, dword [0x447030]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x248
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x42dc04
mov dword [ebp - 0x1c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x42dc65
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x42dc3b
mov dword [ebp - 0x1c], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x42dc65
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x42dc5e
mov dword [ebp - 0x1c], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x42dc65
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42dd20
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [0x447030], 0x100
push 0
push 0
push 0
push 0
push str.UserAgent_1.0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x42dd73
mov dword [ebp - 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x42deba
cmp dword [ebp + 0x10], 0
je 0x42dd8d
push 4
lea eax, [ebp + 0x10]
push eax
push 3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x3c
mov ecx, dword [ebp + 8]
add ecx, 0x48
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0x100
mov ecx, dword [ebp + 8]
add ecx, 0x248
mov edx, dword [ebp + 8]
mov dword [edx + 0x38], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x3c], 0x800
mov ecx, dword [ebp + 8]
add ecx, 0xc
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x42ddfd
mov dword [ebp - 8], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x42deba
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 2
jne 0x42de33
mov dword [ebp - 0xc], 0xa00
push 4
lea edx, [ebp - 0xc]
push edx
push 0x54
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov edx, dword [0x447030]
or edx, 0x800000
mov dword [0x447030], edx
mov dword [0x45eabc], 1
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [0x45f790], eax
mov ecx, dword [ebp + 8]
add ecx, 0x248
mov dword [0x45f794], ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x24]
mov dword [0x458100], eax
push 0
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x24]
push edx
mov eax, dword [ebp + 8]
add eax, 0x48
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
jne 0x42deb3
mov dword [ebp - 8], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov dword [0x45eabc], 0
mov dword [0x45f794], 0
jmp 0x42deba
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42f9d0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x42fa1f
mov dword [ebp - 0x18], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42fb5c
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jge 0x42fa42
mov dword [ebp - 0x18], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42fb56
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x42fa6e
mov dword [ebp - 0x18], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42faf9
lea edx, [ebp - 8]
push edx
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x42fa94
mov dword [ebp - 0x18], 0xfffffffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42faf9
lea eax, [ebp - 4]
push eax
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x42faba
mov dword [ebp - 0x18], 0xfffffffb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42faf9
cmp dword [ebp - 0x10], 0
je 0x42facf
push 0x45f3c0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebp - 8], 0
je 0x42fae4
push 0x45f4c0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebp - 4], 0
je 0x42faf9
push 0x45f5c0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebp - 4], 0
je 0x42fb11
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [eax + 0x14]
call edx
cmp dword [ebp - 8], 0
je 0x42fb29
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 0x14]
call ecx
cmp dword [ebp - 0x10], 0
je 0x42fb41
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ecx + 0x14]
call eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 8]
call ecx
jmp 0x42fb56
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 4
Function at 0x431040
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4462a0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x214], 0x100
mov dword [ebp - 0x218], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edx, dword [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jne 0x4310ba
mov dword [ebp - 4], 0
jmp 0x431103
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x431103
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00402850
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4313d0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4462a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x110], 0x7c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [0x447840], eax
push 0x100
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.00402860
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.00402860
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x431526
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x21c], 0
jmp 0x431479
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
test edx, edx
je 0x4314d2
mov eax, dword [ebp - 0x21c]
movzx ecx, word [ebp + eax*2 - 0x218]
cmp ecx, 0x61
jl 0x4314d0
mov edx, dword [ebp - 0x21c]
movzx eax, word [ebp + edx*2 - 0x218]
cmp eax, 0x7a
jg 0x4314d0
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
sub edx, 0x20
mov eax, dword [ebp - 0x21c]
mov word [ebp + eax*2 - 0x218], dx
jmp 0x43146a
lea ecx, [ebp - 0x218]
push ecx
push str.ADMINISTRATOR
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4314f3
xor edx, edx
mov word [0x45eac0], dx
jmp 0x431526
lea eax, [ebp - 0x218]
push eax
push 0x4434a0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x431514
xor ecx, ecx
mov word [0x45eac0], cx
jmp 0x431526
lea edx, [ebp - 0x108]
push edx
push 0x45eac0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 8]
push eax
call fcn.00431120
push 0x4434b0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x43156f
push 0x4434cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x43156f
mov dword [0x447844], 2
jmp 0x4315a9
cmp dword [ebp - 0x10c], 0
je 0x4315a2
push str.AddAccessAllowedAceEx
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x447844], eax
cmp dword [0x447844], 0
jne 0x4315a2
mov dword [0x447844], 3
jmp 0x4315a9
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402850
mov esp, ebp
pop ebp
ret 4
Function at 0x402b92
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x28]
mov dword [ebp - 0xc], eax
lea eax, [esi + 8]
cmp dword [eax + 0x14], 0x10
jb 0x402bb2
mov eax, dword [eax]
xor ecx, ecx
push ecx
push ecx
push dword [esi]
push dword [esi + 4]
push 0xff
push ecx
push 0x40000003
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0x20], eax
cmp eax, 0xffffffff
jne 0x402bd9
xor eax, eax
jmp 0x402c55
push ebx
lea ebx, [esi + 0x2c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x402c37
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x402c37
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x402c2a
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x402c2a
push eax
lea eax, [ebp - 4]
push eax
push ebx
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x402c37
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x402c54
push 0x6c
call fcn.0040575b
pop ecx
push dword [ebp + 8]
mov ecx, eax
mov dword [ebp - 8], eax
push dword [esi + 4]
push dword [esi]
push dword [esi + 0x20]
call fcn.00402afe
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x402c5c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x50]
lea ebx, [esi + 0x40]
push ebx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
mov eax, dword [esi + 0x28]
push dword [esi + 0x20]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x402cb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x402ccf
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x402cc1
push edi
lea eax, [ebp - 4]
push eax
push ebx
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x402ccf
cmp eax, 1
jne 0x402ccf
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_CancelIo]
cmp dword [ebp - 4], edi
je 0x402cd9
mov edi, dword [ebp - 4]
jmp 0x402ce0
mov ecx, esi
call fcn.00402dee
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x402d25
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x64]
lea ebx, [esi + 0x54]
push ebx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
mov eax, dword [esi + 0x28]
push dword [esi + 0x20]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402d79
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x402d98
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x402d8a
push edi
lea eax, [ebp - 4]
push eax
push ebx
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x402d98
cmp eax, 1
jne 0x402d98
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_CancelIo]
cmp dword [ebp - 4], edi
je 0x402da2
mov edi, dword [ebp - 4]
jmp 0x402da9
mov ecx, esi
call fcn.00402dee
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8