joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58d250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1808
push 0x591288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x58d329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x58d329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.005901d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x58d329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x58d329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x58d32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0058d351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58dd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x58dd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x58dd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x58dd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x58dd94
push eax
push esi
call fcn.0059020b
add esp, 8
pop esi
ret 0x10

Function at 0x58dda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x58de22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x58de15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x5a6320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0058fdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x58ddda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x58de30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x58dec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x58deb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x5a6320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0058fdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x58deab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x58de6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x58e000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x58e131
push esi
call fcn.00591145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00580080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x58e131
push 0
push ebp
call fcn.005803a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00580260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x58e08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.005802f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x58e121
push 0x5a6918
push edi
call fcn.0058f3f0
push eax
push ebx
push esi
call fcn.0058df60
push 0x5a68f8
push edi
call fcn.0058f3f0
push eax
push ebx
push esi
call fcn.0058df60
push 0x5a68d8
push edi
call fcn.0058f3f0
push eax
push ebx
push esi
call fcn.0058df60
push 0x5a68c0
push edi
call fcn.0058f3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0058df60
push 0x5a68a0
push edi
call fcn.0058f3f0
push eax
push ebx
push esi
call fcn.0058df60
push 0x5a6888
push edi
call fcn.0058f3f0
push eax
push ebx
push esi
call fcn.0058df60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x58f1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0058f140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0058f140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0058f140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0058f140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x58fbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x58fc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x5a187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x58fc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x58fc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4011d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
bswap esi
rcr edx, 0xea
mov edx, 0x4c
bswap esi
neg eax
bswap edi
bswap ebx
imul edi
neg edx
neg ebx
bswap esi
neg edi
inc eax
ror edi, 0xeb
and eax, 0x8e
dec esi
mov eax, 0x6b
sub esi, 0x39
or edi, 0x65
or esi, 0xfa
or esi, 0x27
rol edx, 0xea
and ebx, 0x1a
or esi, 0x5e
rcl esi, 0xdc
neg eax
imul edi
mov edi, 0x22
bswap esi
rcl eax, 0xc4
and esi, 0xde
inc esi
sbb esi, 0xd7
mov eax, 0x94
sub eax, 0x64
rcl eax, 0xb1
ror edi, 0x19
neg edi
add edi, 8
and eax, 0x3e
or ebx, 0x7d
not edx
neg edi
imul ebx
mov eax, 0x82
bswap edi
dec eax
inc eax
sbb edx, 0x7e
bswap edx
xor ecx, ecx
xor edi, edi
and eax, 0x55
rcr edx, 0x43
or ebx, 0xdb
not ebx
sbb edx, 0xfd
add edx, 0x87
sub ebx, 0xed
not edx
rol esi, 0x92
not esi
bswap edi
not edx
rol ebx, 0xc7
neg ebx
not ebx
bswap ebx
ror esi, 0xff
not edx
sbb ebx, 0x2d
inc ebx
rcr eax, 0xc1
neg edx
inc eax
and edx, 0xbd
ror edx, 0x21
neg edi
or eax, 0xb5
dec edi
sub edi, 0x65
not edx
rcl eax, 0x4d
ror esi, 0x1f
neg ebx
add eax, 0x77
mov ebx, 0x77
not ebx
inc eax
sbb edi, 0x30
rol esi, 0x50
dec edi
rcl eax, 0x1c
or eax, 0xc
inc edi
ror esi, 0x88
rcr ebx, 0xa3
dec eax
ror esi, 0xe6
rcl edi, 0xc7
imul ebx
dec eax
mov ecx, dword [ebp + 0xc]
or eax, 0x4b
mov ebx, 0x80
imul ebx
neg edi
neg ebx
sbb esi, 3
mov ebx, 0xc1
imul edi
ror edx, 0xf2
or esi, 0x62
mov edx, 0x6e
bswap ebx
imul eax
inc edi
dec edi
imul esi
neg esi
add eax, 0x1b
not edi
sub edi, 0x42
not ebx
rcl edi, 0x51
inc eax
neg edi
sbb edi, 0xe4
rcr edi, 0x79
neg esi
bswap esi
sbb eax, 0x49
neg edx
or esi, 0x5d
mov esi, 0x43
rcr edi, 0xd7
inc edi
or edx, 0x84
not eax
add eax, 0x6f
rol edi, 0xf3
sub edi, 0xc2
dec eax
rol ebx, 0xb7
bswap edi
sbb edx, 0x8a
inc esi
bswap eax
dec edx
add edx, 0xf1
neg ebx
not edi
neg ebx
mov edi, dword [ebp + 8]
xor eax, ebx
mov esi, eax
xor ebx, eax
not byte [edi]
xor ebx, eax
xor ebx, ebx
mov esi, ebx
sub byte [edi], 0x88
xor ebx, esi
xor esi, esi
mov ebx, eax
add byte [edi], 0x49
mov esi, esi
mov ebx, ebx
xor esi, eax
imul byte [edi]
inc edi
loop 0x401389
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404f08
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f05c]
jne 0x404f12
repz ret
jmp fcn.00406c05
Function at 0x408443
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404f89
and dword [ebp - 4], 0
cmp dword [0x41064c], 0
mov ebx, eax
jne 0x4084f4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4085a5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4085a5
push eax
call fcn.00404f17
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41064c], eax
call esi
push eax
call fcn.00404f17
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x410650], eax
call esi
push eax
call fcn.00404f17
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x410654], eax
call esi
push eax
call fcn.00404f17
pop ecx
mov dword [0x41065c], eax
test eax, eax
je 0x4084f4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404f17
pop ecx
mov dword [0x410658], eax
mov eax, dword [0x410658]
cmp eax, ebx
je 0x40854c
cmp dword [0x41065c], ebx
je 0x40854c
push eax
call fcn.00404f92
push dword [0x41065c]
mov esi, eax
call fcn.00404f92
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40854c
test edi, edi
je 0x40854c
call esi
test eax, eax
je 0x408543
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408543
test byte [ebp - 0xc], 1
jne 0x40854c
or dword [ebp + 0x10], 0x200000
jmp 0x408585
mov eax, dword [0x410650]
cmp eax, ebx
je 0x408585
push eax
call fcn.00404f92
pop ecx
test eax, eax
je 0x408585
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408585
mov eax, dword [0x410654]
cmp eax, ebx
je 0x408585
push eax
call fcn.00404f92
pop ecx
test eax, eax
je 0x408585
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41064c]
call fcn.00404f92
pop ecx
test eax, eax
je 0x4085a5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4085a7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x101476b9
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.10147738
jae 0x101476c5
xor ecx, ecx
call fcn.10147738
jae 0x101476ef
xor eax, eax
call fcn.10147738
jae 0x10147700
mov al, 0x10
call fcn.10147738
adc al, al
jae 0x101476e1
jne 0x1014772d
stosb byte es:[edi], al
jmp 0x101476c6
call fcn.10147744
dec ecx
loop 0x1014770c
mov eax, ebp
call fcn.10147742
jmp 0x1014772e
lodsb al, byte [esi]
shr eax, 1
je 0x10147754
adc ecx, 2
mov ebp, eax
jmp 0x1014772e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.10147742
cmp eax, 0x7d00
jae 0x1014772c
cmp eax, 0x500
jae 0x1014772d
cmp eax, 0x7f
ja 0x1014772e
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x101476c6
pop ebp
ret 8
Function at 0x401060
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, 1
cmp ebp, esi
push edi
mov byte [0x40c6f0], 0
mov byte [0x40c81c], 0
mov dword [0x40c818], 0
jle 0x4010ff
mov edi, dword [esp + 0x14]
mov edi, edi
mov eax, dword [edi + esi*4]
mov cl, byte [eax]
cmp cl, 0x2d
je 0x4010b2
cmp cl, 0x2f
je 0x4010b2
mov edx, 0x40c81c
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4010a6
jmp 0x4010fa
mov cl, byte [eax + 1]
cmp cl, 0x3f
je 0x401167
cmp cl, 0x64
je 0x4010e1
cmp cl, 0x76
jne 0x4010fa
push str.Loginsid.exe_ver_07_28_98_n
call fcn.00402525
add esp, 4
mov dword [0x40c818], 1
jmp 0x4010fa
add eax, 2
mov edx, 0x40c6f0
sub edx, eax
jmp 0x4010f0
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4010f0
inc esi
cmp esi, ebp
jl 0x401090
push 0x40a29c
push 0x40c7f4
