joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f4ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
lea eax, [ebx + 0x134]
push edi
lea esi, [ebx + 0x34]
mov dword [esp + 0x14], eax
xor edi, edi
mov ecx, dword [ebx + 0x1c]
mov ebp, edi
and ebp, 0xff
mov al, byte [ecx + ebp + 1]
test al, 3
je 0x5f4f20
mov byte [edi + esi], 2
jmp 0x5f4f57
test al, 4
je 0x5f4f2a
mov byte [edi + esi], 0xd
jmp 0x5f4f57
mov edx, dword [ebx + 0x240]
push edi
push ebx
call dword [edx + 4]
add esp, 8
cmp eax, 1
jle 0x5f4f43
mov byte [edi + esi], 2
jmp 0x5f4f57
mov eax, dword [ebx + 0x1c]
test byte [eax + ebp + 1], 0x17
jne 0x5f4f53
mov byte [edi + esi], 0x19
jmp 0x5f4f57
mov byte [edi + esi], 1
inc edi
cmp edi, 0x100
jb 0x5f4f07
mov ecx, dword [esp + 0x14]
mov al, 7
mov byte [esi + 0x21], al
mov byte [esi + 0x3d], al
mov byte [esi + 0x3e], al
mov al, 0x10
mov byte [esi + 0x7c], al
mov byte [esi + 0x26], al
mov byte [esi + 0x24], 2
mov byte [esi + 0x5f], 2
mov byte [esi + 0x27], 9
mov byte [esi + 0x2e], 0xf
mov byte [esi + 0x3c], 8
mov byte [esi + 0x23], 0xa
mov byte [esi + 0x3b], 0x15
mov byte [esi + 0x3a], 0x16
mov byte [esi], 0x11
mov byte [esi + 0x5c], 0x12
mov byte [esi + 0x2f], 0x13
mov byte [esi + 0x2a], 0x14
mov byte [esi + 0x40], 0x17
mov byte [esi + 0x60], 0x1a
mov byte [esi + 0x22], 0x20
mov eax, esi
sub ecx, esi
mov edi, 0x100
mov dl, byte [eax]
cmp dl, 2
je 0x5f4fcb
cmp dl, 0xd
je 0x5f4fcb
xor edx, edx
jmp 0x5f4fd0
mov edx, 1
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x5f4fbb
mov al, 0x1d
mov byte [esi + 0x58], al
mov byte [esi + 0x78], al
mov al, 0x1f
pop edi
mov byte [esi + 0x62], 0x1e
mov byte [esi + 0x4e], al
mov byte [esi + 0x6e], al
pop esi
pop ebp
pop ebx
ret

Function at 0x5f4ff0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push 0x4000
call fcn.005f38b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x5f5011
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x10]
push ebx
push 0
push eax
call fcn.005f6650
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x5f5036
push esi
call fcn.005f3940
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
push ebp
push 0x4000
push esi
push edi
call fcn.005e908b
push ebx
push edi
mov ebp, eax
call fcn.005f66c0
push 0x5f5070
push ebp
push esi
call fcn.005f79f0
push esi
call fcn.005f3940
add esp, 0x24
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x5f6380
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x10e23a0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10e22c8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x5f63fb
push 0x4c
push 1
call fcn.005ded05
mov esi, eax
add esp, 8
test esi, esi
jne 0x5f63c3
push 0x10e23a0
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x10e22c8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x10d4c64]
inc eax
lea edx, [esi + 0xc]
mov dword [0x10d4c64], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.005f9eb0
add esp, 8
mov byte [esi + 0x3c], 1
push 0x10e23a0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret

Function at 0x5f6880
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.005de8dd
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.005e908b
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x5f697a
call fcn.005de8dd
cmp dword [eax], 0
je 0x5f68c7
call fcn.005de8dd
mov ebp, dword [eax]
jmp 0x5f68ca
or ebp, 0xffffffff
call fcn.005f6410
test esi, esi
mov dword [eax], ebp
jne 0x5f68df
call fcn.005de8dd
cmp dword [eax], 4
je 0x5f692f
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x5f6912
cmp esi, 0xffffffff
je 0x5f6954
test al, 6
je 0x5f6912
call fcn.005f6410
mov ecx, dword [eax]
push ecx
push ebx
call fcn.005f9ee0
add esp, 4
push eax
push 0x24
push 9
call fcn.005f6c60
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x5f6972
test al, 6
je 0x5f6920
test ah, 2
je 0x5f6972
test esi, esi
jbe 0x5f697e
test ah, 2
je 0x5f697e
add dword [esp + 0x18], esi
sub edi, esi
call fcn.005de8dd
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.005e908b
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x5f697a
jmp 0x5f68b4
call fcn.005f6410
mov eax, dword [eax]
push eax
push ebx
call fcn.005f9ee0
add esp, 4
push eax
push 0x24
push 2
call fcn.005f6c60
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x5f698b
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x5f6994
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x61d440
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x63b750
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.00612378
mov eax, dword [0xf5f208]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.006122aa
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.0061df70
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x61d4e7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x61d4de
cmp al, 0xff
je 0x61d4de
dec al
mov byte [ecx], al
jmp 0x61d4e7
push ecx
call fcn.006278bd
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x61d518
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x61d50f
cmp al, 0xff
je 0x61d50f
dec al
mov byte [ecx], al
jmp 0x61d518
push ecx
call fcn.006278bd
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x629f33
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x629f6b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00627fae
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00627f86
jmp 0x629f77
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x62b6fd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x62b73f
call fcn.00631c2b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x62b73f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x62b736
xor eax, eax
jmp 0x62b747
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0062b74d
pop edi
pop esi
pop ebx
ret 4

Function at 0x63215b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x632189
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x6321a7
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.006320c1
jmp 0x6321a7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x6321a7
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.006320c1
test edi, edi
mov eax, edi
jne 0x632191
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x405f30
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x405f7c
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esp + 8]
mov edx, dword [esi + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x405f65
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
pop esi
ret 4
mov ecx, dword [esi + 4]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 4], 0
pop esi
ret 4
mov edx, dword [esi + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
pop esi
ret 4

Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
push esi
push eax
mov eax, esp
mov esi, section..data
push eax
push 0x40
push 0x288
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
mov ecx, 0x3e8
call fcn.0040103f
mov ecx, 0x3e9
call fcn.0040103f
xor eax, eax
inc eax
add esp, 4
pop esi
ret

Function at 0x40103f
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x804
lea ebx, [esp + 4]
mov esi, ecx
push ebx
call pe_dos_header
add esp, 4
mov edi, eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
push ebx
push esi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x401132
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 0x14
lea ebx, [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x401127
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
sub esp, 0x20
xor ebp, ebp
mov dword [esp], eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 4], ebp
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x401127
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
sub esp, 0x20
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 4], ebp
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push ebp
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 4
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x401146
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadString_failed_with__d_n
call pe_dos_header
add esp, 8
add esp, 0x804
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4057f1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x38fffffc], esp
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00404883
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00404838
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00404873
and ch, dh
invalid
Function at 0x401aad
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, 0x103
push edi
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.0040c63d
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.00405302
add esp, 0x14
cmp byte [ebp - 0x103], 0x3a
je 0x401aef
cmp byte [ebp - 0x103], 0x5c
jne 0x401b4e
cmp byte [ebp - 0x104], 0
je 0x401b19
lea eax, [ebp - 0x104]
push eax
call fcn.00413210
cmp byte [ebp + eax - 0x105], 0x5c
lea eax, [ebp + eax - 0x105]
pop ecx
jne 0x401b19
and byte [eax], 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, eax
xor eax, 0x20
push eax
lea eax, [ebp - 0x104]
push eax
call esi
test eax, eax
je 0x401b4e
lea eax, [ebp - 0x104]
push edi
push eax
call esi
push 1
pop eax
jmp 0x401b50
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x403e1f
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x420b78]
test eax, eax
jne 0x403ea5
push esi
push edi
push str.shell32.dll
call fcn.0040c877
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [esp], str.SHGetSpecialFolderLocation
push edi
call esi
push str.SHGetPathFromIDListA
push edi
mov dword [0x420b48], eax
call esi
cmp dword [0x423800], 0
mov dword [0x420b54], eax
je 0x403e6e
push str.SHGetPathFromIDListW
push edi
call esi
mov dword [0x420b58], eax
push str.SHBrowseForFolderA
push edi
call esi
cmp dword [0x423800], 0
mov dword [0x420b4c], eax
je 0x403e96
push str.SHBrowseForFolderW
push edi
call esi
mov dword [0x420b50], eax
mov eax, dword [0x420b4c]
neg eax
sbb eax, eax
pop edi
and eax, 2
pop esi
dec eax
mov dword [0x420b78], eax
xor ecx, ecx
cmp eax, 1
sete cl
mov eax, ecx
ret
Function at 0x403eb0
Capabilities:
Get user security identifier
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
push edi
xor edi, edi
push str.Advapi32.dll
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
call fcn.0040c877
cmp eax, edi
pop ecx
je 0x403ee5
push str.ConvertSidToStringSidW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x420b7c], eax
cmp dword [0x420b7c], edi
jne 0x403ef4
xor eax, eax
jmp 0x404031
lea eax, [ebp - 0x24]
push esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push edi
push eax
push edi
push dword [ebp + 8]
push edi
call esi
cmp dword [ebp - 4], edi
je 0x40402d
push ebx
push dword [ebp - 4]
call fcn.00413c32
mov ebx, eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
call fcn.00413c32
pop ecx
mov dword [ebp - 0x1c], eax
pop ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push edi
call esi
test eax, eax
je 0x40401c
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [0x420b7c]
test eax, eax
je 0x40401c
push 0x1fe
lea eax, [ebp - 0x62c]
push dword [ebp - 0x14]
push eax
call fcn.0040c67c
lea eax, [ebp - 0x62c]
push eax
call fcn.004091c9
push 0x1ff
lea eax, [ebp - 0x62c]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push eax
call fcn.0040c719
add esp, 0x1c
cmp dword [ebp + 0xc], edi
mov dword [ebp + 8], 0x41c690
jne 0x403fae
mov dword [ebp + 8], str.Programs
lea eax, [ebp - 0xc]
push eax
push 0x20019
lea eax, [ebp - 0x62c]
push edi
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40401c
push 1
lea eax, [ebp - 0x20]
pop esi
mov dword [ebp - 0x20], 0x207
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 8]
mov dword [ebp - 0x18], esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404013
push dword [ebp + 0x14]
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 0x10]
call fcn.0040c67c
add esp, 0xc
mov dword [ebp - 0x10], esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.00413bc9
push dword [ebp - 0x1c]
call fcn.00413bc9
pop ecx
pop ecx
pop ebx
mov eax, dword [ebp - 0x10]
pop esi
pop edi
leave
ret
Function at 0x404433
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x75c
push ebx
push esi
mov esi, 0x102
lea eax, [ebp - 0x75c]
push esi
push 0x423b40
push eax
call fcn.0040c7b3
lea eax, [ebp - 0x75c]
push eax
call fcn.004091c9
xor ebx, ebx
lea eax, [ebp - 0x248]
push ebx
push 0x101
push dword [ebp + 0xc]
push eax
call fcn.00404099
add esp, 0x20
test eax, eax
je 0x40463b
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.00405507
lea eax, [ebp - 0x248]
push eax
call fcn.004091c9
push esi
lea eax, [ebp - 0x248]
push dword [ebp + 8]
push eax
call fcn.0040c74e
add esp, 0x18
lea eax, [ebp - 0x248]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4044e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4044e0
push dword [0x420b04]
lea eax, [ebp - 0x248]
push eax
call fcn.0040b3f4
pop ecx
pop ecx
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.004091c9
lea eax, [ebp - 0x248]
push eax
call fcn.00413733
pop ecx
lea edi, [ebp + eax*2 - 0x248]
pop ecx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov esi, 0x103
inc dword [ebp + 0xc]
lea eax, [ebp - 0x40]
push 0xa
push eax
push dword [ebp + 0xc]
call fcn.00413472
lea eax, [ebp - 0x34c]
push esi
push eax
lea eax, [ebp - 0x40]
push 0x420b98
push eax
push 0x422c00
call fcn.00403881
add esp, 0x20
cmp byte [ebp - 0x34c], bl
je 0x404619
lea eax, [ebp - 0x75c]
push esi
push eax
lea eax, [ebp - 0x554]
push eax
call fcn.0040c67c
lea eax, [ebp - 0x34c]
push esi
push eax
lea eax, [ebp - 0x554]
push eax
call fcn.0040c74e
lea eax, [ebp - 0x554]
push 0x22
push eax
call fcn.00413ce4
add esp, 0x20
cmp eax, ebx
je 0x40460d
mov word [eax], bx
add eax, 6
push esi
push eax
lea eax, [ebp - 0x248]
mov word [edi], bx
push eax
call fcn.0040c719
push esi
lea eax, [ebp - 0x248]
push str..lnk
push eax
call fcn.0040c719
lea eax, [ebp - 0x554]
push eax
call fcn.004092ab
add esp, 0x1c
test eax, eax
je 0x40460d
lea eax, [ebp - 0x554]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x554]
push eax
call fcn.0040adce
add esp, 0xc
test eax, eax
jne 0x404606
push dword [0x420b04]
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x554]
push eax
call fcn.0040b5f5
add esp, 0xc
test eax, eax
je 0x40460d
mov dword [ebp + 8], 1
cmp byte [ebp - 0x34c], bl
jne 0x40450d
cmp dword [ebp + 8], ebx
pop edi
jne 0x40463b
cmp dword [0x420b1c], ebx
jne 0x40463b
push 0x30
push 7
push 0xa
push dword [0x422bf8]
call fcn.0040ab69
add esp, 0x10
pop esi
pop ebx
leave
ret
Function at 0x407244
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
xor ebx, ebx
cmp dword [0x4240b0], ebx
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
je 0x407442
cmp dword [0x422bf4], ebx
jne 0x407442
call fcn.00406e85
test eax, eax
je 0x407442
mov esi, 0x103
lea eax, [ebp - 0x46c]
push esi
push dword [ebp + 8]
push eax
call fcn.0040c7b3
lea eax, [ebp - 0x1c]
mov word [ebp - 0x264], bx
push eax
lea eax, [ebp - 0x264]
push eax
mov dword [ebp - 0x1c], esi
call fcn.0040babf
mov esi, dword [ebp + 0xc]
add esp, 0x14
cmp esi, ebx
je 0x4072c5
cmp word [ebp - 0x264], bx
je 0x407442
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push ebx
push 4
lea eax, [ebp - 0x46c]
push 1
push eax
call dword [0x420b8c]
test eax, eax
jne 0x407442
cmp dword [ebp - 4], ebx
je 0x407442
lea eax, [ebp - 0xc]
push edi
push eax
push ebx
push ebx
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xb
push 1
push 0x41c08c
call edi
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
push 0x41c094
call edi
mov eax, dword [ebp - 4]
mov dword [ebp + 8], ebx
cmp word [eax + 4], bx
jbe 0x407385
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x407376
mov eax, dword [ebp - 0x18]
cmp byte [eax], bl
jne 0x407376
push dword [ebp - 0xc]
lea edi, [eax + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x407368
push dword [ebp - 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x407376
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
jmp 0x407379
inc dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 4]
cmp dword [ebp + 8], ecx
jl 0x407330
push 0x40
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.004140b0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
neg esi
push 1
mov dword [ebp - 0x5c], 0xa0020000
pop edi
mov dword [ebp - 0x48], ebx
push 3
mov dword [ebp - 0x58], edi
pop eax
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x264]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x5c]
push dword [ebp - 4]
mov dword [ebp - 0x3c], 0x1f01ff
sbb esi, esi
mov dword [ebp - 0x28], edi
and esi, 0xfffffffd
push eax
add esi, 4
push 2
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x24], edi
call dword [0x420b84]
test eax, eax
jne 0x40740d
push ebx
lea eax, [ebp - 0x46c]
push dword [ebp - 8]
push ebx
push ebx
push 0x80000004
push edi
push eax
call dword [0x420b88]
cmp dword [ebp - 0x14], ebx
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
je 0x40741e
push dword [ebp - 0x14]
call esi
cmp dword [ebp - 8], ebx
je 0x407428
push dword [ebp - 8]
call esi
cmp dword [ebp - 0x10], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_FreeSid]
je 0x407438
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0xc], ebx
je 0x407442
push dword [ebp - 0xc]
call esi
pop esi
pop ebx
leave
ret