joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ca10
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, 0x80000
je 0x1001ca24
mov byte [ecx + 0x208], 1
mov dword [ebp + 8], eax
pop ebp
jmp fcn.1001d5d0

Function at 0x1001d5d0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x90], 0
je 0x1001d5f3
mov eax, 0x232d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp + 8]
mov dword [edi + 0x78], ebx
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
test bl, 0x20
je 0x1001d711
mov esi, dword [edi + 8]
mov dword [edi + 0x1c8], 0xffffffff
mov dword [edi + 0x1cc], 0xffffffff
test esi, esi
je 0x1001d674
mov ecx, dword [esi]
test ecx, ecx
je 0x1001d674
lea edx, [esi + 8]
add edx, dword [esi + 4]
cmp ecx, 0xf
je 0x1001d64c
mov ecx, dword [edx]
mov esi, edx
test ecx, ecx
jne 0x1001d637
jmp 0x1001d674
mov ecx, edx
test edx, edx
je 0x1001d669
cmp dword [edx], 0
je 0x1001d664
mov eax, dword [ecx + 4]
add ecx, 8
add ecx, eax
cmp dword [ecx], 0
jne 0x1001d657
sub ecx, edx
add ecx, 8
push ecx
push edx
push esi
call fcn.100c0760
add esp, 0xc
mov esi, dword [edi + 8]
test esi, esi
je 0x1001d6be
mov ecx, dword [esi]
test ecx, ecx
je 0x1001d6be
lea edx, [esi + 8]
add edx, dword [esi + 4]
cmp ecx, 0x29
je 0x1001d696
mov ecx, dword [edx]
mov esi, edx
test ecx, ecx
jne 0x1001d681
jmp 0x1001d6be
mov ecx, edx
test edx, edx
je 0x1001d6b3
cmp dword [edx], 0
je 0x1001d6ae
mov eax, dword [ecx + 4]
add ecx, 8
add ecx, eax
cmp dword [ecx], 0
jne 0x1001d6a1
sub ecx, edx
add ecx, 8
push ecx
push edx
push esi
call fcn.100c0760
add esp, 0xc
test ebx, 0x40000
je 0x1001d6e5
lea ecx, [edi + 0x98]
call fcn.10001a50
mov dword [edi + 0x1c8], 0
mov dword [edi + 0x1cc], 0
test ebx, 0x2000000
je 0x1001d711
lea ecx, [edi + 0xf8]
mov edx, 0x10100b60
call fcn.10007ef0
mov dword [edi + 0x1c8], 0
mov dword [edi + 0x1cc], 0
mov ecx, dword [edi + 0x1e8]
mov eax, ecx
mov edx, dword [edi + 0x1ec]
and eax, edx
mov dword [edi + 0x90], 1
cmp eax, 0xffffffff
je 0x1001d764
cmp dword [edi + 0x28], 0
mov dword [edi + 0x88], ecx
mov dword [edi + 0x8c], edx
jne 0x1001d750
test edx, edx
jg 0x1001d750
jl 0x1001d74d
cmp ecx, dword [edi + 0x24]
jae 0x1001d750
mov dword [edi + 0x24], ecx
mov dword [edi + 0x1e8], 0xffffffff
mov dword [edi + 0x1ec], 0xffffffff
test bl, bl
jns 0x1001d79d
mov eax, dword [edi]
push 0
push 0
push 0
mov esi, dword [eax + 0x1c]
mov ecx, esi
push 0
call dword [0x100f5330]
mov ecx, edi
call esi
test eax, eax
je 0x1001d79d
mov dword [edi + 0x90], 0
mov eax, 0x232a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10021530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
test eax, eax
je 0x100215f1
movzx ecx, ax
mov edx, 5
call fcn.10052960
movzx ecx, word [edi + 0x10]
mov ebx, eax
push 5
push ecx
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x100215f1
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
call fcn.100c3c54
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100215f1
push esi
push dword [ebp - 4]
push ebx
call fcn.100c0760
add esp, 0xc
cmp dword [edi + 0x18], 0
jne 0x100215b5
mov eax, dword [0x10121fa8]
test eax, eax
je 0x100215af
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
mov dword [edi + 0x18], eax
mov ecx, dword [edi]
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 0xc]
push eax
mov esi, dword [ecx + 0x40]
mov ecx, esi
call dword [0x100f5330]
mov ecx, edi
call esi
push edi
push ecx
push dword [edi + 0x18]
mov ecx, dword [ebp - 8]
mov edx, ebx
call fcn.100221a0
push ebx
mov esi, eax
call fcn.100c3c60
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029b20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x1011d1c0]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
lea eax, [esp + 8]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x10029b8f
cmp eax, 0x104
ja 0x10029b8f
lea edx, [esp + 8]
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10029b60
sub edx, ecx
lea eax, [esp + 8]
sar edx, 1
mov ecx, esi
push edx
push eax
call fcn.10023c00
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.100be435
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 7
jbe 0x10029b9e
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov eax, dword [0x1011de3c]
cmp eax, 0x1011de3c
je 0x10029bd3
test byte [eax + 0x1c], 0x10
je 0x10029bd3
cmp byte [eax + 0x19], 2
jb 0x10029bd3
push dword [eax + 0x14]
mov edx, 0x10102b98
mov ecx, 0x26
push dword [eax + 0x10]
call fcn.10022c70
add esp, 8
mov ecx, dword [esp + 0x214]
pop esi
xor ecx, esp
call fcn.100be435
mov esp, ebp
pop ebp
ret

Function at 0x1002a4d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e6030
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1011d1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.FileIStream.0
mov dword [ebp - 4], 0
mov ecx, dword [0x1011de3c]
cmp ecx, 0x1011de3c
je 0x1002a542
test byte [ecx + 0x1c], 0x10
je 0x1002a542
cmp byte [ecx + 0x19], 0xb
jb 0x1002a542
push dword [edi + 4]
mov eax, edi
cdq
push edx
push eax
push dword [ecx + 0x14]
mov edx, 0x10102ba8
push dword [ecx + 0x10]
mov ecx, 0xb
call fcn.1002a380
add esp, 0x14
lea eax, [edi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea esi, [edi + 0x40]
mov ebx, 5
mov eax, dword [esi]
mov dword [esi - 4], 0
test eax, eax
je 0x1002a56e
push eax
call dword [0x1011d08c]
mov dword [esi], 0
add esi, 8
sub ebx, 1
jne 0x1002a554
cmp dword [edi + 0x1c], ebx
je 0x1002a5a9
cmp byte [edi + 9], bl
je 0x1002a592
cmp dword [edi + 0x20], 7
lea eax, [edi + 0xc]
jbe 0x1002a58b
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [edi + 0xc]
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 7
jbe 0x1002a5a4
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], 0xffffffff
lea esi, [edi + 0xc]
mov eax, dword [esi + 0x14]
cmp eax, 7
jbe 0x1002a5c7
push eax
push dword [esi]
push esi
call fcn.10016690
add esp, 0xc
xor eax, eax
mov dword [esi + 0x10], 0
test byte [ebp + 8], 1
mov dword [esi + 0x14], 7
mov word [esi], ax
je 0x1002a5eb
push 0x64
push edi
call fcn.100be473
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1002a9c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.1002a6d0
test eax, eax
jne 0x1002aa16
mov eax, dword [0x1011de3c]
cmp eax, 0x1011de3c
je 0x1002aa09
test byte [eax + 0x1c], 0x10
je 0x1002aa09
cmp byte [eax + 0x19], 2
jb 0x1002aa09
push dword [eax + 0x14]
mov edx, 0x10102ba8
mov ecx, 0xf
push dword [eax + 0x10]
call fcn.10022c70
add esp, 8
mov eax, 0x8000ffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0
lea ecx, [esp + 0x10]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002aa99
mov esi, dword [esp + 0xc]
cmp esi, 0xffffffff
je 0x1002aa99
test esi, esi
je 0x1002aa99
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1002aa44
mov dword [eax], esi
cmp byte [edi + 8], 0
je 0x1002aa8f
test esi, esi
je 0x1002aa8f
mov ecx, dword [ebp + 0xc]
mov edx, esi
lfence
call fcn.1000df50
cmp esi, eax
je 0x1002aa8f
mov eax, dword [0x1011de3c]
cmp eax, 0x1011de3c
je 0x1002aa8f
test byte [eax + 0x1c], 0x10
je 0x1002aa8f
cmp byte [eax + 0x19], 2
jb 0x1002aa8f
push dword [eax + 0x14]
mov edx, 0x10102ba8
mov ecx, 0x10
push dword [eax + 0x10]
call fcn.10022c70
add esp, 8
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1002aaa6
mov dword [eax], 0
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002b040
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x5c
push esi
push 0x48
lea eax, [esp + 0x14]
push 0
push eax
call fcn.100c0600
mov esi, dword [ebp + 0xc]
add esp, 0xc
movups xmm0, xmmword [esp + 0x10]
mov ecx, dword [ebp + 8]
movups xmmword [esi], xmm0
movups xmm0, xmmword [esp + 0x20]
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [esp + 0x40]
movups xmmword [esi + 0x30], xmm0
movq xmm0, qword [esp + 0x50]
movq qword [esi + 0x40], xmm0
call fcn.1002a6d0
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov dword [esp + 8], ecx
cmp ecx, 0xffffffff
jne 0x1002b0cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1002b0c9
or ecx, 0xffffffff
or eax, ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 8], ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1002b9f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e627f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1011d1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.100bd8f1
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x1002baa1
push eax
push esi
call fcn.100bdbd2
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.100bd377
int3
Function at 0x1002ca40
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e67d9
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x10
push esi
push edi
mov eax, dword [0x1011d1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov eax, dword [ebx + 8]
mov dword [edi], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebx + 0x14]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x18]
mov dword [edi + 0xc], eax
mov al, byte [ebx + 0x1c]
mov byte [edi + 0x10], al
mov eax, dword [ebx + 0x20]
mov dword [edi + 0x14], eax
xor eax, eax
push 0x1002ce30
push 0x1003a560
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
push 2
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov byte [edi + 0x30], al
lea eax, [edi + 0x34]
push 8
push eax
call fcn.100beabb
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [edi + 0x44], 0
xor eax, eax
movups xmmword [edi + 0x48], xmm0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 7
mov word [edi + 0x48], ax
mov byte [ebp - 4], 1
lea ecx, [edi + 0x60]
mov dword [ebp - 0x18], ecx
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 7
mov word [ecx], ax
mov byte [ebp - 4], 2
mov byte [ecx + 0x18], al
call fcn.10029b20
mov byte [ebp - 4], 3
mov dword [edi + 0x7c], 0
mov byte [ebp - 4], 4
xorps xmm0, xmm0
movups xmmword [edi + 0x80], xmm0
xor eax, eax
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 7
mov word [edi + 0x80], ax
mov byte [ebp - 4], 5
mov dword [edi + 0x98], eax
mov byte [ebp - 4], 6
lea esi, [edi + 0xa0]
mov word [edi + 0x9c], ax
lea ecx, [esi + 0x10]
mov dword [ebp - 0x1c], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call fcn.10025680
mov byte [ebp - 4], 7
mov dword [esi + 0x70], 0
mov byte [ebp - 4], 8
xor eax, eax
mov word [edi + 0x118], ax
xorps xmm0, xmm0
mov dword [edi + 0x120], eax
mov dword [edi + 0x124], eax
mov byte [edi + 0x128], al
mov dword [edi + 0x12c], eax
mov dword [edi + 0x130], eax
mov dword [edi + 0x134], eax
mov dword [edi + 0x138], eax
mov dword [edi + 0x13c], eax
mov dword [edi + 0x140], eax
mov dword [edi + 0x144], eax
mov dword [edi + 0x148], eax
mov eax, dword [ebx + 0x10]
movups xmmword [edi + 0x14c], xmm0
movq qword [edi + 0x15c], xmm0
mov dword [edi + 0x1c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x1c
Function at 0x1003d150
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e8229
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x1011d1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x18], eax
cmp dword [eax + 4], 0x2222222
je 0x1003d2df
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
push 0x78
mov dword [ebp - 0x28], 0
call fcn.100be486
mov ecx, dword [ebp + 0x18]
add esp, 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
lea edx, [eax + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edx
mov edi, dword [ecx]
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x14], edi
mov esi, dword [ecx]
mov dword [edx], 0
mov dword [edx + 4], eax
mov byte [edx + 8], 0
call dword [0x1011d03c]
mov ecx, dword [ebp - 0x10]
xorps xmm0, xmm0
mov dword [ecx + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x1c], edx
movups xmmword [ecx + 0x20], xmm0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx + 0x20], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x30], xmm0
mov byte [ebp - 4], 1
xor edx, edx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], dx
mov dword [ecx + 0x3c], esi
lea esi, [ecx + 0x44]
mov dword [ecx + 0x38], edi
mov byte [ecx + 0x40], dl
mov dword [ebp - 0x20], esi
push 0x48
mov dword [esi], edx
mov dword [esi + 4], edx
call fcn.100be486
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 3
xorps xmm0, xmm0
mov edi, dword [ebp - 0x10]
xor eax, eax
movups xmmword [edi + 0x4c], xmm0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 7
mov word [edi + 0x4c], ax
mov byte [ebp - 4], 4
lea esi, [edi + 0x64]
mov dword [ebp - 0x24], esi
push 8
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call fcn.100be486
add esp, 8
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
mov dword [ebp - 4], 7
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], 0
inc dword [eax + 4]
mov eax, dword [ecx + 4]
mov dword [edi], ecx
mov dword [edi + 4], eax
mov dword [ecx + 4], edi
mov dword [eax], edi
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
push 0x10102da8
call fcn.100bd337
int3
Function at 0x10046370
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e97fd
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x1011d1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
push 0x4c
mov dword [ebp - 0x10], 0
call fcn.100be486
mov edx, eax
add esp, 4
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movq qword [edx], xmm0
lea eax, [edx + 0xc]
mov dword [edx + 8], 0
mov dword [edx + 4], 1
mov dword [edx + 8], 1
mov dword [edx], vtable.std::_Ref_count_obj2_struct_MailPluginsUserCfg::Cfg_.0
movups xmm0, xmmword [esi]
movups xmmword [eax], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [esi + 0x30]
movups xmmword [eax + 0x30], xmm0
mov byte [ebp - 4], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov dword [edi], eax
mov dword [edi + 4], edx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10047060
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e9896
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1011d1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x18]
movzx eax, byte [esi]
mov byte [edi], al
movzx eax, byte [esi + 1]
mov byte [edi + 1], al
movzx eax, byte [esi + 2]
mov byte [edi + 2], al
movzx eax, byte [esi + 3]
mov byte [edi + 3], al
movzx eax, byte [esi + 4]
mov byte [edi + 4], al
movzx eax, byte [esi + 5]
mov byte [edi + 5], al
movzx eax, byte [esi + 6]
mov byte [edi + 6], al
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
movzx eax, byte [esi + 0x10]
mov byte [edi + 0x10], al
movzx eax, byte [esi + 0x11]
mov byte [edi + 0x11], al
movzx eax, byte [esi + 0x12]
mov byte [edi + 0x12], al
movzx eax, byte [esi + 0x13]
mov byte [edi + 0x13], al
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [esi + 0x18]
push eax
call fcn.1001ec10
mov dword [ebp - 4], 0
lea ecx, [edi + 0x34]
movzx eax, byte [esi + 0x30]
mov byte [edi + 0x30], al
lea eax, [esi + 0x34]
push eax
call fcn.1001ec10
mov byte [ebp - 4], 1
lea ecx, [edi + 0x50]
movzx eax, byte [esi + 0x4c]
mov byte [edi + 0x4c], al
movzx eax, byte [esi + 0x4d]
mov byte [edi + 0x4d], al
lea eax, [esi + 0x50]
push eax
call fcn.1001ec10
mov byte [ebp - 4], 2
movzx eax, byte [esi + 0x68]
mov byte [edi + 0x68], al
movzx eax, byte [esi + 0x69]
mov byte [edi + 0x69], al
movzx eax, byte [esi + 0x6a]
mov byte [edi + 0x6a], al
movzx eax, byte [esi + 0x6b]
mov byte [edi + 0x6b], al
movzx eax, byte [esi + 0x6c]
mov byte [edi + 0x6c], al
movzx eax, byte [esi + 0x6d]
mov byte [edi + 0x6d], al
movzx eax, byte [esi + 0x6e]
mov byte [edi + 0x6e], al
movzx eax, byte [esi + 0x6f]
mov byte [edi + 0x6f], al
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
movzx eax, byte [esi + 0x74]
mov byte [edi + 0x74], al
mov eax, dword [esi + 0x78]
mov dword [edi + 0x78], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1004e550
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x1011d1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
mov edx, 0x104
push ecx
lea ecx, [ebp - 0x210]
call fcn.1004fef0
add esp, 4
lea ecx, [ebp - 0x210]
mov edx, 0x104
push str.eeclnt.exe
call fcn.10053a50
add esp, 4
mov dword [ebp - 0x248], 0
xorps xmm0, xmm0
mov dword [ebp - 0x250], 0x3c
lea eax, [ebp - 0x210]
movlpd qword [ebp - 0x23c], xmm0
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x250]
push eax
movlpd qword [ebp - 0x234], xmm0
movlpd qword [ebp - 0x22c], xmm0
movlpd qword [ebp - 0x224], xmm0
movlpd qword [ebp - 0x21c], xmm0
mov dword [ebp - 0x24c], 0x440
mov dword [ebp - 0x244], str.runas
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1004e694
mov edi, dword [ebx + 4]
test edi, edi
je 0x1004e688
mov eax, dword [edi]
push 0
push 0
mov esi, dword [eax + 0x14]
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call dword [0x100f5330]
mov ecx, edi
call esi
mov esi, eax
cmp esi, 4
je 0x1004e643
cmp esi, 1
jne 0x1004e65b
push 0x3e8
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1004e608
push dword [ebp - 0x218]
call dword [0x1011d08c]
test esi, esi
je 0x1004e675
cmp esi, 3
je 0x1004e675
cmp esi, 0xc
jne 0x1004e694
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100be435
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x218]
call dword [0x1011d08c]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100be435
mov esp, ebp
pop ebp
ret
Function at 0x1004e6b0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1011d1c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10122624]
mov dword [ebp - 0x2c], edx
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
test eax, eax
jne 0x1004e82d
call dword [0x1011d134]
test eax, eax
je 0x1004e6ea
mov eax, 1
jmp 0x1004e828
push esi
lea eax, [ebp - 0x14]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1004e822
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
push 4
lea eax, [ebp - 0x28]
mov byte [ebp - 0xd], 0
push eax
push 0x12
push esi
mov dword [ebp - 0xc], 0
mov word [ebp - 8], 0x500
mov dword [ebp - 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1004e819
cmp dword [ebp - 0x24], 4
jb 0x1004e819
cmp dword [ebp - 0x28], 3
jne 0x1004e819
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1004e819
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1004e803
push dword [ebp - 0x18]
call fcn.100c3c54
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1004e800
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push ebx
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1004e7f7
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1004e7f7
xor esi, esi
cmp dword [ebx], esi
jbe 0x1004e7ee
push edi
lea edi, [ebx + 4]
nop
push dword [ebp - 0x1c]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1004e7e9
inc esi
add edi, 8
cmp esi, dword [ebx]
jb 0x1004e7d0
jmp 0x1004e7ed
mov byte [ebp - 0xd], 1
pop edi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push ebx
call fcn.100c3c60
add esp, 4
mov ebx, dword [ebp - 0x20]
push dword [ebp - 0x14]
call dword [0x1011d08c]
cmp byte [ebp - 0xd], 0
je 0x1004e822
mov eax, 3
jmp 0x1004e827
push dword [ebp - 0x14]
call dword [0x1011d08c]
mov eax, 2
pop esi
mov dword [0x10122624], eax
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebx]
test dl, 2
je 0x1004e844
cmp eax, 2
je 0x1004e841
cmp eax, 3
jne 0x1004e844
mov ecx, dword [ebx + 4]
test dl, 4
je 0x1004e851
cmp eax, 2
jne 0x1004e851
mov ecx, dword [ebx + 4]
test dl, 8
je 0x1004e86d
cmp eax, 4
jne 0x1004e86d
mov eax, dword [ebx + 4]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100be435
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100be435
mov esp, ebp
pop ebp
ret