call fcn.00402504
mov al, byte [0x40c81c]
add esp, 8
test al, al
je 0x4011af
push 0x40a294
push 0x40c7f4
call fcn.00402504
add esp, 8
push 0x10
push 0x40c7f8
push 0xffffffffffffffff
push 0x40c81c
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x40c81c]
mov byte [eax + 0x40c6c0], cl
inc eax
test cl, cl
jne 0x401150
pop edi
pop esi
xor eax, eax
pop ebp
ret
push str.Usage:_n_n
call fcn.00402525
push str.loginsid__machine_name____d_output_directory_____v__n_n
call fcn.00402525
push str.Machine_name_defaults_to_local._n
call fcn.00402525
push str.No_space_between__d_and__output_directory_._Defaults_to_current._n
call fcn.00402525
push str.Output_file_name_is_always_logininfo.sid._n
call fcn.00402525
push str._v:_verbose_output_to_console__no_output_file_generated._n
call fcn.00402525
add esp, 0x18
pop edi
pop esi
mov eax, 1
pop ebp
ret
lea eax, [esp + 0x10]
push eax
push 0x40c6c0
mov dword [esp + 0x18], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
pop edi
pop esi
xor eax, eax
pop ebp
ret
Function at 0x4011e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
xor eax, eax
push esi
mov esi, dword [esp + 0x10]
mov dword [0x40c6d0], eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x40c6d4], eax
xor ecx, ecx
mov word [0x40c830], cx
mov dword [0x40c6d8], eax
mov dword [0x40c6dc], eax
lea edx, [esp + 0xc]
push edx
push 0x40c6d0
mov dword [0x40c6e0], eax
push ecx
mov dword [0x40c6e4], eax
push ecx
mov dword [0x40c6e8], eax
push str.DefaultDomain
mov word [0x40c6ec], ax
push esi
mov byte [0x40c6ee], al
mov byte [0x40c832], cl
mov dword [esp + 0x24], 0x1f
call edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push str.Map_
push esi
mov dword [esp + 0x24], 2
call edi
test eax, eax
jne 0x401276
mov dl, byte [esp + 8]
mov byte [0x40c830], dl
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0x40a2c4
push esi
mov dword [esp + 0x24], 2
call edi
test eax, eax
jne 0x4012a2
mov dl, byte [esp + 8]
mov byte [0x40c831], dl
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push str.Map
push esi
mov dword [esp + 0x24], 2
call edi
test eax, eax
pop edi
pop esi
jne 0x4012cf
mov dl, byte [esp]
mov byte [0x40c832], dl
add esp, 8
ret
Function at 0x401bd0
Capabilities:
List user accounts for group
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
mov eax, dword [0x40c2c0]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x78]
mov dword [esp + 0x6c], eax
xor ebx, ebx
mov eax, edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401bf3
sub eax, edx
lea esi, [eax + eax]
lea eax, [esi + 2]
push eax
call fcn.00402952
add esp, 4
push esi
mov ebp, eax
push ebp
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x401c20
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0x400
lea ecx, [esp + 0x20]
push ecx
push 1
push ebp
push 0x40c7f4
call sub.NETAPI32.dll_NetLocalGroupGetMembers
mov esi, dword [esp + 0x10]
mov ebx, eax
mov eax, dword [esp + 0x14]
xor edi, edi
test eax, eax
jbe 0x401d12
lea ebx, [ebx]
mov eax, 0x1e
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x54]
push ecx
mov ecx, dword [esi]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x3c]
push eax
push ecx
push 0x40c81c
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
je 0x401cff
mov eax, dword [0x40c818]
test eax, eax
je 0x401cb8
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x50]
push eax
push str.LOCAL_GROUP_MEMBER:__s_s_n
call fcn.00402525
add esp, 0xc
lea ecx, [esp + 0x2c]
push str.NONE
push ecx
call fcn.00409853
add esp, 8
test eax, eax
je 0x401cff
mov eax, dword [esp + 0x1c]
cmp eax, 1
jne 0x401ce8
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x50]
push eax
call fcn.00401700
jmp 0x401cfc
cmp eax, 2
jne 0x401cff
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.004017b0
add esp, 8
mov ecx, dword [esp + 0x14]
inc edi
movzx eax, di
add esi, 0xc
cmp eax, ecx
jb 0x401c60
mov ecx, dword [esp + 0x10]
push ecx
call sub.NETAPI32.dll_NetApiBufferFree
cmp ebx, 0xea
mov dword [esp + 0x10], 0
je 0x401c20
test ebp, ebp
je 0x401d4b
push ebp
call fcn.00402899
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x401d4b
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
pop ebx
call fcn.0040273a
add esp, 0x60
ret
Function at 0x4038fe
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x40c8a0], esi
push edi
jne 0x40391e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x40c89c], esi
mov byte [0x40c898], al
jne 0x403984
mov ecx, dword [0x40cde8]
test ecx, ecx
je 0x403965
mov eax, dword [0x40cde4]
sub eax, 4
cmp eax, ecx
jmp 0x40395e
mov eax, dword [eax]
test eax, eax
je 0x403950
call eax
mov eax, dword [0x40cde4]
sub eax, 4
cmp eax, dword [0x40cde8]
mov dword [0x40cde4], eax
jae 0x403948
mov eax, 0x40c020
mov esi, 0x40c028
cmp eax, esi
mov edi, eax
jae 0x403984
mov eax, dword [edi]
test eax, eax
je 0x40397d
call eax
add edi, 4
cmp edi, esi
jb 0x403975
mov eax, 0x40c02c
mov esi, 0x40c030
cmp eax, esi
mov edi, eax
jae 0x4039a3
mov eax, dword [edi]
test eax, eax
je 0x40399c
call eax
add edi, 4
cmp edi, esi
jb 0x403994
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x4039bd
push dword [ebp + 8]
mov dword [0x40c8a0], 1
call fcn.0040381a
pop ebp
ret

Function at 0x405c35
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x40c2c0]
mov ecx, dword [ebp + 0x98]
push ebx
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x40c2f0]
je 0x405c6a
inc eax
cmp eax, 0x13
jb 0x405c5b
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x40c2f0]
jne 0x405d8d
mov eax, dword [0x40c848]
cmp eax, 1
je 0x405d68
cmp eax, edx
jne 0x405c9a
cmp dword [0x40c2d4], 1
je 0x405d68
cmp ecx, 0xfc
je 0x405d8d
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405cd0
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.00406ea0
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.004064c0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x405d04
mov eax, edi
push eax
call fcn.004064c0
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x40a508
push edi
call fcn.00406fa0
add esp, 0x10
push edi
call fcn.004064c0
push dword [esi + 0x40c2f4]
mov ebx, eax
call fcn.004064c0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00402820
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00406ea0
push edi
push ebx
call fcn.00406eb0
push 0x40a504
push ebx
call fcn.00406eb0
push dword [esi + 0x40c2f4]
push ebx
call fcn.00406eb0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00406da1
add esp, 0x2c
jmp 0x405d8d
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x40c2f4]
push dword [esi]
call fcn.004064c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x8c]
call fcn.0040273a
pop edi
pop esi
pop ebx
add ebp, 0x90
leave
ret
Function at 0x40670b
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov ecx, dword [ebp + 0x3ac]
cmp ecx, dword [0x40ccc8]
mov eax, dword [0x40c2c0]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x78], edi
jae 0x4068ab
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x40cce0]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x4068ab
and dword [ebp - 0x70], 0
and dword [ebp - 0x7c], 0
cmp dword [ebp + 0x3b4], 0
jne 0x40677f
xor eax, eax
jmp 0x4068bf
test al, 0x20
je 0x406792
push 2
push 0
push 0
push ecx
call fcn.00408390
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x406827
and dword [ebp - 0x68], 0
cmp dword [ebp + 0x3b4], 0
mov dword [ebp - 0x6c], edi
jbe 0x406888
mov ecx, dword [ebp - 0x6c]
xor edi, edi
sub ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x4067ec
mov edx, dword [ebp - 0x6c]
inc dword [ebp - 0x6c]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4067dd
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x4067bf
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x74]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40684c
mov eax, dword [ebp - 0x74]
add dword [ebp - 0x70], eax
cmp eax, edi
jl 0x406855
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x78]
cmp eax, dword [ebp + 0x3b4]
jb 0x4067b4
jmp 0x406855
push 0
lea ecx, [ebp - 0x74]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40684c
mov eax, dword [ebp - 0x74]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x70], eax
jmp 0x406855
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x70]
test eax, eax
jne 0x4068a6
cmp dword [ebp - 0x68], eax
je 0x406885
push 5
pop eax
cmp dword [ebp - 0x68], eax
jne 0x40687a
mov dword [0x40c854], 9
mov dword [0x40c858], eax
jmp 0x4068bc
push dword [ebp - 0x68]
call fcn.004078e2
pop ecx
jmp 0x4068bc
mov edi, dword [ebp - 0x78]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x40689a
cmp byte [edi], 0x1a
je 0x406778
mov dword [0x40c854], 0x1c
jmp 0x4068b5
sub eax, dword [ebp - 0x7c]
jmp 0x4068bf
mov dword [0x40c854], 9
and dword [0x40c858], 0
or eax, 0xffffffff
mov ecx, dword [ebp + 0x3a0]
pop edi
pop esi
pop ebx
call fcn.0040273a
add ebp, 0x3a4
leave
ret