joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0cb0
Capabilities:
Check os version

Disassembly:
cmp dword [0x74aff0], 0
push esi
jne 0x4e0cdb
mov esi, 1
mov dword [0x74aff0], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x4e0cdb
cmp al, 6
jb 0x4e0cdb
mov dword [0x74afec], esi
jmp 0x4e0ce4
cmp dword [0x74afec], 0
je 0x4e0d2e
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
push eax
push ecx
push edx
call fcn.004d8370
add esp, 0x10
push 0x647698
push 0x61bed4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push 0
push 0
push 0
test eax, eax
je 0x4e0d26
call eax
pop esi
ret
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop esi
ret
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push esi
push eax
push ecx
push edx
call edi
push esi
push 0
push 0
push 0
call edi
pop edi
pop esi
ret

Function at 0x4e0d60
Capabilities:
Check os version

Disassembly:
cmp dword [0x74aff0], 0
jne 0x4e0d8d
mov dword [0x74aff0], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x4e0d8d
cmp al, 6
jb 0x4e0d8d
mov dword [0x74afec], 1
jmp 0x4e0d96
cmp dword [0x74afec], 0
je 0x4e0dd1
mov eax, dword [0x74b060]
test eax, eax
jne 0x4e0dbf
push 0x647f8c
push 0x61bed4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x74b060], eax
test eax, eax
je 0x4e0dd1
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
push ecx
call eax
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
ret

Function at 0x4e0df0
Capabilities:
Check os version
Read .ini file

Disassembly:
push esi
push edi
push 1
push 0x410
mov edi, 0x400
call fcn.005e34ab
mov esi, eax
add esp, 8
test esi, esi
je 0x4e0ec4
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x1c]
lea ebx, [ebx]
cmp dword [0x74aff0], 0
jne 0x4e0e4d
mov dword [0x74aff0], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x4e0e4d
cmp al, 6
jb 0x4e0e4d
mov dword [0x74afec], 1
jmp 0x4e0e56
cmp dword [0x74afec], 0
je 0x4e0e8f
push 0x64767c
push 0x61bed4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push edi
push esi
push ebp
test eax, eax
je 0x4e0e83
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
push edx
call eax
jmp 0x4e0ea3
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
jmp 0x4e0e9d
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [edi - 2]
cmp eax, ecx
jb 0x4e0ec0
add edi, edi
push edi
push esi
call fcn.005e25a6
mov esi, eax
add esp, 8
test esi, esi
jne 0x4e0e20
pop ebp
mov eax, esi
pop ebx
pop edi
pop esi
ret
Function at 0x4e0ed0
Capabilities:
Check os version

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x18]
push esi
push 0
push 0
push 0x60c81c
push edi
push ebx
call fcn.004e0df0
mov ebp, eax
add esp, 0x18
test ebp, ebp
je 0x4e0f04
cmp byte [ebp], 0
jne 0x4e0f91
cmp dword [0x74aff0], 0
jne 0x4e0f31
mov dword [0x74aff0], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x4e0f31
cmp al, 6
jb 0x4e0f31
mov dword [0x74afec], 1
jmp 0x4e0f3a
cmp dword [0x74afec], 0
je 0x4e0f78
mov eax, dword [esp + 0x1c]
push esi
push eax
push edi
push ebx
call fcn.004d8370
add esp, 0x10
push 0x647698
push 0x61bed4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push 0
push 0
push 0
test eax, eax
je 0x4e0f70
call eax
jmp 0x4e0f91
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4e0f91
mov ecx, dword [esp + 0x1c]
push esi
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push ebx
call edi
push esi
push 0
push 0
push 0
call edi
test ebp, ebp
je 0x4e0f9e
push ebp
call fcn.005e0865
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4e0fb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x34
push esi
mov esi, dword [esp + 0x3c]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4e105e
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 3
jne 0x4e1053
cmp byte [esi], 0x5c
jne 0x4e0fe1
cmp byte [esi + 1], 0x5c
je 0x4e0ff6
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e0fe6
sub eax, edx
cmp eax, 0x104
jbe 0x4e1053
push 0
push 0xa000000
push 3
push 0
push 3
push 0
push esi
call fcn.004e0400
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x4e1053
push edi
push 0x30
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x18], 0
call fcn.005dfd60
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
pop edi
je 0x4e1053
mov eax, dword [esp + 8]
pop ebx
pop esi
add esp, 0x34
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop ebx
pop esi
add esp, 0x34
ret
Function at 0x4e1070
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x34
push esi
mov esi, dword [esp + 0x3c]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4e112e
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 3
jne 0x4e1123
cmp word [esi], 0x5c
jne 0x4e10a7
cmp word [esi + 2], 0x5c
je 0x4e10c6
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4e10b0
sub eax, edx
sar eax, 1
cmp eax, 0x104
jbe 0x4e1123
push 0
push 0xa000000
push 3
push 0
push 3
push 0
push esi
call fcn.004e0530
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x4e1123
push edi
push 0x30
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x18], 0
call fcn.005dfd60
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
pop edi
je 0x4e1123
mov eax, dword [esp + 8]
pop ebx
pop esi
add esp, 0x34
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop ebx
pop esi
add esp, 0x34
ret

Function at 0x4e1620
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
mov ebx, 1
test edi, edi
je 0x4e1754
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x4e174e
cmp byte [edi], 0
je 0x4e174e
push esi
push 0x647fa0
push edi
call fcn.005e00ad
mov esi, eax
add esp, 8
test esi, esi
jne 0x4e1676
push 0x60cf08
push edi
call fcn.005e00ad
mov esi, eax
add esp, 8
test esi, esi
je 0x4e1747
push 2
push 0
push esi
call fcn.005e0626
push esi
call fcn.005e45b4
add esp, 0x10
test eax, eax
je 0x4e1728
push 2
push 0xffffffffffffffff
push esi
xor edi, edi
call fcn.005e0626
push esi
push 1
lea eax, [esp + 0x28]
push 1
push eax
call fcn.005e057f
add esp, 0x1c
test eax, eax
jne 0x4e16eb
push 2
push 0xfffffffffffffffe
push esi
call fcn.005e0626
add esp, 0xc
test eax, eax
jne 0x4e16e5
push esi
push 1
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.005e057f
add esp, 0x10
cmp byte [esp + 0x14], 0xa
je 0x4e16e5
cmp dword [esp + 0x1c], edi
je 0x4e16e5
mov edi, ebx
push 2
push 0xffffffffffffffff
jmp 0x4e16fe
cmp byte [esp + 0x14], 0xa
je 0x4e16fa
cmp dword [esp + 0x1c], edi
je 0x4e16fa
mov edi, ebx
push 2
push 0
push esi
call fcn.005e0626
add esp, 0xc
test edi, edi
je 0x4e1728
push 0x60cc70
push esi
call fcn.005dfdda
push 0x60cc70
push ebp
call fcn.004dd620
add esp, 0x10
test eax, eax
je 0x4e1737
push ebp
push 0x60c800
push esi
call fcn.005dfdda
add esp, 0xc
push esi
call fcn.005dff6d
add esp, 4
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
ret
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
ret
pop ebp
pop edi
mov eax, ebx
pop ebx
ret
pop edi
mov eax, ebx
pop ebx
ret
Function at 0x4e1ee0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
push eax
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push esi
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, eax
test esi, esi
je 0x4e1f1c
cmp byte [esi], 0
je 0x4e1f1c
push esi
call fcn.004d9060
add esp, 4
mov eax, edi
pop edi
pop esi
ret 0x18

