joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0xcc81ac
Capabilities:
Encode data using xor

Disassembly:
and byte [esp + 0x34], dl
loopne 0xcc81f6
das
mov dword [0xd5e39a26], eax
les ecx, [esi - 0x17db7ab9]
rcl byte [esi - 0xa], cl
mov ah, 0x18
push edi
sbb al, 9
add byte [eax], al
jmp 0xcc81b6
pushal
call 0xcc81bc
pop ebp
sub ebp, 0x10
sub ebp, 0x8c81ac
jmp 0xcc81d2
mov eax, 0x8c81ac
add eax, ebp
add eax, 0x4c
mov ecx, 0x5be
mov edx, 0x34c1da87
xor byte [eax], dl
inc eax
dec ecx
jne 0xcc81e9
jmp 0xcc81fc
add byte [eax], al
popfd
adc edx, ecx
ror byte [edx + ecx*2], cl
or al, 0x4a
or al, 0xe
mov ebx, 0x6878787
inc esi
jg 0xcc818f
xchg dword [edi - 0x7cc0b57c], eax
xchg dword [edi - 0x7850c279], eax
xchg dword [edi + 0x4f846570], eax
or al, 6
mov eax, dword [edi + 0x42848787]
xlatb
or ah, bl
mov dword [0xa3830e7b], eax
out dx, eax
daa
inc edi
lcall 0x87e9, 0x468def87
xchg byte [ebx - 0x2fe0105d], ch
wait
mov gs, word [edi - 0x7e]
xchg dword [edi - 0x78569179], eax
xchg dword [edi + 0x7ba3e30a], eax
push cs
stosd dword es:[edi], eax
mov dword [0x20c6b0c], eax
pop dword [edi + 0x120c8787]
mov eax, dword [edi + 0xa0c8787]
xchg edi, eax
xchg dword [edi - 0x7a91b979], eax
mov dh, 0x85
add al, 0x45
or esi, 0xffffff88
add dh, byte [ebx + 0x78]
js 0xcc82e8
fiadd dword [ebp - 0x75]
xchg dword [ebx + ecx], ecx
mov dword [0x87878783], eax
out dx, eax
daa
inc edi
lcall 0x87e9, 0x468def87
xchg byte [ebx - 0x5c1cf55d], ch
jnp 0xcc829b
mov esp, dword [ebx - 0x78787d91]
add byte [edi - 0x41917879], 0x85
xchg dword [edi + 0x786b0cd2], eax
mov edi, dword [eax - 0xe]
xchg dword [esi - 0x42], ebp
test dword [edi + 0x6b0cd287], eax
js 0xcc8290
imul edi, dword [eax - 0xe], 0xffffff8b
js 0xcc8293
mov edi, dword [eax - 0xe]
invalid
scasb al, byte es:[edi]
retf
Function at 0x10004f30
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100063df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.10003d90
lea ebx, [esi + 0x10]
xor edi, edi
mov ecx, ebx
mov dword [esp + 0x1c], edi
call sub.MFC42.DLL_CString::CString
lea ebp, [esi + 0x14]
mov byte [esp + 0x1c], 1
mov ecx, ebp
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x18]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x1c]
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x24]
mov byte [esp + 0x1c], 4
call sub.MFC42.DLL_CString::CString
push 0x10017cac
mov ecx, ebx
mov byte [esp + 0x20], 5
mov dword [esi], 0x10008424
call sub.MFC42.DLL_CString::operator
push 0x10017cac
mov ecx, ebp
call sub.MFC42.DLL_CString::operator
push 0x10017cac
lea ecx, [esi + 0x18]
call sub.MFC42.DLL_CString::operator
push 0x10017cac
lea ecx, [esi + 0x1c]
call sub.MFC42.DLL_CString::operator
push 0x10017cac
lea ecx, [esi + 0x24]
mov dword [esi + 0x20], edi
call sub.MFC42.DLL_CString::operator
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x40102a
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor ebx, ebx
pop ecx
test eax, eax
je 0x401078
push str.Windows_original_main_args:_n
call fcn.004010f9
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov esi, ebx
pop ecx
call edi
cmp dword [eax], ebx
jle 0x401078
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.004010f9
add esp, 0xc
inc esi
call edi
cmp esi, dword [eax]
jl 0x401058
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
mov edi, eax
lea ecx, [edi*4 + 4]
push ecx
call sub.jli.dll_JLI_MemAlloc
pop ecx
pop ecx
mov esi, eax
call sub.jli.dll_JLI_GetStdArgs
mov edx, ebx
test edi, edi
jle 0x4010b2
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, edi
jl 0x4010a7
mov ecx, dword [str.java]
mov dword [esi + edx*4], ebx
test ecx, ecx
jne 0x4010c1
mov ecx, dword [esi]
mov eax, dword [section..data]
test eax, eax
jne 0x4010cc
mov eax, dword [esi]
push ebx
push ebx
push ebx
push 1
push ecx
push eax
push 0x4021b4
push 0x4021b8
push 0x40300c
push 2
push 0x403004
push 2
push esi
push edi
call sub.jli.dll_JLI_Launch
add esp, 0x38
pop edi
pop esi
pop ebx
ret
Function at 0x45a144a4
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
test byte [0x45a3f468], 1
push ebx
push esi
push edi
jne 0x45a144c9
or dword [0x45a3f468], 1
call fcn.45a1444e
mov dword [0x45a3f464], eax
push 4
pop eax
call fcn.45a3abe0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x45a1455e
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x48]
lea edi, [eax - 1]
not edi
and edi, esi
sub edi, eax
mov dword [ebp - 8], eax
mov eax, dword [0x45a3f3d4]
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xffff1000
add esi, 0x11000
add esi, ebx
cmp edi, esi
jb 0x45a1455e
cmp eax, 1
je 0x45a1457f
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x45a1455e
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x45a1452b
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x45a1455a
xor eax, eax
inc eax
jmp 0x45a1459e
cmp edi, eax
jae 0x45a14562
xor eax, eax
jmp 0x45a1459e
cmp eax, esi
jae 0x45a14569
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x45a3f3d4]
jmp 0x45a14582
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x45a14f46
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
cmp word [ecx], 0
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
je 0x45a14fd1
cmp word [eax], 0
push ebx
push esi
push edi
je 0x45a14fcc
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
jmp 0x45a14fb2
mov ax, word [edi]
test ax, ax
je 0x45a14fd5
movzx ecx, word [esi]
movzx eax, ax
sub ecx, eax
jne 0x45a14fb8
push esi
call ebx
push edi
mov dword [ebp - 4], eax
call ebx
mov ecx, dword [ebp - 4]
sub eax, edi
sub ecx, esi
xor eax, ecx
test eax, 0xfffffffe
jne 0x45a14fb8
jmp 0x45a14fad
inc esi
inc esi
movzx ecx, word [esi]
inc edi
inc edi
movzx eax, word [edi]
sub ecx, eax
je 0x45a14fb2
cmp esi, dword [ebp - 4]
jb 0x45a14f9f
cmp word [esi], 0
jne 0x45a14f72
cmp word [edi], 0
je 0x45a14fd5
push dword [ebp + 8]
call ebx
cmp word [eax], 0
mov dword [ebp + 8], eax
jne 0x45a14f6a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp + 8]
jmp 0x45a14fce
Function at 0x45a1591c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x45a3f2e4]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], esi
call fcn.45a14af8
cmp eax, esi
jne 0x45a159bd
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x45a15974
lea eax, [ebp - 0x204]
push eax
call fcn.45a1591c
cmp eax, esi
jne 0x45a159bc
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x208]
je 0x45a15964
call fcn.45a14a85
push dword [ebp - 0x210]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 0x208]
mov esi, eax
call fcn.45a14a85
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.45a3a970
leave
ret 4
Function at 0x45a179e7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
push 2
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 8], esi
jne 0x45a17a3c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x45a17a27
call esi
mov esi, eax
jmp 0x45a17b53
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x45a17b53
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x45a17a5d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, ebx
jne 0x45a17a85
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x45a17a70
call esi
jmp 0x45a17b48
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x45a17b4a
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov edi, esi
je 0x45a17af3
lea edi, [ebx + 1]
cmp edi, 0x400
ja 0x45a17ac0
push edi
call fcn.45a146de
test al, al
je 0x45a17ac0
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.45a3abe0
mov dword [ebp + 8], esp
jmp 0x45a17acc
push edi
lea ecx, [ebp - 4]
call fcn.45a16060
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x45a17ada
mov esi, 0x8007000e
jmp 0x45a17b4a
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov byte [eax + ebx], 0
test edi, edi
jne 0x45a17afb
xor eax, eax
jmp 0x45a17b3c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea ebx, [esi + esi]
cmp ebx, 0x400
ja 0x45a17b2b
push ebx
call fcn.45a146de
test al, al
je 0x45a17b2b
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.45a3abe0
mov eax, esp
jmp 0x45a17b34
push ebx
lea ecx, [ebp - 4]
call fcn.45a16060
push esi
push edi
push eax
call fcn.45a1499b
push dword [ebp + 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.45a170f4
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 4]
call fcn.45a15696
mov eax, esi
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x45a17dbc
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
je 0x45a17f43
mov eax, dword [ebp + 8]
cmp eax, esi
mov dword [edi], esi
je 0x45a17f43
cmp word [eax], si
je 0x45a17f43
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push esi
lea ecx, [ebp - 0xc]
push ecx
push esi
push eax
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x45a17e48
cmp eax, 0xe
je 0x45a17e3e
cmp eax, 8
je 0x45a17e3e
cmp eax, 0x8009000e
je 0x45a17e3e
cmp eax, esi
jle 0x45a17f48
and eax, 0xffff
or eax, 0x80070000
jmp 0x45a17f48
mov eax, 0x8007000e
jmp 0x45a17f48
push dword [ebp - 0xc]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, dword [ebp - 8]
mov dword [edi], eax
lea eax, [esi + esi]
cmp eax, dword [0x45a3f970]
ja 0x45a17ea1
mov ecx, dword [0x45a3f974]
lea ecx, [ecx + esi*2 + 8]
cmp ecx, eax
jb 0x45a17ea1
push ecx
call fcn.45a3adaf
test eax, eax
je 0x45a17e9e
mov esi, dword [ebp - 8]
lea eax, [esi + esi + 8]
add eax, 3
and eax, 0xfffffffc
call fcn.45a3abe0
mov edi, esp
test edi, edi
je 0x45a17ea1
mov dword [edi], 0x6b637453
add edi, 8
jne 0x45a17ebb
mov esi, dword [ebp - 8]
lea eax, [esi + esi + 8]
push eax
call dword [0x45a3f978]
mov edi, eax
test edi, edi
je 0x45a17ebb
mov dword [edi], 0x70616548
add edi, 8
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x45a17f0b
test edi, edi
je 0x45a17f0b
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push edi
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp + 8]
push 0
call ebx
test eax, eax
jne 0x45a17f12
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe
je 0x45a17f0b
cmp eax, 8
je 0x45a17f0b
cmp eax, 0x8009000e
je 0x45a17f0b
test eax, eax
jle 0x45a17f06
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
jmp 0x45a17f12
mov dword [ebp - 4], 0x8007000e
test edi, edi
je 0x45a17f28
lea eax, [edi - 8]
cmp dword [eax], 0x70616548
jne 0x45a17f28
push eax
call dword [0x45a3f97c]
cmp dword [ebp - 4], 0
je 0x45a17f3e
mov eax, dword [esi]
test eax, eax
je 0x45a17f3e
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [esi], 0
mov eax, dword [ebp - 4]
jmp 0x45a17f48
mov eax, 0x80070057
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x45a250bf
Capabilities:
Get domain information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
xor esi, esi
inc esi
push esi
push ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call sub.NETAPI32.dll_DsRoleGetPrimaryDomainInformation
mov edi, eax
cmp edi, ebx
jne 0x45a25196
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx]
cmp eax, 4
jl 0x45a25119
cmp eax, 5
jg 0x45a25119
push ecx
mov dword [0x45a3f5a4], esi
call sub.NETAPI32.dll_DsRoleFreeMemory
xor eax, eax
jmp 0x45a25198
push ecx
call sub.NETAPI32.dll_DsRoleFreeMemory
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.ADVAPI32.dll_LsaOpenPolicy
cmp eax, ebx
jge 0x45a2513c
push eax
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov edi, eax
jmp 0x45a2517c
lea eax, [ebp - 8]
push eax
push 5
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaQueryInformationPolicy
cmp eax, ebx
jl 0x45a25132
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x45a2515a
push 8
pop edi
jmp 0x45a2517c
mov eax, dword [eax + 8]
push eax
push dword [0x45a3e280]
push eax
call dword [sym.imp.ntdll.dll_RtlLengthSid]
push eax
call dword [sym.imp.ntdll.dll_RtlCopySid]
cmp eax, ebx
jl 0x45a25132
mov dword [0x45a3f5ec], esi
cmp dword [ebp - 4], ebx
je 0x45a25189
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaClose
cmp dword [ebp - 8], ebx
je 0x45a25196
push dword [ebp - 8]
call sub.ADVAPI32.dll_LsaFreeMemory
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45a27ece
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edx, edx
push 0xd
xor eax, eax
pop ecx
lea edi, [ebp - 0x40]
mov dword [ebp - 0x44], edx
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x1d0]
cmp eax, 0xffffffff
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
jne 0x45a27f06
push 0x32
pop eax
jmp 0x45a28019
push esi
lea ecx, [ebp - 0xc]
push ecx
push 0x38
lea ecx, [ebp - 0x44]
push ecx
push 0xa
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x45a27f29
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x45a27fe8
lea eax, [ebp - 8]
push eax
push 1
push 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x45a27f5c
call esi
mov edi, eax
cmp edi, 0x3f0
jne 0x45a27fea
and dword [ebp - 8], 0
push dword [ebx + 0x1d0]
mov ebx, dword [sym.imp.ADVAPI32.dll_SetThreadToken]
xor edi, edi
push edi
call ebx
test eax, eax
jne 0x45a27f75
call esi
jmp 0x45a27fe8
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp + 8], edi
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x45a27f90
mov edi, 0x54f
jmp 0x45a27fd7
call esi
mov edi, eax
cmp edi, 0xea
jne 0x45a27fd7
mov eax, dword [ebp + 8]
push 0x45a12b74
add eax, eax
push eax
call fcn.45a3991f
test eax, eax
mov dword [ebp - 4], eax
jne 0x45a27fb8
push 8
pop edi
jmp 0x45a27fd7
lea ecx, [ebp + 8]
push ecx
push eax
push dword [ebp + 0xc]
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x45a27fcf
call esi
mov edi, eax
jmp 0x45a27fd7
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
xor edi, edi
push dword [ebp - 8]
push 0
call ebx
test eax, eax
jne 0x45a27fea
call esi
test edi, edi
jne 0x45a27ff9
mov edi, eax
test edi, edi
jne 0x45a27ff9
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
and dword [ebp - 4], edi
mov dword [eax], ecx
cmp dword [ebp - 4], 0
pop esi
je 0x45a28008
push dword [ebp - 4]
call fcn.45a39953
cmp dword [ebp - 8], 0
je 0x45a28017
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebx
leave
ret 0x10
Function at 0x45a28509
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x45a3f2e4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.AUTHZ.dll_AuthzGetInformationFromContext]
push 0
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x18]
push ecx
push 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 1
push eax
mov dword [ebp - 0x1c], eax
call edi
test eax, eax
je 0x45a28549
mov esi, 0x54f
jmp 0x45a286aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x7a
jne 0x45a286aa
mov esi, dword [ebp - 0x18]
cmp esi, dword [0x45a3f970]
ja 0x45a285a1
mov eax, dword [0x45a3f974]
lea eax, [eax + esi + 8]
cmp eax, esi
jb 0x45a285a1
push eax
call fcn.45a3adaf
test eax, eax
je 0x45a2859e
mov esi, dword [ebp - 0x18]
lea eax, [esi + 8]
add eax, 3
and eax, 0xfffffffc
call fcn.45a3abe0
mov ebx, esp
test ebx, ebx
je 0x45a285a1
mov dword [ebx], 0x6b637453
add ebx, 8
jne 0x45a285c4
mov esi, dword [ebp - 0x18]
add esi, 8
push esi
call dword [0x45a3f978]
mov ebx, eax
test ebx, ebx
je 0x45a285bc
mov dword [ebx], 0x70616548
add ebx, 8
jne 0x45a285c4
push 8
pop esi
jmp 0x45a28694
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 1
push dword [ebp - 0x1c]
call edi
test eax, eax
jne 0x45a285e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x45a28694
push dword [ebx]
call dword [sym.imp.ntdll.dll_RtlLengthSid]
mov dword [ebp - 0x1c], eax
push 0x45a12ba8
lea eax, [eax*4 + 0xe]
push eax
call fcn.45a3991f
test eax, eax
je 0x45a285bc
mov esi, 0x45a12b9c
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebx]
xor edi, edi
cmp dword [ebp - 0x1c], edi
lea ecx, [eax + 0xa]
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x33
mov byte [ebp - 0x10], 0x34
mov byte [ebp - 0xf], 0x35
mov byte [ebp - 0xe], 0x36
mov byte [ebp - 0xd], 0x37
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 0x39
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 9], 0x42
mov byte [ebp - 8], 0x43
mov byte [ebp - 7], 0x44
mov byte [ebp - 6], 0x45
mov byte [ebp - 5], 0x46
jbe 0x45a28687
movzx edx, byte [edi + esi]
shr edx, 4
movsx dx, byte [ebp + edx - 0x14]
mov word [ecx], dx
xor edx, edx
mov dl, byte [edi + esi]
inc ecx
inc ecx
and edx, 0xf
movsx dx, byte [ebp + edx - 0x14]
mov word [ecx], dx
inc ecx
inc ecx
inc edi
cmp edi, dword [ebp - 0x1c]
jb 0x45a2865c
mov dword [ecx], 0x3e
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
xor esi, esi
test ebx, ebx
je 0x45a286aa
add ebx, 0xfffffff8
cmp dword [ebx], 0x70616548
jne 0x45a286aa
push ebx
call dword [0x45a3f97c]
mov eax, esi
lea esp, [ebp - 0x2c]
mov ecx, dword [ebp - 4]
call fcn.45a3a970
pop edi
pop esi
pop ebx
leave
ret 8