joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b1ad
Capabilities:
Encode data using base64
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
mov dword [esi + 0xe48], eax
mov dword [esi + 0xe58], eax
mov dword [esi + 0xe54], eax
mov dword [esi + 0xe60], eax
mov dword [esi + 0xe5c], eax
push esi
call fcn.004733cc
add esp, 4
cmp dword [esi + 0xe48], 2
jne 0x47b1e6
pop esi
ret
mov ecx, esi
pop esi
jmp fcn.004775a6
Function at 0x4843e3
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x428ed4]
test eax, eax
jne 0x484418
push 0
push 0x484420
push dword [esp + 0xc]
push 0x6e
push dword [0x428ea8]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x428ed4], eax
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x428ed4]
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
ret

Function at 0x484ae8
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
sub esp, 0x98
mov eax, dword [0x42b238]
mov dword [esp + 0x94], eax
cmp dword [0x4278bc], 0
je 0x484b16
xor ebx, ebx
cmp dword [0x4278b0], 0
setne bl
jmp 0x484c39
lea esi, [esp + 4]
push 0x90
push 0
push esi
call fcn.0049acf0
add esp, 0xc
mov dword [esi - 4], 0x94
mov esi, esp
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [esi + 0x10], 2
sete al
mov dword [0x4278c0], eax
push 0x41ba88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x484c03
push str.GetSystemMetrics
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4278a0], eax
je 0x484c03
push str.MonitorFromWindow
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4278a4], eax
je 0x484c03
push str.MonitorFromRect
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4278a8], eax
je 0x484c03
push str.MonitorFromPoint
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4278ac], eax
je 0x484c03
push str.EnumDisplayMonitors
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4278b4], eax
je 0x484c03
push str.GetMonitorInfoA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4278b0], eax
je 0x484c03
push str.EnumDisplayDevicesA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4278b8], eax
je 0x484c03
xor ebx, ebx
mov dword [0x4278bc], 1
inc ebx
jmp 0x484c39
xor ebx, ebx
mov dword [0x4278bc], 1
mov dword [0x4278a0], ebx
mov dword [0x4278a4], ebx
mov dword [0x4278a8], ebx
mov dword [0x4278ac], ebx
mov dword [0x4278b0], ebx
mov dword [0x4278b4], ebx
mov dword [0x4278b8], ebx
mov ecx, dword [esp + 0x94]
call fcn.00497c4a
mov eax, ebx
add esp, 0x98
pop esi
pop ebx
ret
Function at 0x485b0d
Capabilities:
Authenticate hmac
Check http status code
Get geographical location
Get keyboard layout
Log keystrokes via input method manager
Log keystrokes via polling
Parse pe header
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x14]
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, 0xffffff00
xor ebx, ebx
mov eax, dword [edi + 0x428560]
test eax, eax
je 0x485b2f
push eax
call ebp
mov dword [edi + 0x428560], ebx
mov dword [edi + 0x428e24], ebx
add edi, 4
jne 0x485b22
push dword [0x428418]
call fcn.0043f9d4
add esp, 4
mov eax, dword [0x428414]
test eax, eax
je 0x485b5e
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
call fcn.004901a0
push 2
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
cmp eax, 3
jne 0x485b7d
call fcn.004921c4
call fcn.00484d61
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call fcn.004a3719
Function at 0x4897f7
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x408
mov eax, dword [0x42b238]
mov dword [esp + 0x404], eax
push 2
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
push eax
call fcn.0044420b
add esp, 4
test eax, eax
mov dword [0x42841c], eax
je 0x489996
mov ebp, dword [eax]
push 8
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
mov esi, eax
push 7
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
mov edi, eax
push 1
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
mov ebx, eax
xor eax, eax
push eax
push dword [0x428eb4]
call fcn.00431a8c
add esp, 8
mov ecx, esp
push esi
push edi
mov edi, 0
push ecx
push ebx
push eax
push dword [0x428eb4]
push 0x428420
