joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7547a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 8], ecx
mov ebp, dword [esp + 0x28]
mov ecx, dword [ebp + 0x10c]
lea esi, [ebp + 0x114]
mov dword [ebp + 0x114], 0x3020100
inc ecx
cmp ecx, 3
mov edi, 2
cmovae edi, ecx
cmp ecx, 9
mov dword [esp + 4], esi
jae 0x7547e9
mov eax, 1
mov ecx, 0x3020100
jmp 0x754868
mov dword [esp], edi
lea esi, [edi - 1]
mov edi, esi
and edi, 0xfffffff8
imul ecx, edi, 0x4040404
add ecx, 0x3020100
lea eax, [edi + 1]
movdqa xmm0, xmmword [0xadbfb0]
xor ebx, ebx
movdqa xmm1, xmmword [0xadbfc0]
movdqa xmm2, xmmword [0xadbfd0]
movdqa xmm3, xmmword [str._________________NO_ERROR]
nop word cs:[eax + eax]
movdqa xmm4, xmm0
paddd xmm4, xmm1
movdqa xmm5, xmm0
paddd xmm5, xmm2
movdqu xmmword [ebp + ebx*4 + 0x118], xmm4
movdqu xmmword [ebp + ebx*4 + 0x128], xmm5
add ebx, 8
paddd xmm0, xmm3
cmp edi, ebx
jne 0x754830
cmp esi, edi
mov esi, dword [esp + 4]
mov edi, dword [esp]
je 0x75487e
add ecx, 0x4040404
nop
mov dword [esi + eax*4], ecx
inc eax
add ecx, 0x4040404
cmp edi, eax
jne 0x754870
test edx, edx
je 0x754897
lea ecx, [ebp + 0x113]
cmp edx, 1
mov dword [esp + 0xc], edx
jne 0x75489e
xor esi, esi
xor ebx, ebx
jmp 0x75490b
xor ebx, ebx
jmp 0x754940
and edx, 0xfffffffe
mov dword [esp + 0x10], edx
xor esi, esi
xor ebx, ebx
mov dword [esp], ecx
nop dword [eax]
mov edi, dword [esp + 8]
movzx ebp, byte [edi + esi]
mov edx, dword [esp + 4]
movzx eax, byte [edx + ebp]
mov byte [edi + esi], al
mov byte [ecx], al
lea eax, [ebp + 1]
push eax
push ecx
push edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
add esp, 0xc
or ebx, ebp
movzx ebp, byte [edi + esi + 1]
mov edx, dword [esp + 4]
movzx eax, byte [edx + ebp]
mov byte [edi + esi + 1], al
mov ecx, dword [esp]
mov byte [ecx], al
lea eax, [ebp + 1]
push eax
push dword [esp + 4]
push edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov ecx, dword [esp + 0xc]
add esp, 0xc
or ebx, ebp
add esi, 2
cmp dword [esp + 0x10], esi
jne 0x7548b0
test byte [esp + 0xc], 1
je 0x754939
mov edx, dword [esp + 8]
movzx ebp, byte [edx + esi]
mov edi, ecx
mov ecx, dword [esp + 4]
movzx eax, byte [ecx + ebp]
mov byte [edx + esi], al
mov byte [edi], al
lea eax, [ebp + 1]
push eax
push edi
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
add esp, 0xc
or ebx, ebp
shr ebx, 2
mov ebp, dword [esp + 0x28]
mov dword [ebp + 0x10c], ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x785b50
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x25c
mov eax, dword [0xb4060c]
mov dword [esp + 0x24], str.getaddrinfo
movzx ebx, word [esp + 0x270]
mov dword [esp + 0x28], 0x785d60
mov dword [esp + 0x2c], str.getnameinfo
mov dword [esp + 0x30], 0x786110
mov dword [esp + 0x34], str.freeaddrinfo
mov dword [esp + 0x38], fcn.00785d10
test eax, eax
je 0x785bb0
mov eax, dword [ebx*8 + 0x8be0bc]
add esp, 0x25c
pop ebx
pop esi
pop edi
pop ebp
ret 4
lea esi, [esp + 0x3f]
mov dword [esp + 4], 0x104
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
sub esp, 8
test eax, eax
jne 0x785be0
mov dword [0xb4060c], 1
jmp 0x785b9b
lea edi, [esp + 0x144]
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, edi
mov dword [eax], 0x3273775c
mov dword [eax + 4], 0x32335f
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp], edi
mov dword [esp + 0x1c], eax
call eax
sub esp, 4
mov ebp, eax
test eax, eax
je 0x785c9c
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.getaddrinfo
mov dword [esp + 0x18], eax
call eax
sub esp, 8
test eax, eax
je 0x785c90
lea esi, [esp + 0x24]
lea edi, [esp + 0x3c]
mov eax, dword [esi]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
call eax
mov dword [esi + 4], eax
sub esp, 8
test eax, eax
je 0x785cf6
add esi, 8
cmp esi, edi
jne 0x785c46
mov eax, dword [esp + 0x28]
mov dword [0x8be0bc], eax
mov eax, dword [esp + 0x30]
mov dword [0x8be0c4], eax
mov eax, dword [esp + 0x38]
mov dword [fcn.00785d10], eax
jmp 0x785bcc
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, edi
mov dword [eax], 0x6873775c
mov dword [eax + 4], 0x367069
mov eax, dword [esp + 0x1c]
mov dword [esp], edi
call eax
sub esp, 4
mov ebp, eax
test eax, eax
je 0x785bcc
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.getaddrinfo
mov dword [esp + 0x18], eax
call eax
sub esp, 8
test eax, eax
jne 0x785c3e
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
jmp 0x785bcc
Function at 0x787220
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0xb4064c]
test esi, esi
jle 0x787340
mov eax, dword [0xb40650]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x787254
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x7872d7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x787240
mov dword [esp], ebx
call fcn.00787c10
mov edi, eax
test eax, eax
je 0x787367
mov eax, dword [0xb40650]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00787d50
mov edx, dword [0xb40650]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x787347
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x7872d0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x7872e0
add dword [0xb4064c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0xb40650]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x7872d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.007871c0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x78725e
mov eax, dword [0xb40650]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.007871c0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.007871c0
lea esi, [esi]
nop

Function at 0x787880
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0xb40668
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0xb40660]
sub esp, 4
test ebx, ebx
je 0x7878d5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x7878ce
test esi, esi
je 0x7878ce
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x7878b0
mov dword [esp], 0xb40668
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x406627
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x40664b
xor eax, eax
test eax, eax
je 0x40665d
cmp byte [ebp + eax - 0x121], 0x5c
je 0x40665d
xor ecx, ecx
jmp 0x406660
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x40674c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42ca1c], 0
push esi
jne 0x406783
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40675d
mov dword [ecx*4 + 0x42ca18], eax
inc ecx
cmp ecx, 0x100
jl 0x406758
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067b4
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42ca18]
xor eax, esi
inc ecx
dec edx
jne 0x406796
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp int.00401219
Function at 0x100316c
Capabilities:
Get domain information
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
push dword [0x101a768]
xor edi, edi
mov dword [ebp - 0x14], 0x104
mov dword [ebp - 8], edi
call fcn.01009547
lea eax, [ebp - 4]
push eax
push 1
call fcn.0100ed3d
cmp eax, edi
je 0x10031a4
push eax
call fcn.0100e881
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x220]
push eax
push 3
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 1
push edi
call sub.NETAPI32.dll_DsRoleGetPrimaryDomainInformation
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 0x10191b0
push 0x13
call fcn.0100e9ac
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0xc]
push eax
push 0x1019168
push 9
add esi, 5
call fcn.0100e9ac
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push edi
push dword [0x10191b4]
push esi
call fcn.0100e523
push eax
push esi
push edi
push str.__.ws_Fws_r_n
call fcn.0100e4f5
add esp, 0x14
cmp ebx, edi
je 0x100323a
lea eax, [ebp - 0x220]
push eax
push edi
push dword [0x10191bc]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
push edi
push dword [0x10191c4]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
add esp, 0x14
call fcn.0100e806
push edi
push dword [0x1019244]
push esi
call fcn.0100e523
push eax
push esi
push edi
push str.__.ws_r_n
call fcn.0100e4f5
mov eax, dword [ebp - 4]
add esp, 0x10
push 1
push dword [eax + 0x20]
call fcn.01006339
push dword [0x10191ac]
push edi
push dword [0x10191cc]
push esi
call fcn.0100e523
push eax
push esi
push edi
push str.__.ws__0.31ws_r_n
call fcn.0100e4f5
add esp, 0x14
call fcn.0100e806
mov eax, dword [ebp - 4]
push dword [eax + 0x14]
push edi
push dword [0x10191dc]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
add esp, 0x14
cmp dword [ebp - 0x10], edi
jne 0x100330a
mov eax, dword [ebp - 8]
push dword [eax + 0xc]
push edi
push dword [0x10191ec]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
add esp, 0x14
push dword [ebp - 8]
call sub.NETAPI32.dll_DsRoleFreeMemory
mov eax, dword [ebp - 4]
push dword [eax + 0x84]
push edi
push dword [0x10191e4]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
add esp, 0x14
call fcn.0100e806
mov eax, dword [ebp - 4]
push dword [eax + 0x24]
push edi
push dword [0x10191f4]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a7a4]
call fcn.0100e4f5
mov eax, dword [ebp - 4]
add esp, 0x14
push dword [eax + 0x2c]
push edi
push dword [0x10191fc]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a7a4]
call fcn.0100e4f5
mov eax, dword [ebp - 4]
add esp, 0x14
push dword [eax + 0x28]
push edi
push dword [0x1019204]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a7a8]
call fcn.0100e4f5
add esp, 0x14
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
call fcn.0100e815
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1003a8a
Capabilities:
Add user account

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x454]
push 0x106
push eax
call fcn.010107d3
movzx eax, ax
xor esi, esi
cmp eax, esi
jne 0x1003b26
push dword [ebp + 0xc]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x248]
push eax
mov word [ebp - 0x22c], si
call dword [sym.imp.msvcrt.dll__wcslwr]
lea eax, [ebp - 0x454]
push 0x10014c4
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x14
lea eax, [ebp - 0x454]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x248]
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
lea ecx, [ebp - 0x20]
inc eax
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 0x1001
mov dword [ebp - 4], esi
call sub.NETAPI32.dll_NetUserAdd
pop esi
leave
ret 8

Function at 0x1003b2b
Capabilities:
Delete user account

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push 0x106
push eax
call fcn.010107d3
movzx eax, ax
test eax, eax
jne 0x1003b72
lea eax, [ebp - 0x20c]
push 0x10014c4
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call sub.NETAPI32.dll_NetUserDel
leave
ret 8

Function at 0x100409b
Capabilities:
Add user account group

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
push edi
call fcn.0100d5e8
mov eax, dword [ebp + 8]
xor edi, edi
cmp dword [0x101d220], edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edi
je 0x1004124
mov edi, dword [sym.imp.msvcrt.dll_wcscmp]
mov esi, 0x101d220
push ebx
mov ebx, esi
push str._ADD
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
je 0x1004117
push 0x101a884
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
je 0x1004117
push dword [esi]
call fcn.0100e1b8
test eax, eax
mov dword [ebp + 8], eax
jne 0x1004102
push 0xdb1
call fcn.0100e881
push str._COMMENT
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x1004117
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
add ebx, 4
cmp dword [ebx], 0
mov esi, ebx
jne 0x10040cc
xor edi, edi
pop ebx
push 1
push edi
push edi
push 0x105
lea eax, [ebp - 0x214]
push eax
call fcn.0100d443
cmp eax, edi
je 0x1004143
push eax
call fcn.0100e881
push edi
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x214]
push eax
call sub.NETAPI32.dll_NetGroupAdd
mov esi, eax
cmp esi, edi
je 0x1004178
cmp esi, 0x35
jne 0x1004172
lea eax, [ebp - 0x214]
push eax
push 0xe81
call fcn.0100e791
push esi
call fcn.0100e881
call fcn.0100e815
pop edi
pop esi
leave
ret 4
Function at 0x1004266
Capabilities:
Delete user account group

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
call fcn.0100d5e8
push 1
push 0
push 0
push 0x105
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d443
test eax, eax
je 0x1004295
push eax
call fcn.0100e881
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.NETAPI32.dll_NetGroupDel
mov esi, eax
test esi, esi
je 0x10042c7
cmp esi, 0x35
jne 0x10042c1
lea eax, [ebp - 0x20c]
push eax
push 0xe81
call fcn.0100e791
push esi
call fcn.0100e881
call fcn.0100e815
pop esi
leave
ret 4

Function at 0x10042d1
Capabilities:
Add user account to group

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
xor esi, esi
mov dword [ebp - 4], esi
call fcn.0100d5e8
push 1
push esi
push esi
push 0x105
lea eax, [ebp - 0x214]
push eax
call fcn.0100d443
cmp eax, esi
je 0x1004304
push eax
call fcn.0100e881
cmp dword [0x101cc28], esi
mov dword [ebp - 8], 2
je 0x10043d0
push ebx
mov ebx, dword [ebp + 8]
mov esi, 0x101cc28
push edi
mov edi, esi
push dword [esi]
lea eax, [ebp - 0x214]
push ebx
push eax
call sub.NETAPI32.dll_NetGroupAddUser
mov ecx, eax
sub ecx, 0
je 0x1004399
sub ecx, 0x35
je 0x1004388
sub ecx, 0x46
je 0x1004370
sub ecx, 0x832
je 0x1004367
sub ecx, 0xf
je 0x1004358
push eax
call fcn.0100e881
jmp 0x1004399
push 2
mov dword [0x101d824], ebx
push 0xeaa
jmp 0x1004377
push 1
push 0xeab
jmp 0x1004377
push 1
push 0xe9e
mov eax, dword [esi]
mov dword [0x101d820], eax
call fcn.0100e35c
inc dword [ebp - 4]
jmp 0x1004399
lea eax, [ebp - 0x214]
push eax
push 0xe81
call fcn.0100e791
inc dword [ebp - 8]
add edi, 4
cmp dword [edi], 0
mov esi, edi
jne 0x1004323
cmp dword [ebp - 4], 0
pop edi
pop ebx
je 0x10043d0
mov eax, dword [ebp - 8]
add eax, 0xfffffffe
cmp dword [ebp - 4], eax
jge 0x10043c7
push 0xdb0
call fcn.0100e828
push 1
call fcn.0100e405
jmp 0x10043d5
call fcn.0100e815
pop esi
leave
ret 4
Function at 0x10043da
Capabilities:
Delete user account from group

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
xor esi, esi
mov dword [ebp - 4], esi
call fcn.0100d5e8
push 1
push esi
push esi
push 0x105
lea eax, [ebp - 0x214]
push eax
call fcn.0100d443
cmp eax, esi
je 0x100440d
push eax
call fcn.0100e881
cmp dword [0x101cc28], esi
mov dword [ebp - 8], 2
je 0x10044d9
push ebx
mov ebx, dword [ebp + 8]
mov esi, 0x101cc28
push edi
mov edi, esi
push dword [esi]
lea eax, [ebp - 0x214]
push ebx
push eax
call sub.NETAPI32.dll_NetGroupDelUser
mov ecx, eax
sub ecx, 0
je 0x10044a2
sub ecx, 0x35
je 0x1004491
sub ecx, 0x46
je 0x1004479
sub ecx, 0x832
je 0x1004470
sub ecx, 0x10
je 0x1004461
push eax
call fcn.0100e881
jmp 0x10044a2
push 2
mov dword [0x101d824], ebx
push 0xea9
jmp 0x1004480
push 1
push 0xeab
jmp 0x1004480
push 1
push 0xe9e
mov eax, dword [esi]
mov dword [0x101d820], eax
call fcn.0100e35c
inc dword [ebp - 4]
jmp 0x10044a2
lea eax, [ebp - 0x214]
push eax
push 0xe81
call fcn.0100e791
inc dword [ebp - 8]
add edi, 4
cmp dword [edi], 0
mov esi, edi
jne 0x100442c
cmp dword [ebp - 4], 0
pop edi
pop ebx
je 0x10044d9
mov eax, dword [ebp - 8]
add eax, 0xfffffffe
cmp dword [ebp - 4], eax
jge 0x10044d0
push 0xdb0
call fcn.0100e828
push 1
call fcn.0100e405
jmp 0x10044de
call fcn.0100e815
pop esi
leave
ret 4

Function at 0x10044e3
Capabilities:
List user account groups

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0xc], ebx
call fcn.0100d5e8
lea eax, [ebp - 0x10]
push eax
push 0xa
call fcn.0100ed3d
test eax, eax
je 0x1004518
mov dword [ebp - 0xc], 1
mov word [ebp - 0x42c], bx
jmp 0x1004534
mov eax, dword [ebp - 0x10]
push dword [eax]
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push dword [ebp - 0x10]
call sub.NETAPI32.dll_NetApiBufferFree
push ebx
push ebx
push ebx
push 0x105
lea eax, [ebp - 0x220]
push eax
call fcn.0100d443
cmp eax, ebx
je 0x1004552
push eax
call fcn.0100e881
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x220]
push eax
call sub.NETAPI32.dll_NetGroupEnum
cmp eax, ebx
je 0x1004578
push eax
call fcn.0100e881
cmp dword [ebp - 4], ebx
jne 0x1004582
call fcn.0100e86f
push 0x100b751
push 4
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_qsort]
add esp, 0x10
call fcn.0100e806
cmp word [ebp - 0x220], bx
je 0x10045c3
lea eax, [ebp - 0x220]
push 0x10014c0
push eax
call dword [sym.imp.msvcrt.dll_wcsspn]
pop ecx
pop ecx
lea eax, [ebp + eax*2 - 0x220]
jmp 0x10045c9
lea eax, [ebp - 0x42c]
push eax
push 0x1130
call fcn.0100e852
call fcn.0100e7af
mov edi, dword [ebp - 8]
xor esi, esi
cmp dword [ebp - 4], ebx
jbe 0x10045fc
push ebx
push dword [edi]
push 0x1001508
call fcn.0100e4f5
add esp, 0xc
inc esi
add edi, 4
cmp esi, dword [ebp - 4]
jb 0x10045e3
cmp dword [ebp - 0xc], ebx
pop edi
pop esi
pop ebx
je 0x1004615
push 0xdb0
call fcn.0100e828
push 1
call fcn.0100e405
push dword [ebp - 8]
call sub.NETAPI32.dll_NetApiBufferFree
call fcn.0100e815
leave
ret
Function at 0x1004624
Capabilities:
List user accounts for group

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
call fcn.0100d5e8
xor esi, esi
push esi
push esi
push esi
push 0x105
lea eax, [ebp - 0x21c]
push eax
call fcn.0100d443
cmp eax, esi
je 0x1004655
push eax
call fcn.0100e881
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 8]
lea eax, [ebp - 0x21c]
push eax
call sub.NETAPI32.dll_NetGroupGetInfo
cmp eax, esi
je 0x10046a9
cmp eax, 0x8ba
je 0x100467d
push eax
call fcn.0100e881
jmp 0x10046a9
mov eax, dword [ebp - 4]
push esi
push 3
push 0x101
push dword [eax]
push dword [ebp + 8]
push esi
call sub.NETAPI32.dll_I_NetNameCanonicalize
cmp eax, esi
je 0x100469d
push eax
call fcn.0100e881
mov eax, dword [ebp - 4]
mov ecx, dword [0x101a75c]
mov dword [eax + 4], ecx
lea eax, [ebp - 8]
push eax
push 0x1019328
push 2
call fcn.0100e9ac
add dword [ebp - 8], 5
mov eax, dword [ebp - 4]
push dword [eax]
push esi
push dword [0x101932c]
push dword [ebp - 8]
call fcn.0100e523
push eax
push dword [ebp - 8]
push esi
push dword [0x101a79c]
call fcn.0100e4f5
mov eax, dword [ebp - 4]
add esp, 0x14
push dword [eax + 4]
push esi
push dword [0x1019334]
push dword [ebp - 8]
call fcn.0100e523
push eax
push dword [ebp - 8]
push esi
push dword [0x101a79c]
call fcn.0100e4f5
add esp, 0x14
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x21c]
push eax
call sub.NETAPI32.dll_NetGroupGetUsers
cmp eax, esi
je 0x100473d
push eax
call fcn.0100e881
push 0x100b751
push 4
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_qsort]
add esp, 0x10
call fcn.0100e806
push 0x1133
call fcn.0100e828
call fcn.0100e7af
mov ebx, dword [ebp - 4]
xor edi, edi
cmp dword [ebp - 0xc], esi
jbe 0x10047a3
push esi
push dword [ebx]
push 0x19
call fcn.0100e523
push eax
push 0x10014fc
call fcn.0100e4f5
pop ecx
pop ecx
inc edi
push 3
xor edx, edx
mov eax, edi
pop ecx
div ecx
test edx, edx
jne 0x100479b
call fcn.0100e806
add ebx, 4
cmp edi, dword [ebp - 0xc]
jb 0x1004771
push 3
pop ecx
mov eax, edi
xor edx, edx
div ecx
pop edi
pop esi
pop ebx
test edx, edx
je 0x10047b8
call fcn.0100e806
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
call fcn.0100e815
leave
ret 4
Function at 0x1004829
Capabilities:
Accept command line arguments

Disassembly:
push esi
mov esi, dword [0x101d854]
test esi, esi
je 0x1004867
push edi
mov ecx, dword [esi + 8]
mov edi, dword [esi]
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
cmp dword [esi + 0xc], 0
mov edi, dword [esi + 4]
je 0x100485a
push dword [esi]
call fcn.01010acb
push esi
call fcn.01010acb
test edi, edi
mov esi, edi
jne 0x1004835
pop edi
mov eax, dword [0x101cc20]
and dword [0x101d854], 0
test eax, eax
je 0x100488b
mov esi, 0x101cc20
push eax
call fcn.01010aff
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x100487c
xor esi, esi
inc esi
cmp dword [0x101d84c], esi
jbe 0x10048ac
mov eax, dword [0x101d850]
push dword [eax + esi*4]
call fcn.01010ad0
inc esi
cmp esi, dword [0x101d84c]
jb 0x1004896
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.01010aff
pop esi
ret