joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48dbf9
Capabilities:
Get user security identifier

Disassembly:
push 0xd8
mov eax, 0x6c0654
call fcn.00432a44
mov ebx, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0xe4], edi
call fcn.0048eb6c
test edi, edi
je 0x48de11
and dword [ebp - 0xd8], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0xd8]
push 0x100
call fcn.0048dba3
mov esi, dword [ebp - 0xd8]
lea eax, [ebx + 0x4c]
push eax
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xdc], 0x44
push eax
push esi
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xe0], 0x80
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x48dd94
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x48dded
cmp dword [ebp - 0xdc], 0x44
ja 0x48de1b
mov eax, dword [ebp - 0xe0]
mov edx, 0x80
cmp eax, edx
jbe 0x48dd70
cmp eax, 0x7fffffff
jae 0x48de1b
mov ecx, dword [ebp - 0xd8]
add eax, eax
test ecx, ecx
jne 0x48dcdc
cmp eax, edx
jbe 0x48dd5e
push eax
lea ecx, [ebp - 0xd8]
call fcn.0048dba3
jmp 0x48dd6a
cmp eax, edx
lea edx, [ebp - 0xd4]
jbe 0x48dd33
cmp ecx, edx
lea ecx, [ebp - 0xd8]
push eax
jne 0x48dd2c
call fcn.0048dba3
mov edi, dword [ebp - 0xd8]
test edi, edi
jne 0x48dd11
call fcn.00570b0e
push 0x16
pop esi
mov dword [eax], esi
call fcn.005708e5
jmp 0x48dd1e
push 0x20
pop ecx
lea esi, [ebp - 0xd4]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
call fcn.00439f60
mov edi, dword [ebp - 0xe4]
jmp 0x48dd6a
call fcn.0048dbc8
jmp 0x48dd6a
cmp ecx, edx
je 0x48dd5e
test eax, eax
je 0x48dd4c
push eax
push ecx
lea eax, [ebp - 0xd4]
push eax
call fcn.00435014
add esp, 0xc
push 0
call fcn.00439f60
lea ecx, [ebp - 0xd8]
call fcn.0048dbf0
lea eax, [ebp - 0xd4]
mov dword [ebp - 0xd8], eax
mov esi, dword [ebp - 0xd8]
lea eax, [ebx + 0x4c]
push eax
lea eax, [ebp - 0xe0]
push eax
push esi
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x48dded
lea eax, [ebp - 0x54]
mov byte [ebx + 0x48], 1
push eax
lea eax, [ebx + 4]
push eax
push dword [ebp - 0xdc]
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x48dded
lea ecx, [ebx + 0x54]
push esi
call fcn.0048eacf
lea ecx, [ebx + 0x50]
push edi
call fcn.0048eacf
lea ecx, [ebx + 0x5c]
push 0
call fcn.0048eacf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd4]
cmp dword [ebp - 0xd8], ecx
je 0x48dde9
lea ecx, [ebp - 0xd8]
call fcn.0048dbf0
mov al, 1
jmp 0x48de13
mov ecx, ebx
call fcn.0048eb6c
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xd8], eax
je 0x48de11
lea ecx, [ebp - 0xd8]
call fcn.0048dbf0
xor al, al
call fcn.00402698
ret 8
push 0x80004005
call fcn.0048bd27
int3
Function at 0x48f693
Capabilities:
Create thread

Disassembly:
push 0x14
mov eax, 0x6c0fd4
call fcn.00401167
lea eax, [ebp - 0x18]
mov byte [ebp - 0x20], cl
push eax
xor ebx, ebx
mov dword [ebp - 0x1c], edx
push ebx
lea eax, [ebp - 0x20]
push eax
push 0x48fe77
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x48f6e2
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 0x10]
jmp 0x48f6f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00435aec
mov dword [ebp - 0x10], eax
test eax, eax
jns 0x48f713
mov edi, 0x80004004
cmp eax, edi
je 0x48f713
cmp eax, 0x800704c7
je 0x48f713
push eax
push ebx
push 5
pop edx
xor ecx, ecx
call fcn.0049bfad
jmp 0x48f715
mov edi, eax
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x48f727
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], ebx
mov eax, edi
call fcn.004026a3
ret

