joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eb680
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x240
mov ecx, 0x40
xor eax, eax
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x150]
push str.c:endpcache
rep stosd dword es:[edi], eax
xor ebx, ebx
call fcn.004f2beb
mov edi, str.c:endpcache.reg
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x150]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x150]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4eb8ac
mov ebp, dword [esp + 0x254]
lea eax, [esp + 0x3c]
push str.services.reg
push eax
xor esi, esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4eb714
mov esi, 1
lea ecx, [esp + 0x3c]
push str.services_new.reg
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4eb72f
mov esi, 1
lea edx, [esp + 0x3c]
push str.wsock2_new.reg
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4eb74a
mov esi, 1
lea eax, [esp + 0x3c]
push str.winsock2_new.reg
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4eb765
mov esi, 1
lea ecx, [esp + 0x3c]
push str.wsock2.reg
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4eb780
mov esi, 1
lea edx, [esp + 0x3c]
push str.wsock2_xp.reg
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4eb79b
mov esi, 1
lea eax, [esp + 0x3c]
push str.wsock2_2000.reg
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4eb7b6
mov esi, 1
lea ecx, [esp + 0x3c]
push str.wsock2_2003.reg
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4eb7d1
mov esi, 1
lea edx, [esp + 0x3c]
push str.wsock2_vista.reg
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4eb7ec
mov esi, 1
lea eax, [esp + 0x3c]
push str.winsock.reg
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4eb807
mov esi, 1
lea ecx, [esp + 0x3c]
push str.tcpip.reg
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4eb822
mov esi, 1
lea edx, [esp + 0x3c]
push str.network.reg
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4eb83d
mov esi, 1
lea eax, [esp + 0x3c]
push str.safeboot.reg
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4eb858
mov esi, 1
lea ecx, [esp + 0x3c]
push str.recover.reg
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4eb88e
test esi, esi
jne 0x4eb88e
lea edx, [esp + 0x3c]
push 0x80
push edx
push ebp
call fcn.004f27c0
add esp, 0xc
inc ebx
add ebp, 0x40
cmp ebx, 0x7f
je 0x4eb8ac
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4eb6f7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or edi, 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x258]
pop edi
pop esi
pop ebp
mov dword [ecx], ebx
mov ax, 1
pop ebx
add esp, 0x240
ret
Function at 0x4eb8d0
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcf20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x504
push ebx
push esi
push edi
lea eax, [ebp - 0x90]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x80
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [ebp - 0x90]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x110]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x210]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x110]
push esi
push ecx
push str._s_s
push edx
mov byte [ebp - 0x10e], bl
call fcn.004f175f
lea eax, [ebp - 0x90]
push esi
push eax
lea ecx, [ebp - 0x410]
push str._sdllcache_bk_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0x90]
push esi
push edx
lea eax, [ebp - 0x310]
push str._sdllcache_s
push eax
call fcn.004f175f
push esi
push str.c:endpcache
lea ecx, [ebp - 0x510]
push str._s_s
push ecx
call fcn.004f175f
add esp, 0x40
push str.c:endpcache
call fcn.004f2beb
lea edx, [ebp - 0x210]
push edx
call fcn.004ab3c0
add esp, 8
cmp eax, 0x400
jge 0x4eba73
lea eax, [ebp - 0x410]
push eax
call fcn.004ab3c0
add esp, 4
cmp eax, 0x2800
jle 0x4eba07
lea ecx, [ebp - 0x210]
push ebx
lea edx, [ebp - 0x410]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x310]
push eax
call fcn.004ab3c0
add esp, 4
cmp eax, 0x2800
jle 0x4eba48
lea ecx, [ebp - 0x210]
push ebx
lea edx, [ebp - 0x310]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x510]
push eax
call fcn.004ab3c0
add esp, 4
cmp eax, 0x2800
jle 0x4eba73
lea ecx, [ebp - 0x210]
push ebx
lea edx, [ebp - 0x510]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ebbb0
Capabilities:
Resume thread
Suspend thread
Terminate thread

Disassembly:
sub esp, 0x2d4
mov eax, dword [esp + 0x2d8]
push esi
push edi
push eax
push 0
push 0x4b
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
jne 0x4ebbff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenThread_failed_error__d__n
call fcn.004f172e
add esp, 8
xor al, al
pop edi
pop esi
add esp, 0x2d4
ret
mov eax, dword [0xf45884]
test eax, eax
jne 0x4ebc39
push str.NtQueryInformationThread
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0xf45884], eax
jne 0x4ebc39
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetProcAddress_failed_error__d__n
jmp 0x4ebd2a
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push 4
push edx
push 9
push esi
call eax
test eax, eax
je 0x4ebc60
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
add esp, 0x2d4
ret
mov edi, dword [esp + 0x2e4]
mov ecx, dword [esp + 8]
mov eax, dword [edi + 0x14]
cmp ecx, eax
jb 0x4ebcb9
mov edx, dword [edi + 0x18]
add edx, eax
cmp ecx, edx
ja 0x4ebcb9
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x4ebd4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.TerminateThread_failed_error__d__n
call fcn.004f172e
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
add esp, 0x2d4
ret
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x4ebd4b
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10001
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x4ebcfa
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
add esp, 0x2d4
ret
mov eax, dword [edi + 0x14]
mov ecx, dword [esp + 0xc8]
cmp ecx, eax
jb 0x4ebd44
mov edx, dword [edi + 0x18]
add edx, eax
cmp ecx, edx
ja 0x4ebd44
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x4ebd4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.TerminateThread_failed_error__d__n
call fcn.004f172e
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
add esp, 0x2d4
ret
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
add esp, 0x2d4
ret
Function at 0x4ebde0
Capabilities:
Create thread
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcf30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
push ebx
push esi
push edi
xor edx, edx
mov ecx, 0x88
xor eax, eax
lea edi, [ebp - 0x240]
mov dword [ebp - 0x244], edx
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], esp
push edi
push 8
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], edx
mov byte [ebp - 0x11], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0x1c], ebx
jne 0x4ebe4d
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x244]
mov dword [ebp - 0x244], 0x224
push eax
push ebx
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x4ebf56
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x224]
push ecx
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4ebe9b
lea edx, [ebp - 0x124]
push edx
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4ebf41
lea eax, [ebp - 0x244]
push eax
push edi
call fcn.004ebd60
add esp, 8
mov byte [ebp - 0x11], al
test al, al
je 0x4ebf41
push edi
push 0
push 0x40a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x4ebf3e
push str.FreeLibrary
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4ebf34
mov ecx, dword [ebp - 0x230]
push 0
push 0
push ecx
push edi
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
test esi, esi
je 0x4ebf34
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 0x20]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4ebf2d
mov eax, dword [ebp - 0x18]
cmp eax, 0x32
jae 0x4ebf34
inc eax
mov dword [ebp - 0x18], eax
jmp 0x4ebee7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x244]
push eax
push ebx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x4ebe6c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ebf80
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4ebfb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcessToken___failed__Error___d_SeDebugPrivilege_is_not_available._n
call fcn.004f172e
add esp, 8
add esp, 0x1c
ret
lea ecx, [esp + 4]
push ecx
push 0x50d674
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x4ebfec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LookupPrivilegeValue___failed__Error___d_SeDebugPrivilege_is_not_available._n
call fcn.004f172e
mov edx, dword [esp + 8]
add esp, 8
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x1c
ret
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
lea edx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 8]
push 0x10
push edx
push 0
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4ec03c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.AdjustTokenPrivileges___failed__Error___d_SeDebugPrivilege_is_not_available._n
call fcn.004f172e
add esp, 8
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x1c
ret

Function at 0x4ec050
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcf40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push esi
push edi
xor esi, esi
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x134]
mov dword [ebp - 0x138], esi
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], esi
mov bl, 1
call fcn.004ebf80
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ec0b7
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x138]
mov dword [ebp - 0x138], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4ec0f8
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp + 8]
push ecx
push edx
call fcn.004ebde0
add esp, 8
mov bl, al
lea eax, [ebp - 0x138]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4ec0d2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0xf45888]
test eax, eax
je 0x4ec11b
push eax
call fcn.004f2537
add esp, 4
mov dword [0xf45888], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ec1b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
push edi
cmp ebx, 0x834
mov edi, 0x1300
jb 0x4ec1e8
cmp ebx, 0xbb7
ja 0x4ec1e8
push 2
push esi
push str.netmsg.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x4ec1e8
mov edi, 0x1b00
push 0
lea eax, [esp + 0x18]
push 0
push eax
push 0x400
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x4ec22a
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
push edx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x4ec235
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4ec240
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcf60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], esp
push 0x80
call fcn.004f266a
add esp, 4
mov ebx, eax
push 0x80
push ebx
call sub.WS2_32.dll_gethostname
test eax, eax
je 0x4ec2cb
push str.get_host_name_error
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
push ebx
call fcn.004f265f
add esp, 4
or ax, 0xffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.hostname
mov ecx, 0xf558a0
call fcn.004f0087
push ebx
mov ecx, eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
push ebx
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x4ec31f
push ebx
call fcn.004f265f
add esp, 4
mov ax, 0xfffe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x90]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.addr
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0xf558a0
call fcn.004f0087
lea ecx, [ebp - 0x90]
push ecx
mov ecx, eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edi, 0x50de30
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x90]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004fa6c0
mov ecx, dword [ebp + 8]
push ebx
mov dword [ecx], eax
call fcn.004f265f
mov ecx, dword [ebp - 0xc]
add esp, 8
xor ax, ax
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ec600
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcf80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
push str.Get_users_infomation_...
mov ecx, 0xf558a0
mov dword [ebp - 4], esi
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x24]
push eax
lea edx, [ebp - 0x1c]
push ecx
mov eax, 0x1f40
push edx
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, 2
push eax
mov eax, 1
push eax
push 0
call sub.NETAPI32.dll_NetUserEnum
mov ebx, eax
mov ecx, 0xf558a0
push ebx
call fcn.004f0509
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
test ebx, ebx
je 0x4ec6e4
push ebx
call fcn.004ec1b0
add esp, 4
mov ecx, 0xf558a0
push str.NetUserEnum:_Failed.
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
or ax, 0xffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.er_
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.004f0509
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, dword [ebp - 0x18]
xor edi, edi
cmp edi, dword [ebp - 0x1c]
jge 0x4ec761
mov edx, dword [esi + 0x18]
and edx, 2
cmp dl, 2
jne 0x4ec75b
mov eax, dword [esi]
push 0x100
lea ecx, [ebp - 0x124]
push eax
push ecx
call fcn.004f35d0
lea edx, [ebp - 0x124]
push str.guest
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4ec75b
mov dword [ebp - 0x14], 1
add esi, 0x20
inc edi
jmp 0x4ec718
mov eax, dword [ebp - 0x18]
push eax
call sub.NETAPI32.dll_NetApiBufferFree
test ebx, ebx
jne 0x4ec653
mov ecx, dword [ebp - 0x14]
mov eax, 1
cmp ecx, eax
je 0x4ec6d3
push str.Success.
mov ecx, 0xf558a0
mov dword [ebp - 4], 0xffffffff
call fcn.004f0087
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor ax, ax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ec7d0
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcf90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x10], esp
xor edi, edi
push str.Get_users_infomation_...
mov ecx, 0xf558a0
mov dword [ebp - 4], edi
mov dword [ebx], edi
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x20]
push ecx
mov eax, 0x1f40
push edx
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, 2
push eax
mov eax, 1
push eax
push 0
call sub.NETAPI32.dll_NetUserEnum
test eax, eax
mov dword [ebp - 0x28], eax
je 0x4ec89d
push eax
call fcn.004ec1b0
add esp, 4
mov ecx, 0xf558a0
push str.NetUserEnum:_Failed.
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebx], 0
or ax, 0xffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.er_
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, dword [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.004f0509
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], esi
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp edx, eax
jge 0x4ec981
mov eax, dword [esi]
push 0x100
lea ecx, [ebp - 0x12c]
push eax
push ecx
call fcn.004f35d0
add esp, 0xc
lea edx, [ebp - 0x12c]
mov ecx, 0xf558a0
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [esi + 0x18]
and eax, 0x10
cmp al, 0x10
jne 0x4ec96f
mov edx, dword [ebx]
mov ecx, dword [ebp + 8]
shl edx, 7
add edx, ecx
lea edi, [ebp - 0x12c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx]
mov edi, 1
inc edx
mov eax, edx
mov dword [ebx], edx
cmp eax, 0x40
je 0x4ec981
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add esi, 0x20
inc eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], eax
jmp 0x4ec8d9
mov ecx, dword [ebp - 0x18]
push ecx
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x4ec825
test edi, edi
jne 0x4ec99b
mov dword [ebx], edi
push str.Success.
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ec9f0
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcfa0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], edi
mov dword [ebp - 0x24], edi
mov dword [ebx], edi
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x1c]
push ecx
mov eax, 0x1f40
push edx
push eax
lea eax, [ebp - 0x20]
push eax
xor eax, eax
push eax
mov eax, 3
push eax
push edi
call sub.NETAPI32.dll_NetUserEnum
cmp eax, edi
mov dword [ebp - 0x28], eax
je 0x4eca91
push eax
call fcn.004ec1b0
add esp, 4
mov ecx, 0xf558a0
push str.NetUserEnum:_Failed.
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebx], edi
or ax, 0xffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.er_
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.004f0509
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], esi
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
jge 0x4ecbac
mov eax, dword [esi]
push 0x100
lea ecx, [ebp - 0x12c]
push eax
push ecx
call fcn.004f35d0
add esp, 0xc
lea edx, [ebp - 0x12c]
mov ecx, 0xf558a0
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, dword [esi + 0x50]
mov ecx, 0xf558a0
push esi
call fcn.004f0509
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
cmp esi, 0xffffffff
jne 0x4ecb3e
or esi, esi
lea eax, [ebp - 0x12c]
push esi
push eax
lea ecx, [ebp - 0x22c]
push 0x52fbb4
push ecx
call fcn.004f175f
mov edx, dword [ebx]
mov ecx, dword [ebp + 8]
shl edx, 7
add edx, ecx
lea edi, [ebp - 0x22c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
inc ecx
mov eax, ecx
mov dword [ebx], ecx
cmp eax, 0x80
je 0x4ecbac
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
add ecx, 0x74
inc eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov esi, ecx
jmp 0x4ecac9
mov ecx, dword [ebp - 0x20]
push ecx
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 0x28]
xor edi, edi
cmp eax, edi
jne 0x4eca21
push str.Success.
mov ecx, 0xf558a0
mov dword [ebp - 4], 0xffffffff
call fcn.004f0087
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret