joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46bd70
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x676000
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x75e7a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.006129a7
mov esi, eax
add esp, 4
test esi, esi
je 0x46bdd0
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00614e44
add esp, 4
mov dword [esi + 4], eax
jmp 0x46bdd2
xor esi, esi
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea edi, [eax + 0x14]
mov dword [eax + 0x20], ecx
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
mov dword [eax + 0x34], esi
lea esi, [eax + 8]
mov dword [eax + 0x2c], edx
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov esi, dword [ebp - 0x10]
not ecx
and ecx, 1
mov dword [edi], 0
shl ecx, 2
mov eax, ebx
mov dword [edx], 0
mov edx, ecx
or edx, 2
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
and al, 2
mov dword [esi + 0x38], 0
mov eax, ebx
cmovne edx, ecx
mov ecx, edx
or ecx, 8
and al, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
and bl, 4
cmove eax, ecx
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46d6e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x46d726
mov ax, word [ebp + 0xc]
test ax, ax
je 0x46d726
push edi
movzx edi, ax
push edi
push esi
push 0x59
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp eax, 1
jbe 0x46d725
cmp eax, edi
jae 0x46d725
push edi
add eax, esi
push eax
push 0x5a
push 0x400
mov byte [eax - 1], 0x5f
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
pop edi
pop esi
pop ebp
ret

Function at 0x46d810
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa30
mov eax, dword [0x75e7a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp - 0xa2c], eax
mov dword [ebp - 0xa30], ecx
test eax, eax
je 0x46d9c5
push 0x20a
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00628ae0
add esp, 0xc
xor eax, eax
mov word [ebp - 0xa28], ax
lea eax, [ebp - 0xa28]
push eax
push 0x1ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
dec eax
cmp eax, 0x1fe
ja 0x46d9c5
mov eax, dword [0x6b7420]
movzx ecx, word [ebp - 0xa28]
push esi
mov dword [ebp - 0xc], eax
mov ax, word [0x6b7424]
push edi
mov word [ebp - 8], ax
lea edi, [ebp - 0xa28]
nop dword [eax]
push 0x104
lea eax, [ebp - 0x420]
mov word [ebp - 0xc], cx
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x46d9a6
lea esi, [ebp - 0x420]
lea ecx, [esi + 2]
nop dword [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x46d8d0
sub esi, ecx
sar esi, 1
cmp esi, 0x104
jae 0x46d9a6
push esi
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0xa2c]
call fcn.0063de9b
add esp, 0xc
add esi, esi
test eax, eax
mov eax, dword [ebp - 0xa2c]
jne 0x46d91b
cmp word [esi + eax], 0x5c
jne 0x46d91b
mov ebx, 1
jmp 0x46d91d
xor ebx, ebx
test ebx, ebx
je 0x46d9a6
add eax, esi
push eax
lea eax, [ebp - 0xc]
push eax
push 0x6b7428
lea eax, [ebp - 0x628]
push 0x104
push eax
call fcn.00441140
lea ecx, [ebp - 0x628]
add esp, 0x14
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d950
sub ecx, edx
lea eax, [ebp - 0x628]
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x218]
push 0x105
push eax
call fcn.0063de41
lea ecx, [ebp - 0x218]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d984
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0xa30]
push eax
call fcn.00455ea0
movzx eax, word [edi]
add edi, 2
test ax, ax
jne 0x46d9a6
test ebx, ebx
jne 0x46d9c3
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x46d8a0
pop edi
pop esi
mov ecx, dword [ebp - 4]
test ebx, ebx
pop ebx
setne al
xor ecx, ebp
call fcn.00612996
mov esp, ebp
pop ebp
ret
Function at 0x46de30
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x676532
mov eax, dword fs:[0]
push eax
sub esp, 0x310
mov eax, dword [0x75e7a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x31c], esi
mov dword [ebp - 0x318], 0
push 7
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
push str.unknown
mov dword [ebp - 4], 0
mov byte [esi], 0
call fcn.00455da0
mov ax, word [0x6b4060]
push 0x1fe
mov word [ebp - 0x310], ax
lea eax, [ebp - 0x30e]
push 0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x318], 1
call fcn.00628ae0
add esp, 0xc
mov dword [ebp - 0x314], 0x100
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x310]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x46df4a
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00628ae0
add esp, 0xc
lea eax, [ebp - 0x110]
push 0
push 0
push 0x100
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x310]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46df32
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
mov ecx, esi
call fcn.00455da0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00612996
mov esp, ebp
pop ebp
ret

Function at 0x46e0a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x676532
mov eax, dword fs:[0]
push eax
sub esp, 0x310
mov eax, dword [0x75e7a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x31c], esi
mov dword [ebp - 0x318], 0
push 7
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
push str.unknown
mov dword [ebp - 4], 0
mov byte [esi], 0
call fcn.00455da0
mov ax, word [0x6b4060]
push 0x1fe
mov word [ebp - 0x310], ax
lea eax, [ebp - 0x30e]
push 0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x318], 1
call fcn.00628ae0
add esp, 0xc
mov dword [ebp - 0x314], 0x100
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x310]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x46e1ba
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00628ae0
add esp, 0xc
lea eax, [ebp - 0x110]
push 0
push 0
push 0x100
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x310]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46e1a2
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
mov ecx, esi
call fcn.00455da0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00612996
mov esp, ebp
pop ebp
ret
Function at 0x46e1e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x75e7a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push 0x104
push 0
push eax
call fcn.00628ae0
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push 0
push 0
push 0x2e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x46e241
push 0x104
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0063e4a7
add esp, 0xc
lea edx, [ebp - 0x108]
lea ecx, [edx + 1]
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x46e250
sub edx, ecx
lea eax, [ebp - 0x108]
push edx
push eax
mov ecx, esi
call fcn.00452c80
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00612996
mov esp, ebp
pop ebp
ret
Function at 0x4706b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x676848
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x75e7a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 8
mov dword [ebx + 0x30], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0x201
mov dword [ebx + 0x18], 6
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0xc], 0
call fcn.006129a7
mov edi, eax
add esp, 4
test edi, edi
je 0x470754
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00614e44
add esp, 4
mov dword [edi + 4], eax
jmp 0x470756
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], 0
mov edi, dword [edi + 4]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x6aa5ec]
mov ecx, edi
call esi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 1
push eax
call fcn.004693b0
mov edi, eax
add esp, 4
mov ecx, dword [edi]
push 0x20
mov esi, dword [ecx + 0x20]
mov ecx, esi
call dword [0x6aa5ec]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x14]
mov byte [ebp - 0xd], al
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4707e2
mov edx, dword [edi]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x6aa5ec]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
je 0x4707df
mov ecx, dword [edi]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x6aa5ec]
mov ecx, edi
call esi
mov al, byte [ebp - 0xd]
cmp dword [ebx + 0x38], 0
mov byte [ebx + 0x40], al
jne 0x4707fe
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x10]
and eax, 0x13
or eax, 4
mov dword [ebx + 0xc], eax
and ecx, eax
jne 0x470821
cmp byte [ebp + 0xc], 0
je 0x47080d
push ebx
call fcn.0061568e
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x47082d
mov esi, 0x6b72bc
jmp 0x47083d
test cl, 2
mov esi, 0x6b72d4
mov eax, 0x6b72ec
cmove esi, eax
lea eax, [ebp - 0x18]
push 1
push eax
call fcn.00441c40
add esp, 8
lea ecx, [ebp - 0x2c]
push eax
push esi
call fcn.00442120
push 0x738048
lea eax, [ebp - 0x2c]
push eax
call fcn.00628cde
int3
Function at 0x4714a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00612d80
mov eax, dword [0x75e7a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
call fcn.00441130
push ebx
push 0
push edi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
test esi, esi
jne 0x471532
push 0xffd
lea edx, [ebp - 0x1004]
or ecx, 1
push edx
push eax
push ecx
call fcn.0063746c
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
jle 0x471503
lea eax, [ebp + eax - 0x1004]
jmp 0x47150b
cmp eax, 0xffffffff
jne 0x471543
lea eax, [ebp - 7]
mov word [eax], 0xa0d
mov byte [eax + 2], 0
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00612996
mov esp, ebp
pop ebp
ret
push esi
push eax
push ecx
call fcn.00637318
push esi
call fcn.0063f91e
add esp, 0x1c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00612996
mov esp, ebp
pop ebp
ret

Function at 0x471d70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x75e7a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x471de7
test edi, edi
je 0x471de7
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x471d95
sub ecx, edx
je 0x471de7
lea eax, [ebp - 0x34]
push eax
push edi
call fcn.00472530
add esp, 8
test eax, eax
jne 0x471de7
mov eax, dword [ebp - 0x20]
inc eax
push 1
push eax
call fcn.0063dc96
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x471de7
push 0x6b30b0
push edi
call fcn.00472270
mov edi, eax
add esp, 8
mov eax, dword [esi]
test edi, edi
jne 0x471dfa
push eax
call fcn.0063d570
add esp, 4
mov dword [esi], edi
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00612996
mov esp, ebp
pop ebp
ret
push edi
push dword [ebp - 0x20]
push 1
push eax
call fcn.00632859
push edi
mov esi, eax
call fcn.00632464
mov ecx, dword [ebp - 4]
add esp, 0x14
mov eax, esi
xor ecx, ebp
pop edi
pop esi
call fcn.00612996
mov esp, ebp
pop ebp
ret
Function at 0x472020
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x75e7a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
dec eax
push esi
push edi
cmp eax, 0xfe
ja case.0x47204b.2
movzx eax, byte [eax + 0x472138]
jmp dword [eax*4 + 0x472118]
mov esi, 0x2b
jmp 0x472081
mov esi, 0x23
jmp 0x472081
mov esi, 0x1a
jmp 0x472081
mov esi, 0x1c
jmp 0x472081
mov esi, 0x2a
jmp 0x472081
mov esi, 0x26
jmp 0x472081
mov esi, 0x2c
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
mov eax, esi
or eax, 0x8000
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x4720c1
cmp esi, 0x2c
jne 0x472105
push 1
push ebx
call fcn.00472020
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00612996
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
call fcn.00471b40
mov edi, eax
add esp, 4
test edi, edi
je 0x472105
push 0x104
push edi
push 0x104
push ebx
call fcn.00471a90
push edi
mov esi, eax
call fcn.0063d570
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00612996
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00612996
mov esp, ebp
pop ebp
ret

Function at 0x472310
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00471ae0
mov edi, eax
add esp, 4
test edi, edi
je 0x47233d
push esi
push edi
call fcn.00640f9f
push edi
mov esi, eax
call fcn.0063d570
add esp, 8
mov eax, esi
pop esi
pop edi
pop ebp
ret
push 0x16
call fcn.00640c21
add esp, 4
or eax, 0xffffffff
pop edi
pop ebp
ret

Function at 0x472560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x75e7a4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4725ef
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00471b40
mov esi, eax
add esp, 4
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4725a4
sub ecx, edx
je 0x4725ba
cmp byte [ecx + esi - 1], 0x5c
jne 0x4725ba
mov byte [ecx + esi - 1], al
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4725c0
sub ecx, edx
push ecx
push esi
push dword [ebp + 0xc]
push edi
call fcn.00471a90
push esi
call fcn.0063d570
add esp, 0x14
mov eax, edi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00612996
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.00612996
mov esp, ebp
pop ebp
ret
Function at 0x477330
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x677438
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x75e7a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x47736a
mov byte [esi + 0xc], 1
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea edi, [esi + 8]
push edi
push 0x6b79e8
push 1
push 0
push 0x6b79c8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test ebx, ebx
js 0x47746d
cmp dword [edi], 0
je 0x477447
push 0x6b8b30
lea ecx, [ebp - 0x10]
call fcn.00477080
mov eax, dword [eax]
mov dword [ebp - 4], 0
test eax, eax
je 0x4773cb
mov ebx, dword [eax]
jmp 0x4773cd
xor ebx, ebx
mov ecx, dword [edi]
lea eax, [esi + 4]
push eax
push 0
push 0
mov edx, dword [ecx]
push 0
push 0
push 0
push 0
push ebx
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp - 0x10]
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x477444
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x47743d
test edi, edi
je 0x47743d
mov eax, dword [edi]
test eax, eax
je 0x47741b
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x477432
push eax
call fcn.00612991
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.006129d7
add esp, 8
mov dword [ebp - 0x10], 0
lea edi, [esi + 8]
test ebx, ebx
js 0x47746d
mov eax, dword [esi + 4]
test eax, eax
je 0x477469
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test ebx, ebx
jns 0x4774a3
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x47747a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [edi]
test ecx, ecx
je 0x477486
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp byte [esi + 0xc], 0
je 0x477492
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [esi + 4], 0
mov dword [edi], 0
mov byte [esi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478ef0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x75e7a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
push eax
push 0
push 8
mov word [ebp - 8], 0x500
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x478f6e
call esi
cmp eax, 0x3f0
jne 0x478f4f
lea eax, [ebp - 0x14]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x478f6e
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00612996
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x478f58
call esi
cmp eax, 0x7a
jne 0x478f58
mov esi, dword [ebp - 0x18]
mov eax, esi
call fcn.00613810
mov ebx, esp
test ebx, ebx
je 0x478f58
lea eax, [ebp - 0x18]
push eax
push esi
push ebx
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x478f58
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x222
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x478f58
xor esi, esi
mov byte [ebp - 0xd], 0
cmp dword [ebx], esi
jbe 0x479000
lea edi, [ebx + 4]
push dword [ebp - 0x1c]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x478ffc
inc esi
add edi, 8
cmp esi, dword [ebx]
jb 0x478fe3
jmp 0x479000
mov byte [ebp - 0xd], 1
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0xd]
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00612996
mov esp, ebp
pop ebp
ret
Function at 0x47cd20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x75e7a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push 1
mov dword [ebp - 0x18], eax
mov esi, ecx
lea eax, [ebp - 0x14]
push 0xe
push eax
call fcn.00632859
add esp, 0x10
cmp eax, 1
jne 0x47ceb0
mov edx, dword [ebp - 0x14]
mov di, word [ebp - 0xe]
mov bx, word [ebp - 0xc]
mov ecx, dword [ebp - 0x12]
mov eax, dword [ebp - 0xa]
mov byte [esi], dl
mov byte [esi + 1], dh
mov dword [esi + 4], ecx
mov word [esi + 8], di
mov word [esi + 0xa], bx
mov dword [esi + 0xc], eax
cmp dl, 0x42
jne 0x47ceb0
cmp dh, 0x4d
jne 0x47ceb0
test di, di
jne 0x47ceb0
test bx, bx
jne 0x47ceb0
lea eax, [ecx - 0x37]
cmp eax, 0x1e8449
ja 0x47ceb0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x47cdbe
push eax
call fcn.0063d570
mov ecx, dword [esi + 4]
add esp, 4
push ecx
call fcn.0063dcb0
add esp, 4
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x47cde6
pop edi
pop esi
mov eax, 0xfffffff9
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00612996
mov esp, ebp
pop ebp
ret 4
xor edx, edx
nop dword [eax + eax]
mov ecx, dword [esi + 0x3c]
movzx eax, byte [ebp + edx - 0x14]
mov byte [edx + ecx], al
mov ecx, dword [esi + 0x3c]
movzx eax, byte [ebp + edx - 0x13]
mov byte [ecx + edx + 1], al
add edx, 2
cmp edx, 0xe
jl 0x47cdf0
push dword [ebp - 0x18]
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 4]
sub eax, 0xe
push 1
push eax
lea eax, [ecx + 0xe]
push eax
call fcn.00632859
mov edx, dword [esi + 0x3c]
add esp, 0x10
cmp eax, 1
jne 0x47cea0
mov eax, dword [edx + 0xe]
mov dword [esi + 0x10], eax
mov eax, dword [edx + 0x12]
mov dword [esi + 0x14], eax
mov eax, dword [edx + 0x16]
mov dword [esi + 0x18], eax
movzx ecx, word [edx + 0x1a]
mov dword [esi + 0x1c], ecx
movzx eax, word [edx + 0x1c]
mov dword [esi + 0x20], eax
mov edi, eax
mov ebx, dword [edx + 0x1e]
mov dword [esi + 0x24], ebx
mov eax, dword [edx + 0x22]
mov dword [esi + 0x28], eax
mov eax, dword [edx + 0x26]
mov dword [esi + 0x2c], eax
mov eax, dword [edx + 0x2a]
mov dword [esi + 0x30], eax
mov eax, dword [edx + 0x2e]
mov dword [esi + 0x34], eax
mov eax, dword [edx + 0x32]
mov dword [esi + 0x38], eax
cmp ecx, 1
jne 0x47cea0
test ebx, ebx
jne 0x47cea0
cmp edi, 0x18
je 0x47ce8b
cmp edi, 0x20
jne 0x47cea0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00612996
mov esp, ebp
pop ebp
ret 4
push edx
call fcn.0063d570
mov dword [esi + 0x3c], 0
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 0xfffffffe
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00612996
mov esp, ebp
pop ebp
ret 4