joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020e90
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x10020ebd
xor eax, eax
je 0x10020ebd
jmp 0x10020eb7
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x10020ee4
xor ecx, ecx
je 0x10020ee4
jmp 0x10020ede
lea edx, [ebp - 8]
push edx
push 0x1002ffbc
push 1
push 0
push 0x1003008c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x10020f10
xor eax, eax
je 0x10020f0b
jmp 0x10020f05
jmp 0x10020fb0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x10020f50
xor edx, edx
je 0x10020f4e
jmp 0x10020f48
jmp 0x10020fb0
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x10020f79
xor ecx, ecx
je 0x10020f77
jmp 0x10020f71
jmp 0x10020fb0
push 8
call fcn.10013960
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10020f94
xor edx, edx
je 0x10020f92
jmp 0x10020f8c
jmp 0x10020fb0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
xor ecx, ecx
je 0x10020fab
jmp 0x10020fa5
mov eax, dword [ebp - 4]
jmp 0x10020fda
cmp dword [ebp - 0x14], 0
je 0x10020fc4
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
call edx
cmp dword [ebp - 8], 0
je 0x10020fd8
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10021140
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0
push str.ROOTCIMV2
call fcn.10020e90
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10021167
xor eax, eax
jmp 0x100211ca
lea eax, [ebp - 0x10]
push eax
push str.Caption
push str.SELECT__FROM_Win32_OperatingSystem
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push edx
call fcn.10021040
add esp, 0x10
test eax, eax
je 0x100211bb
mov eax, dword [ebp - 8]
push eax
call fcn.10016c90
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100211b1
push 0x1002a3b8
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrTrimW]
xor edx, edx
je 0x100211b1
jmp 0x100211ab
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x14]
push ecx
call fcn.10020fe0
add esp, 4
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret

Function at 0x10021260
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0
push str.ROOTCIMV2
call fcn.10020e90
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x10021287
xor eax, eax
jmp 0x100212ea
lea eax, [ebp - 0x10]
push eax
push str.Name
push str.SELECT__FROM_Win32_Processor
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
call fcn.10021040
add esp, 0x10
test eax, eax
je 0x100212db
mov eax, dword [ebp - 8]
push eax
call fcn.10016c90
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100212d1
push 0x1002a3b8
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrTrimW]
xor edx, edx
je 0x100212d1
jmp 0x100212cb
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x18]
push ecx
call fcn.10020fe0
add esp, 4
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x10023c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
lea edi, [eax + ecx - 0x21524111]
mov ecx, dword [ebp + 8]
mov esi, edi
mov ebx, edi
cmp eax, 0xc
jbe switch.0x10023d45
lea edx, [eax - 0xd]
mov eax, 0xaaaaaaab
mul edx
shr edx, 3
inc edx
mov dword [ebp + 8], edx
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 4]
add edx, esi
shl eax, 8
add edx, eax
movzx eax, byte [ecx + 0xb]
movzx esi, byte [ecx + 3]
shl eax, 8
mov dword [ebp - 4], edx
movzx edx, byte [ecx + 0xa]
add eax, edx
movzx edx, byte [ecx + 9]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 8]
add edx, edi
movzx edi, byte [ecx + 2]
shl esi, 8
add esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
add esi, edi
movzx edi, byte [ecx]
shl esi, 8
add esi, edi
mov edi, dword [ebp - 4]
shl eax, 8
add edx, eax
sub esi, edx
add esi, ebx
mov eax, edx
rol eax, 4
xor eax, esi
add edx, edi
sub edi, eax
mov esi, eax
rol esi, 6
xor esi, edi
sub dword [ebp + 0xc], 0xc
add eax, edx
sub edx, esi
mov edi, esi
rol edi, 8
xor edi, edx
add esi, eax
sub eax, edi
mov ebx, edi
rol ebx, 0x10
xor ebx, eax
add edi, esi
sub esi, ebx
mov eax, ebx
ror eax, 0xd
xor esi, eax
add ebx, edi
mov edx, esi
sub edi, esi
rol edx, 4
xor edi, edx
add esi, ebx
add ecx, 0xc
dec dword [ebp + 8]
jne 0x10023c82
cmp dword [ebp + 0xc], 0xc
ja case.default.0x10023d45
mov eax, dword [ebp + 0xc]
jmp dword [eax*4 + 0x10023e04]
movzx eax, byte [ecx + 0xb]
shl eax, 0x18
add edi, eax
movzx edx, byte [ecx + 0xa]
shl edx, 0x10
add edi, edx
movzx eax, byte [ecx + 9]
shl eax, 8
add edi, eax
movzx edx, byte [ecx + 8]
add edi, edx
movzx eax, byte [ecx + 7]
shl eax, 0x18
add esi, eax
movzx edx, byte [ecx + 6]
shl edx, 0x10
add esi, edx
movzx eax, byte [ecx + 5]
shl eax, 8
add esi, eax
movzx edx, byte [ecx + 4]
add esi, edx
movzx eax, byte [ecx + 3]
shl eax, 0x18
add ebx, eax
movzx edx, byte [ecx + 2]
shl edx, 0x10
add ebx, edx
movzx eax, byte [ecx + 1]
shl eax, 8
add ebx, eax
movzx ecx, byte [ecx]
add ebx, ecx
xor edi, esi
mov edx, esi
rol edx, 0xe
sub edi, edx
mov eax, edi
rol eax, 0xb
mov ecx, edi
xor ecx, ebx
sub ecx, eax
xor esi, ecx
mov edx, ecx
ror edx, 7
sub esi, edx
xor edi, esi
mov eax, esi
rol eax, 0x10
sub edi, eax
mov eax, edi
rol edi, 4
mov edx, eax
xor edx, ecx
sub edx, edi
mov ecx, edx
xor esi, edx
rol ecx, 0xe
sub esi, ecx
mov edx, esi
pop edi
xor eax, esi
ror edx, 8
pop esi
sub eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x10028ef5
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x10028f0d
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x10028f3c
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x10028f7e
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x10029052
sub edx, 0x10000
js 0x10029052
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x10028f64
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x10028f64
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x10028fd5
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x10028fd2
add edx, 8
jne 0x10028fb9
jmp 0x10029043
add edx, 4
test eax, 0xffff
jne 0x10028fe2
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x10029043
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x10029016
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x10028f64
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x10029052
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x10028f64
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x10029063
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1005ad60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101258d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1005ad90
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1005adc0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1005adc0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1005aebe
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1005ade9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1005ae1d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1005ae7c
sub eax, 1
je 0x1005ae7c
sub eax, 2
jne 0x1005aebe
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.100ab47e
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1005ae9d
lfence
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1005aebe
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1005aebe
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
Function at 0x100ab47e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x100ab48d
pop dword [ebp - 0x3c]
mov eax, 0x5ea1c6d7
add eax, 0xb168edb6
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x57ee4c61
add dword [ebp - 0x4c], 0xf663f8ea
mov dword [ebp - 0x48], 0x9ce0b485
sub dword [ebp - 0x48], 0x6aad6840
mov dword [ebp - 0x44], 0x959a1f0d
add dword [ebp - 0x44], 0xb6b22521
mov dword [ebp - 0x40], 0xa5c0a764
sub dword [ebp - 0x40], 0xa5c0a764
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xd1bbdc34
add dword [ebp - 0x4c], 0xa2b68d22
mov dword [ebp - 0x48], 0x5ad91fcc
sub dword [ebp - 0x48], 0x196cbe57
mov dword [ebp - 0x44], 0x3e4962d
sub dword [ebp - 0x44], 0xa07529c1
mov dword [ebp - 0x40], 0xd9a4b9b1
sub dword [ebp - 0x40], 0xd9a4b9b1
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x5264b543
add eax, 0xbdaa7b65
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x87227
push 0
call eax
mov ecx, 0x2f06c2d8
add ecx, 0xd0f98a14
mov esi, eax
mov edx, 0xa02bc836
sub edx, 0x90185e36
add edx, dword [ebp - 0x3c]
mov edi, 0xb4256d0f
sub edi, 0xcaba333a
xor dword [ebp - 0x30], edi
mov ebx, dword [edx]
xor dword [ebp - 0x18], 0x7c49f02e
xor ebx, edi
xor dword [ebp - 0x38], ecx
mov dword [esi], ebx
add dword [ebp - 0x1c], 0x59ea045f
add esi, 0x18593128
add esi, 0xe7a6cedc
add edx, 0xed443d5c
add edx, 0x12bbc2a8
loop 0x100ab5aa
add eax, 0xbec17e9b
add eax, 0x413fa7e8
xor ebx, ebx
add ebx, eax
add eax, 0x5ccf16a6
add eax, 0xa330e95f
mov ecx, 0x10000000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x402920
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x234]
push edi
push 0x228
push 0
push eax
mov ebx, edx
mov edi, ecx
call fcn.0042a4e0
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp - 0x228], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x234]
push eax
push 0x402720
mov dword [ebp - 0x220], esi
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp - 0x234]
test ecx, ecx
jne 0x40299a
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00428cd6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x22c]
mov dword [edi], ecx
mov dword [ebx], eax
lea eax, [ebp - 0x234]
push eax
push 0x402830
push ecx
mov dword [ebp - 0x21c], str.msctls_progress32
mov dword [ebp - 0x214], 0x11
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x230]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00428cd6
mov esp, ebp
pop ebp
ret

Function at 0x403910
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x3c
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.0042a4e0
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x403941
mov ecx, edi
call fcn.00403270
test esi, esi
je 0x403952
sub esp, 8
mov ecx, esi
call fcn.00403870
add esp, 8
mov edi, dword [0x4574c4]
test edi, edi
jne 0x403972
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
mov dword [0x4574c4], edi
test edi, edi
je 0x403a41
mov esi, dword [0x4574c8]
test esi, esi
jne 0x40399e
push 0x4574c0
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [0x4574c8], esi
test esi, esi
je 0x403a47
mov edi, dword [0x4574c4]
mov ecx, dword [esi]
test ecx, ecx
je 0x4039be
push 0x457630
mov edx, SysReAllocString
call fcn.00402470
test eax, eax
js 0x4039be
mov eax, dword [0x457630]
jmp 0x4039d8
mov dword [0x457630], ebx
mov eax, dword [esi]
test eax, eax
je 0x4039d6
cmp word [eax], bx
je 0x4039d6
mov eax, SysReAllocString
jmp 0x4039d8
xor eax, eax
xor ecx, ecx
mov word [edi + eax*2 + 4], cx
cmp dword [0x4574c0], 1
jle 0x4039f1
add eax, 3
lea eax, [edi + eax*2]
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x34], str.runas
mov dword [ebp - 0x3c], 0x4000
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x403a41
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
mov ecx, 5
cmove ebx, ecx
mov esi, dword [0x4574c8]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x404090
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
test ebx, ebx
je 0x40426b
cmp word [ebx], 0
je 0x40426b
push esi
push 0x60
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.0042a4e0
mov eax, dword [0x457680]
add esp, 0xc
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x74]
mov dword [ebp - 0x64], 0x1f01ff
mov dword [ebp - 0x60], 1
push eax
push 0x44416c
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x44], 0x1200a9
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x30], 0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x70]
push eax
push 0
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x70], 0
push eax
push 0
lea eax, [ebp - 0x78]
mov dword [ebp - 0x68], 0
push eax
push 7
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
mov dword [0x45771c], eax
test eax, eax
jne 0x404232
push edi
push dword [0x457680]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [ebp - 0x6c]
mov edi, eax
xor eax, eax
mov dword [ebp - 0x80], edi
xor esi, esi
cmp ax, word [ecx + 4]
jae 0x4041f3
lea eax, [ebp - 0x7c]
movzx edi, si
push eax
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x4041e6
mov eax, dword [ebp - 0x7c]
mov cl, byte [eax]
test cl, cl
je 0x4041e6
test byte [eax + 1], 0x1f
jne 0x4041e6
cmp cl, 1
je 0x4041d6
cmp cl, 6
je 0x4041d6
cmp cl, 0xa
je 0x4041d6
cmp cl, 0xc
jne 0x4041e6
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
add esi, 0xffff
mov ecx, dword [ebp - 0x6c]
inc esi
cmp si, word [ecx + 4]
jb 0x4041a0
mov edi, dword [ebp - 0x80]
lea eax, [ebp - 0x68]
push eax
push ecx
lea eax, [ebp - 0x64]
push eax
push 2
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov dword [0x45771c], eax
test eax, eax
jne 0x404231
push eax
push dword [ebp - 0x68]
push eax
test edi, edi
je 0x40421b
push eax
push 4
jmp 0x404223
push dword [0x457680]
push 5
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov dword [0x45771c], eax
pop edi
mov eax, dword [ebp - 0x70]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
je 0x404242
push eax
call esi
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x40424c
push eax
call esi
push dword [ebp - 0x74]
call esi
cmp dword [0x45771c], 0
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428cd6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop ebx
call fcn.00428cd6
mov esp, ebp
pop ebp
ret
Function at 0x405670
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, ecx
mov dword [ebp - 8], 0
mov edi, edx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], 0
push ecx
push eax
mov byte [ebp - 1], 0
mov dword [edi], 0
mov dword [edi + 4], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x405720
push ebx
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x405720
push esi
push ebx
push dword [ebp - 8]
push dword [ebp - 0x10]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x405707
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x444140
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x405707
cmp dword [ebp - 0xc], 0
je 0x405707
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 1], 1
mov eax, dword [ecx + 8]
mov dword [edi + 4], eax
mov eax, dword [ecx + 0xc]
mov dword [edi], eax
push esi
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405730
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov eax, ecx
mov dword [ebp - 8], 0
push edi
lea ecx, [ebp - 8]
mov dword [ebp - 0x18], eax
push ecx
xor ebx, ebx
mov dword [ebp - 0x10], 0
push eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x4058c0
push edi
push ebx
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4058c0
push esi
push edi
push dword [ebp - 8]
push dword [ebp - 0x18]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4058a8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4058a8
cmp dword [ebp - 0xc], ebx
je 0x4058a8
push 0x457630
mov edx, SysReAllocString
mov ecx, 0x44a1d0
call fcn.00402470
test eax, eax
jns 0x4057ec
mov dword [0x457630], ebx
mov eax, SysReAllocString
jmp 0x4057f1
mov eax, dword [0x457630]
add eax, 0x1a
mov dword [ebp - 4], eax
add eax, eax
push eax
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x405874
mov eax, dword [ebp - 0x10]
push 0x44a1d0
mov ecx, dword [eax]
mov eax, ecx
shr eax, 0x10
push eax
movzx eax, cx
push eax
push str.StringFileInfo_04x_04x_s
push dword [ebp - 4]
push edi
call dword [0x457664]
add esp, 0x18
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x405899
mov eax, dword [ebp - 4]
test eax, eax
je 0x405899
add eax, eax
push eax
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x40587e
push edi
push eax
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4058a8
mov eax, dword [ebp - 4]
add eax, eax
push eax
push dword [ebp - 0x14]
push ebx
call fcn.0043c9e0
mov eax, dword [ebp - 4]
add esp, 0xc
dec eax
mov dword [0x457638], eax
push edi
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret