joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e950
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a63f4
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x38]
xor ebx, ebx
mov dword [esp + 0x30], ebx
push 0xc
mov dword [esp + 0x18], ebx
call fcn.005737a7
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, 1
mov dword [esp + 0x30], ecx
cmp eax, ebx
je 0x46e9ac
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
jmp 0x46e9ae
xor eax, eax
mov byte [esp + 0x30], bl
mov dword [ebp], eax
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x40]
push ebx
lea edx, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x50]
push eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x46ea54
mov edi, dword [ebp]
cmp esi, dword [edi + 4]
je 0x46ea15
mov eax, dword [edi]
push esi
push eax
call fcn.005765a8
mov ecx, dword [edi + 4]
add esp, 8
mov dword [edi], eax
cmp esi, ecx
jbe 0x46ea12
mov edx, esi
sub edx, ecx
push edx
add ecx, eax
push ebx
push ecx
call fcn.005783f0
add esp, 0xc
mov dword [edi + 4], esi
mov eax, dword [ebp]
mov edx, dword [esp + 0x3c]
push ebx
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], esi
mov eax, dword [eax]
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46ea3b
cmp dword [esp + 0x40], esi
je 0x46ea54
mov esi, dword [ebp]
cmp dword [esi + 4], ebx
je 0x46ea54
mov eax, dword [esi]
push ebx
push eax
call fcn.005765a8
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x46ea70
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor esi, esi
xor ebp, ebp
push edi
test ebx, ebx
jb 0x46eae6
ja 0x46ea89
cmp esi, dword [esp + 0x20]
jae 0x46eaea
mov ecx, dword [esp + 0x20]
sub ecx, esi
mov eax, ebx
sbb eax, ebp
test eax, eax
ja 0x46eaa5
jb 0x46eaa1
cmp ecx, 0x10000
jae 0x46eaa5
mov edi, ecx
jmp 0x46eaaa
mov edi, 0x10000
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push edi
lea edx, [esi + ecx]
push edx
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46eae6
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x46eae6
add esi, eax
adc ebp, 0
cmp ebp, ebx
jb 0x46ea89
ja 0x46eae6
cmp esi, dword [esp + 0x20]
jb 0x46ea89
cmp esi, dword [esp + 0x20]
jne 0x46eb07
cmp ebp, ebx
jne 0x46eb07
or esi, ebp
je 0x46eaff
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
Function at 0x46eb10
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5a7d08
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x46ebb5
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
push ecx
push edx
push esi
call fcn.0046ea70
add esp, 0x10
test al, al
je 0x46eb9d
mov dword [esp + 0x18], 0xffffffff
push esi
call ebx
mov al, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
cmp byte [esp + 0x2c], 0
je 0x46ebb5
push esi
call ebx
or esi, 0xffffffff
push edi
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x18], 0xffffffff
cmp esi, 0xffffffff
je 0x46ebc5
push esi
call ebx
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x46ec50
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x46ec76
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
ret
or eax, 0xffffffff
or edx, 0xffffffff
add esp, 0xc
ret
Function at 0x46f1b0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x5a7cdc
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
mov dword [esp + 0x34], ebx
push 0xc
mov dword [esp + 0x1c], ebx
call fcn.005737a7
add esp, 4
mov dword [esp + 0x1c], eax
mov edi, 1
mov dword [esp + 0x34], edi
cmp eax, ebx
je 0x46f20c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], edi
jmp 0x46f20e
xor eax, eax
mov byte [esp + 0x34], bl
mov dword [ebp], eax
mov dword [esp + 0x34], ebx
lea eax, [esp + 0x1c]
push eax
push esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x46f2ad
mov ecx, dword [esp + 0x1c]
mov edx, ecx
and edx, dword [esp + 0x20]
cmp edx, 0xffffffff
je 0x46f2ad
push ebx
push ebx
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.0046e950
add esp, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x34], 2
mov esi, dword [ebp]
add dword [esi + 8], 0xffffffff
jne 0x46f275
xor edi, edi
call fcn.00428c7e
mov edi, 1
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
add dword [eax + 8], edi
mov dword [ebp], eax
mov byte [esp + 0x34], bl
mov eax, dword [esp + 0x14]
dec dword [eax + 8]
mov esi, eax
add eax, 8
cmp dword [eax], ebx
jne 0x46f2ad
xor edi, edi
call fcn.00428c7e
mov edx, dword [esp + 0x14]
push edx
call fcn.00573721
add esp, 4
mov dword [esp + 0x14], ebx
mov eax, ebp
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x46f3d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5ad739
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [0x6c7718]
mov edx, dword [eax + 0xc]
mov ecx, 0x6c7718
call edx
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], 1
call fcn.0046f2d0
add esp, 8
mov dword [esp + 0x28], 2
mov eax, dword [esp + 0x18]
cmp dword [eax], ebx
je 0x46f492
cmp dword [eax + 4], ebx
je 0x46f492
mov esi, dword [eax + 4]
mov edi, dword [eax]
mov eax, dword [ebp]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, esi
or eax, ecx
jge 0x46f472
mov eax, esi
mov ecx, ebp
call fcn.0040d918
cmp esi, ebx
mov eax, dword [ebp]
jl 0x46f4d4
cmp esi, dword [eax - 8]
jg 0x46f4d4
push esi
mov dword [eax - 0xc], esi
mov edx, dword [ebp]
push edi
push eax
mov byte [esi + edx], bl
call fcn.005784a0
add esp, 0xc
mov byte [esp + 0x28], bl
mov eax, dword [esp + 0x18]
dec dword [eax + 8]
mov esi, eax
add eax, 8
cmp dword [eax], ebx
jne 0x46f4be
xor edi, edi
call fcn.00428c7e
mov eax, dword [esp + 0x18]
push eax
call fcn.00573721
add esp, 4
mov dword [esp + 0x18], ebx
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push 0x80070057
call fcn.00402d79
int3
Function at 0x46f9a0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5b37bc
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6b06f8]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x50], ebp
mov edi, ecx
push edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebp
call fcn.0046fbc0
mov dword [esp + 0x50], ebp
push ebp
push ebp
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, eax
cmp ebx, ebp
je 0x46fb9c
lea esi, [ebx + 1]
mov eax, 7
xor ecx, ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ebp
mov word [esp + 0x2c], cx
cmp esi, 0xffffffff
jne 0x46fa29
call fcn.00572631
jmp 0x46fa31
cmp esi, 0x7ffffffe
jbe 0x46fa3a
call fcn.00572631
mov eax, dword [esp + 0x40]
cmp eax, esi
jae 0x46fa6f
mov edx, dword [esp + 0x3c]
push edx
push esi
lea eax, [esp + 0x30]
push eax
call fcn.0040cc51
mov eax, dword [esp + 0x40]
cmp esi, ebp
jbe 0x46facc
cmp esi, 1
jne 0x46fa8b
cmp eax, 8
mov eax, dword [esp + 0x2c]
jae 0x46fa68
lea eax, [esp + 0x2c]
xor edx, edx
mov word [eax], dx
jmp 0x46fab3
cmp esi, ebp
jne 0x46fa54
cmp eax, 8
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], ebp
jae 0x46fa84
lea eax, [esp + 0x2c]
xor ecx, ecx
mov word [eax], cx
jmp 0x46facc
mov edi, dword [esp + 0x2c]
cmp eax, 8
jae 0x46fa98
lea edi, [esp + 0x2c]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, esi
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x18]
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], esi
jae 0x46fac6
lea eax, [esp + 0x2c]
xor ecx, ecx
mov word [eax + esi*2], cx
mov dword [esp + 0x50], 1
mov eax, dword [esp + 0x2c]
mov esi, 8
cmp dword [esp + 0x40], esi
jae 0x46fae7
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x46fb70
cmp dword [esp + 0x40], esi
mov esi, dword [esp + 0x2c]
jae 0x46fb01
lea esi, [esp + 0x2c]
cmp word [esi], bp
je 0x46fb70
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.0046e760
mov byte [esp + 0x50], 2
mov ebx, eax
call fcn.0046fc30
mov byte [esp + 0x50], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46fb43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
lea edx, [eax + 2]
jmp 0x46fb50
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46fb50
mov edi, dword [esp + 0x18]
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 + 2], cx
lea esi, [esi + eax*2 + 2]
jne 0x46fb06
xor ebp, ebp
mov byte [esp + 0x50], 0
cmp dword [esp + 0x40], 8
jb 0x46fb89
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00573721
add esp, 4
xor edx, edx
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebp
mov word [esp + 0x2c], dx
mov eax, edi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0057372c
add esp, 0x40
ret
Function at 0x470550
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5ad669
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], esi
mov eax, dword [0x6c7718]
mov edx, dword [eax + 0xc]
mov ecx, 0x6c7718
call edx
mov edi, dword [esp + 0x2c]
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x24], esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push ebp
push esi
push 0xfde9
mov dword [esp + 0x38], 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 1
jle 0x470670
mov edi, eax
lea ebx, [esp + 0x14]
call fcn.00471c80
mov dword [esp + 0x24], 2
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor ebx, ebx
push ebx
push ebx
push eax
push ecx
push 0xffffffffffffffff
push ebp
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 1
jle 0x470638
mov ecx, dword [esi]
mov byte [ecx + eax - 1], bl
mov edx, dword [esi]
cmp edx, ebx
jne 0x470618
mov ebp, dword [esp + 0x2c]
xor eax, eax
push eax
push edx
mov eax, ebp
call fcn.0040b232
jmp 0x47063c
mov eax, edx
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x470620
mov ebp, dword [esp + 0x2c]
sub eax, edi
push eax
push edx
mov eax, ebp
call fcn.0040b232
jmp 0x47063c
mov ebp, dword [esp + 0x2c]
mov byte [esp + 0x24], bl
add dword [esi + 8], 0xffffffff
jne 0x47065a
xor edi, edi
call fcn.00471dc0
push esi
call fcn.00573721
add esp, 4
mov dword [esp + 0x14], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x470690
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5ad619
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], esi
mov eax, dword [0x6c7718]
mov edx, dword [eax + 0xc]
mov ecx, 0x6c7718
call edx
mov edi, dword [esp + 0x2c]
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x24], esi
push esi
push esi
push 0xffffffffffffffff
push ebp
push esi
push 0xfde9
mov dword [esp + 0x30], 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, 1
jle 0x4707b6
mov edi, eax
lea ebx, [esp + 0x14]
call fcn.00471d20
mov dword [esp + 0x24], 2
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
push 0xffffffffffffffff
push ebp
xor ebx, ebx
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, 1
jle 0x47077e
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2 - 2], dx
mov edx, dword [esi]
cmp edx, ebx
jne 0x470757
mov ebp, dword [esp + 0x2c]
xor eax, eax
push eax
push edx
mov eax, ebp
call fcn.0040b33c
jmp 0x470782
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x470760
mov ebp, dword [esp + 0x2c]
sub eax, edi
sar eax, 1
push eax
push edx
mov eax, ebp
call fcn.0040b33c
jmp 0x470782
mov ebp, dword [esp + 0x2c]
mov byte [esp + 0x24], bl
add dword [esi + 8], 0xffffffff
jne 0x4707a0
xor edi, edi
call fcn.00471e10
push esi
call fcn.00573721
add esp, 4
mov dword [esp + 0x14], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x470c60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ad5b9
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6b06f8]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x44], ebx
mov ebp, dword [esp + 0x4c]
mov dword [esp + 0x14], ebx
mov eax, dword [0x6c7718]
mov edx, dword [eax + 0xc]
mov ecx, 0x6c7718
mov dword [esp + 0x18], ebp
call edx
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0x44], ebx
mov eax, 7
xor ecx, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], cx
cmp esi, 0xffffffff
jne 0x470ce7
call fcn.00572631
jmp 0x470cef
cmp esi, 0x7ffffffe
jbe 0x470cf8
call fcn.00572631
mov eax, dword [esp + 0x34]
cmp eax, esi
jae 0x470d2d
mov edx, dword [esp + 0x30]
push edx
push esi
lea eax, [esp + 0x24]
push eax
call fcn.0040cc51
mov eax, dword [esp + 0x34]
cmp esi, ebx
jbe 0x470d8a
cmp esi, 1
jne 0x470d4d
cmp eax, 8
mov eax, dword [esp + 0x20]
jae 0x470d26
lea eax, [esp + 0x20]
xor edx, edx
mov word [eax], dx
jmp 0x470d71
cmp esi, ebx
jne 0x470d12
mov edi, 8
cmp eax, edi
mov eax, dword [esp + 0x20]
mov dword [esp + 0x30], ebx
jae 0x470d46
lea eax, [esp + 0x20]
xor ecx, ecx
mov word [eax], cx
jmp 0x470d8f
mov edi, dword [esp + 0x20]
cmp eax, 8
jae 0x470d5a
lea edi, [esp + 0x20]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, esi
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
mov dword [esp + 0x30], esi
jae 0x470d84
lea eax, [esp + 0x20]
xor ecx, ecx
mov word [eax + esi*2], cx
mov edi, 8
mov dword [esp + 0x44], 2
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x34], edi
jae 0x470da5
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x54]
push edx
mov edx, dword [esp + 0x34]
push ecx
push 0xffffffffffffffff
push edx
push eax
call fcn.00574f31
mov esi, eax
add esp, 0x14
cmp esi, ebx
jle 0x470de4
cmp esi, dword [esp + 0x30]
jbe 0x470dd0
call fcn.0057451a
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x34], edi
jae 0x470dde
lea eax, [esp + 0x20]
xor ecx, ecx
mov word [eax + esi*2], cx
cmp dword [esp + 0x34], edi
jb 0x470df8
mov eax, dword [esp + 0x20]
mov edx, eax
cmp eax, ebx
jne 0x470dfc
xor eax, eax
jmp 0x470e10
lea edx, [esp + 0x20]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x470e01
sub eax, esi
sar eax, 1
push eax
push edx
mov eax, ebp
call fcn.0040b33c
mov byte [esp + 0x44], bl
cmp dword [esp + 0x34], edi
jb 0x470e30
mov edx, dword [esp + 0x20]
push edx
call fcn.00573721
add esp, 4
xor eax, eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], ax
mov eax, ebp
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0057372c
add esp, 0x34
ret
Function at 0x470fb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ad4f9
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6b06f8]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x50], ebx
mov eax, dword [esp + 0x5c]
mov ebp, dword [esp + 0x58]
mov dword [esp + 0x20], ebx
mov edx, dword [0x6c7718]
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x6c7718
mov dword [esp + 0x24], ebp
call eax
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0x50], ebx
mov eax, dword [esp + 0x60]
push ebx
cdq
push 2
push edx
push eax
mov dword [esp + 0x30], 1
call fcn.00578e90
mov esi, eax
add esi, 1
adc edx, ebx
mov eax, esi
add eax, 0x80000000
adc edx, ebx
mov dword [esp + 0x1c], edx
jne 0x471048
cmp eax, 0xffffffff
jbe 0x471052
push 0x80004005
call fcn.00402d79
cmp esi, ebx
jle 0x47119c
lea edi, [esi + 1]
mov eax, 0xf
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp edi, 0xffffffff
jne 0x47107a
call fcn.00572631
jmp 0x47107f
cmp edi, 0xfffffffe
jbe 0x471088
call fcn.00572631
mov eax, dword [esp + 0x40]
cmp eax, edi
jae 0x4710b9
mov ecx, dword [esp + 0x3c]
push ecx
push edi
lea ecx, [esp + 0x30]
call fcn.0040cb26
mov eax, dword [esp + 0x40]
cmp edi, ebx
jbe 0x471104
cmp edi, 1
jne 0x4710d6
cmp eax, 0x10
mov eax, dword [esp + 0x2c]
jae 0x4710b5
lea eax, [esp + 0x2c]
mov byte [eax], bl
jmp 0x4710ee
cmp edi, ebx
jne 0x4710a1
mov edi, 0x10
cmp eax, edi
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], ebx
jae 0x4710d2
lea eax, [esp + 0x2c]
mov byte [eax], bl
jmp 0x471109
cmp eax, 0x10
mov eax, dword [esp + 0x2c]
jae 0x4710e3
lea eax, [esp + 0x2c]
push edi
push ebx
push eax
call fcn.005783f0
add esp, 0xc
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], edi
jae 0x471101
lea eax, [esp + 0x2c]
mov byte [eax + edi], bl
mov edi, 0x10
mov dword [esp + 0x50], 2
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], esi
cmp dword [esp + 0x40], edi
jae 0x471123
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x60]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
call fcn.0041c222
add esp, 4
test eax, eax
je 0x471175
mov esi, dword [esp + 0x18]
cmp esi, ebx
jl 0x471175
cmp esi, dword [esp + 0x3c]
jbe 0x47114f
call fcn.0057451a
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x40], edi
jae 0x47115d
lea eax, [esp + 0x2c]
mov byte [eax + esi], bl
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x40], edi
jae 0x47116e
lea eax, [esp + 0x2c]
push eax
push ebp
call fcn.004084c5
mov byte [esp + 0x50], bl
cmp dword [esp + 0x40], edi
jb 0x47118c
mov eax, dword [esp + 0x2c]
push eax
call fcn.00573721
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
mov eax, ebp
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0057372c
add esp, 0x40
ret
Function at 0x471e70
Capabilities:
Get token privileges

Disassembly:
push 0xffffffffffffffff
push 0x5a7c1b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x471eb3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x471fbf
push 0xc
call fcn.005737a7
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
mov byte [esp + 0x24], 1
cmp esi, ebx
je 0x471f2c
push 0x1000
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 1
call fcn.005765a8
mov ecx, dword [esi + 4]
add esp, 8
mov dword [esi], eax
cmp ecx, 0x1000
jae 0x471f23
mov edx, 0x1000
sub edx, ecx
push edx
add ecx, eax
push ebx
push ecx
call fcn.005783f0
add esp, 0xc
mov dword [esi + 4], 0x1000
jmp 0x471f2e
xor esi, esi
mov byte [esp + 0x24], bl
mov dword [esp + 0x18], esi
mov byte [esp + 0x24], 2
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 4]
push eax
push edi
push 3
push edx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x471f92
xor eax, eax
cmp dword [edi], ebx
jbe 0x471f7e
lea ecx, [edi + 0xc]
jmp 0x471f70
mov dword [ecx], 2
inc eax
add ecx, 0xc
cmp eax, dword [edi]
jb 0x471f70
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ebx
push ebx
push eax
push edi
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov byte [esp + 0x24], bl
add dword [esi + 8], 0xffffffff
jne 0x471fbf
cmp dword [esi + 4], ebx
je 0x471fb2
mov eax, dword [esi]
push ebx
push eax
call fcn.005765a8
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
push esi
call fcn.00573721
add esp, 4
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x471fd6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret