joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403980
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
movzx eax, word [ebp + 0x14]
push esi
mov esi, ecx
mov dword [ebp - 0x18], eax
call fcn.00402040
cmp dword [ebp + 0xc], 0xffe3
jbe 0x4039f7
push 0x401400
push str._the_number_of_bytes_to_send_is_greater_than_sf::UdpSocket::MaxDatagramSize_
push str.Cannot_send_data_over_the_network
call fcn.00403c20
push eax
call fcn.004011b0
add esp, 8
push eax
call fcn.004011b0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
pop esi
mov eax, 4
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403f05
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
call fcn.00403450
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00403a70
add esp, 0xc
mov ecx, esi
movups xmm0, xmmword [eax]
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0xc]
movups xmmword [ebp - 0x14], xmm0
push ebx
call fcn.00402140
push eax
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x403a4b
call fcn.00403ab0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403f05
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00403f05
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403b80
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x10]
mov dword [esi], vtable.DefaultErrStreamBuf.0
mov edi, dword [eax]
mov eax, dword [esi + 0x20]
mov ebx, dword [eax]
cmp edi, ebx
je 0x403bce
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
sub ebx, edi
push ebx
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov eax, dword [esi + 0x30]
add esp, 0x14
mov ecx, dword [esi + 0x20]
mov edx, dword [eax]
mov eax, dword [esi + 0x10]
add edx, dword [ecx]
mov eax, dword [eax]
sub edx, eax
mov dword [ecx], eax
mov eax, dword [esi + 0x30]
mov dword [eax], edx
mov eax, dword [esi + 0x10]
mov edi, dword [eax]
push edi
call fcn.00404c20
add esp, 4
mov ecx, esi
pop edi
pop esi
pop ebx
jmp dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void_]
Function at 0x403db0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x10]
mov ebx, dword [eax]
mov eax, dword [esi + 0x20]
mov edi, dword [eax]
cmp ebx, edi
je 0x403df3
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
sub edi, ebx
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov eax, dword [esi + 0x30]
add esp, 0x14
mov ecx, dword [esi + 0x20]
mov edx, dword [eax]
mov eax, dword [esi + 0x10]
add edx, dword [ecx]
mov eax, dword [eax]
sub edx, eax
mov dword [ecx], eax
mov eax, dword [esi + 0x30]
mov dword [eax], edx
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x40db7a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x441e50]
test eax, eax
jne 0x40db95
mov ecx, 0x441e48
call fcn.0040dafb
mov eax, dword [0x441e50]
push esi
mov esi, dword [ebp + 0xc]
xor edx, edx
mov ecx, esi
and ecx, 0xfffffff0
cmp byte [ebp + 0x14], dl
setne dl
cmp byte [ebp + 0x10], 0
je 0x40dbdf
test eax, eax
je 0x40dbfa
push edx
push ecx
push dword [ebp + 8]
call eax
test eax, eax
jne 0x40dc1f
push str.CryptProtectMemory_failed
mov esi, 0x43cbd8
push esi
call fcn.00406b2c
pop ecx
pop ecx
mov ecx, esi
call fcn.00406c5c
push 2
mov ecx, esi
call fcn.00406b27
jmp 0x40dc1f
mov eax, dword [0x441e54]
test eax, eax
je 0x40dbfa
push edx
push ecx
push dword [ebp + 8]
call eax
test eax, eax
jne 0x40dc1f
push str.CryptUnprotectMemory_failed
jmp 0x40dbc0
push ebx
call dword [0x43008c]
xor edx, edx
mov ebx, eax
test esi, esi
je 0x40dc1e
push edi
mov edi, dword [ebp + 8]
add bl, 0x4b
lea ecx, [edx + edi]
lea eax, [edx + ebx]
xor byte [ecx], al
inc edx
cmp edx, esi
jb 0x40dc10
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
Function at 0x418433
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x43171c
push 1
push ebx
push 0x4317ec
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x418504
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0x4317dc
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x4184fb
cmp byte [ebp + 8], bl
je 0x418486
mov eax, dword [ebp - 8]
push 2
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x4184a3
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
push ebx
mov ecx, dword [eax]
cmp dword [ebp + 0x1c], ebx
jne 0x4184b5
push 0x430294
jmp 0x4184b8
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x4184cd
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x4184de
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
push 1
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
test eax, eax
js 0x4184f2
mov bl, 1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x418b32
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.0041c630
push 0x800
lea eax, [ebp - 0x1020]
push eax
call fcn.004185b2
cmp byte [0x4547e2], 0
jne 0x418bc7
push 6
push dword [0x43a14c]
lea eax, [ebp - 0x1020]
push eax
call fcn.0040b4f8
push eax
call fcn.00410708
test eax, eax
jne 0x418bc7
push 0x4304f4
call fcn.0041894c
lea eax, [ebp - 0x1020]
push eax
call fcn.00421845
xor ecx, ecx
push 0x1e
push ecx
mov word [ebp + eax*2 - 0x101e], cx
lea eax, [ebp - 0x20]
push eax
call fcn.0041d5e0
add esp, 0x10
mov dword [ebp - 0x1c], 3
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esp, ebp
pop ebp
ret
Function at 0x418e6b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0041c630
cmp byte [0x449118], 0
je 0x418f14
lea eax, [ebp - 0x200c]
push eax
push dword [ebp + 8]
call fcn.0041a204
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418f14
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1000
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x418f0b
mov eax, dword [ebp - 4]
mov ecx, 0x7ff
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x418eef
mov eax, ecx
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.0040ed2b
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8

Function at 0x4190b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov ebx, eax
neg ebx
sbb bl, bl
add bl, 1
je 0x419107
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 4]
dec eax
neg eax
sbb al, al
lea ebx, [eax + 1]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
jmp 0x41910f
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41b1aa
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1040
call fcn.0041c630
push ebx
push esi
mov esi, dword [esp + 0x1050]
xor ebx, ebx
cmp word [esi], bx
je 0x41b3e2
push esi
call fcn.00421845
pop ecx
cmp eax, 0x7f6
jae 0x41b3e2
push edi
push 0x3c
pop edi
push edi
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0041d5e0
add esp, 0xc
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], 0x1c0
cmp byte [esp + 0x1058], bl
je 0x41b20a
mov dword [esp + 0x14], 0x5c0
movzx ecx, word [esi]
lea edx, [esi + 2]
push 0x22
pop edi
cmp cx, di
je 0x41b21a
mov edx, esi
mov dword [esp + 0x20], edx
mov eax, ebx
push ebp
test cx, cx
je 0x41b264
push 0x20
mov ecx, esi
pop ebp
cmp word [ecx], di
jne 0x41b245
jmp 0x41b238
cmp word [esi + eax*2], di
je 0x41b241
inc eax
cmp word [esi + eax*2], bx
jne 0x41b232
jmp 0x41b245
mov word [esi + eax*2], bp
cmp word [esi + eax*2], bp
je 0x41b3b9
cmp word [esi + eax*2 + 2], 0x2f
je 0x41b3b3
inc eax
lea ecx, [esi + eax*2]
cmp word [ecx], bx
jne 0x41b22b
mov eax, dword [esp + 0x28]
test eax, eax
je 0x41b271
cmp word [eax], bx
jne 0x41b28b
cmp byte [esp + 0x105c], bl
jne 0x41b28b
cmp word [0x44a11a], bx
je 0x41b28b
mov dword [esp + 0x28], 0x44a11a
push edx
mov dword [esp + 0x34], 1
call fcn.0040ad74
mov esi, eax
test esi, esi
je 0x41b2b6
push str..inf
push esi
call fcn.004106e6
test eax, eax
jne 0x41b2b6
mov dword [esp + 0x20], str.Install
push dword [esp + 0x24]
call fcn.00409b05
test al, al
je 0x41b2de
push 0x800
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x2c]
call fcn.0040aafd
lea eax, [esp + 0x50]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41b3e0
mov edi, dword [esp + 0x1054]
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x449110], bl
jne 0x41b317
cmp byte [esp + 0x105c], bl
jne 0x41b317
cmp byte [0x4557fe], bl
je 0x41b376
test edi, edi
je 0x41b32c
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41b32c
push ebx
push edi
call ebp
mov bl, 1
push 0x7d0
push dword [esp + 0x50]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [esp + 0x4c]
call fcn.0041b638
cmp byte [0x4557fe], 0
je 0x41b376
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x50]
call dword [0x430124]
test eax, eax
je 0x41b376
mov eax, dword [esp + 0x10]
add eax, 0x3e8
cmp eax, dword [0x455800]
jbe 0x41b376
mov dword [0x455800], eax
push dword [esp + 0x4c]
call dword [0x430014]
test esi, esi
je 0x41b393
push str..exe
push esi
call fcn.004106e6
test eax, eax
je 0x41b3cc
cmp byte [0x449110], 0
mov al, byte [esp + 0x105c]
je 0x41b3d3
test al, al
jne 0x41b3d3
mov dword [0x455804], 0x1b58
jmp 0x41b3d3
cmp word [esi + eax*2], bp
jne 0x41b3bf
xor ecx, ecx
mov word [esi + eax*2], cx
inc eax
lea eax, [esi + eax*2]
mov dword [esp + 0x28], eax
jmp 0x41b268
mov al, byte [esp + 0x105c]
test bl, bl
je 0x41b3e0
test al, al
je 0x41b3e0
push 1
push edi
call ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1040
ret 0xc
Function at 0x41b3ed
Capabilities:
Hide graphical window

Disassembly:
and dword [0x4420f8], 0
push 1
push dword [esp + 8]
mov byte [0x4420ec], 1
mov byte [0x4420ed], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.00401263
cmp dword [0x449104], 0
jne 0x41b42d
cmp byte [0x4420f2], 0
je 0x41b436
cmp dword [0x4420e8], 0
jne 0x41b449
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x41b549
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041c630
cmp byte [0x449118], 0
je 0x41b5d3
cmp word [0x455808], 0
je 0x41b5d3
push esi
lea eax, [ebp - 0x1008]
push eax
push 0x455808
call fcn.0041a204
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41b5d2
push dword [ebp + 8]
call fcn.00421845
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43bdda
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, edx
xor ebx, ebx
and dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x14], esi
mov edi, ecx
and dword [esi], ebx
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
jne 0x43bec8
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 8
push eax
xor ecx, ecx
lea eax, [ebp - 8]
push eax
push ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
push eax
push ecx
push edi
push ecx
mov dword [ebp - 8], ecx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x43be53
call fcn.004c73cc
mov esi, eax
cmp esi, 0x8007007a
je 0x43be50
push esi
push 0xec0012e
push edi
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x43bf04
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x43be7f
mov ecx, 0x8007000e
push ecx
push 0xeca012e
mov esi, ecx
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x43bf04
push dword [ebp - 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x43be9e
mov ecx, 0x8007000e
push ecx
push 0xed1012e
jmp 0x43be72
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push ebx
lea ecx, [ebp - 0xc]
push ecx
push eax
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x43bec8
call fcn.004c73cc
mov esi, eax
push esi
push 0xede012e
jmp 0x43be74
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x43bee2
mov esi, 0x80070539
push esi
push 0xee5012e
jmp 0x43be74
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
jne 0x43bf02
call fcn.004c73cc
mov esi, eax
push esi
push 0xeea012e
jmp 0x43be74
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x43ebf6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43ec0c
test al, 0x10
jne 0x43ec0c
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x43f353
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x24], eax
mov ebx, edx
push esi
push edi
lea eax, [ebp - 0x10]
shr ebx, 1
mov dword [ebp - 0x20], eax
lea edi, [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x28], edx
stosd dword es:[edi], eax
mov esi, ecx
mov ecx, edx
mov dword [ebp - 0x18], esi
and ecx, 1
and ebx, 1
mov dword [ebp - 0x1c], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, 0x43f210
test esi, esi
jne 0x43f3a1
mov eax, 0x43f1d0
lea ecx, [ebp - 0x2c]
xor edi, edi
push ecx
push edi
lea ecx, [ebp - 0x28]
push ecx
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x43f3d1
call fcn.004c73cc
push eax
push 0x1c0012f
mov dword [ebp - 0x14], eax
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x43f450
mov ecx, dword [ebp - 0x18]
push edi
mov edi, dword [ebp - 0x1c]
mov edx, edi
push ebx
call fcn.0043f248
jmp 0x43f3e9
cmp eax, 0x102
jne 0x43f42d
push 0x1f4
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x18]
mov edx, edi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
push ebx
call fcn.0043f248
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x43f3e2
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x43f435
call fcn.004c73cc
push eax
mov dword [ebp - 0x14], eax
push 0x1d6012f
jmp 0x43f443
push eax
push 0x1e2012f
jmp 0x43f443
cmp dword [ebp - 0x14], 0
je 0x43f449
push dword [ebp - 0x14]
push 0x1d9012f
call dword [sym.imp.certcli.dll_Ordinal_357]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.005036b0
leave
ret 4
Function at 0x441372
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], esi
test edi, edi
je 0x441393
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov ecx, dword [0x518ddc]
neg ecx
sbb ecx, ecx
add ecx, 0x8b9
call fcn.004cf8b9
push eax
push 0x4063b8
call fcn.004c5942
mov eax, dword [0x518ddc]
neg eax
pop ecx
sbb eax, eax
pop ecx
and eax, 0xff000000
add eax, 0x1000000
push eax
push ebx
push ebx
push ebx
push 0x4063dc
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ecx, eax
mov dword [ebp - 0xc], ecx
test ecx, ecx
jne 0x4413f8
call fcn.004c73cc
mov esi, eax
push esi
push 0x3c70140
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x441553
mov eax, dword [0x518ddc]
neg eax
push ebx
sbb eax, eax
and eax, 0x80000000
add eax, 0x1000
push eax
push 0xffffffffffffffff
push 0x406404
push esi
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ebx, eax
test ebx, ebx
jne 0x441449
call fcn.004c73cc
mov esi, eax
test esi, esi
je 0x441446
push 0x80072ee6
push esi
push 0x3da0140
push dword [ebp - 4]
call dword [sym.imp.certcli.dll_Ordinal_360]
jmp 0x44152d
mov esi, dword [ebp - 4]
test edi, edi
jne 0x44149f
cmp dword [0x518ddc], edi
je 0x441477
cmp dword [0x51996c], edi
je 0x44149f
mov edx, esi
xor ecx, ecx
call fcn.0044078c
mov esi, eax
test esi, esi
je 0x44149f
push esi
push 0x3e40140
jmp 0x4414ff
cmp dword [0x51996c], 0
je 0x44149f
test ebx, ebx
je 0x44149f
mov ecx, ebx
call fcn.00440573
mov esi, eax
test esi, esi
je 0x44149f
push esi
push 0x3ec0140
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x441509
mov edx, dword [ebp - 4]
mov ecx, ebx
push edi
push dword [ebp - 8]
call fcn.00440a5f
mov esi, eax
test esi, esi
je 0x4414bf
push esi
push 0x3f10140
call dword [sym.imp.certcli.dll_Ordinal_357]
test edi, edi
jne 0x4414f5
cmp dword [0x518ddc], edi
jne 0x4414f5
cmp dword [0x51996c], edi
je 0x4414f5
mov edx, dword [ebp - 4]
xor ecx, ecx
call fcn.0044078c
mov edi, eax
test edi, edi
je 0x4414ef
push edi
push 0x3f80140
call dword [sym.imp.certcli.dll_Ordinal_357]
test esi, esi
jne 0x4414f9
mov esi, edi
test esi, esi
je 0x441505
push esi
push 0x3ff0140
call dword [sym.imp.certcli.dll_Ordinal_357]
test ebx, ebx
je 0x44152d
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
jne 0x44152d
call fcn.004c73cc
mov edi, eax
push edi
push 0x4070140
call dword [sym.imp.certcli.dll_Ordinal_357]
test esi, esi
jne 0x44152d
mov esi, edi
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
jne 0x441553
call fcn.004c73cc
mov edi, eax
push edi
push 0x4130140
call dword [sym.imp.certcli.dll_Ordinal_357]
test esi, esi
jne 0x441553
mov esi, edi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x451e7b
Capabilities:
Get domain controller name
List groups for user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
lea edx, [ebp - 4]
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push edi
push eax
call fcn.004cc0a1
mov edi, dword [ebp - 0xc]
mov esi, eax
test esi, esi
je 0x451eb3
push esi
push 0x23af0133
jmp 0x451f8d
test edi, edi
je 0x451f65
push 0x24
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x451f65
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push SysReAllocString
push esi
push esi
push dword [ebp - 4]
push esi
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
je 0x451efd
mov ecx, eax
call fcn.004c738c
mov esi, eax
push esi
push 0x23c20133
jmp 0x451f8d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push esi
push edi
push dword [eax]
call dword [sym.imp.NETAPI32.dll_NetUserGetGroups]
test eax, eax
je 0x451f2d
mov ecx, eax
call fcn.004c738c
mov esi, eax
push esi
push 0x23d00133
jmp 0x451f8d
mov ecx, 0x81b
call fcn.004cf8b9
push eax
push 0x408828
call fcn.004c5942
pop ecx
pop ecx
cmp dword [ebp - 0x14], esi
jbe 0x451f61
mov eax, dword [ebp - 8]
push dword [eax + esi*4]
push 0x4056e4
call fcn.004c5942
inc esi
pop ecx
pop ecx
cmp esi, dword [ebp - 0x14]
jb 0x451f49
xor esi, esi
jmp 0x451f93
mov ecx, 0x85c
call fcn.004cf8b9
push eax
call fcn.004c5942
mov dword [esp], 0x406520
call fcn.004c5942
pop ecx
mov esi, 0x80070057
push esi
push 0x23b60133
call dword [sym.imp.certcli.dll_Ordinal_357]
cmp dword [ebp - 4], 0
je 0x451fa2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x451fad
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], 0
je 0x451fbc
push dword [ebp - 8]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
pop edi
mov eax, esi
pop esi
leave
ret