joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4360d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x470cb8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x410]
mov edx, 0x80000002
push eax
push 9
push ecx
push 0x3de900
call fcn.0040fa36
test eax, eax
jne 0x4361ef
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x414]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x204]
mov edi, ebx
push eax
push ebx
jmp 0x43618c
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0x208
push eax
lea eax, [ebp - 0x40c]
push eax
push ebx
push 2
push 0x3de9b0
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x410]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x436178
mov word [ebp - 0x206], ax
lea eax, [ebp - 0x40c]
push 0x3de344
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4361ae
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x414]
inc edi
push eax
lea eax, [ebp - 0x204]
push eax
push edi
push dword [ebp - 0x410]
mov dword [ebp - 0x414], 0x100
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x436122
jmp 0x4361d2
push ecx
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 1
push eax
push ecx
push 0x3de9c0
mov edx, 0x3de9f0
call fcn.00441980
mov esi, eax
push dword [ebp - 0x410]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea eax, [esi - 0x103]
neg eax
pop edi
sbb eax, eax
and eax, esi
pop esi
pop ebx
jmp 0x4361fb
cmp eax, 2
je 0x4361f9
cmp eax, 3
jne 0x4361fb
xor eax, eax
test eax, eax
jle 0x436207
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b590
leave
ret
Function at 0x43622e
Capabilities:
Delete file
Get common file path
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x470cb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x436333
push 0x3de2c0
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.003f0c07
mov esi, eax
test esi, esi
js 0x436333
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x4362ba
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4362a8
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070002
je 0x4362b8
cmp esi, 0x80070003
jne 0x4362ba
mov esi, ebx
test esi, esi
js 0x436333
push edi
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4362f5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x436332
movzx esi, si
or esi, 0x80070000
jmp 0x436332
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
push ebx
push ebx
lea eax, [ebp - 0x214]
push eax
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileTime]
test eax, eax
jne 0x43632b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43632b
movzx esi, si
or esi, 0x80070000
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b590
leave
ret
Function at 0x436343
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x15c
mov eax, dword [0x470cb8]
xor eax, esp
mov dword [esp + 0x158], eax
push ebx
push esi
push edi
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push 0xf003f
push ecx
push 0x3d7210
mov edx, 0x80000002
mov dword [esp + 0x1c], ebx
call fcn.0040fa36
mov esi, eax
mov edi, 0x80070000
test esi, esi
jle 0x436394
movzx esi, si
or esi, edi
test esi, esi
js 0x436472
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x20
push eax
push 0x3d7704
push 1
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetNLSVersionEx]
test eax, eax
je 0x436457
push 0x32
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
mov esi, eax
test esi, esi
js 0x436468
push 0xc8
lea eax, [esp + 0x9c]
push ebx
push eax
call fcn.0040cfd6
add esp, 0xc
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0xa0]
push dword [esp + 0x1c]
push 6
push 0x3ddfa0
push 0x64
push eax
call fcn.003ed6f4
mov esi, eax
add esp, 0x1c
test esi, esi
js 0x436468
lea ecx, [esp + 0x98]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x436424
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [esp + 0x9c]
push eax
push 1
push 0x3d7730
push ebx
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
jmp 0x43645d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x436468
movzx esi, si
or esi, edi
push dword [esp + 0xc]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [esp + 0x164]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b590
mov esp, ebp
pop ebp
ret
Function at 0x43b56a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
push edi
test edx, edx
jne 0x43b587
mov ecx, 0x80004005
call fcn.0042fefb
xor eax, eax
mov edi, edx
mov dword [ebp - 4], eax
mov esi, eax
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x43b598
sub ecx, dword [ebp - 8]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x43b590
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x43b634
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
test edx, edx
jne 0x43b64f
mov ecx, 0x80004005
call fcn.0042fefb
mov ecx, edx
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x43b656
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x43c0d3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
test eax, eax
je 0x43c12b
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
mov esi, eax
test esi, esi
je 0x43c12b
push edi
push ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x43c11d
cmp esi, ecx
jae 0x43c12b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x43c10b
cmp esi, ecx
jae 0x43c12b
cmp word [esi], 0
je 0x43c12b
mov eax, esi
jmp 0x43c12d
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x43f48d
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x230
mov eax, 0x41cfbe
call fcn.0040bc61
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x220], ecx
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov eax, dword [ebp + 8]
inc edi
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x228], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], ecx
test edx, edx
jne 0x43f4d5
test eax, eax
je 0x43f5e5
test ebx, ebx
jne 0x43f4de
mov ebx, 0x104
mov esi, dword [0x3d2f5c]
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
mov ecx, esi
call dword [0x473670]
call esi
mov esi, eax
mov dword [ebp - 0x21c], esi
test esi, esi
jne 0x43f512
xor edi, edi
jmp 0x43f5e5
xor eax, eax
mov dword [ebp - 0x22c], eax
push 0
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x224], ebx
push ecx
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x230], 0x104
push ecx
push 0
lea ecx, [ebp - 0x224]
push ecx
push esi
push eax
push dword [ebp - 0x220]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x43f5f3
push dword [ebp + 0x18]
mov esi, dword [ebp - 0x23c]
push dword [ebp - 0x234]
mov edx, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x220]
push ebx
push dword [ebp - 0x228]
push dword [ebp - 0x238]
push esi
call fcn.0043f609
mov edi, eax
test edi, edi
je 0x43f5b5
test esi, esi
je 0x43f5b5
cmp dword [ebp - 0x224], ebx
jae 0x43f5ef
push dword [ebp - 0x228]
mov ecx, esi
push dword [ebp - 0x21c]
push dword [ebp - 0x220]
call dword [0x473670]
call esi
mov esi, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
test edi, edi
jne 0x43f51a
and dword [ebp - 4], 0
push esi
mov esi, dword [0x3d2f60]
mov ecx, esi
call dword [0x473670]
call esi
mov eax, edi
call fcn.0040bc10
ret 0x14
xor edi, edi
jmp 0x43f5b5
cmp eax, 0x103
je 0x43f5d0
sub eax, 0xea
neg eax
sbb eax, eax
not eax
and edi, eax
jmp 0x43f5bb

Function at 0x43ffb6
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x9c], edi
jne 0x43ffd5
push 6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x44000d
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0xc]
lea eax, [eax*2 + 2]
push eax
push edi
call fcn.003fe5c5
push eax
push 1
push edi
push dword [ebp + 8]
push dword [esi + 0x9c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x440003
push eax
jmp 0x43ffcb
push edi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x440666
Capabilities:
Create directory
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
push esi
mov ebx, edx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x4406b7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebx], eax
cmp eax, 0x50
je 0x440699
cmp eax, 0xb7
je 0x440699
xor eax, eax
jmp 0x4406d1
test edi, edi
je 0x4406b7
push dword [edi + 4]
push 4
push esi
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetFileSecurityW]
test eax, eax
jne 0x4406b7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebx], eax
jmp 0x440695
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
or eax, 0x2000
push eax
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
and dword [ebx], 0
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x440fcb
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x180
mov eax, dword [0x470cb8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi], 2
jne 0x441175
xor edi, edi
cmp dword [esi + 0x10], edi
jle 0x441175
mov eax, dword [esi + 0x14]
lea ecx, [ebp - 0x170]
push 0x3da8c0
mov dword [ebp - 0x170], edi
mov dword [ebp - 0x16c], edi
mov dword [ebp - 0x168], edi
mov dword [ebp - 0x164], edi
mov dword [ebp - 0x160], edi
mov dword [ebp - 0x15c], eax
call fcn.003ed246
test al, al
je 0x441062
mov eax, dword [ebp - 0x170]
cmp eax, dword [esi]
jne 0x441062
mov eax, dword [ebp - 0x16c]
cmp eax, dword [esi + 4]
jne 0x441062
mov eax, dword [ebp - 0x168]
cmp eax, dword [esi + 8]
jne 0x441062
mov eax, dword [ebp - 0x160]
cmp eax, dword [esi + 0x10]
je 0x441175
push dword [esi + 0x14]
lea eax, [ebp - 0x24]
push 0x3dfda4
push 0x10
push eax
call fcn.003ed6f4
add esp, 0x10
test eax, eax
js 0x441175
push dword [esi + 0x10]
lea eax, [ebp - 0x44]
push 0x3d77e4
push 0x10
push eax
call fcn.003ed6f4
add esp, 0x10
test eax, eax
js 0x441175
push edi
push 0x2710
push dword [esi + 8]
push dword [esi + 4]
call fcn.0040d000
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x150]
mov dword [ebp - 0x14c], edx
push eax
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_FileTimeToSystemTime]
test eax, eax
je 0x441175
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x180]
push eax
push edi
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_SystemTimeToTzSpecificLocalTime]
test eax, eax
je 0x441175
push 0x80
lea eax, [ebp - 0x148]
push eax
push edi
lea eax, [ebp - 0x168]
push eax
push edi
push 0x800
call dword [sym.imp.api_ms_win_core_datetime_l1_1_0.dll_GetTimeFormatW]
test eax, eax
jle 0x441175
lea eax, [ebp - 0x24]
mov dword [ebp - 0x158], 0x3d7044
mov dword [ebp - 0x154], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x148]
push 0x3d6bfc
push edi
mov dword [ebp - 0x14c], eax
call dword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x441175
push edi
lea eax, [ebp - 0x158]
push eax
push edi
push 4
push edi
push 0x800003f7
push 1
push 2
push esi
call dword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_ReportEventW]
push esi
call dword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040b590
leave
ret
Function at 0x441af1
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x470cb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x68
push 0
push ebx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x230], edi
call fcn.0040cfd6
add esp, 0xc
test edi, edi
je 0x441b3d
xor eax, eax
mov word [edi], ax
lea ecx, [ebp - 0x218]
call fcn.00441db4
mov esi, eax
test esi, esi
js 0x441c59
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetLogicalDrives]
mov di, word [ebp - 0x218]
mov edx, eax
xor eax, eax
mov dword [ebp - 0x224], ebx
mov ebx, dword [ebp - 0x228]
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x220], eax
cmp eax, 0x1a
jae 0x441c39
mov ecx, dword [ebp - 0x220]
xor eax, eax
inc eax
shl eax, cl
test edx, eax
je 0x441c1d
lea eax, [ecx + 0x41]
mov dword [ebp - 0xc], 0x3a0020
movzx eax, ax
mov dword [ebp - 0x228], eax
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 0x5c
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
cmp eax, 3
jne 0x441c17
push ecx
mov ecx, dword [ebp - 0x228]
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x22c]
mov dx, di
call fcn.00441e1d
mov esi, eax
test esi, esi
js 0x441c17
mov edx, ebx
lea ecx, [ebp - 0x214]
call fcn.00441a00
mov esi, eax
cmp esi, 1
jne 0x441bfe
xor esi, esi
jmp 0x441c17
test esi, esi
js 0x441c17
push dword [ebp - 0x224]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHCORE.dll_SHStrDupW]
mov esi, eax
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x220]
add dword [ebp - 0x224], 4
inc eax
mov dword [ebp - 0x220], eax
test esi, esi
jns 0x441b7b
mov edi, dword [ebp - 0x230]
mov ebx, dword [ebp - 0x234]
test esi, esi
js 0x441c59
test edi, edi
je 0x441c6e
mov ax, word [ebp - 0x218]
mov word [edi], ax
jmp 0x441c6e
xor edi, edi
push dword [ebx + edi*4]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
and dword [ebx + edi*4], 0
inc edi
cmp edi, 0x1a
jb 0x441c5b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b590
leave
ret 8

Function at 0x441db4
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x470cb8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.0040cfd6
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x24
push esi
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x441e0d
push dword [ebp - 0x20c]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
mov word [edi], ax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0040b590
leave
ret
Function at 0x441e1d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x470cb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ecx
mov esi, edx
xor edi, edi
call dword [sym.imp.msvcrt.dll_towupper]
movzx eax, ax
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
cmp cx, ax
jne 0x441e6e
push dword [ebp + 8]
mov edx, 0x104
mov ecx, ebx
call fcn.003f2867
jmp 0x441ef1
push 0x104
lea eax, [ebp - 0x214]
mov dword [ebp - 0xc], 0x3a0020
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0x5c
push eax
mov word [ebp - 0xc], cx
call dword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x441eb3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x441eb1
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x441ef3
lea eax, [ebp - 0x214]
push 0x7b
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x441ecf
mov edi, 0x8000ffff
test edi, edi
js 0x441ef3
push dword [ebp + 8]
mov edx, 0x104
mov ecx, ebx
call fcn.003f2867
mov edi, eax
test edi, edi
js 0x441ef3
push ecx
push esi
mov ecx, ebx
call fcn.00441f06
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b590
leave
ret 0xc
Function at 0x444927
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d440
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x36b4
call fcn.00417ce0
mov eax, dword [0x470cb8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [ebp + 0x10]
mov esi, 0xdac
and dword [ebp - 4], 0
mov edx, esi
mov eax, dword [ebp + 0xc]
push dword [ecx]
lea ecx, [ebp - 0x36c4]
push eax
call fcn.0042dd9f
test eax, eax
js 0x444a20
lea eax, [ebp - 0x36c4]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
push 0x3e1b50
lea eax, [ebp - 0x1b6c]
push esi
push eax
call fcn.003ed6f4
add esp, 0x14
test eax, eax
js 0x4449c3
cmp byte [0x471379], 0
je 0x4449c3
lea eax, [ebp - 0x1b6c]
push eax
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
lea eax, [ebp - 0x1b6c]
push eax
call fcn.00444ebe
cmp byte [0x471378], 0
jne 0x4449dd
call fcn.0040a79a
cmp byte [0x471379], 0
jne 0x444a01
push 0x3d7f50
push dword [0x4705c4]
push dword [0x4705c0]
call dword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventEnabled]
test al, al
je 0x444a20
test byte [0x472942], 0x20
je 0x444a20
lea eax, [ebp - 0x36c4]
mov edx, 0x3d7f50
push eax
mov ecx, 0x4705c0
call fcn.004365e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040b590
leave
ret 0xc

Function at 0x44d476
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x470cb8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x4c], 0x44
push eax
push 0
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
test eax, eax
jne 0x44d4c7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x44d4be
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x44d4eb
mov eax, 0x80004005
jmp 0x44d4eb
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
test eax, eax
je 0x44d4aa
mov eax, dword [ebp - 0x50]
neg eax
sbb eax, eax
and eax, 0x7ff8fffb
add eax, 0x80070005
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040b590
leave
ret 8
Function at 0x44eef4
Capabilities:
Reference sql statements

Disassembly:
push 0x200
mov eax, 0x41e302
call fcn.0040bccd
mov ebx, edx
mov edx, ecx
push 0x65
pop ecx
mov esi, 0x3e24d8
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x1d8]
mov dword [ebp - 0x1e0], eax
rep movsd dword es:[edi], dword [esi]
push 0xb
pop ecx
mov esi, 0x3e24a4
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
mov dword [ebp - 0x204], edi
mov dword [ebp - 0x200], edi
mov dword [ebp - 0x1fc], edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x44]
cmp edx, 1
je 0x44ef53
mov eax, 0x3d7044
push edx
push eax
lea eax, [ebp - 0x1d8]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0044e757
mov esi, eax
add esp, 0x10
test esi, esi
js 0x44f06a
mov dword [ebp - 0x1dc], edi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1dc]
push dword [ebp - 0x204]
call fcn.0044e864
sub esp, 0x18
mov dword [ebp - 0x1f8], edi
mov eax, esp
mov dword [ebp - 0x1f4], edi
mov dword [ebp - 0x1e8], edi
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e4], edi
lea edx, [ebp - 0x1e8]
mov dword [ebp - 0x1ec], eax
mov dword [eax], 0x3d2b3c
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x1dc]
mov dword [eax + 8], edx
mov dword [eax + 0x10], eax
lea eax, [ebp - 0x20c]
push eax
mov byte [ebp - 4], 3
call fcn.0044e3b5
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x1f0]
push dword [ebp - 0x1e8]
push dword [ebp - 0x1f4]
push dword [ebp - 0x1f8]
call fcn.0044ea49
mov ecx, dword [ebp + 4]
test eax, eax
jns 0x44f01e
push eax
push 0x3e2290
mov edx, pe_nt_image_headers32
call fcn.0040f81b
mov ecx, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1f0]
mov dword [ebx], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x1dc]
call fcn.003ee3c6
jmp 0x44f06a
lea ecx, [ebp - 0x204]
call fcn.0042e3cb
mov eax, esi
call fcn.0040bc1f
ret 4

Function at 0x44f07f
Capabilities:
Reference sql statements

Disassembly:
push 0x1c8
mov eax, 0x41e356
call fcn.0040bccd
mov ebx, edx
mov edx, ecx
push 0x5d
pop ecx
mov esi, 0x3e22e8
lea edi, [ebp - 0x1b8]
rep movsd dword es:[edi], dword [esi]
push 0xb
pop ecx
mov esi, 0x3e24a4
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
mov dword [ebp - 0x1cc], esi
mov dword [ebp - 0x1c8], esi
mov dword [ebp - 0x1c4], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x44]
cmp edx, 1
je 0x44f0d5
mov eax, 0x3d7044
push edx
push eax
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.0044e757
add esp, 0x10
test eax, eax
js 0x44f16a
mov dword [ebp - 0x1bc], esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1bc]
push dword [ebp - 0x1cc]
call fcn.0044e864
sub esp, 0x18
mov dword [ebp - 0x1d4], esi
mov eax, esp
mov dword [ebp - 0x1d0], esi
mov dword [ebp - 0x1c0], eax
mov dword [eax], 0x3d2b58
lea ecx, [ebp - 0x1bc]
mov dword [eax + 4], ebx
mov dword [eax + 0x10], eax
lea eax, [ebp - 0x1d4]
push eax
mov byte [ebp - 4], 3
call fcn.0044e3b5
lea ecx, [ebp - 0x1bc]
call fcn.003ee3c6
jmp 0x44f16a
lea ecx, [ebp - 0x1cc]
call fcn.0042e3cb
call fcn.0040bc1f
ret