joyce8/EMBER2024-capa huggingface dataset:
Function at 0x939250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x94d808
push 0x93d288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x939329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x939329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0093c1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x939329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x939329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x93932c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00939351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x939d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x939d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x939d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x939d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x939d94
push eax
push esi
call fcn.0093c20b
add esp, 8
pop esi
ret 0x10

Function at 0x939da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x939e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x939e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x952320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0093bdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x939dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x939e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x939ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x939eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x952320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0093bdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x939eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x939e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x93a000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x93a131
push esi
call fcn.0093d145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0092c080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x93a131
push 0
push ebp
call fcn.0092c3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0092c260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x93a08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0092c2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x93a121
push 0x952918
push edi
call fcn.0093b3f0
push eax
push ebx
push esi
call fcn.00939f60
push 0x9528f8
push edi
call fcn.0093b3f0
push eax
push ebx
push esi
call fcn.00939f60
push 0x9528d8
push edi
call fcn.0093b3f0
push eax
push ebx
push esi
call fcn.00939f60
push 0x9528c0
push edi
call fcn.0093b3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00939f60
push 0x9528a0
push edi
call fcn.0093b3f0
push eax
push ebx
push esi
call fcn.00939f60
push 0x952888
push edi
call fcn.0093b3f0
push eax
push ebx
push esi
call fcn.00939f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x93b1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0093b140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0093b140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0093b140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0093b140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x93bbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x93bc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x94d87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x93bc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x93bc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x3000726e
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 8], eax
call fcn.300123fe
mov edi, eax
test edi, edi
jl 0x3000731c
push ebx
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call fcn.300123fe
mov edi, eax
test edi, edi
jne 0x30007316
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
xor ebx, ebx
inc ebx
mov edi, dword [ebp - 4]
mov ax, word [edi]
cmp ax, 0x2f
je 0x300072d5
cmp ax, 0x2d
jne 0x30007339
add edi, 2
push edi
push 0x3000199c
call esi
test eax, eax
jne 0x300072e9
mov eax, dword [ebp + 0x10]
jmp 0x300072f8
push edi
push 0x3000197c
call esi
test eax, eax
jne 0x30007331
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call fcn.300123fe
mov edi, eax
test edi, edi
je 0x300072c3
test edi, edi
jl 0x3000731a
xor edi, edi
pop esi
pop ebx
cmp dword [ebp - 4], 0
je 0x3000732a
push dword [ebp - 4]
call fcn.30011460
mov eax, edi
pop edi
leave
ret 0x10
push edi
push 0x30001958
call esi
mov edi, 0x80070057
jmp 0x3000731a
Function at 0x3000b28d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
cmp dword [edi + 0x44], esi
mov dword [ebp - 8], esi
je 0x3000b2aa
xor ebx, ebx
inc ebx
jmp 0x3000b490
cmp dword [ebp + 8], esi
jne 0x3000b2f8
mov eax, dword [edi + 0xc]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push eax
call dword [ecx + 0x40]
mov ebx, eax
cmp ebx, esi
jl 0x3000b490
lea eax, [ebp + 8]
push eax
push 2
push esi
push dword [edi + 0x14]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jle 0x3000b2e7
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp ebx, esi
jl 0x3000b490
mov dword [ebp - 8], 1
mov eax, dword [edi + 0x48]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x30002134
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000b325
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000b481
mov eax, dword [edi + 0x50]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x30002120
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000b357
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000b481
push 4
lea eax, [edi + 0x74]
push eax
push 4
push 0
push 0x30002100
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000b383
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000b481
push 4
lea eax, [edi + 0x70]
push eax
push 4
push 0
push 0x300020e0
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000b3af
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000b481
push 4
lea eax, [edi + 0x6c]
push eax
push 4
push 0
push 0x300021ac
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000b3db
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000b481
push 4
lea eax, [edi + 0x5c]
push eax
push 4
push 0
push 0x30002194
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000b407
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000b481
push 4
lea eax, [edi + 0x60]
push eax
push 4
push 0
push 0x30002178
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000b42f
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000b481
push 4
lea eax, [edi + 0x64]
push eax
push 4
push 0
push 0x30002160
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000b457
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000b481
push 4
add edi, 0x68
push edi
push 4
push 0
push 0x30002140
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000b47f
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x3000b490
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x3000e6e2
Capabilities:
Clear file content

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x250]
push edi
xor ebx, ebx
xor edi, edi
cmp eax, 0xffffffff
jne 0x3000e6fc
inc edi
jmp 0x3000e7d6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x250], 0xffffffff
cmp dword [esp + 0x10], ebx
je 0x3000e7d6
cmp dword [esi + 0x14], ebx
jne 0x3000e7d6
push ebp
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x250], eax
jne 0x3000e75c
call ebp
mov edi, eax
cmp edi, ebx
jle 0x3000e75a
and edi, 0xffff
or edi, 0x80070000
cmp edi, ebx
jl 0x3000e7d5
mov ecx, dword [esi + 0x244]
mov eax, dword [esi + 0x240]
push ebx
push ebx
push ecx
push eax
push dword [esi + 0x250]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x3000e794
call ebp
mov edi, eax
cmp edi, ebx
jle 0x3000e792
and edi, 0xffff
or edi, 0x80070000
cmp edi, ebx
jl 0x3000e7d5
push dword [esi + 0x250]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x3000e7bc
call ebp
mov edi, eax
cmp edi, ebx
jle 0x3000e7ba
and edi, 0xffff
or edi, 0x80070000
cmp edi, ebx
jl 0x3000e7d5
mov edx, dword [esi + 0x244]
mov ecx, dword [esi + 0x240]
mov eax, dword [esi + 0x20]
mov ebx, dword [eax]
push edx
push ecx
push edx
push ecx
push eax
call dword [ebx + 0x50]
pop ebp
mov eax, dword [esi + 0x250]
cmp eax, 0xffffffff
je 0x3000e7ef
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x250], 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x3000f193
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov ebx, 0x80070000
jne 0x3000f1dd
call edi
mov esi, eax
test esi, esi
jle 0x3000f1d7
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3000f26c
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x3000f1f6
mov esi, 0x8007000e
jmp 0x3000f25d
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x3000f21d
call edi
mov esi, eax
test esi, esi
jle 0x3000f21b
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3000f25d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x30001910
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x3000f24a
call edi
mov esi, eax
test esi, esi
jle 0x3000f248
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3000f25d
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
cmp dword [ebp - 4], 0
je 0x3000f26c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x3000f34b
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x3000f3ea
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 5
jne 0x3000f3d9
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x3000f384
mov esi, 0x80070005
jmp 0x3000f3e9
test al, 0x10
je 0x3000f38f
mov esi, 0x8000ffff
jmp 0x3000f3e9
test al, 7
je 0x3000f3e9
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
mov ebp, 0xffff
mov ebx, 0x80070000
jne 0x3000f3bd
call edi
mov esi, eax
test esi, esi
jle 0x3000f3bb
and esi, ebp
or esi, ebx
test esi, esi
jl 0x3000f3e9
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x3000f3e9
call edi
mov esi, eax
test esi, esi
jle 0x3000f3e9
and esi, ebp
or esi, ebx
jmp 0x3000f3e9
test eax, eax
jle 0x3000f3e7
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x3000f3f2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.30011273
mov edi, eax
cmp edi, ebx
jl 0x3000f4fc
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 4], 0xffffffff
jne 0x3000f4c1
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp + 8]
push dword [ebp - 0xc]
push 0x300025e4
push eax
call fcn.30011a22
mov edi, eax
add esp, 0x18
cmp edi, ebx
jl 0x3000f4fc
push ebx
push 0x80
push 1
push ebx
push 1
push 0x40000000
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x3000f4b1
call esi
test eax, eax
jg 0x3000f491
call esi
mov edi, eax
jmp 0x3000f4a1
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
cmp edi, 0x80070050
jne 0x3000f4ad
xor edi, edi
jmp 0x3000f4b1
cmp edi, ebx
jl 0x3000f4fc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x3e8
jl 0x3000f433
cmp dword [ebp + 0x10], ebx
je 0x3000f4d9
push 0xfde9
push ebx
push dword [ebp - 8]
push dword [ebp + 0x10]
call fcn.30011391
mov edi, eax
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x3000f4e5
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
cmp edi, ebx
jl 0x3000f4ed
cmp eax, ebx
jne 0x3000f4fc
cmp dword [ebp - 4], 0xffffffff
je 0x3000f4fc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x3000f509
push dword [ebp - 8]
call fcn.30011460
cmp dword [ebp - 0xc], ebx
je 0x3000f516
push dword [ebp - 0xc]
call fcn.30011460
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x3000f51f
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x30015078]
and dword [ebp - 0x78], 0
or dword [ebp - 0x7c], 0xffffffff
push ebx
push esi
mov dword [ebp + 0x194], eax
push edi
lea eax, [ebp - 0x74]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x80070000
jne 0x3000f57b
call edi
mov esi, eax
test esi, esi
jle 0x3000f573
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3000f651
jmp 0x3000f581
mov esi, dword [ebp + 0x1a4]
and dword [ebp - 0x80], 0
cmp dword [ebp - 0x7c], 0xffffffff
jne 0x3000f618
push dword [ebp + 0x1a4]
lea eax, [ebp - 0x74]
push dword [ebp - 0x80]
push dword [ebp + 0x1a0]
push eax
lea eax, [ebp - 0x78]
push 0x300025f0
push eax
call fcn.30011a0f
mov esi, eax
add esp, 0x18
test esi, esi
jl 0x3000f651
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x7c], eax
jne 0x3000f608
call edi
test eax, eax
jg 0x3000f5ec
call edi
mov esi, eax
jmp 0x3000f5f8
call edi
mov esi, eax
and esi, 0xffff
or esi, ebx
cmp esi, 0x80070050
jne 0x3000f604
xor esi, esi
jmp 0x3000f608
test esi, esi
jl 0x3000f651
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], 0x3e8
jl 0x3000f585
mov ecx, dword [ebp + 0x1ac]
test ecx, ecx
je 0x3000f627
mov eax, dword [ebp - 0x7c]
mov dword [ecx], eax
mov eax, dword [ebp + 0x1a8]
test eax, eax
je 0x3000f63a
mov edx, dword [ebp - 0x78]
and dword [ebp - 0x78], 0
mov dword [eax], edx
test esi, esi
jl 0x3000f642
test ecx, ecx
jne 0x3000f651
cmp dword [ebp - 0x7c], 0xffffffff
je 0x3000f651
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x78], 0
je 0x3000f65f
push dword [ebp - 0x78]
call fcn.30011460
mov ecx, dword [ebp + 0x194]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.30012b55
add ebp, 0x198
leave
ret 0x10
Function at 0x3000f70e
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 8], 0
push ebx
push esi
push edi
push 0x44
pop edi
push 1
push edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], 0xff
call fcn.30012d1b
test eax, eax
mov dword [ebp - 4], eax
mov ebx, 0x80070000
jne 0x3000f758
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x3000f752
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3000f845
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call fcn.3001121a
mov esi, eax
test esi, esi
jl 0x3000f845
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x3000f838
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7a
jne 0x3000f827
cmp dword [ebp - 0x10], edi
jbe 0x3000f7d4
push 1
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.30012d3b
mov edi, eax
test edi, edi
jne 0x3000f7d1
call esi
mov esi, eax
test esi, esi
jle 0x3000f7cf
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3000f845
mov dword [ebp - 4], edi
cmp dword [ebp - 0xc], 0xff
jbe 0x3000f7ef
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call fcn.3001121a
mov esi, eax
test esi, esi
jl 0x3000f845
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x3000f838
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x3000f836
and esi, 0xffff
or esi, ebx
jmp 0x3000f834
test eax, eax
jle 0x3000f832
and eax, 0xffff
or eax, ebx
mov esi, eax
test esi, esi
jl 0x3000f845
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], ecx
mov dword [ebp - 4], esi
cmp dword [ebp - 8], 0
je 0x3000f853
push dword [ebp - 8]
call fcn.30011460
cmp dword [ebp - 4], 0
je 0x3000f861
push dword [ebp - 4]
call fcn.30012d5f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x3000f944
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
push ebx
xor edx, edx
cmp ecx, edx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, 0x80070000
je 0x3000f978
lea eax, [ebp - 4]
push eax
push ecx
push edx
call fcn.3000f70e
mov esi, eax
jmp 0x3000f9b6
lea ecx, [ebp - 4]
push ecx
push dword [eax + 0x30]
mov cl, byte [eax + 0x12]
push dword [eax + 0x2c]
add eax, 0xc
push dword [eax + 0x1c]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x3000f9ba
call edi
mov esi, eax
test esi, esi
jle 0x3000f9b8
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3000f9eb
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call sub.ADVAPI32.dll_CheckTokenMembership
test eax, eax
jne 0x3000f9e1
call edi
mov esi, eax
test esi, esi
jle 0x3000f9df
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3000f9eb
xor eax, eax
cmp dword [ebp - 8], eax
sete al
mov esi, eax
cmp dword [ebp - 4], 0
je 0x3000f9fa
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x300102b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor ecx, ecx
or eax, 0xffffffff
cmp dword [0x30015600], ecx
push edi
mov esi, 0xff
jne 0x300102f3
mov dword [0x30015600], 1
push 8
mov edx, ecx
pop edi
test dl, 1
je 0x300102e2
shr edx, 1
xor edx, 0xedb88320
jmp 0x300102e4
shr edx, 1
dec edi
jne 0x300102d3
mov dword [ecx*4 + 0x30015200], edx
inc ecx
cmp ecx, esi
jle 0x300102ce
mov ecx, dword [esp + 0x10]
test ecx, ecx
jbe 0x30010313
mov edi, dword [esp + 0xc]
mov dl, byte [edi]
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x30015200]
inc edi
dec ecx
jne 0x300102ff
pop edi
not eax
pop esi
ret 8