Function at 0x48f72f
Capabilities:
Get common file path

Disassembly:
push 0x210
mov eax, 0x6c1028
call fcn.00432a44
mov ebx, ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
test esi, esi
jne 0x48f813
xor edi, edi
cmp byte [ebx + 4], al
je 0x48f7a2
lea eax, [ebp - 0x218]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x48f7a2
push 0x48f81c
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.005746be
add esp, 0xc
test eax, eax
jne 0x48f7a2
lea eax, [ebp - 0x218]
push 0x48f854
push eax
call fcn.0057454b
pop ecx
pop ecx
mov edi, eax
mov ecx, ebx
call fcn.00490005
mov esi, eax
test edi, edi
je 0x48f80d
test esi, esi
js 0x48f7c4
push esi
push 0x48f878
push edi
call fcn.004901b5
add esp, 0xc
jmp 0x48f806
and dword [ebp - 0x21c], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x21c]
push eax
push esi
push 5
xor edx, edx
pop ecx
call fcn.0049c002
push esi
push dword [ebp - 0x21c]
push 0x48f8d0
push edi
call fcn.004901b5
add esp, 0x10
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x21c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
call fcn.0057461f
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
call fcn.00402698
ret
Function at 0x49005f
Capabilities:
Create process on windows

Disassembly:
push 0x4c
mov eax, 0x6c1178
call fcn.00401167
mov dword [ebp - 0x14], ecx
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov ebx, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.0048f1fc
mov esi, dword [ebp - 0x10]
mov edi, eax
test edi, edi
js 0x490122
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.00436326
mov eax, dword [ebx]
add esp, 0xc
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], 0x800040
mov dword [ebp - 0x3c], 1
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x4c], 0x490138
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x44], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push eax
call fcn.004050cb
mov edi, eax
test edi, edi
js 0x490122
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 1
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoWaitForMultipleHandles]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push eax
call fcn.004050cb
mov edi, eax
test edi, edi
js 0x490122
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x20], 0
mov edi, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
call fcn.004026a3
ret 4

Function at 0x490288
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0
mov eax, 0x6c1228
call fcn.00401167
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
push esi
and dword [eax], 0
and dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4902b7
mov eax, 0x80040154
jmp 0x490336
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4902d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00435aec
jmp 0x490336
push 0x47de60
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
and dword [ebp + 0x10], 0
mov dword [ebp - 4], 1
lea ecx, [ebp + 0x10]
push ecx
push 0x47de74
push edi
call eax
mov edi, eax
test edi, edi
js 0x490316
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push dword [ebp + 8]
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov edi, eax
test edi, edi
jns 0x49031f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x490323
mov dword [ebx], esi
xor edi, edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x490334
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, edi
call fcn.004026a3
ret 0xc
Function at 0x491f18
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x48
mov eax, 0x6c1a98
call fcn.00432a44
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 4], ebx
push ebx
push 0x8000000
push 3
pop eax
push eax
push ebx
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x54], esi
setne al
push eax
call fcn.004050cb
mov edi, eax
test edi, edi
js 0x492032
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x491f79
cmp ebx, 0x6400000
jbe 0x491f83
mov edi, 0x8000ffff
jmp 0x492032
and dword [ebp - 0x4c], 0
mov byte [ebp - 4], 1
lea eax, [ebx + 1]
push eax
call fcn.00439c0c
pop ecx
push 0
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x4c], eax
push ecx
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
call fcn.004050cb
mov edi, eax
test edi, edi
js 0x492021
cmp dword [ebp - 0x50], ebx
je 0x491fbf
mov edi, 0x8000ffff
jmp 0x492021
mov edi, dword [ebp - 0x4c]
lea ecx, [ebp - 0x48]
sub esp, 0xc
mov byte [edi + ebx], 0
call fcn.00492902
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
push dword [ebp - 0x50]
push edi
call fcn.004931a6
cmp dword [ebp - 0x18], 0
jne 0x492010
push 3
pop eax
cmp word [ebp - 0x3a], ax
jne 0x492010
lea ecx, [ebp - 0x48]
call fcn.00491a58
mov edi, eax
test edi, edi
js 0x492015
lea ecx, [ebp - 0x48]
call fcn.00491d28
mov edi, eax
test edi, edi
js 0x492015
xor edi, edi
jmp 0x492015
mov edi, 0x8000ffff
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0049289a
mov byte [ebp - 4], 0
push dword [ebp - 0x4c]
call fcn.004030a8
and dword [ebp - 0x4c], 0
pop ecx
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x492045
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x54], 0
mov eax, edi
call fcn.00402698
ret
Function at 0x49204d
Capabilities:
Enumerate files on windows

Disassembly:
push 0x47c
mov eax, 0x6c1b31
call fcn.00432a44
cmp byte [0x721aac], 0
je 0x49206c
xor eax, eax
jmp 0x492248
lea ecx, [ebp - 0x488]
call fcn.004366f5
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4920ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4920c4
movzx esi, si
or esi, 0x80070000
jmp 0x4920c2
lea eax, [ebp - 0x488]
push eax
lea edx, [ebp - 0x218]
call fcn.00491831
mov esi, eax
test esi, esi
js 0x492234
push 0x250
lea eax, [ebp - 0x47c]
push ebx
push eax
call fcn.00436326
add esp, 0xc
lea eax, [ebp - 0x47c]
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x488]
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor ecx, ecx
mov edi, eax
cmp edi, 0xffffffff
setne cl
push ecx
call fcn.004050cb
mov esi, eax
test esi, esi
jns 0x49211f
cmp esi, 0x80070002
jne 0x492234
mov esi, ebx
jmp 0x492234
push dword [ebp - 0x488]
lea ecx, [ebp - 0x22c]
call fcn.00491771
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x480]
call fcn.004366f5
mov byte [ebp - 4], 5
lea eax, [ebp - 0x22c]
push dword [ebp - 0x224]
push eax
lea eax, [ebp - 0x480]
push 0x47ded4
push eax
call fcn.0048c9cb
mov eax, dword [ebp - 0x480]
add esp, 0x10
mov eax, dword [eax - 0xc]
test eax, eax
je 0x492184
dec eax
lea ecx, [ebp - 0x480]
push eax
call fcn.00492ba9
cmp ax, 0x5c
je 0x492194
push 0x47e024
lea ecx, [ebp - 0x480]
call fcn.00439500
lea ecx, [ebp - 0x484]
call fcn.004366f5
mov byte [ebp - 4], 6
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x484]
call fcn.004954ae
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x484]
call fcn.00439500
mov ecx, dword [ebp - 0x484]
call fcn.00491f18
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x484]
lea ecx, [ecx - 0x10]
call fcn.0040119b
lea eax, [ebp - 0x47c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x492194
push edi
mov byte [0x721aac], 1
call dword [sym.imp.KERNEL32.dll_FindClose]
neg eax
sbb esi, esi
and esi, 0x7fff0001
add esi, 0x8000ffff
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x480]
lea ecx, [ecx - 0x10]
call fcn.0040119b
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x22c]
call fcn.004919d4
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x488]
add ecx, 0xfffffff0
call fcn.0040119b
mov eax, esi
call fcn.00402698
ret
Function at 0x495ac1
Capabilities:
Connect pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor bl, bl
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push eax
call fcn.004050cb
test eax, eax
js 0x495b42
movzx eax, word [esi + 8]
push eax
call dword [sym.imp.WS2_32.dll_htons]
movzx eax, ax
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
call fcn.004050cb
test eax, eax
js 0x495b21
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push eax
call fcn.004050cb
test eax, eax
jns 0x495b2a
cmp eax, 0x800703e3
jne 0x495b2a
mov bl, 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push eax
call fcn.004050cb
test eax, eax
js 0x495b42
test bl, bl
je 0x495acc
xor eax, eax
pop esi
pop ebx
leave
ret

Function at 0x495db1
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, edx
push 0x3a
push ecx
mov byte [ebx], 0
call fcn.00567edc
pop ecx
pop ecx
test eax, eax
je 0x495e3b
add eax, 2
push eax
call fcn.00575459
mov esi, eax
pop ecx
test esi, esi
jle 0x495e3b
cmp esi, 0xffff
jg 0x495e3b
push 0
push 1
push 2
pop eax
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
jne 0x495e14
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00435aec
test eax, eax
js 0x495e40
push 4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
push 0xfffffffffffffffb
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x495e4f
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0x80004005
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040548e
leave
ret
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push 2
pop eax
push esi
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x495e9e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00435aec
mov esi, eax
cmp esi, 0x8007271d
jne 0x495ea0
mov byte [ebx], 1
xor esi, esi
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
jmp 0x495e40
Function at 0x4972d1
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, ecx
xor esi, esi
push esi
push 1
xor ecx, ecx
mov dword [ebp - 0x1c], eax
push 2
mov word [eax], cx
pop eax
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0xffffffff
jne 0x49731a
call ebx
push eax
call fcn.00435aec
test eax, eax
js 0x49739b
push 2
pop eax
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x49734f
call ebx
push eax
call fcn.00435aec
mov esi, eax
test esi, esi
js 0x497378
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x497383
call ebx
push eax
call fcn.00435aec
mov esi, eax
test esi, esi
jns 0x497383
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
jmp 0x49739b
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [ebp - 0x12]
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [ebp - 0x1c]
mov word [ecx], ax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040548e
leave
ret
Function at 0x49794a
Capabilities:
Get token membership

Disassembly:
push 0x1c
mov eax, 0x6c2b50
call fcn.00432a44
mov esi, ecx
mov dword [ebp - 0x28], esi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov word [ebp - 0x14], 0x500
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
mov dword [ebx], ecx
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4979b7
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x1c]
neg eax
sbb eax, eax
and dword [ebp - 0x24], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x24]
jmp 0x4979b9
xor eax, eax
test eax, eax
je 0x4979cd
xor eax, eax
cmp dword [esi + 0x1c], 3
sete al
add eax, 0xe6
jmp 0x4979df
xor eax, eax
cmp dword [esi + 0x1c], 3
sete al
dec eax
and eax, 0xffffffe8
add eax, 0xe0
and dword [ebp - 0x20], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push ecx
push eax
mov ecx, 0x6fe668
call fcn.0060f80b
mov esi, eax
test esi, esi
jne 0x497a4c
mov ecx, dword [ebp - 0x28]
add ecx, 0x10
call fcn.00497283
test al, al
je 0x497a15
mov eax, dword [ebp - 0x20]
and dword [ebp - 0x20], esi
mov dword [ebx], eax
jmp 0x497a4c
and dword [ebp - 0x1c], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1c]
push eax
call fcn.00497236
mov esi, eax
test esi, esi
jne 0x497a3f
push ebx
push dword [ebp - 0x20]
push 0x497a64
push dword [ebp - 0x1c]
call fcn.0048baba
mov esi, eax
mov byte [ebp - 4], 0
push dword [ebp - 0x1c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x20]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
call fcn.00402698
ret 4
Function at 0x497b14
Capabilities:
Set environment variable

Disassembly:
push 8
mov eax, 0x6c2bb4
call fcn.00401167
mov edi, ecx
call fcn.0049be42
test al, al
je 0x497b35
mov eax, 0x805e0006
jmp 0x497ce6
mov esi, dword [ebp + 8]
push 2
pop ebx
cmp dword [edi + 0xc], ebx
je 0x497b49
mov byte [0x721aae], 1
jmp 0x497b7a
cmp byte [esi + 0x1f], 0
jne 0x497b7a
cmp dword [esi + 0x18], 3
jne 0x497b7a
push 0xdf
mov edx, ebx
xor ecx, ecx
call fcn.0049b38d
cmp eax, 1
jne 0x497b72
mov eax, 0x80004004
jmp 0x497ce6
test eax, eax
js 0x497ce6
cmp dword [edi + 0xc], ebx
jne 0x497bbd
cmp byte [esi + 0x1d], 0
jne 0x497bbd
call fcn.0060faa4
test al, al
je 0x497bbd
lea eax, [ebp + 8]
push eax
call fcn.0060f855
test eax, eax
js 0x497ba2
cmp word [ebp + 8], 0xc
je 0x497bbd
push 0xcc
mov edx, ebx
xor ecx, ecx
call fcn.0049b38d
cmp eax, 1
je 0x497b68
test eax, eax
js 0x497ce6
push 0x47e0b8
push 0x497cf0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp dword [edi + 0xc], ebx
jne 0x497be5
cmp byte [esi + 0x1e], 0
jne 0x497be5
call fcn.0049ba48
test eax, eax
js 0x497ce6
push esi
mov ecx, edi
call fcn.00497d1c
test eax, eax
js 0x497ce6
cmp dword [edi + 0xc], ebx
jne 0x497c1c
cmp byte [esi + 0x20], 0
jne 0x497c0a
cmp byte [esi + 0xc], 0
jne 0x497c0a
xor cl, cl
jmp 0x497c0c
mov cl, 1
mov edx, dword [esi + 0x18]
call fcn.0048f693
test eax, eax
js 0x497ce6
mov eax, dword [esi + 0x18]
lea ecx, [edi + 0x18]
mov dword [edi + 0x1c], eax
mov al, byte [esi + 0x1c]
mov byte [edi + 0x22], al
mov eax, dword [esi + 0x10]
mov dword [edi + 0x24], eax
push dword [esi + 8]
call fcn.004988f0
movzx eax, word [esi + 0x26]
lea ebx, [edi + 0x20]
mov word [ebx], ax
test ax, ax
jne 0x497c67
cmp dword [esi + 4], 0
je 0x497c5f
mov ecx, ebx
call fcn.004972d1
test eax, eax
js 0x497ce6
jmp 0x497c67
mov eax, 0xfb8
mov word [ebx], ax
push 0x2c
call fcn.0040251c
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov ecx, eax
call fcn.0048ce3c
mov dword [ebp + 8], eax
or dword [ebp - 4], 0xffffffff
mov dword [edi], eax
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
test eax, eax
jne 0x497caa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00435aec
jmp 0x497cb4
lea eax, [ecx + 0x14]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
js 0x497ce6
cmp dword [edi + 0xc], 1
je 0x497ccd
mov ecx, dword [edi]
lea eax, [edi + 0x10]
push eax
call fcn.0048cf5b
test eax, eax
js 0x497ce6
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x497ce4
mov dx, word [ebx]
lea eax, [edi + 4]
push eax
call fcn.00495560
test eax, eax
js 0x497ce6
xor eax, eax
call fcn.004026a3
ret 4
Function at 0x497e2d
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 1
jne 0x497e5a
call fcn.00432cf0
call fcn.00432cfc
mov ecx, dword [esi]
mov ecx, dword [ecx + 8]
call fcn.00437fba
mov edi, eax
test edi, edi
jne 0x497f36
mov ebx, dword [ebp + 8]
lea ecx, [esi + 0x10]
movzx eax, byte [ebx + 0x21]
push eax
push 0
push ecx
mov ecx, esi
call fcn.00497f73
mov edi, eax
test edi, edi
js 0x497f36
cmp dword [ebx + 0x28], 0
je 0x497e95
push dword [ebx + 0x28]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [ebx + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebx + 0x28], 0
cmp dword [esi + 0xc], 2
je 0x497ea1
cmp dword [esi + 0xc], 0
jne 0x497ee3
push 0x497f58
push 0x405b40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x497ec5
push 3
push 0x70f7d8
call eax
cmp byte [ebx + 0x22], 0
je 0x497ed0
push 6
pop eax
jmp 0x497ed3
mov eax, dword [ebp + 0xc]
mov ecx, esi
mov dword [esi + 0x78], eax
call fcn.0049816a
mov edi, eax
test edi, edi
js 0x497f36
cmp byte [esi + 0x57], 0
jne 0x497f2d
cmp dword [esi + 0xc], 1
je 0x497f2d
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x497eff
call fcn.004973aa
test al, al
jne 0x497f2d
mov ecx, dword [esi]
lea edi, [ecx + 0x28]
cmp dword [edi], 0
jne 0x497f17
add ecx, 0x14
mov edx, edi
call fcn.0048c202
test eax, eax
js 0x497f2d
mov ecx, dword [edi]
lea eax, [esi + 0x10]
push eax
call fcn.0048c370
test eax, eax
js 0x497f2d
mov ecx, dword [edi]
call fcn.0048c2c2
mov ecx, esi
call fcn.0049822f
mov edi, eax
cmp dword [esi + 0xc], 1
jne 0x497f41
call fcn.0043b047
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x497f4d
call fcn.00495b46
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8