Function at 0x4e1f30
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x408
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x404], eax
push esi
mov esi, dword [esp + 0x410]
push edi
mov edi, dword [esp + 0x418]
push 0x3ff
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call fcn.005dfd60
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 9
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x4e1fa4
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x408
ret
mov eax, dword [esp + 8]
push 0x400
lea edx, [esp + 0x10]
push edx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x40c]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
xor ecx, esp
call fcn.005dfbbe
add esp, 0x408
ret
Function at 0x4e1ff0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x1138
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x1134], eax
push ebp
mov ebp, dword [esp + 0x1144]
push esi
mov esi, dword [esp + 0x1144]
push edi
mov edi, dword [esp + 0x1150]
mov dword [esp + 0x10], esi
test ebp, ebp
je 0x4e2195
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4e2195
push ebx
lea eax, [esp + 0x10]
push eax
push 0x10008
push 0
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
push esi
call ebx
test esi, esi
jne 0x4e214d
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x134]
push edx
push 0
push eax
mov byte [esp + 0x140], 0
mov dword [esp + 0x38], 0x1024
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
cmp esi, 0x103
je 0x4e20c8
test esi, esi
jne 0x4e2127
mov edx, dword [esp + 0x10]
push edi
lea ecx, [esp + 0x124]
push ecx
push edx
call fcn.004e1ff0
add esp, 0xc
mov esi, eax
push esi
call ebx
test esi, esi
je 0x4e2063
jmp 0x4e2127
test edi, edi
je 0x4e20d9
push 0
push ebp
push 0x648100
call edi
add esp, 0xc
mov eax, dword [esp + 0x14]
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push esi
call ebx
test esi, esi
je 0x4e2127
test edi, edi
je 0x4e2127
push 0x103
lea ecx, [esp + 0x21]
push 0
push ecx
call fcn.005dfd60
lea edx, [esp + 0x28]
push 0x103
push edx
mov byte [esp + 0x30], 0
call fcn.004d8c20
lea eax, [esp + 0x30]
push eax
push ebp
push 0x6480cc
call edi
add esp, 0x20
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x1134]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x1138
ret
push esi
call ebx
test edi, edi
je 0x4e2132
push 0x103
lea edx, [esp + 0x21]
push 0
push edx
call fcn.005dfd60
add esp, 0xc
mov byte [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x20]
push 0x103
push eax
call fcn.004d8b50
lea ecx, [esp + 0x28]
push ecx
push ebp
push 0x6480a0
call edi
add esp, 0x18
jmp 0x4e2132
mov ecx, dword [esp + 0x1140]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 0x3f2
call fcn.005dfbbe
add esp, 0x1138
ret
Function at 0x4e2340
Capabilities:
Enumerate services

Disassembly:
sub esp, 0x138
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x134], eax
push ebx
mov ebx, dword [esp + 0x148]
push esi
mov esi, dword [esp + 0x148]
push edi
mov edi, dword [esp + 0x148]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
test eax, eax
je 0x4e2391
mov eax, 1
jmp 0x4e24ba
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0xea
je 0x4e23ca
test ebx, ebx
je 0x4e240e
call ebp
push eax
lea edx, [esp + 0x48]
push 0x100
push edx
call fcn.004d8b50
push eax
push edi
push str.EnumDependentServices_failed:__s___s___n
call ebx
add esp, 0x18
xor eax, eax
jmp 0x4e24b9
mov eax, dword [esp + 0x10]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
mov dword [esp + 0x1c], ebp
test ebp, ebp
jne 0x4e2415
test ebx, ebx
je 0x4e240e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x48]
push 0x100
push ecx
call fcn.004d8b50
push eax
push edi
push str.HeapAlloc_failed:__s___s___n
call ebx
add esp, 0x18
xor eax, eax
jmp 0x4e24b9
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push ecx
push ebp
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
test eax, eax
jne 0x4e2465
test ebx, ebx
je 0x4e2451
lea edx, [esp + 0x44]
push 0x100
push edx
call fcn.004d8c20
push eax
push edi
push str.EnumDependentServices_failed:__s___s___n
call ebx
add esp, 0x14
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x4e24b9
cmp dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
jbe 0x4e24a4
push 1
mov ecx, 9
mov esi, ebp
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x24]
push ebx
push eax
call fcn.00510c30
mov eax, dword [esp + 0x18]
inc eax
add ebp, 0x24
mov dword [esp + 0x18], eax
cmp eax, dword [esp + 0x14]
jb 0x4e2474
mov ebp, dword [esp + 0x1c]
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x140]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x138
ret 0xc
Function at 0x4e25e0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
mov ebx, dword [esp + 0xa8]
push 0x90
lea eax, [esp + 0x14]
push 0
push eax
mov byte [ebx], 0
call fcn.005dfd60
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 6
jb 0x4e26e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 4]
push edx
push 0x18
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4e26e8
mov ecx, dword [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x19
push ecx
call edi
test eax, eax
jne 0x4e26dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4e26dd
mov edx, dword [esp + 0xc]
push esi
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x4e26dc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push ecx
push esi
push 0x19
push edx
call edi
test eax, eax
je 0x4e26d5
mov eax, dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov cl, byte [eax]
mov eax, dword [esi]
dec cl
movzx edx, cl
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov eax, dword [eax]
cmp eax, 0x2000
jae 0x4e26c9
mov byte [ebx], 1
jmp 0x4e26d5
cmp eax, 0x3000
sbb cl, cl
add cl, 3
mov byte [ebx], cl
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
lea edx, [esp + 8]
push edx
call fcn.004dca10
pop edi
mov ecx, dword [esp + 0xa0]
pop ebx
xor ecx, esp
xor eax, eax
call fcn.005dfbbe
add esp, 0xa0
ret

Function at 0x4e2810
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x50
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
mov ebx, dword [esp + 0x58]
push esi
push 0x45
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call fcn.005dfd60
push 0x60cf0c
push ebx
call fcn.005e00ad
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4e28e2
push edi
push 2
push 0xffffffffffffffc2
push esi
call fcn.005e0626
push esi
push 0x3e
lea ecx, [esp + 0x24]
push 1
push ecx
call fcn.005e057f
push esi
mov edi, eax
call fcn.005dff6d
add esp, 0x20
cmp edi, 0x3e
pop edi
jne 0x4e28e2
mov al, 0xad
cmp byte [esp + 0x48], al
jne 0x4e28e2
cmp byte [esp + 0x49], al
jne 0x4e28e2
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push ebx
call fcn.004e0400
mov esi, eax
add esp, 0x1c
mov dword [esp + 8], esi
cmp esi, 0xffffffff
je 0x4e28e2
push 2
push 0
push 0xffffffffffffffc0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea edx, [esp + 8]
push edx
call fcn.004dca10
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x50
ret
mov ecx, dword [esp + 0x54]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.005dfbbe
add esp, 0x50
ret
Function at 0x4e2900
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
mov ebx, dword [esp + 0x54]
push esi
push 0x45
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.005dfd60
push 0x60cf0c
push ebx
call fcn.005e00ad
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4e29c7
push edi
push 2
push 0xffffffffffffffc2
push esi
call fcn.005e0626
push esi
push 0x3e
lea ecx, [esp + 0x20]
push 1
push ecx
call fcn.005e057f
push esi
mov edi, eax
call fcn.005dff6d
add esp, 0x20
cmp edi, 0x3e
pop edi
jne 0x4e29c7
mov al, 0xad
cmp byte [esp + 0x44], al
jne 0x4e29c7
cmp byte [esp + 0x45], al
jne 0x4e29c7
push str.__0fU8QTFFN7ney00Kww8jh3
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [esp + 0xc]
push str.__0fU8QTFFN7ney00Kww8jh3
push edx
call fcn.005e21ae
add esp, 0xc
test eax, eax
jne 0x4e29b0
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x4c
ret
cmp byte [esp + 8], 0x3b
jne 0x4e29c7
cmp dword [esp + 0x5c], 0
je 0x4e299a
push ebx
call fcn.004e2810
add esp, 4
mov ecx, dword [esp + 0x50]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.005dfbbe
add esp, 0x4c
ret

Function at 0x4e2a90
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x98], eax
cmp dword [0x74b068], 0
je 0x4e2ac7
mov eax, dword [0x74b064]
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x9c
ret
cmp dword [0x74aff0], 0
push esi
mov esi, 1
mov dword [0x74b068], esi
jne 0x4e2af8
mov dword [0x74aff0], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x4e2af8
cmp al, 6
jb 0x4e2af8
mov dword [0x74afec], esi
jmp 0x4e2b05
cmp dword [0x74afec], 0
je 0x4e2b91
push 0x90
lea eax, [esp + 0x10]
push 0
push eax
call fcn.005dfd60
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xc], 6
jne 0x4e2b74
cmp dword [esp + 0x10], 0
jne 0x4e2b74
lea edx, [esp + 4]
push 0
push edx
call fcn.004d97f0
add esp, 8
cmp word [esp + 4], si
pop esi
sbb eax, eax
inc eax
mov dword [0x74b064], eax
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x9c
ret
mov eax, esi
mov dword [0x74b064], eax
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x9c
ret
mov ecx, dword [esp + 0x9c]
mov eax, dword [0x74b064]
pop esi
xor ecx, esp
call fcn.005dfbbe
add esp, 0x9c
ret
Function at 0x4e2be0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
xor eax, eax
push 0x60cf0c
push ecx
mov byte [esp + 0x14], 0
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov byte [esp + 0x1d], al
call fcn.005e00ad
mov esi, eax
add esp, 8
test esi, esi
je 0x4e2c72
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
push esi
push edi
lea eax, [esp + 0x18]
push 1
push eax
call fcn.005e057f
push esi
mov ebp, eax
call fcn.005dff6d
add esp, 0x14
cmp ebp, edi
pop ebp
jne 0x4e2c72
push edi
lea ecx, [esp + 0x10]
push ebx
push ecx
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4e2c72
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x10
ret
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.005dfbbe
add esp, 0x10
ret
Function at 0x4e2c90
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x20
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [0x68fed4], 0xffffffff
mov dword [esp + 0xc], 0
jne 0x4e2cd0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x68fed4
call fcn.004d9f10
add esp, 0x2c
cmp dword [0x68fed4], 0
jne 0x4e2ced
mov eax, 1
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x20
ret
call fcn.004e2580
test eax, eax
jne 0x4e2d05
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x20
ret
push esi
lea eax, [esp + 8]
push eax
push 0
push 8
mov byte [esp + 0x24], 0
mov byte [esp + 0x25], 0
mov byte [esp + 0x26], 0
mov byte [esp + 0x27], 0
mov byte [esp + 0x28], 0
mov byte [esp + 0x29], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4e2d77
call esi
cmp eax, 0x3f0
jne 0x4e2d65
lea ecx, [esp + 8]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4e2d77
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x20
ret
mov eax, dword [esp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 2
push eax
call edi
test eax, eax
jne 0x4e2db3
call esi
cmp eax, 0x7a
jne 0x4e2e1a
mov eax, dword [esp + 0x10]
add eax, 0x10
push 1
push eax
call fcn.005e34ab
mov esi, eax
add esp, 8
test esi, esi
jne 0x4e2dd0
lea ecx, [esp + 0xc]
push ecx
call fcn.004dca10
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x20
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
push esi
push 2
push ecx
call edi
test eax, eax
je 0x4e2e11
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x44]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x4e2e37
push esi
call fcn.005e0865
add esp, 4
lea edx, [esp + 0xc]
push edx
call fcn.004dca10
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x20
ret
xor edi, edi
cmp dword [esi], edi
jbe 0x4e2e95
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
push ebp
lea ebp, [esi + 4]
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp]
push eax
push ecx
call ebx
test eax, eax
jne 0x4e2e61
inc edi
add ebp, 8
cmp edi, dword [esi]
jb 0x4e2e48
jmp 0x4e2e93
mov dword [esp + 0x1c], 1
call fcn.004d9b00
test eax, eax
je 0x4e2e93
lea edx, [esp + 0x13]
push edx
mov byte [esp + 0x17], 0
call fcn.004e25e0
add esp, 4
cmp byte [esp + 0x13], 3
je 0x4e2e93
mov dword [esp + 0x1c], 0
pop ebp
pop ebx
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
lea ecx, [esp + 0xc]
push ecx
call fcn.004dca10
push esi
call fcn.005e0865
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
xor ecx, esp
call fcn.005dfbbe
add esp, 0x20
ret