joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003d70
Capabilities:
Add user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [0x101d774]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], eax
push 0x106
lea eax, [ebp - 0x434]
push eax
call fcn.01012187
movzx eax, ax
xor esi, esi
cmp eax, esi
jne 0x1003e3a
lea eax, [ebp - 0x228]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x228]
push eax
mov word [ebp - 0x20c], si
call dword [sym.imp.msvcrt.dll__wcslwr]
lea eax, [ebp - 0x434]
push 0x10014d4
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x14
lea eax, [ebp - 0x434]
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x228]
lea ecx, [ebp - 0x458]
push ecx
mov dword [ebp - 0x450], eax
xor eax, eax
lea ecx, [ebp - 0x454]
inc eax
push ecx
push eax
push ebx
mov dword [ebp - 0x44c], esi
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x440], esi
mov dword [ebp - 0x43c], 0x1001
mov dword [ebp - 0x438], esi
call sub.NETAPI32.dll_NetUserAdd
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100f4dc
leave
ret 8

Function at 0x1003e4e
Capabilities:
Delete user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101d774]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push 0x106
lea eax, [ebp - 0x210]
push eax
call fcn.01012187
movzx eax, ax
test eax, eax
jne 0x1003ea2
lea eax, [ebp - 0x210]
push 0x10014d4
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x210]
push eax
push esi
call sub.NETAPI32.dll_NetUserDel
mov ecx, dword [ebp - 4]
pop esi
call fcn.0100f4dc
leave
ret 8

Function at 0x1004448
Capabilities:
Add user account group

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x101d774]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
call fcn.0100e9df
xor edi, edi
cmp dword [0x1020240], edi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], edi
je 0x10044ea
mov edi, dword [sym.imp.msvcrt.dll_wcscmp]
mov esi, 0x1020240
push ebx
mov ebx, esi
push str._ADD
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
je 0x10044dd
push 0x101d8a4
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
je 0x10044dd
push dword [esi]
call fcn.0100f88d
test eax, eax
mov dword [ebp - 0x21c], eax
jne 0x10044c2
push 0xdb1
call fcn.0101004c
push str._COMMENT
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x10044dd
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x214], eax
add ebx, 4
cmp dword [ebx], 0
mov esi, ebx
jne 0x1004489
xor edi, edi
pop ebx
push 1
push edi
push edi
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0100e833
cmp eax, edi
je 0x1004509
push eax
call fcn.0101004c
push edi
lea eax, [ebp - 0x218]
push eax
push 1
lea eax, [ebp - 0x210]
push eax
call sub.NETAPI32.dll_NetGroupAdd
mov esi, eax
cmp esi, edi
je 0x1004541
cmp esi, 0x35
jne 0x100453b
lea eax, [ebp - 0x210]
push eax
push 0xe81
call fcn.0100ff1c
push esi
call fcn.0101004c
call fcn.0100ffba
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0100f4dc
leave
ret 4
Function at 0x1004674
Capabilities:
Delete user account group

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101d774]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0100e9df
push 1
push 0
push 0
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0100e833
test eax, eax
je 0x10046b1
push eax
call fcn.0101004c
push esi
lea eax, [ebp - 0x210]
push eax
call sub.NETAPI32.dll_NetGroupDel
mov esi, eax
test esi, esi
je 0x10046e0
cmp esi, 0x35
jne 0x10046da
lea eax, [ebp - 0x210]
push eax
push 0xe81
call fcn.0100ff1c
push esi
call fcn.0101004c
call fcn.0100ffba
mov ecx, dword [ebp - 4]
pop esi
call fcn.0100f4dc
leave
ret 4

Function at 0x10046f7
Capabilities:
Add user account to group

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x101d774]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], esi
call fcn.0100e9df
push 1
push esi
push esi
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0100e833
cmp eax, esi
je 0x100473b
push eax
call fcn.0101004c
cmp dword [0x101fc48], esi
mov dword [ebp - 0x218], 2
je 0x1004814
mov esi, 0x101fc48
push ebx
mov ebx, esi
push dword [esi]
lea eax, [ebp - 0x210]
push edi
push eax
call sub.NETAPI32.dll_NetGroupAddUser
mov ecx, eax
sub ecx, 0
je 0x10047d2
sub ecx, 0x35
je 0x10047c1
sub ecx, 0x46
je 0x10047a6
sub ecx, 0x832
je 0x100479d
sub ecx, 0xf
je 0x100478e
push eax
call fcn.0101004c
jmp 0x10047d2
push 2
mov dword [0x1020844], edi
push 0xeaa
jmp 0x10047ad
push 1
push 0xeab
jmp 0x10047ad
push 1
push 0xe9e
mov eax, dword [esi]
mov dword [0x1020840], eax
call fcn.0100fa67
inc dword [ebp - 0x214]
jmp 0x10047d2
lea eax, [ebp - 0x210]
push eax
push 0xe81
call fcn.0100ff1c
inc dword [ebp - 0x218]
add ebx, 4
cmp dword [ebx], 0
mov esi, ebx
jne 0x1004759
cmp dword [ebp - 0x214], 0
pop ebx
je 0x1004814
mov eax, dword [ebp - 0x218]
add eax, 0xfffffffe
cmp dword [ebp - 0x214], eax
jge 0x100480b
push 0xdb0
call fcn.0100ffd2
push 1
call fcn.0100fb27
jmp 0x1004819
call fcn.0100ffba
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0100f4dc
leave
ret 4
Function at 0x100482c
Capabilities:
Delete user account from group

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x101d774]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], esi
call fcn.0100e9df
push 1
push esi
push esi
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0100e833
cmp eax, esi
je 0x1004870
push eax
call fcn.0101004c
cmp dword [0x101fc48], esi
mov dword [ebp - 0x218], 2
je 0x1004949
mov esi, 0x101fc48
push ebx
mov ebx, esi
push dword [esi]
lea eax, [ebp - 0x210]
push edi
push eax
call sub.NETAPI32.dll_NetGroupDelUser
mov ecx, eax
sub ecx, 0
je 0x1004907
sub ecx, 0x35
je 0x10048f6
sub ecx, 0x46
je 0x10048db
sub ecx, 0x832
je 0x10048d2
sub ecx, 0x10
je 0x10048c3
push eax
call fcn.0101004c
jmp 0x1004907
push 2
mov dword [0x1020844], edi
push 0xea9
jmp 0x10048e2
push 1
push 0xeab
jmp 0x10048e2
push 1
push 0xe9e
mov eax, dword [esi]
mov dword [0x1020840], eax
call fcn.0100fa67
inc dword [ebp - 0x214]
jmp 0x1004907
lea eax, [ebp - 0x210]
push eax
push 0xe81
call fcn.0100ff1c
inc dword [ebp - 0x218]
add ebx, 4
cmp dword [ebx], 0
mov esi, ebx
jne 0x100488e
cmp dword [ebp - 0x214], 0
pop ebx
je 0x1004949
mov eax, dword [ebp - 0x218]
add eax, 0xfffffffe
cmp dword [ebp - 0x214], eax
jge 0x1004940
push 0xdb0
call fcn.0100ffd2
push 1
call fcn.0100fb27
jmp 0x100494e
call fcn.0100ffba
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0100f4dc
leave
ret 4
Function at 0x1004961
Capabilities:
List user account groups

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x101d774]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x428], ebx
call fcn.0100e9df
lea eax, [ebp - 0x42c]
push eax
push 0xa
call fcn.01010581
test eax, eax
je 0x10049a9
mov dword [ebp - 0x428], 1
mov word [ebp - 0x41c], bx
jmp 0x10049cb
mov eax, dword [ebp - 0x42c]
push dword [eax]
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push dword [ebp - 0x42c]
call sub.NETAPI32.dll_NetApiBufferFree
push ebx
push ebx
push ebx
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0100e833
cmp eax, ebx
je 0x10049e9
push eax
call fcn.0101004c
push ebx
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x420]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x424]
push eax
push ebx
lea eax, [ebp - 0x210]
push eax
call sub.NETAPI32.dll_NetGroupEnum
cmp eax, ebx
je 0x1004a18
push eax
call fcn.0101004c
cmp dword [ebp - 0x420], ebx
jne 0x1004a25
call fcn.01010035
push 0x100c29f
push 4
push dword [ebp - 0x420]
push dword [ebp - 0x424]
call dword [sym.imp.msvcrt.dll_qsort]
add esp, 0x10
call fcn.0100ffa6
cmp word [ebp - 0x210], bx
je 0x1004a6c
lea eax, [ebp - 0x210]
push 0x10014d0
push eax
call dword [sym.imp.msvcrt.dll_wcsspn]
pop ecx
pop ecx
lea eax, [ebp + eax*2 - 0x210]
jmp 0x1004a72
lea eax, [ebp - 0x41c]
push eax
push 0x1130
call fcn.0101000f
call fcn.0100ff43
mov edi, dword [ebp - 0x424]
xor esi, esi
cmp dword [ebp - 0x420], ebx
jbe 0x1004aae
push ebx
push dword [edi]
push 0x1001518
call fcn.0100fc41
add esp, 0xc
inc esi
add edi, 4
cmp esi, dword [ebp - 0x420]
jb 0x1004a92
cmp dword [ebp - 0x428], ebx
pop edi
pop esi
pop ebx
je 0x1004aca
push 0xdb0
call fcn.0100ffd2
push 1
call fcn.0100fb27
push dword [ebp - 0x424]
call sub.NETAPI32.dll_NetApiBufferFree
call fcn.0100ffba
mov ecx, dword [ebp - 4]
call fcn.0100f4dc
leave
ret
Function at 0x1004ae9
Capabilities:
List user accounts for group

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x101d774]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0100e9df
xor esi, esi
push esi
push esi
push esi
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0100e833
cmp eax, esi
je 0x1004b27
push eax
call fcn.0101004c
lea eax, [ebp - 0x214]
push eax
push 1
push edi
lea eax, [ebp - 0x210]
push eax
call sub.NETAPI32.dll_NetGroupGetInfo
cmp eax, esi
je 0x1004b80
cmp eax, 0x8ba
je 0x1004b50
push eax
call fcn.0101004c
jmp 0x1004b80
mov eax, dword [ebp - 0x214]
push esi
push 3
push 0x101
push dword [eax]
push edi
push esi
call sub.NETAPI32.dll_I_NetNameCanonicalize
cmp eax, esi
je 0x1004b71
push eax
call fcn.0101004c
mov eax, dword [ebp - 0x214]
mov ecx, dword [0x101d77c]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x218]
push eax
push 0x101c340
push 2
call fcn.010101a1
add dword [ebp - 0x218], 5
mov eax, dword [ebp - 0x214]
push dword [eax]
push esi
push dword [0x101c344]
push dword [ebp - 0x218]
call fcn.0100fc80
push eax
push dword [ebp - 0x218]
push esi
push dword [0x101d7bc]
call fcn.0100fc41
mov eax, dword [ebp - 0x214]
add esp, 0x14
push dword [eax + 4]
push esi
push dword [0x101c34c]
push dword [ebp - 0x218]
call fcn.0100fc80
push eax
push dword [ebp - 0x218]
push esi
push dword [0x101d7bc]
call fcn.0100fc41
add esp, 0x14
push dword [ebp - 0x214]
call sub.NETAPI32.dll_NetApiBufferFree
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x214]
push eax
push esi
push edi
lea eax, [ebp - 0x210]
push eax
call sub.NETAPI32.dll_NetGroupGetUsers
cmp eax, esi
je 0x1004c36
push eax
call fcn.0101004c
push 0x100c29f
push 4
push dword [ebp - 0x21c]
push dword [ebp - 0x214]
call dword [sym.imp.msvcrt.dll_qsort]
add esp, 0x10
call fcn.0100ffa6
push 0x1133
call fcn.0100ffd2
call fcn.0100ff43
mov ebx, dword [ebp - 0x214]
xor edi, edi
cmp dword [ebp - 0x21c], esi
jbe 0x1004cab
push esi
push dword [ebx]
push 0x19
call fcn.0100fc80
push eax
push 0x100150c
call fcn.0100fc41
pop ecx
pop ecx
inc edi
push 3
xor edx, edx
mov eax, edi
pop ecx
div ecx
test edx, edx
jne 0x1004ca0
call fcn.0100ffa6
add ebx, 4
cmp edi, dword [ebp - 0x21c]
jb 0x1004c76
push 3
pop ecx
mov eax, edi
xor edx, edx
div ecx
pop edi
pop esi
pop ebx
test edx, edx
je 0x1004cc0
call fcn.0100ffa6
push dword [ebp - 0x214]
call sub.NETAPI32.dll_NetApiBufferFree
call fcn.0100ffba
mov ecx, dword [ebp - 4]
call fcn.0100f4dc
leave
ret 4
Function at 0x1004d48
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push esi
mov esi, dword [0x1020874]
test esi, esi
je 0x1004d88
push edi
mov ecx, dword [esi + 8]
mov edi, dword [esi]
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
cmp dword [esi + 0xc], 0
mov edi, dword [esi + 4]
je 0x1004d7b
push dword [esi]
call fcn.0101253f
push esi
call fcn.0101253f
test edi, edi
mov esi, edi
jne 0x1004d56
pop edi
mov eax, dword [0x101fc40]
and dword [0x1020874], 0
test eax, eax
je 0x1004dac
mov esi, 0x101fc40
push eax
call fcn.01012588
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x1004d9d
xor esi, esi
inc esi
cmp dword [0x102086c], esi
jbe 0x1004dcd
mov eax, dword [0x1020870]
push dword [eax + esi*4]
call fcn.0101254f
inc esi
cmp esi, dword [0x102086c]
jb 0x1004db7
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.01012588
pop esi
ret

Function at 0x1004de0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x18]
push eax
push 1
xor ebx, ebx
push ebx
push 0x10015b4
mov edi, 0x80000002
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], 4
call esi
test eax, eax
jne 0x1004ec0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x10015a0
push dword [ebp - 0x18]
call ebx
test eax, eax
jne 0x1004eb7
cmp dword [ebp - 4], 4
jne 0x1004eb7
cmp dword [ebp - 8], eax
je 0x1004eb7
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x1001584
push edi
call esi
test eax, eax
jne 0x1004eb7
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push 0x1001558
push dword [ebp - 0x10]
call ebx
test eax, eax
jne 0x1004e81
cmp dword [ebp - 4], 4
jne 0x1004e81
cmp dword [ebp - 8], esi
jne 0x1004ea7
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x1001530
push dword [ebp - 0x10]
call ebx
test eax, eax
jne 0x1004eae
cmp dword [ebp - 4], 4
jne 0x1004eae
cmp dword [ebp - 8], esi
je 0x1004eae
mov dword [ebp - 0x14], 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1007897
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 1
push dword [0x1020940]
call sub.ADVAPI32.dll_LsaLookupSids
test eax, eax
jge 0x10078ee
push eax
call fcn.010144d5
cmp eax, 0x6fc
jb 0x10078ea
cmp eax, 0x6fd
jbe 0x10078e5
cmp eax, 0x8ab
jbe 0x10078ea
cmp eax, 0x8ad
jbe 0x10078e5
cmp eax, 0x2019
jne 0x10078ea
mov eax, 0xf7b
leave
ret 8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx]
test eax, eax
jle 0x10078e5
cmp eax, 2
jle 0x1007906
cmp eax, 3
jle 0x10078e5
cmp eax, 5
jg 0x10078e5
mov eax, dword [ecx + 0xc]
test eax, eax
jl 0x10078e5
push ebx
movzx ebx, word [ecx + 4]
push esi
lea esi, [eax + eax*2]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
shl esi, 2
movzx eax, word [eax + esi]
push edi
lea edi, [eax + ebx]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
lea edi, [edi + edi + 4]
push edi
call fcn.01012513
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x10079da
mov ecx, edi
mov edi, dword [ebp - 4]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, esi
cmp word [eax], 0
je 0x10079b9
push dword [0x1020944]
mov edi, dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [eax + 8]
call edi
test eax, eax
jne 0x10079b9
mov eax, dword [ebp - 8]
push dword [0x10224f4]
mov eax, dword [eax + 4]
push dword [eax + esi + 8]
call edi
test eax, eax
jne 0x10079b9
mov eax, dword [ebp - 0x14]
shr eax, 1
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push dword [eax + esi + 4]
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_wcsncpy]
push 0x10014d0
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x14
mov eax, dword [ebp - 0xc]
shr ebx, 1
push ebx
push dword [eax + 8]
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_wcsncat]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
add esp, 0xc
and dword [ebp - 0x10], 0
mov dword [eax], ecx
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_LsaFreeMemory
push dword [ebp - 8]
call sub.ADVAPI32.dll_LsaFreeMemory
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
jmp 0x10078ea
Function at 0x1007f2a
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [esi], ebx
mov dword [edi], 8
call fcn.010079fa
cmp eax, ebx
jne 0x1007fee
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push ebx
push dword [0x1020940]
call sub.ADVAPI32.dll_LsaLookupNames2
cmp eax, ebx
jge 0x1007f8d
cmp eax, 0xc0000073
jne 0x1007f85
mov eax, 0xf7b
jmp 0x1007fee
push eax
call fcn.010144d5
jmp 0x1007fee
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], ebx
jl 0x1007f7e
push dword [eax + 4]
call dword [sym.imp.ntdll.dll_RtlLengthSid]
lea ecx, [ebp + 0x10]
push ecx
push eax
mov dword [ebp + 8], eax
call fcn.01012513
mov ebx, eax
test ebx, ebx
jne 0x1007fdc
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
jne 0x1007fce
mov ebx, 0x85c
jmp 0x1007fdc
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [edi], eax
xor ebx, ebx
push dword [ebp + 0xc]
call sub.ADVAPI32.dll_LsaFreeMemory
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaFreeMemory
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1007ffa
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
and dword [ebp - 8], 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.010079fa
test eax, eax
jne 0x10080c2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
push dword [0x1020938]
call sub.SAMLIB.dll_SamLookupNamesInDomain
test eax, eax
jl 0x1008053
mov eax, dword [ebp - 4]
cmp dword [eax], 4
je 0x1008086
push dword [ebp - 8]
call sub.SAMLIB.dll_SamFreeMemory
push dword [ebp - 4]
call sub.SAMLIB.dll_SamFreeMemory
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
push dword [0x1020940]
call sub.ADVAPI32.dll_LsaLookupNames
test eax, eax
jge 0x10080a7
cmp eax, 0xc0000073
je 0x10080a0
cmp eax, 0xc000018c
je 0x10080a0
push eax
call fcn.010144d5
jmp 0x10080c2
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 0xc]
push eax
mov dword [edx], ecx
call sub.SAMLIB.dll_SamFreeMemory
push dword [ebp - 4]
call sub.SAMLIB.dll_SamFreeMemory
jmp 0x10080c0
mov eax, 0x560
jmp 0x10080c2
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 0xc]
push eax
mov dword [edx], ecx
call sub.ADVAPI32.dll_LsaFreeMemory
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_LsaFreeMemory
xor eax, eax
leave
ret 8
Function at 0x1008467
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
call fcn.01007f2a
mov esi, eax
test esi, esi
je 0x100848d
jmp 0x1008576
push edi
push dword [ebp - 4]
push dword [0x102093c]
call sub.SAMLIB.dll_SamRemoveMemberFromAlias
push dword [ebp - 4]
mov edi, eax
call fcn.0101253f
cmp edi, 0xc0000152
jne 0x1008567
push 0x10014d0
push ebx
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
jne 0x100856b
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
add eax, 0x11
lea ecx, [ebp + 8]
mov dword [ebp - 8], eax
push ecx
add eax, eax
push eax
call fcn.01012513
test eax, eax
je 0x10084ee
push 8
pop eax
jmp 0x1008575
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1008511
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 8]
mov esi, eax
call fcn.0101253f
jmp 0x1008573
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov word [eax + ecx*2], 0x5c
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax*2 + 2]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.01007f2a
push dword [ebp + 8]
mov esi, eax
call fcn.0101253f
test esi, esi
jne 0x1008573
push dword [ebp - 4]
push dword [0x102093c]
call sub.SAMLIB.dll_SamRemoveMemberFromAlias
push dword [ebp - 4]
mov edi, eax
call fcn.0101253f
test edi, edi
jge 0x1008573
push edi
call fcn.010144d5
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10092c2
Capabilities:
Enumerate network shares

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push dword [0x101d78c]
mov byte [ebp - 2], 1
call fcn.0100a1f5
xor ebx, ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
push 2
push ebx
call sub.NETAPI32.dll_NetShareEnum
cmp eax, ebx
je 0x10092fd
push eax
call fcn.0101004c
cmp dword [ebp - 8], ebx
jne 0x1009307
call fcn.01010035
push 0x1008d8b
push 0x20
push dword [ebp - 8]
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_qsort]
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
push 0x101d1c0
push 0x13
call fcn.010101a1
call fcn.0100ffa6
push 0x127a
call fcn.0100ffd2
call fcn.0100ff43
cmp dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jbe 0x10094f6
push esi
mov esi, dword [ebp - 0x10]
push edi
add esi, 0x18
push dword [esi - 0x18]
call fcn.0100fbe2
cmp eax, 0xc
ja 0x100937f
push ebx
push dword [esi - 0x18]
push 0xc
call fcn.0100fc80
push eax
push 0x1001b64
call fcn.0100fc41
mov edi, 0x100150c
jmp 0x10093a3
push dword [esi - 0x18]
mov edi, 0x100150c
push edi
call fcn.0100fc41
pop ecx
pop ecx
call fcn.0100ffa6
push 0x10015f8
push 0x1001b4c
call fcn.0100fc41
and byte [esi - 0x11], 0x7f
cmp dword [esi - 0x14], 1
pop ecx
pop ecx
jne 0x10093e7
push dword [esi - 0x18]
call fcn.01009262
push ebx
push 0x10225a0
push 0xffffffffffffffea
call fcn.0100fc80
push eax
push 0x1001b40
call fcn.0100fc41
pop ecx
pop ecx
push ebx
push dword [0x101d1c4]
push 8
call fcn.0100fc80
push eax
push 0x1001b40
jmp 0x100941e
push dword [esi]
call fcn.0100fbe2
cmp eax, 0x1f
ja 0x1009405
push ebx
push dword [esi]
push 0xffffffffffffffe1
call fcn.0100fc80
push eax
push 0x1001b64
jmp 0x100941e
push dword [esi]
push edi
call fcn.0100fc41
pop ecx
pop ecx
call fcn.0100ffa6
push 0x10015f8
push 0x1001b28
call fcn.0100fc41
mov eax, dword [esi - 0x10]
cmp eax, ebx
pop ecx
pop ecx
mov byte [ebp - 1], bl
je 0x100944a
cmp word [eax], bx
je 0x100944a
push ebx
push eax
push 0xffffffffffffffde
call fcn.0100fc80
push eax
push edi
call fcn.0100fc41
pop ecx
pop ecx
mov byte [ebp - 1], 1
cmp byte [ebp - 2], bl
je 0x10094da
lea eax, [ebp - 0x14]
push eax
push 0x3ed
push dword [esi - 0x18]
push ebx
call sub.NETAPI32.dll_NetShareGetInfo
test eax, eax
jne 0x10094da
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
and eax, 0x30
cmp eax, 0x10
je 0x1009490
cmp eax, 0x20
je 0x1009488
cmp eax, 0x30
jne 0x10094d0
mov edi, dword [0x101d22c]
jmp 0x1009496
mov edi, dword [0x101d224]
jmp 0x1009496
mov edi, dword [0x101d21c]
cmp edi, ebx
je 0x10094d0
cmp byte [ebp - 1], 1
jne 0x10094c3
call fcn.0100ffa6
push edi
push ebx
push 0x10015f8
push 0x2d
call fcn.0100fc80
push eax
push 0x1001b18
call fcn.0100fc41
add esp, 0xc
jmp 0x10094d0
push edi
push 0x1001b10
call fcn.0100fc41
pop ecx
pop ecx
push dword [ebp - 0x14]
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x10094dd
mov byte [ebp - 2], bl
call fcn.0100ffa6
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add esi, 0x20
cmp eax, dword [ebp - 8]
jb 0x1009355
pop edi
pop esi
call fcn.0100ffba
push dword [ebp - 0x10]
call sub.NETAPI32.dll_NetApiBufferFree
pop ebx
leave
ret