joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475eb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x475efe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x475efe
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x475f03
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x475ee9
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x475f13
test esi, esi
jne 0x475f31
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x475f2f
mov byte [eax + esi - 1], 0
jne 0x475f38
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret

Function at 0x47b690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x47b6e0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x47b6e0
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x47b6e5
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x47b6cb
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x47b6f2
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x482e00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov edx, ecx
push edi
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bx
add edx, 4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
lea ecx, [esp + 0x18]
push eax
push edx
push 0x5bf338
push ecx
call fcn.004313f9
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
xor esi, esi
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x482e77
lea ecx, [esp + 0xc]
lea edx, [esp + 0x18]
push ecx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x482ef2
mov edi, dword [esp + 0x220]
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
lea ecx, [esp + 0x1c]
push ebx
push ecx
push ebx
push edi
push edx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esp + 0x14]
cmp eax, 2
jb 0x482ed8
add eax, 2
mov dword [esp + 0x14], eax
shr eax, 1
add eax, eax
push eax
call fcn.005568c8
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x482ed8
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push ebx
push edi
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8

Function at 0x482f00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
mov edx, ecx
push edi
xor esi, esi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
add edx, 4
push eax
push edx
lea ecx, [esp + 0x20]
push 0x5bf338
push ecx
call fcn.004313f9
add esp, 0x10
lea edx, [esp + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0xc], esi
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x482f78
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x482fb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x224]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push esi
push eax
push ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x210
ret 8
Function at 0x483250
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
xor esi, esi
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x48328d
lea ecx, [esp + 8]
push ecx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x48330d
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edx
lea eax, [esp + 0x14]
push 0
push eax
push 0
push edi
push ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x4832f7
add eax, 2
mov dword [esp + 0x18], eax
shr eax, 1
lea edx, [eax + eax]
push edx
call fcn.005568c8
mov esi, eax
add esp, 4
test esi, esi
je 0x4832f7
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, esi
pop edi
pop esi
add esp, 8
ret 8
mov eax, esi
pop edi
pop esi
add esp, 8
ret 8
Function at 0x483420
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x57424b
push eax
mov dword fs:[0], esp
sub esp, 0x65c
mov ecx, 0x5e3678
push ebx
push ebp
push esi
push edi
push str.PATH
push 0x5e367c
call fcn.00483250
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
je 0x483471
push ebp
call fcn.0043139f
add esp, 4
test eax, eax
jne 0x4834b4
push ebp
call fcn.005568f1
add esp, 4
push 0x5bfbd4
call fcn.0043139f
inc eax
lea esi, [eax + eax]
push esi
call fcn.005568c8
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x4835f8
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0x5bfbd4
and ecx, 3
push ebp
rep stosb byte es:[edi], al
call fcn.0043137a
add esp, 8
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x266]
mov word [esp + 0x264], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x264]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x67c]
lea ecx, [esp + 0x264]
push eax
push str.oadbg_
push str._s_s_
push ecx
call fcn.004313f9
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x476]
mov word [esp + 0x474], bx
rep stosd dword es:[edi], eax
add esp, 0x10
lea edx, [esp + 0x264]
stosw word es:[edi], ax
push edx
push ebp
lea eax, [esp + 0x46c]
push str._s_s
push eax
call fcn.004313f9
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ebx
rep stosd dword es:[edi], eax
add esp, 0x10
lea ecx, [esp + 0x14]
lea edx, [esp + 0x464]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4835ef
mov esi, dword [esp + 0x680]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [esp + 0x40]
push 0x5bfba0
push eax
call edi
test eax, eax
je 0x4835d8
lea ecx, [esp + 0x40]
push 0x5bfb9c
push ecx
call edi
test eax, eax
je 0x4835d8
test byte [esp + 0x14], 0x10
jne 0x4835d8
lea edx, [esp + 0x40]
lea ecx, [esp + 0x10]
push edx
call fcn.005562b7
mov eax, dword [esi + 8]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x67c], 0
call fcn.005548f6
lea ecx, [esp + 0x10]
mov dword [esp + 0x674], 0xffffffff
call fcn.005561f7
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x483574
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call fcn.005568f1
add esp, 4
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x668
ret 8
Function at 0x483cc0
Capabilities:
Get user security identifier

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
xor ebx, ebx
push eax
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ebp
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x483d0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x483d0b
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.005568c8
mov ecx, dword [esp + 0x14]
mov dword [edi], eax
lea edx, [ecx + ecx]
push edx
call fcn.005568c8
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x483d50
test esi, esi
je 0x483d61
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x1c]
push esi
push ecx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test esi, esi
je 0x483d5d
push esi
call fcn.005568f1
add esp, 4
test ebx, ebx
jne 0x483d70
mov edi, dword [edi]
test edi, edi
je 0x483d70
push edi
call fcn.005568f1
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret
Function at 0x48a7a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57453f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x5b9f20]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], 1
mov cl, byte [eax + 0xf]
mov dl, byte [eax + 0xe]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xd]
mov dl, byte [eax + 0xc]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xb]
mov dl, byte [eax + 0xa]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 9]
mov dl, byte [eax + 8]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 6]
mov dx, word [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push str._08lX__04lX__04lX__02lX_02lX__02lX_02lX_02lX_02lX_02lX_02lX
push ecx
call fcn.00552f2f
mov esi, dword [esp + 0x50]
add esp, 0x34
lea edx, [esp + 4]
mov ecx, esi
push edx
call fcn.00555f6c
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.005561f7
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x492970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x574daf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x5b9f20]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], 1
mov cl, byte [eax + 0xf]
mov dl, byte [eax + 0xe]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xd]
mov dl, byte [eax + 0xc]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xb]
mov dl, byte [eax + 0xa]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 9]
mov dl, byte [eax + 8]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 6]
mov dx, word [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push str._08lX__04lX__04lX__02lX_02lX__02lX_02lX_02lX_02lX_02lX_02lX
push ecx
call fcn.00552f2f
mov esi, dword [esp + 0x50]
add esp, 0x34
lea edx, [esp + 4]
mov ecx, esi
push edx
call fcn.00555f6c
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.005561f7
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x492eb0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.00432500
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x492edb
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x492eed
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x493059
push esi
call fcn.004942b0
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x492f23
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.00493ee0
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x492f62
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.004933f0
mov eax, dword [esp + 0xa4]
push ebp
push eax
push edi
call fcn.00493560
lea esi, [ebx + 0x34]
lea ecx, [ebx + 0x38]
push esi
push ecx
push edi
call fcn.00493660
add esp, 0x24
jmp 0x492fa1
test ebp, ebp
jl 0x492f6e
cmp ebp, 0x80
jle 0x492f82
push 0x5866a8
push 0x5e
push str..cryptohmachmac.c
call fcn.00493ee0
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x492fc6
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x38]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x492fcf
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x14]
push ebp
push esi
push edi
call fcn.004933f0
push esi
call fcn.004942b0
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.00493560
add esp, 0x1c
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x49300b
lea edi, [ebx + 0x24]
push ebp
push esi
push edi
call fcn.004933f0
push esi
call fcn.004942b0
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.00493560
add esp, 0x1c
lea eax, [ebx + 0x14]
add ebx, 4
push eax
push ebx
call fcn.00493710
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x49303e
jmp 0x492fcd
Function at 0x493d60
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.00432500
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x493da9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x493da9
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x5bb4d0
call fcn.0052f9e9
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.0052f999
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x493ebb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x493ebb
lea edx, [ebp - 4]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x493ebb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x493ebb
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x493ebb
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.00432500
lea eax, [ebp - 4]
mov edi, esp
push eax
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x493ebb
mov ecx, dword [ebp - 4]
push str.Service_0x
push edi
lea eax, [ecx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call fcn.00431690
add esp, 8
test eax, eax
je 0x493ebb
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bb8e0
Capabilities:
Get user security identifier

Disassembly:
mov eax, dword [0x5e458c]
sub esp, 0xa0
push ebx
xor ebx, ebx
push ebp
cmp eax, ebx
push edi
jne 0x4bb92c
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esp + 0x28]
mov eax, 1
cmp ecx, 2
jne 0x4bb927
mov dword [0x5e4590], eax
mov dword [0x5e458c], eax
cmp dword [0x5e4590], ebx
jne 0x4bb940
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa0
ret
mov ebp, dword [esp + 0xb0]
mov edi, dword [esp + 0xb4]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
lea eax, [esp + 0x14]
push ebx
push eax
push ebx
push ebp
push ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x4bb98c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x4bb98c
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa0
ret
mov ecx, dword [esp + 0xc]
push esi
push ecx
call fcn.005568c8
mov edx, dword [esp + 0x18]
mov dword [edi], eax
lea eax, [edx + edx]
push eax
call fcn.005568c8
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x4bb9d1
test esi, esi
je 0x4bb9e2
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x18]
push esi
push ecx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test esi, esi
je 0x4bb9de
push esi
call fcn.005568f1
add esp, 4
test ebx, ebx
jne 0x4bb9f1
mov edi, dword [edi]
test edi, edi
je 0x4bb9f1
push edi
call fcn.005568f1
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x4bc100
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574ee8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd0
mov eax, dword [0x5e4534]
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
mov dword [ebp - 0x10], esp
jne 0x4bc2eb
push 1
push 0x5e4540
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push esi
push esi
push 1
push 0x5e4540
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea ecx, [ebp - 0x34]
mov dword [0x5e4558], 0xc
mov dword [0x5e4560], esi
mov dword [0x5e455c], 0x5e4540
call fcn.00451520
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], esi
call fcn.00554b96
mov eax, dword [0x5e4594]
mov byte [ebp - 4], 1
cmp eax, esi
mov dword [ebp - 0x24], str.S_1_1_0
mov dword [ebp - 0x20], str.S_1_15_2_1
mov dword [ebp - 0x1c], str.S_1_15_2_2
mov ebx, 3
jne 0x4bc201
mov ecx, 0x24
xor eax, eax
lea edi, [ebp - 0xd8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xdc], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0xcc]
mov ecx, 2
cmp eax, ecx
jne 0x4bc1f7
mov eax, dword [ebp - 0xd8]
cmp eax, 6
ja 0x4bc1ed
jne 0x4bc1f7
cmp dword [ebp - 0xd4], ecx
jb 0x4bc1f7
mov dword [0x5e4598], 1
mov dword [0x5e4594], 1
cmp dword [0x5e4598], esi
jne 0x4bc20e
mov ebx, 1
cmp ebx, esi
jle 0x4bc255
lea esi, [ebp - 0x24]
mov edi, ebx
mov ecx, dword [esi]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00449fa0
mov edx, dword [ebp - 0x30]
push eax
push edx
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.00451c80
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0044a810
mov eax, dword [ebp - 0x40]
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x48]
call fcn.00554dba
add esi, 4
dec edi
jne 0x4bc217
xor esi, esi
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x34]
push ecx
push edx
push 0x5e4578
mov byte [ebp - 4], 3
call fcn.004bbcc0
add esp, 0xc
cmp eax, esi
jne 0x4bc2a9
lea eax, [ebp - 0x18]
push 0x5a09d0
push eax
mov dword [ebp - 0x18], esi
call fcn.00432aab
push 1
push 0x5e4578
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
push 0x5e4578
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov eax, 0x4bc2a7
ret
mov eax, 1
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], eax
mov dword [0x5e4568], 0xc
mov dword [0x5e4570], esi
mov dword [0x5e456c], 0x5e4578
mov dword [0x5e4534], eax
mov byte [ebp - 4], 0
call fcn.00554bc9
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.00451530
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bc960
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x574fac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x5b9f20]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 8]
mov dword [edi], eax
mov ecx, dword [0x5b9f20]
lea ebp, [esi + 0x18]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [ebp], ecx
mov edx, dword [0x5b9f20]
mov dword [esi + 0x20], edx
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 2
call fcn.00554f46
mov eax, dword [esp + 0x24]
mov ecx, edi
push eax
mov byte [esp + 0x20], 3
mov dword [esi], 0x58cfa8
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
mov word [esi + 0x24], 0xffff
call fcn.00556380
mov eax, dword [esp + 0x28]
mov cx, word [esp + 0x30]
test eax, 0xffff0000
mov word [esi + 0x24], cx
mov dword [esi + 0x14], eax
je 0x4bca03
push eax
mov ecx, ebp
call fcn.00556380
mov edx, dword [ebp]
mov dword [esi + 0x14], edx
mov eax, dword [esp + 0x2c]
test eax, 0xffff0000
mov dword [esi + 0x1c], eax
je 0x4bca21
lea edi, [esi + 0x20]
push eax
mov ecx, edi
call fcn.00556380
mov eax, dword [edi]
mov dword [esi + 0x1c], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10