joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471d40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
add eax, 0xa0
push eax
mov ecx, dword [ebp - 0x20]
call fcn.00476790
test eax, eax
je 0x471de2
mov ecx, dword [ebp - 0x20]
add ecx, 0xa0
call fcn.0042e880
test eax, eax
je 0x471de2
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x20]
add ecx, 0xa0
call fcn.00442990
mov ecx, eax
call fcn.00441480
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x10
call fcn.00405f90
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x20]
add ecx, 0xa0
call fcn.00442990
mov ecx, eax
call fcn.00441480
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x2c
call fcn.00405f90
mov ecx, dword [ebp - 0x20]
add ecx, 0x10
call fcn.00406030
push eax
push 0x5de9a8
push 0x5dea1c
call fcn.0040c050
add esp, 0xc
mov ecx, dword [ebp - 0x20]
call fcn.00470f60
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
push 0x471eb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x471e2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5dea48
push 0x5deab4
call fcn.0040c050
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 0x20]
push eax
push 0x471ef0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x471e67
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Create_elog_audit_thread_fail__err_d__out_n
push str.CSessionMon::StartSessionMonitorAsync
call fcn.0040c050
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x471e77
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x471e87
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x471e97
cmp dword [ebp - 8], 0
jne 0x471e97
xor eax, eax
jmp 0x471ea7
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x471f30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], 0
mov byte [ebp - 0x108], 0
push 0xff
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.00562540
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x5de8ec
push 0xfe
lea eax, [ebp - 0x108]
push eax
call fcn.0055d70d
add esp, 0x14
lea ecx, [ebp - 0x10c]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x108]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x472045
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_RegOpenKeyExA_err_d__retry__n
push 0x5dec88
call fcn.0040c050
add esp, 0xc
push 0x100
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.00562540
add esp, 0xc
push 0x5dec98
mov ecx, dword [ebp + 8]
push ecx
push str.SystemCurrentControlSetServicesEventLog_s_s
push 0xfe
lea edx, [ebp - 0x108]
push edx
call fcn.0055d70d
add esp, 0x14
lea eax, [ebp - 0x10c]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x108]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x472045
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_RegOpenKeyExA_retry_err_d__retry__n
push 0x5ded34
call fcn.0040c050
add esp, 0xc
xor eax, eax
jmp 0x4720a9
mov dword [ebp - 0x110], 0x103
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
push str.EventMessageFile
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x472097
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_RegQueryValueExA_err_d__OUT__n
push str.el_getEventDLL
call fcn.0040c050
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov byte [edx], 0
xor eax, eax
jmp 0x4720a9
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret
Function at 0x4720c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 0x18], eax
cmp dword [0x63bfe0], 0
jne 0x472230
mov byte [ebp - 0x120], 0
push 0x104
push 0
lea eax, [ebp - 0x11f]
push eax
call fcn.00562540
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00471f30
add esp, 0xc
test eax, eax
jne 0x472138
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_el_getEventDLL_err_d__OUT__n
push 0x5dee04
call fcn.0040c050
add esp, 0xc
xor eax, eax
jmp 0x4722ad
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x10], ecx
push 0x3b
mov edx, dword [ebp - 0x10]
push edx
call fcn.0046f8a0
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x472179
mov eax, dword [ebp - 0x14]
mov byte [eax], 0
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x472179
mov byte [ebp - 0x228], 0
push 0x100
push 0
lea edx, [ebp - 0x227]
push edx
call fcn.00562540
add esp, 0xc
push 0xff
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call fcn.00414e20
mov dword [ebp - 0xc], eax
push 0x22
push 0
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [0x63bfe0], eax
cmp dword [0x63bfe0], 0
jne 0x472224
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5dee18
push 0x5dee64
call fcn.0040c050
add esp, 0xc
push 2
push 0
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [0x63bfe0], eax
cmp dword [0x63bfe0], 0
jne 0x472224
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_LoadLibraryExA_err_d__OUT__n
push 0x5deec4
call fcn.0040c050
add esp, 0xc
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00414de0
add esp, 4
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
or edx, 0x800
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
or eax, 0x100
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
or ecx, 0x2000
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
cmp dword [0x63bfe0], 0
je 0x4722aa
mov edx, dword [ebp + 0x14]
push edx
push 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
push edx
mov eax, dword [0x63bfe0]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x4722aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_FormatMessageA_err_d__OUT__n
push str.el_GetMessage
call fcn.0040c050
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret
Function at 0x47ce20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0
call fcn.0047c9a0
mov ecx, eax
call fcn.00401f30
test eax, eax
jne 0x47ce52
push str.cdrom_interval_init_error
push str.CUSBMonitor::IniUSBMonitor
call fcn.0040c050
add esp, 8
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x47ce00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x47ce81
mov eax, 1
jmp 0x47ce83
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x47ce90
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], 1
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0
je 0x47cf1e
push 0x3e8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47cef4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 4]
push ecx
push str._CUSBMonitor_Wait_trace_thread_fail__ret_d__err_d._n
push 0x5dcc14
call fcn.0040c050
add esp, 0x10
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x47cf11
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 4]
push ecx
push str._CUSBMonitor_Wait_trace_thread_thread_exit_OK..._n
push str.CUSBMonitor::StopUSBMonitor
call fcn.0040c050
add esp, 0x10
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0
mov esp, ebp
pop ebp
ret
Function at 0x47dc00
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x28c], 0x183bd4
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
push ecx
push str.__C:
lea edx, [ebp - 0x288]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
lea eax, [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x47dc79
xor al, al
jmp 0x47dcc4
push 0
lea ecx, [ebp - 0x298]
push ecx
push 0x28
lea edx, [ebp - 0x2c]
push edx
push 0xc
lea eax, [ebp - 0x294]
push eax
push 0x2d1400
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x47dcc2
cmp dword [ebp - 0x10], 7
jne 0x47dcb8
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x47dcc4
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret
Function at 0x47e330
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583d78
mov eax, dword fs:[0]
push eax
sub esp, 0x838
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 0x24], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x82c], 0
push 0x3ff
push 0
lea eax, [ebp - 0x82b]
push eax
call fcn.00562540
add esp, 0xc
mov byte [ebp - 0x424], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x423]
push ecx
call fcn.00562540
add esp, 0xc
mov dword [ebp - 0x1c], 0x400
call fcn.00402270
mov dword [ebp - 0x428], eax
push 0
lea ecx, [ebp + 0xc]
call fcn.00405e80
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x47e3d7
mov dword [ebp - 0x83c], 0
jmp 0x47e43b
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3fffffff
jle 0x47e3fc
mov dword [ebp - 0x840], 0
jmp 0x47e42f
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.0056a8e0
mov dword [ebp - 0x844], esp
mov eax, dword [ebp - 0x428]
push eax
mov ecx, dword [ebp - 0x10]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x844]
push eax
call fcn.004022d0
mov dword [ebp - 0x840], eax
mov ecx, dword [ebp - 0x840]
mov dword [ebp - 0x83c], ecx
push 0x400
lea edx, [ebp - 0x424]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x42c]
push ecx
lea edx, [ebp - 0x834]
push edx
push 0x400
lea eax, [ebp - 0x82c]
push eax
mov ecx, dword [ebp - 0x83c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x82c]
push edx
mov ecx, dword [ebp + 8]
call fcn.0043d540
mov eax, dword [ebp - 0x838]
or eax, 1
mov dword [ebp - 0x838], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0042e5a0
mov eax, dword [ebp + 8]
lea esp, [ebp - 0x848]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret

Function at 0x47ffb0
Capabilities:
Create thread
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x28
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edx, dword [ebp - 8]
add edx, 8
push edx
mov ecx, dword [ebp - 8]
call fcn.004806a0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push 0x480680
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 4], 0
je 0x48000f
mov eax, 1
jmp 0x480011
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x480060
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x24], ecx
cmp dword [ebp + 8], 0
je 0x4800a0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
add ecx, 2
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x28]
mov ax, word [edx]
mov word [ebp - 0x2e], ax
add dword [ebp - 0x28], 2
cmp word [ebp - 0x2e], 0
jne 0x48007e
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x2c]
sar ecx, 1
mov dword [ebp - 0x34], ecx
jne 0x4800a7
xor eax, eax
jmp 0x480145
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x32
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0xc]
ja 0x480142
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x480123
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x534
jne 0x480114
mov dword [ebp - 0xc], 0
jmp 0x480142
cmp dword [ebp - 0x20], 0x7a
jne 0x480121
mov dword [ebp - 0xc], 1
jmp 0x48012a
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 4]
mov dword [ebp - 8], edx
jmp 0x4800bc
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x4806a0
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583c98
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x615000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 2
mov edx, dword [ebp - 0x1c]
push edx
push 0
call sub.NETAPI32.dll_NetUserEnum
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x480725
cmp dword [ebp - 0x14], 0xea
jne 0x480796
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x480796
mov dword [ebp - 0x30], 0
jmp 0x480743
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x10]
jae 0x480796
cmp dword [ebp - 0x28], 0
jne 0x480753
jmp 0x480796
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.004060b0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x4c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00441110
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0xc]
mov dword [eax], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.004060f0
mov eax, dword [ebp - 0x28]
add eax, 0x20
mov dword [ebp - 0x28], eax
jmp 0x48073a
cmp dword [ebp - 0x2c], 0
je 0x4807ac
mov ecx, dword [ebp - 0x2c]
push ecx
call sub.NETAPI32.dll_NetApiBufferFree
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4814d0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 8]
push eax
call fcn.00401bb0
add esp, 4
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push 5
mov eax, dword [ebp - 8]
push eax
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
jne 0x48152e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WTSQuerySessionInformationA_Error__d
push 0x59b44c
call fcn.0040c050
add esp, 0xc
jmp 0x48159b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
mov cl, byte [eax]
mov byte [ebp - 0x1d], cl
add dword [ebp - 0x18], 1
cmp byte [ebp - 0x1d], 0
jne 0x48153d
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 1
jb 0x48159b
cmp dword [ebp - 0xc], 1
jb 0x48159b
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x14]
add edx, 0x28
push edx
call fcn.005694d0
add esp, 0xc
mov eax, dword [ebp - 0x14]
add eax, 0x28
push eax
push 0x59b47c
push str.CUserPrivilegeMonitor::GetCurrentConsoleUser
call fcn.0040c050
add esp, 0xc
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x483c20
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
jmp 0x483c38
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x483c90
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
jmp 0x483c59
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x483c81
mov eax, dword [ebp - 4]
and eax, 1
je 0x483c77
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 4], ecx
jmp 0x483c7f
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jmp 0x483c50
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax*4 + 0x639560], ecx
jmp 0x483c2f
mov esp, ebp
pop ebp
ret
Function at 0x486e70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 0xc], eax
call fcn.00484480
push 0x6399e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x6399f8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x639a10
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
mov word [ebp - 0x420], ax
push 0x40e
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.00562540
add esp, 0xc
push 0x207
lea edx, [ebp - 0x420]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x486f15
cmp dword [ebp - 4], 0x7a
je 0x486f15
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x59a5c4
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x486f40
push 0x410
lea edx, [ebp - 0x420]
push edx
call fcn.004020c0
add esp, 8
push 0x207
push 0x59a5e8
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea ecx, [ebp - 0x420]
push ecx
push str.conf_file_path_s_r_n
push 0x59a638
call fcn.0040c050
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
mov ecx, 0x63b204
call fcn.0040e480
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x486fb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x59a648
push 2
push 0x59a69c
call fcn.0040c0b0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x59a6b0
push str.InitParseConf
call fcn.0040c050
add esp, 0xc
xor eax, eax
jmp 0x486fc2
lea ecx, [ebp - 0x420]
push ecx
call fcn.00486760
add esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret

Function at 0x48aa50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jne 0x48aa64
mov eax, 1
jmp 0x48aaa4
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x10], edx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x48b050
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x48aaa2
mov eax, 1
jmp 0x48aaa4
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x48aab0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax]
test ecx, ecx
jne 0x48ab6c
mov edx, dword [ebp - 0x14]
mov byte [edx], 1
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x14]
cmp dword [eax + 4], 0
je 0x48ab24
push 0x1f4
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x48ab0d
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], 0
mov byte [ebp - 0x10], 0
xor edx, edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov byte [ebp - 7], dl
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x10], 0
je 0x48ab51
push 0xa
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x10]
push eax
call fcn.0048b090
add esp, 0xc
mov ecx, dword [ebp - 0x14]
add ecx, 0x2c
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x599280
push 0x59928c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret

Function at 0x48af40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], ecx
push 0x103
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x48af97
cmp dword [ebp - 4], 0x7a
je 0x48af97
mov ecx, dword [ebp - 0xc]
add ecx, 0x2c
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x5992dc
mov edx, dword [ebp - 0xc]
add edx, 0x2c
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x48afc2
push 0x104
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
call fcn.004020c0
add esp, 8
push 0x103
push 0x5992f0
mov ecx, dword [ebp - 0xc]
add ecx, 0x2c
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edx, dword [ebp - 0xc]
add edx, 0x2c
push edx
push str.conf_file_path_S_r_n
push 0x59932c
call fcn.0040c050
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x48b009
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x599348
push str.CSelfLearn::IniSelfLearn
call fcn.0040c050
add esp, 0xc
xor eax, eax
jmp 0x48b03c
mov ecx, 0x63b288
call fcn.0042e880
mov esi, eax
mov ecx, 0x63b2ec
call fcn.0042e880
add esi, eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 8], esi
mov ecx, 0x63b398
call fcn.0042e880
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xc], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret