joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x42ed6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x42078b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4207a4
lea eax, [ebp - 0x10]
mov edx, dword [0x44c73c]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x4207b7
lea eax, [ebp - 0x10]
mov edx, dword [0x44c73c]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4207c3
adc edx, 0
mov edx, dword [edx*4 + 0x44b538]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x42093d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420930
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420930
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x4208ce
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x4208ce
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4208ce
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4208ce
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420930
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420930
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420930
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420930
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420955
inc ebx
cmp ebx, 0x19
jne 0x42077d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ed72
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x432098
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x432098
lcall 0x5de5, 0x8b10c483
jmp loc.0096a8b8
Function at 0x3e4fc1
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ecx + 0x9c]
test edx, edx
je 0x427c02
mov ecx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x3e4fde
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp + 0xc]
push 1
push edi
push dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0x427c11
push edi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 8
push 6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x3e5019
push eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x3e5017

Function at 0x3e7450
Capabilities:
Get common file path
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x470cb8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x471318], 0
je 0x3e747c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b590
leave
ret
lea eax, [ebp - 0x20c]
push eax
xor eax, eax
push eax
push eax
push 0x801c
push eax
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
test eax, eax
jne 0x3e7470
lea eax, [ebp - 0x20c]
push eax
push 0x3d7ccc
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
test eax, eax
je 0x428953
mov byte [0x471318], 1
jmp 0x3e746e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x3e7470
movzx eax, ax
or eax, 0x80070000
jmp 0x3e7470

Function at 0x3ea7a9
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x470cb8]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push dword [ecx + 0x14]
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push 0x3d6bc0
push 0x10
push eax
xor bl, bl
call fcn.003ed6f4
add esp, 0x10
test eax, eax
js 0x3ea80e
lea eax, [ebp - 0x2c]
mov edx, 0x80000002
push eax
push 2
push ecx
push esi
call fcn.0040fa36
test eax, eax
jne 0x3ea80e
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
test eax, eax
jne 0x3ea805
inc bl
push dword [ebp - 0x2c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b590
leave
ret 4
Function at 0x3ed2d2
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x470cb8]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, ecx
lea eax, [ebp - 0x28]
xor ebx, ebx
push dword [esi + 0x14]
push 0x3d6bc0
push 0x10
push eax
call fcn.003ed6f4
add esp, 0x10
test eax, eax
js 0x3ed340
lea eax, [ebp - 0x2c]
mov edx, 0x80000002
push eax
push 2
push ecx
push 0x3d6950
call fcn.0040fa36
test eax, eax
jne 0x3ed340
push 0x14
push esi
push 3
push ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0x3ed337
mov bl, 1
push dword [ebp - 0x2c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b590
leave
ret 4
Function at 0x3ed352
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x146c
call fcn.00417ce0
mov eax, dword [0x470cb8]
xor eax, esp
mov dword [esp + 0x1468], eax
cmp byte [0x471838], 0
push ebx
push esi
push edi
jne 0x3ed38a
call fcn.003eb795
mov byte [0x471838], 1
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push 3
push ecx
mov esi, 0x80000002
mov dword [esp + 0x18], ebx
push 0x3d6950
mov edx, esi
mov dword [esp + 0x24], ebx
call fcn.0040fa36
test eax, eax
jne 0x3ed540
lea eax, [esp + 0x14]
mov edx, esi
push eax
push 3
push ecx
push 0x3da8c0
call fcn.0040fa36
test eax, eax
jne 0x3ed540
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esp + 0x38]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x3ed540
mov eax, dword [esp + 0x10]
cmp eax, 0x400
ja 0x3ed540
mov edi, ebx
test eax, eax
je 0x3ed4ee
lea esi, [esp + 0x54]
lea eax, [esp + 0x18]
mov byte [esi], bl
push eax
lea eax, [esp + 0x40]
mov dword [esp + 0x20], 0x10
push eax
lea eax, [esp + 0x40]
mov dword [esp + 0x44], ebx
push eax
push ebx
lea eax, [esp + 0x2c]
mov dword [esp + 0x50], ebx
push eax
lea eax, [esp + 0x1468]
mov dword [esp + 0x58], ebx
push eax
push edi
push dword [esp + 0x28]
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x38], 0x14
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0x3ed4de
cmp dword [esp + 0x38], 3
jne 0x3ed4de
cmp dword [esp + 0x18], 0x14
jne 0x3ed4de
mov eax, dword [esp + 0x1c]
add eax, eax
cmp eax, 0x20
jae 0x3ed577
xor ecx, ecx
lea edx, [esi - 4]
mov word [esp + eax + 0x1454], cx
lea ecx, [esp + 0x1454]
call fcn.003ed681
test al, al
je 0x3ed4dc
xor eax, eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [esi - 4]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x3c]
push eax
call fcn.003ed5e5
lea ecx, [esp + 0x20]
call fcn.003ed57d
xor ebx, ebx
cmp dword [esp + 0x20], ebx
jne 0x3ed4de
mov byte [esi], 1
jmp 0x3ed4de
xor ebx, ebx
mov eax, dword [esp + 0x10]
inc edi
add esi, 5
cmp edi, eax
jb 0x3ed40f
mov edi, ebx
test eax, eax
je 0x3ed540
lea esi, [esp + 0x50]
cmp byte [esi + 4], 0
je 0x3ed538
mov eax, dword [esi]
lea ecx, [esp + 0x20]
push 0x3d6950
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], eax
call fcn.003ea7a9
push 0x3da8c0
lea ecx, [esp + 0x24]
call fcn.003ea7a9
mov eax, dword [esp + 0x10]
inc edi
add esi, 5
cmp edi, eax
jb 0x3ed4f8
cmp dword [esp + 0xc], 0
je 0x3ed551
push dword [esp + 0xc]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [esp + 0x14], 0
je 0x3ed562
push dword [esp + 0x14]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [esp + 0x1474]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b590
mov esp, ebp
pop ebp
ret
call fcn.0040b6d8
int3
Function at 0x3ed90e
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x470cb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x210], eax
push ecx
mov esi, 0x104
mov dword [eax], edi
mov edx, esi
mov dword [eax + 4], edi
lea ecx, [ebp - 0x20c]
call fcn.003f2867
push 0x3d6bf4
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.003f0c07
lea eax, [ebp - 0x20c]
push eax
push edi
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov esi, eax
mov dword [ebp - 0x214], esi
test esi, esi
je 0x4219ce
lea edx, [ebp - 0x218]
mov dword [ebp - 0x218], edi
mov ecx, esi
call fcn.003ed9e5
mov ebx, eax
test ebx, ebx
js 0x4219f3
mov ecx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x218]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x3ed9d2
lea edx, [ebp - 0x210]
mov dword [ebp - 0x210], esi
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x406df0
call fcn.0040d568
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b590
leave
ret 8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x3ed9ad
mov ecx, dword [ebp + 4]
mov edx, 0xc9
push 0x3d94e8
call fcn.0042d93a
mov edi, eax
jmp 0x421a08
mov ecx, dword [ebp + 4]
mov edx, 0xcf
push ebx
push 0x3d94e8
call fcn.0042d953
mov edi, ebx
mov esi, dword [ebp - 0x214]
jmp 0x3ed9ad
Function at 0x3ee096
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
push 0x7cf
mov dword [ebp - 0xc], ebx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
mov edi, 0x4718c0
mov edx, 0x7d0
push eax
mov ecx, edi
call fcn.003f0c5b
test eax, eax
js 0x3ee2a7
xor eax, eax
mov esi, edi
push 0x22
mov dword [ebx], eax
pop ecx
cmp word [esi], ax
je 0x3ee163
mov edi, esi
sub edi, 0x4718c0
mov eax, edi
sar eax, 1
cmp eax, 0x7d0
jae 0x3ee10b
movzx eax, word [esi]
test ax, ax
je 0x3ee108
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x3ee28d
push 0x22
pop ecx
mov eax, esi
mov edi, 0x4718c0
sub eax, edi
and eax, 0xfffffffe
cmp eax, 0xfa0
je 0x3ee163
movzx eax, word [esi]
test ax, ax
je 0x3ee163
cmp ax, cx
je 0x421bff
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x3ee14a
xor eax, eax
cmp word [esi], ax
je 0x3ee14c
add esi, 2
movzx eax, word [esi]
jmp 0x3ee12f
xor eax, eax
inc dword [ebx]
mov ecx, esi
sub ecx, edi
sar ecx, 1
push 0x22
cmp ecx, 0x7d0
pop ecx
jb 0x3ee0d4
mov eax, dword [ebx]
test eax, eax
je 0x3ee2a7
mov esi, dword [0x3d2f5c]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
mov ecx, esi
call dword [0x473670]
call esi
mov ecx, eax
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x3ee2a7
xor eax, eax
mov esi, edi
mov ecx, eax
mov dword [ebp - 4], eax
cmp word [esi], ax
je 0x3ee285
cmp ecx, dword [ebx]
jge 0x3ee285
mov edi, esi
sub edi, 0x4718c0
mov eax, edi
sar eax, 1
cmp eax, 0x7d0
jae 0x3ee1de
movzx eax, word [esi]
test ax, ax
je 0x3ee1de
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x421c21
mov edi, esi
sub edi, 0x4718c0
mov eax, edi
sar eax, 1
cmp eax, 0x7d0
je 0x3ee285
movzx ecx, word [esi]
test cx, cx
je 0x3ee285
push 0x22
pop ebx
cmp cx, bx
lea ecx, [esi + 2]
je 0x3ee20e
mov ecx, esi
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
push 0x22
mov dword [ebx + edx*4], ecx
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
inc ecx
pop edx
cmp word [esi], dx
lea edx, [esi + 2]
mov dword [ebp - 4], ecx
je 0x421c2c
cmp eax, 0x7d0
jae 0x3ee261
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x3ee25e
xor ecx, ecx
cmp word [esi], cx
je 0x3ee25e
add edi, 2
add esi, 2
mov eax, edi
sar eax, 1
cmp eax, 0x7d0
jb 0x3ee237
mov ecx, dword [ebp - 4]
xor eax, eax
cmp word [esi], ax
je 0x3ee26e
mov word [esi], ax
add esi, 2
mov eax, esi
sub eax, 0x4718c0
sar eax, 1
push 0
cmp eax, 0x7d0
pop eax
jb 0x3ee1a2
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
add edi, 2
add esi, 2
mov eax, edi
sar eax, 1
cmp eax, 0x7d0
jb 0x3ee0f0
jmp 0x3ee108
xor eax, eax
jmp 0x3ee288
lea eax, [esi + 2]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x421c1a
add esi, 2
jmp 0x3ee14a
inc dword [ebx]
jmp 0x3ee163
add esi, 2
add edi, 2
jmp 0x3ee1bb
push 0x22
pop eax
push eax
push edx
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x3ee285
jmp 0x3ee25e
Function at 0x3ee6c4
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x470cb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 8]
mov dword [ebp - 8], edi
call fcn.0040ecb8
push eax
push 0x88
push esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
test eax, eax
je 0x3ee752
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 6
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
test eax, eax
jne 0x3ee802
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x3ee758
push ebx
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
mov esi, dword [ebp - 0xc]
add esi, 0xc
add esi, eax
mov eax, esi
mov dword [ebp - 0xc], esi
call fcn.00417bf0
mov ebx, esp
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push 6
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
test eax, eax
jne 0x3ee76d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x3ee807
movzx eax, ax
or eax, 0x80070000
jmp 0x3ee807
cmp dword [ebx], edi
je 0x3ee802
push dword [ebp - 0x10]
mov esi, dword [ebx]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
add eax, 8
add word [esi + 2], ax
lea eax, [ebp - 0x14]
push eax
mov esi, edi
push edi
jmp 0x3ee7aa
mov eax, dword [ebp - 0x14]
add eax, 8
push eax
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
jne 0x3ee809
lea eax, [ebp - 0x14]
inc esi
push eax
push esi
push dword [ebx]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
test eax, eax
jne 0x3ee790
push dword [ebp - 0x10]
push 0x10000000
push 2
push dword [ebx]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AddAccessAllowedAce]
test eax, eax
je 0x3ee7eb
push dword [ebx]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsValidAcl]
mov eax, dword [ebx]
movzx eax, word [eax + 2]
push eax
push ebx
push 6
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetTokenInformation]
test eax, eax
jne 0x3ee809
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x3ee809
movzx edi, di
or edi, 0x80070000
jmp 0x3ee809
mov eax, 0x80004005
mov edi, eax
lea ecx, [ebp - 8]
call fcn.003ee825
mov eax, edi
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b590
leave
ret
Function at 0x4002d6
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x470cb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
lea eax, [ebp - 0x210]
mov ecx, 0x105
xor ebx, ebx
push ecx
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
push ebx
push ecx
lea eax, [ebp - 0x41c]
push eax
push dword [esi + 0x10]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
test eax, eax
jne 0x40032a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov byte [esi + 0x20], bl
jmp 0x4003d6
lea edx, [ebp - 0x41c]
push edi
cmp byte [esi + 0x21], bl
je 0x400385
mov ecx, dword [esi + 0x10]
call fcn.0040fa8d
test al, al
je 0x40037e
mov edx, 0x3d9654
lea eax, [ebp - 0x210]
mov di, word [eax]
xor ecx, ecx
inc ecx
cmp di, word [edx]
jne 0x400376
test di, di
je 0x400372
mov di, word [eax + 2]
cmp di, word [edx + 2]
jne 0x400376
add eax, 4
add edx, 4
test di, di
jne 0x40034d
mov eax, ebx
jmp 0x40037a
sbb eax, eax
or eax, ecx
test eax, eax
jne 0x400380
mov cl, bl
mov edx, dword [esi + 0x10]
jmp 0x4003be
mov ecx, 0x3d9654
lea eax, [ebp - 0x210]
mov di, word [eax]
cmp di, word [ecx]
jne 0x4003b4
test di, di
je 0x4003b9
mov di, word [eax + 2]
cmp di, word [ecx + 2]
jne 0x4003b4
add eax, 4
add ecx, 4
test di, di
jne 0x400390
jmp 0x4003b9
sbb ebx, ebx
or ebx, 1
test ebx, ebx
setne cl
mov byte [esi + 0x20], cl
movzx eax, byte [esi + 0x21]
mov ecx, dword [esi + 0x1c]
push eax
push edx
lea edx, [ebp - 0x210]
call 0x40e1b0
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b590
leave
ret

Function at 0x403296
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
xor bl, bl
push esi
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathIsUNCServerW]
test eax, eax
jne 0x4032c3
push esi
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathIsUNCServerShareW]
test eax, eax
jne 0x4032c3
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4032c3
test al, 0x10
je 0x4032c3
inc bl
pop esi
mov al, bl
pop ebx
ret
Function at 0x404980
Capabilities:
Compare security identifiers

Disassembly:
push 0x100
mov eax, 0x41a92f
call fcn.0040bc61
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xf4], 0x3d1524
xor ebx, ebx
call fcn.003f53b2
mov dword [ebp - 0xf4], 0x3d14c0
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
push ebx
push 0x2001f
push 0x3d7880
push 0x80000002
lea ecx, [ebp - 0xf4]
mov dword [ebp - 4], ebx
call fcn.003f9520
test eax, eax
js 0x404ae2
lea eax, [ebp - 0xf8]
mov dword [ebp - 0xf8], ebx
push eax
push ebx
push ecx
lea ecx, [ebp - 0xf4]
call fcn.00404b0d
cmp eax, 0x7a
jne 0x404ae2
push 0x3d84c8
push dword [ebp - 0xf8]
call fcn.0040b996
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x404acd
lea eax, [ebp - 0xf8]
push eax
push esi
push ecx
lea ecx, [ebp - 0xf4]
call fcn.00404b0d
test eax, eax
jg 0x427c9d
js 0x404acd
lea eax, [ebp - 0x10c]
mov dword [ebp - 0xfc], ebx
push eax
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x427cac
cmp dword [ebp - 0x104], 0
je 0x404acd
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], 0x44
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push 0x1a
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
test eax, eax
je 0x427cac
mov edi, ebx
lea eax, [ebp - 0x100]
push eax
push edi
push dword [ebp - 0xfc]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
test eax, eax
je 0x404acd
mov eax, dword [ebp - 0x100]
add eax, 8
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
jne 0x404af5
inc edi
test bl, bl
je 0x404a98
mov byte [ebp - 4], 1
push esi
mov esi, dword [0x3d2f60]
mov ecx, esi
call dword [0x473670]
call esi
lea ecx, [ebp - 0xf4]
call fcn.003f535f
mov al, bl
call fcn.0040bc10
ret
mov eax, dword [ebp - 0x100]
mov ecx, 0xf003f
mov eax, dword [eax + 4]
and eax, ecx
cmp eax, ecx
jne 0x404ac8
mov bl, 1
jmp 0x404ac8
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0x404a37
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x404acd