push edi
call ebp
add esp, 0x20
mov esi, eax
mov eax, dword [0x42841c]
push dword [0x428ecc]
push dword [0x428420]
call dword [eax + 0x34]
add esp, 8
test esi, esi
jne 0x4899cb
mov dword [0x4289a4], edi
mov dword [0x4289a0], edi
push 0x5f
push dword [0x428eb4]
call fcn.00431a8c
add esp, 8
mov esi, eax
cmp byte [esi], 0
jne 0x4898f9
lea esi, [esp + 4]
push dword [0x402050]
push dword [esp + 4]
push str._s____s
push esi
call fcn.00432778
add esp, 0x10
push dword [esp]
call fcn.0043f9d4
sub esp, 4
mov dword [esp + 4], esi
call fcn.0048bdc6
mov dword [esp + 4], esi
call fcn.0048be32
add esp, 8
mov eax, dword [0x42841c]
push dword [0x428420]
push dword [eax + 0x14]
push dword [0x428ea4]
call fcn.00475c45
add esp, 0xc
push 0
push dword [0x428420]
push dword [0x42841c]
push dword [0x428ea4]
push dword [0x428eb4]
call fcn.0043bfd4
add esp, 0x14
mov edi, dword [sym.imp.USER32.dll_DeleteMenu]
mov esi, 0xfffffff8
mov dword [0x428ce0], eax
push 0
push pe_nt_image_headers32
push dword [esi + 0x428404]
call edi
add esi, 4
jne 0x489967
mov byte [0x428448], 0
mov ecx, dword [esp + 0x404]
call fcn.00497c4a
add esp, 0x408
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [0x402050]
push str._s_Internal_Error
call fcn.0043f758
add esp, 8
mov esi, eax
push 0x30
push esi
push str.Unsupported_protocol_number_found
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0043f9d4
add esp, 4
push 1
call fcn.00485b0d
push dword [0x402050]
push str._s_Error
call fcn.0043f758
add esp, 8
xor ebp, ebp
mov edi, eax
push dword [0x428eb4]
call fcn.00440153
add esp, 4
lea ebx, [esp + 4]
push esi
push eax
push str.Unable_to_open_connection_to_n_.800s_n_s
push ebx
call fcn.00432778
add esp, 0x10
push 0x10
push edi
push ebx
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call fcn.0043f9d4
add esp, 4
push ebp
call fcn.004a3719
Function at 0x48c158
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
lea eax, [ebp + 1]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x48c203
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x48c203
mov ebx, dword [esp + 0x20]
push ebp
push dword [esp + 0x1c]
push edi
call fcn.0049a1f0
add esp, 0xc
mov byte [edi + ebp], 0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
jne 0x48c1bc
push 0
push 1
push 0x8002
push dword [0x428eac]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x428eac]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x48c1e3
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x48c1ea
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test ebx, ebx
jne 0x48c203
xor eax, eax
push eax
push eax
push 0x8002
push dword [0x428eac]
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x48cb7b
Capabilities:
Create thread

Disassembly:
sub esp, 8
mov eax, dword [0x42b238]
xor ecx, ecx
mov dword [esp + 4], eax
mov eax, esp
push eax
push ecx
push dword [0x428eac]
push 0x48cbad
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 4]
call fcn.00497c4a
add esp, 8
ret

Function at 0x48cd29
Capabilities:
Check for time delay via gettickcount

Disassembly:
push edi
push esi
sub esp, 0xbc
mov eax, dword [esp + 0xcc]
mov ecx, dword [0x42b238]
cmp eax, 4
mov dword [esp + 0xb8], ecx
je 0x48ce05
cmp eax, 3
je 0x48cd89
cmp eax, 1
jne 0x48ce41
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x428cc4]
cmp eax, 0x32
jb 0x48ce59
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x428cc4], eax
jmp 0x48ce41
push 0x6c
push dword [0x428eb4]
call fcn.00431daf
add esp, 8
mov esi, eax
mov eax, dword [0x428cc8]
test eax, eax
je 0x48cdb7
push 0x20001
push 0
push dword [esi]
call eax
test eax, eax
jne 0x48ce41
lea edi, [esp + 0x64]
push dword [esi]
push str.Unable_to_play_sound_file_n_s_nUsing_default_sound_instead
push edi
call fcn.00432778
add esp, 0xc
mov esi, esp
push dword [0x402050]
push str._.70s_Sound_Error
push esi
call fcn.00432778
add esp, 0xc
push 0x30
push esi
push edi
push dword [0x428eac]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
push 0x66
push dword [0x428eb4]
call fcn.00431ee3
add esp, 0xc
jmp 0x48ce41
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x428ccc]
cmp eax, 0x32
jb 0x48ce59
cmp dword [0x429770], 2
jne 0x48ce2e
push 0x64
push 0x320
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x48ce36
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x428ccc], eax
mov eax, dword [0x428ea4]
cmp dword [eax + 0x134], 0
jne 0x48ce59
mov ecx, 2
call fcn.0048ce6e
mov ecx, dword [esp + 0xb8]
call fcn.00497c4a
add esp, 0xbc
pop esi
pop edi
ret

Function at 0x48d341
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
sub esp, 0x104
mov eax, dword [0x42b238]
mov dword [esp + 0x100], eax
mov eax, esp
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x48d377
cmp byte [esp + 0x12], 0
js 0x48d37b
mov al, byte [esp + 0xa5]
shr al, 7
movzx esi, al
jmp 0x48d37e
xor esi, esi
jmp 0x48d37e
xor esi, esi
inc esi
mov ecx, dword [esp + 0x100]
call fcn.00497c4a
mov eax, esi
add esp, 0x104
pop esi
ret
Function at 0x48dd7c
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x42b238]
mov ebp, dword [esp + 0x1c]
mov dword [esp + 4], eax
push 0x1034
push 1
call fcn.0043f807
add esp, 8
mov esi, eax
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ebx, [esi + 4]
push edi
push edi
push edi
push edi
call ebp
mov dword [esi + 8], eax
push edi
push edi
push edi
push edi
call ebp
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x1030], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x24], eax
mov eax, dword [0x428f14]
test eax, eax
jne 0x48ddff
push 0x48de35
call fcn.0047dc24
add esp, 4
mov dword [0x428f14], eax
push esi
push eax
call fcn.0047dcb3
add esp, 8
mov eax, esp
push eax
push edi
push ebx
push 0x48de51
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], 1
mov ecx, dword [esp + 4]
call fcn.00497c4a
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x48dfa6
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x42b238]
mov edi, dword [esp + 0x1c]
xor ebx, ebx
inc ebx
mov dword [esp + 4], eax
push 0x1034
push ebx
call fcn.0043f807
add esp, 8
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
mov dword [esi], ebx
mov dword [esi + 4], edi
lea ebx, [esi + 4]
xor edi, edi
push edi
push edi
push edi
push edi
call ebp
mov dword [esi + 8], eax
push edi
push edi
push edi
push edi
call ebp
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], eax
lea eax, [esi + 0x38]
push eax
call fcn.0043ff45
add esp, 4
mov eax, dword [esp + 0x20]
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x24], eax
mov eax, dword [0x428f14]
test eax, eax
jne 0x48e03a
push 0x48de35
call fcn.0047dc24
add esp, 4
mov dword [0x428f14], eax
push esi
push eax
call fcn.0047dcb3
add esp, 8
mov eax, esp
push eax
push edi
push ebx
push 0x48e069
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 4]
call fcn.00497c4a
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x48f5eb
Capabilities:
Get session user name

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x42b238]
mov dword [esp + 4], eax
mov al, byte [0x429744]
test al, al
je 0x48f60b
mov ecx, dword [0x429740]
jmp 0x48f64a
push str.secur32.dll
call fcn.0048f6f9
add esp, 4
mov esi, eax
push str.sspicli.dll
call fcn.0048f6f9
add esp, 4
test esi, esi
je 0x48f63b
push str.GetUserNameExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x48f63d
xor ecx, ecx
mov dword [0x429740], ecx
mov byte [0x429744], 1
test ecx, ecx
je 0x48f699
xor eax, eax
mov edi, esp
mov ebx, 8
mov dword [edi], eax
push edi
push eax
push ebx
call ecx
push 1
push dword [edi]
call fcn.0043f807
add esp, 8
mov esi, eax
push edi
push esi
push ebx
call dword [0x429740]
test al, al
je 0x48f690
movzx edi, al
push pe_nt_image_headers32
push esi
call fcn.0049ae50
add esp, 8
test eax, eax
je 0x48f6e2
mov byte [eax], 0
jmp 0x48f6e2
push esi
call fcn.0043f9d4
add esp, 4
mov edi, esp
xor eax, eax
mov dword [edi], eax
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x48f6b0
mov eax, dword [esp]
jmp 0x48f6bc
mov eax, 0x100
mov dword [esp], 0x100
push 1
push eax
call fcn.0043f807
add esp, 8
mov esi, eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edi, eax
test edi, edi
jne 0x48f6e2
push esi
call fcn.0043f9d4
add esp, 4
xor edi, edi
mov ecx, dword [esp + 4]
test edi, edi
cmove esi, edi
call fcn.00497c4a
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x48f6f9
Capabilities:
Get common file path

Disassembly:
push ebx
push edi
push esi
mov eax, dword [0x429750]
mov esi, dword [esp + 0x10]
test eax, eax
jne 0x48f743
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
xor ebx, ebx
lea ecx, [ebx + ebx*2]
mov ebx, ecx
shr ebx, 0x1f
add ebx, ecx
sar ebx, 1
add ebx, 0x200
push 1
push ebx
push eax
call fcn.0043f8db
add esp, 0xc
mov dword [0x429750], eax
push ebx
push eax
call edi
cmp eax, ebx
mov eax, dword [0x429750]
jge 0x48f713
push 0
push esi
push 0x41d001
push eax
call fcn.0043fa97
add esp, 0x10
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push esi
call fcn.0043f9d4
add esp, 4
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x48f99c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebp, dword [ebx]
push ebp
call fcn.004a7f30
add esp, 4
mov esi, eax
test edi, edi
je 0x48fa17
push ebp
push edi
call fcn.004a7c00
add esp, 8
mov al, byte [ebx + 7]
mov byte [edi + esi + 1], al
mov al, byte [ebx + 6]
mov byte [edi + esi + 2], al
mov al, byte [ebx + 5]
mov byte [edi + esi + 3], al
mov al, byte [ebx + 4]
mov byte [edi + esi + 4], al
mov al, byte [ebx + 0xb]
mov byte [edi + esi + 5], al
mov al, byte [ebx + 0xa]
mov byte [edi + esi + 6], al
mov al, byte [ebx + 9]
mov byte [edi + esi + 7], al
mov al, byte [ebx + 8]
mov byte [edi + esi + 8], al
mov al, byte [ebx + 0xf]
mov byte [edi + esi + 9], al
mov al, byte [ebx + 0xe]
mov byte [edi + esi + 0xa], al
mov al, byte [ebx + 0xd]
mov byte [edi + esi + 0xb], al
mov al, byte [ebx + 0xc]
mov byte [edi + esi + 0xc], al
add esi, 0xd
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49202c
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x274
mov eax, dword [0x42b238]
mov edi, dword [esp + 0x288]
lea esi, [esp + 0x29]
mov dword [esp + 0x270], eax
push 0x107
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call fcn.004a7f30
add esp, 4
lea ebx, [esp + 0x130]
mov byte [esp + eax + 0x2b], 0
mov word [esp + eax + 0x29], 0x2a5c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4920a4
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x140
push ebx
call edi
add esp, 8
push ebx
push esi
call ebp
test eax, eax
jne 0x49208a
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esp + 4]
mov dword [ecx], eax
push 4
push ecx
call edi
add esp, 8
mov ecx, dword [0x429ee8]
test ecx, ecx
je 0x4920c9
mov eax, dword [0x429ef4]
jmp 0x492146
push str.advapi32.dll
call fcn.0048f6f9
add esp, 4
test eax, eax
mov dword [0x429ee8], eax
je 0x492129
push str.CryptAcquireContextA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x429ee8]
mov dword [0x429eec], eax
test ecx, ecx
je 0x492133
push str.CryptGenRandom
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x429ee8]
mov dword [0x429ef0], eax
test ecx, ecx
je 0x49213d
push str.CryptReleaseContext
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x429ee8]
jmp 0x492141
mov dword [0x429eec], 0
mov dword [0x429ef0], 0
xor ecx, ecx
xor eax, eax
mov dword [0x429ef4], eax
test ecx, ecx
je 0x49219f
mov ecx, dword [0x429eec]
test ecx, ecx
je 0x49219f
mov edx, dword [0x429ef0]
test edx, edx
je 0x49219f
test eax, eax
je 0x49219f
xor eax, eax
mov edx, esp
push 0xf0000000
push 1
push eax
push eax
push edx
call ecx
test eax, eax
je 0x49219f
lea esi, [esp + 9]
push esi
push 0x20
push dword [esp + 8]
call dword [0x429ef0]
test eax, eax
je 0x492193
push 0x20
push esi
call edi
add esp, 8
push 0
push dword [esp + 4]
call dword [0x429ef4]
push edi
call fcn.00494bf2
add esp, 4
call fcn.004921c4
mov ecx, dword [esp + 0x270]
call fcn.00497c4a
add esp, 0x274
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49225f
Capabilities:
Get memory capacity

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [0x42b238]
mov dword [esp + 0x50], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea edi, [esp + 0x2c]
mov esi, 4
mov dword [edi], eax
push esi
push edi
call fcn.004698c8
add esp, 8
call dword [sym.imp.USER32.dll_GetCapture]
mov dword [edi], eax
push esi
push edi
call fcn.004698c8
add esp, 8
call dword [sym.imp.USER32.dll_GetClipboardOwner]
mov dword [edi], eax
push esi
push edi
call fcn.004698c8
add esp, 8
push 0x1cbf
call dword [sym.imp.USER32.dll_GetQueueStatus]
lea ecx, [esp + 0x28]
mov dword [ecx], eax
push esi
push ecx
call fcn.004698c8
add esp, 8
lea esi, [esp + 0x20]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, 8
push eax
push esi
call fcn.004698c8
add esp, 8
mov edi, esp
push edi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 0x20
push eax
push edi
call fcn.004698c8
add esp, 8
lea ebx, [esp + 0x48]
lea esi, [esp + 0x40]
lea ebp, [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea edi, [esp + 0x30]
push ebx
push esi
push ebp
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov eax, 0x20
push eax
push edi
call fcn.004698c8
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push esi
push ebp
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov eax, 0x20
push eax
push edi
call fcn.004698c8
add esp, 8
mov ecx, dword [esp + 0x50]
call fcn.00497c4a
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4923c0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x42b238]
mov esi, dword [esp + 0x20]
mov dword [esp + 8], eax
push 9
push str..pipe_
push esi
call fcn.004a7fc0
add esp, 0xc
test eax, eax
je 0x4923fc
push 0x1e
push str..._windows_winnpc.c
push str.strncmp_pipename___.pipe___9___0
call fcn.004a509d
add esp, 0xc
lea eax, [esi + 9]
push 0x5c
push eax
call fcn.0049ae50
add esp, 8
test eax, eax
je 0x492422
push 0x1f
push str..._windows_winnpc.c
push str.strchr_pipename__9_____NULL
call fcn.004a509d
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
xor edi, edi
push edi
push 0x40000000
push 3
push edi
push edi
push 0xc0000000
mov ebx, esi
push esi
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x49249a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x492509
push 0
mov esi, ebx
push esi
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
test eax, eax
jne 0x49242a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0048f7e3
add esp, 4
push eax
push esi
push str.Error_waiting_for_named_pipe__s:__s
call fcn.0043f758
add esp, 0xc
mov esi, eax
push dword [esp + 0x24]
push esi
call fcn.0043bf6c
add esp, 8
mov edi, eax
push esi
jmp 0x492561
call fcn.004931fa
mov edi, eax
test edi, edi
je 0x49253b
mov eax, esp
xor ecx, ecx
lea edx, [esp + 4]
push eax
push ecx
push ecx
push ecx
push edx
push 1
push 6
push esi
call dword [0x429f34]
test eax, eax
je 0x49257c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0048f7e3
add esp, 4
push eax
push str.Unable_to_get_named_pipe_security_information:__s
call fcn.0043f758
add esp, 8
mov ebx, eax
push dword [esp + 0x24]
push ebx
call fcn.0043bf6c
add esp, 8
mov edi, eax
push ebx
call fcn.0043f9d4
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x492569
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0048f7e3
add esp, 4
push eax
push ebx
push str.Unable_to_open_named_pipe__s:__s
call fcn.0043f758
add esp, 0xc
mov esi, eax
push dword [esp + 0x24]
push esi
call fcn.0043bf6c
add esp, 8
mov edi, eax
push esi
jmp 0x492561
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Unable_to_get_user_SID
call fcn.0043f758
add esp, 4
mov esi, eax
push dword [esp + 0x24]
push esi
call fcn.0043bf6c
add esp, 8
mov edi, eax
push esi
call fcn.0043f9d4
add esp, 4
mov ecx, dword [esp + 8]
call fcn.00497c4a
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4925aa
push dword [esp]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 1
push dword [esp + 0x28]
push 0
push esi
push esi
call fcn.0048e968
add esp, 0x14
mov edi, eax
jmp 0x492569
push ebx
push str.Owner_of_named_pipe__s_is_not_us
call fcn.0043f758
add esp, 8
mov ebx, eax
push dword [esp + 0x24]
push ebx
call fcn.0043bf6c
add esp, 8
mov edi, eax
push ebx
call fcn.0043f9d4
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x492569