joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c45a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x5c464c
cmp dword [ebx + 0x98], 0
jne 0x5c4646
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5c44d8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x5c4646
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5c460c
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5c4646
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.004afa1c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5c461b
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5c486c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x7a23a0]
cmp dword [eax + 0x178], 0
je 0x5c49d1
test bl, bl
jne 0x5c491f
cmp dword [esi + 0xa0], 0
jne 0x5c4914
mov eax, esi
call fcn.005c775c
push eax
push 0x5c4778
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x5c48e5
mov eax, dword [0x7a23a0]
cmp byte [eax + 0xd7], 0
je 0x5c48e5
mov eax, dword [esi + 0xdc]
call fcn.0040c348
mov edi, eax
cmp edi, 0
jl 0x5c48e5
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c48ce
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c4914
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.004afa1c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c48f4
inc dword [esi + 0xa0]
jmp 0x5c49d1
cmp dword [esi + 0xa0], 0
jle 0x5c49d1
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x5c49d1
cmp dword [esi + 0x48], 0
je 0x5c497c
mov eax, dword [0x7a23a0]
cmp byte [eax + 0xd7], 0
je 0x5c497c
mov eax, dword [esi + 0xdc]
call fcn.0040c348
mov edi, eax
cmp edi, 0
jl 0x5c497c
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c4965
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c49ab
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.004afa1c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c498b
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x5b6894]
call fcn.0040c55c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x5c562c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb0], 0
je 0x5c5689
cmp byte [ebx + 0xd7], 0
jne 0x5c5689
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a118
mov eax, dword [esi]
test eax, eax
je 0x5c5676
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5c5696
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.0040a370
jmp 0x5c5696
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.0040a370
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5c6ec8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x5c6f36
mov eax, esi
call fcn.0054036c
test al, al
je 0x5c6f36
mov eax, dword [ebx + 0x88]
call fcn.0053ffb8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5c6f36
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x110]
test al, al
je 0x5c6f2a
push 0
mov eax, dword [ebx + 0x88]
call fcn.0053ffb8
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x88]
call fcn.00536c6c
jmp 0x5c6f36
mov cl, 1
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.005c6d00
pop esi
pop ebx
ret
Function at 0x5d053c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
test ebp, ebp
je 0x5d05dc
test ebp, ebp
setl byte [esp]
mov eax, edi
xor ecx, ecx
mov edx, 0xb
call fcn.0040ab00
mov esi, 0xb
mov eax, ebp
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov ecx, 0xa
mov eax, ebp
cdq
idiv ecx
mov ebp, eax
mov eax, edi
call fcn.0040a558
add bl, 0x30
mov byte [eax + esi - 1], bl
dec esi
test ebp, ebp
jne 0x5d0566
cmp byte [esp], 0
je 0x5d05ab
mov eax, edi
call fcn.0040a558
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x5d05e8
mov eax, edi
call fcn.0040a558
push eax
mov eax, edi
call fcn.0040a558
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.00406900
mov edx, ebx
mov eax, edi
xor ecx, ecx
call fcn.0040ab00
jmp 0x5d05e8
mov eax, edi
mov edx, 0x5d05fc
call fcn.0040a414
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5d1110
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5d1118
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5d132a
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x5d115b
lea edx, [ebp - 0xc]
mov eax, ebx
call dword [0x787314]
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0040afa0
jmp 0x5d12f7
test ebx, 0xc0000000
je 0x5d11a3
lea edx, [ebp - 0x10]
mov eax, dword [0x787550]
call fcn.005d1348
mov eax, dword [ebp - 0x10]
call fcn.0040aa3c
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x787338]
call fcn.005d1348
mov eax, dword [ebp - 0x14]
call fcn.0040aa3c
push eax
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress_2
test eax, eax
je 0x5d11a3
push ebx
call eax
mov ebx, eax
mov edi, 0x1300
cmp ebx, 0x834
jb 0x5d11e8
cmp ebx, 0xbb7
ja 0x5d11e8
push 2
push 0
lea edx, [ebp - 0x18]
mov eax, dword [0x78754c]
call fcn.005d1348
mov eax, dword [ebp - 0x18]
call fcn.0040aa3c
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5d11ed
or edi, 0x800
jmp 0x5d11ed
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5d12f0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0x400
push ebx
mov eax, dword [ebp - 8]
push eax
push edi
call sub.kernel32.dll_FormatMessageW
test eax, eax
je 0x5d1290
xor eax, eax
push ebp
push 0x5d1289
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040af30
mov eax, dword [esi]
call fcn.0040a488
mov ebx, eax
test ebx, ebx
jbe 0x5d1272
mov eax, dword [esi]
movzx edi, word [eax + ebx*2 - 2]
cmp di, 0xd
jne 0x5d1259
mov eax, esi
call fcn.0040a550
mov word [eax + ebx*2 - 2], 0x20
jmp 0x5d126d
cmp di, 0xa
jne 0x5d126d
mov eax, esi
mov ecx, 1
mov edx, ebx
call fcn.0040b34c
dec ebx
test ebx, ebx
ja 0x5d123c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d12d3
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LocalFree_1
ret
lea edx, [ebp - 0x20]
mov eax, dword [0x787554]
call fcn.005d1348
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.0040afa0
push dword [ebp - 0x1c]
push 0x5d1344
lea eax, [ebp - 0x24]
push eax
mov cx, 0x30
mov edx, 1
mov eax, ebx
call fcn.005d0b70
push dword [ebp - 0x24]
mov eax, esi
mov edx, 3
call fcn.0040b1bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d12f7
cmp dword [ebp - 8], 0
je 0x5d12ef
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d1331
lea eax, [ebp - 0x24]
call fcn.00409f90
lea eax, [ebp - 0x20]
call fcn.00409fb4
lea eax, [ebp - 0x1c]
call fcn.00409f90
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.0040a020
ret
Function at 0x5d1348
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.0040a414
mov eax, ebx
call fcn.0040a56c
mov eax, dword [ebx]
call fcn.0040a494
test eax, eax
jle 0x5d1379
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x5d136e
pop esi
pop ebx
ret
Function at 0x5d7784
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5d7848
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
mov eax, ebx
call fcn.0040aa3c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5d7832
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
call fcn.0040ab00
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, ebx
call fcn.0040aa3c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x5d7832
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x5d785c
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5d7832
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d784f
lea eax, [ebp - 4]
call fcn.00409fb4
ret

Function at 0x5d7aa4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x5d7af0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 2
mov edi, esi
mov eax, edi
call fcn.005d8924
test al, al
jne 0x5d7ae6
cmp word [edi], 0x5a4d
jne 0x5d7ae6
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x5d7ae6
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5d7afc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5d7c94
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
cmp byte [0x7875dc], 0
jne 0x5d7d75
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x5d7ce7
push 0x10000
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
push 0x8000
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameW_1
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileW_1
mov esi, eax
jmp 0x5d7d18
push 0x105
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
push 0x104
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileA
mov esi, eax
push ebx
call sub.kernel32.dll_LocalFree_1
cmp esi, 0xffffffff
je 0x5d7d75
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x5d7d43
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingW
mov ebx, eax
jmp 0x5d7d55
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x5d7d6f
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
push ebx
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x5d9264
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5d9391
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.0040dbf8
cmp dword [0x7a240c], 0
je 0x5d937b
mov eax, dword [0x7a240c]
mov edx, dword [eax]
call dword [edx + 0x84]
xor eax, eax
push ebp
push 0x5d9374
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x5d930c
mov eax, dword [0x7a2408]
call fcn.0040c348
mov esi, eax
test esi, esi
jl 0x5d9359
inc esi
xor ebx, ebx
mov eax, dword [0x7a2408]
mov eax, dword [eax + ebx*4]
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040b2cc
jne 0x5d9306
mov eax, edi
mov edx, dword [0x7a2408]
mov edx, dword [edx + ebx*4]
call fcn.0040dc10
jmp 0x5d9359
inc ebx
dec esi
jne 0x5d92d4
jmp 0x5d9359
cmp dword [ebp - 8], 0
je 0x5d9359
mov eax, dword [0x7a2408]
call fcn.0040c348
mov esi, eax
test esi, esi
jl 0x5d9359
inc esi
xor ebx, ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x7a2408]
mov eax, dword [eax + ebx*4]
mov edx, dword [eax]
call dword [edx + 0x94]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x5d9355
mov eax, edi
mov edx, dword [0x7a2408]
mov edx, dword [edx + ebx*4]
call fcn.0040dc10
jmp 0x5d9359
inc ebx
dec esi
jne 0x5d9325
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d937b
mov eax, dword [0x7a240c]
mov edx, dword [eax]
call dword [edx + 0x8c]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d9398
lea eax, [ebp - 0xc]
call fcn.00409f90
ret
Function at 0x5d98c8
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x5d98d0
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x5d9a08
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0x40], 0
jne 0x5d99e9
mov eax, esi
call fcn.005d4758
test al, al
je 0x5d99e9
lea eax, [ebp - 0x2c]
call fcn.005d6da0
cmp byte [ebp - 0x1a], 0
je 0x5d99db
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [esi + 0x38]
call fcn.0040aec8
push eax
push 0
call sub.advapi32.dll_LookupAccountNameW
mov eax, dword [ebp - 4]
call fcn.0040668c
mov dword [esi + 0x40], eax
lea eax, [esi + 0x3c]
mov edx, dword [ebp - 8]
call fcn.0040b05c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x3c]
call fcn.0040aec8
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x40]
push eax
mov eax, dword [esi + 0x38]
call fcn.0040aec8
push eax
push 0
call sub.advapi32.dll_LookupAccountNameW
cmp eax, 1
sbb ebx, ebx
inc ebx
mov byte [esi + 8], bl
test bl, bl
je 0x5d99b4
movzx eax, byte [ebp - 0xc]
mov byte [esi + 0x44], al
mov eax, dword [esi + 0x3c]
call fcn.0040aec8
mov edx, eax
lea eax, [esi + 0x3c]
call fcn.0040af30
mov eax, esi
test eax, eax
je 0x5d99ad
sub eax, 0xffffffb8
call fcn.005d9198
jmp 0x5d99e9
lea eax, [esi + 0x3c]
call fcn.00409f90
mov eax, dword [esi + 0x40]
call fcn.004066dc
xor eax, eax
mov dword [esi + 0x40], eax
call sub.kernel32.dll_GetLastError_2
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.005d4098
jmp 0x5d99e9
xor ecx, ecx
mov edx, 0x78
mov eax, esi
call fcn.005d4098
mov ebx, dword [esi + 0x40]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d9a0f
lea eax, [ebp - 0x2c]
mov edx, dword [0x5d680c]
call fcn.0040b900
ret
Function at 0x5d9eb0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5da02d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x130]
call fcn.005d6da0
cmp byte [ebp - 0x11e], 0
je 0x5d9f77
call sub.kernel32.dll_GetCurrentProcess
lea edx, [ebp - 8]
call fcn.005d9e38
test al, al
je 0x5d9f46
mov edx, ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.005da2a4
mov eax, dword [ebp - 8]
call fcn.004066dc
jmp 0x5d9ff8
call sub.kernel32.dll_GetLastError_2
push eax
push 0
push 0
push 0
push 2
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5d8da0]
call fcn.005d93a0
mov edx, eax
test edx, edx
je 0x5d9f6b
sub edx, 0xffffffb8
mov eax, ebx
call fcn.0040dc10
jmp 0x5d9ff8
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10d]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x5d9fcc
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
push 0
call fcn.0040a79c
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 0x134]
call fcn.0040afa0
mov eax, dword [ebp - 0x134]
mov ecx, ebx
mov dl, 2
call fcn.005da1d8
jmp 0x5d9ff8
call sub.kernel32.dll_GetLastError_2
push eax
push 0
push 0
push 0
push 2
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5d8da0]
call fcn.005d93a0
mov edx, eax
test edx, edx
je 0x5d9ff1
sub edx, 0xffffffb8
mov eax, ebx
call fcn.0040dc10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5da034
lea eax, [ebp - 0x138]
call fcn.00409fb4
lea eax, [ebp - 0x134]
call fcn.00409f90
lea eax, [ebp - 0x130]
mov edx, dword [0x5d680c]
call fcn.0040b900
ret
Function at 0x5dc60c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5dc80c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.005dffd4
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [ebp - 0x14]
mov dword [0x787e24], eax
mov eax, dword [ebp - 0xc]
mov dword [0x787e28], eax
mov eax, dword [ebp - 0x24]
mov dword [0x787e2c], eax
mov eax, dword [0x79c8a8]
cmp dword [eax], 2
sete byte [0x787605]
push 0x5dc818
call sub.kernel32.dll_GetModuleHandleW_2
lea edx, [ebp - 4]
call fcn.005de23c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x787605], 0
jne 0x5dc69b
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.005de8f0
test al, al
je 0x5dc69b
mov eax, dword [ebp - 0x4c]
mov dword [0x7a24ac], eax
jmp 0x5dc6a2
xor eax, eax
mov dword [0x7a24ac], eax
call fcn.005dbc60
and eax, 0x7f
cmp eax, 0x14
ja case.0x5dc6b3.0
jmp dword [eax*4 + 0x5dc6ba]
mov byte [0x787600], 1
jmp case.0x5dc6b3.0
mov byte [0x787601], 1
jmp case.0x5dc6b3.0
mov byte [0x787602], 1
jmp case.0x5dc6b3.0
mov byte [0x787603], 1
jmp case.0x5dc6b3.0
mov byte [0x787604], 1
jmp case.0x5dc6b3.0
mov byte [0x787606], 1
mov byte [0x787607], 1
jmp case.0x5dc6b3.0
mov byte [0x787606], 1
mov byte [0x787608], 1
jmp case.0x5dc6b3.0
mov byte [0x787606], 1
mov byte [0x787608], 1
mov byte [0x787609], 1
jmp case.0x5dc6b3.0
mov byte [0x78760a], 1
jmp case.0x5dc6b3.0
mov byte [0x78760b], 1
jmp case.0x5dc6b3.0
mov byte [0x78760c], 1
jmp case.0x5dc6b3.0
mov byte [0x78760d], 1
jmp case.0x5dc6b3.0
mov byte [0x78760e], 1
jmp case.0x5dc6b3.0
mov byte [0x78760f], 1
jmp case.0x5dc6b3.0
mov byte [0x787610], 1
jmp case.0x5dc6b3.0
mov byte [0x787611], 1
jmp case.0x5dc6b3.0
mov byte [0x787612], 1
jmp case.0x5dc6b3.0
mov byte [0x787613], 1
jmp case.0x5dc6b3.0
mov byte [0x787614], 1
jmp case.0x5dc6b3.0
mov byte [0x787615], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dc813
lea eax, [ebp - 4]
call fcn.00409f90
ret
Function at 0x5dcfd8
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x79c7fc]
movzx eax, byte [eax]
xor al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x5dd18f
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x15], 0
push ebp
push 0x5dd188
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
jne 0x5dd069
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x3f0
jne 0x5dd069
lea eax, [ebp - 0xc]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x5dd14e
mov al, 2
mov edx, 0x20
mov ecx, ebx
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
lea ebx, [ebp - 8]
push ebx
mov ebx, dword [ebp - 0x28]
push ebx
mov ebx, dword [ebp - 0x24]
push ebx
mov ebx, dword [ebp - 0x20]
push ebx
mov ebx, dword [ebp - 0x1c]
push ebx
push edi
push esi
push ecx
push edx
push eax
mov eax, dword [0x79bd54]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
call fcn.0042ec58
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x5dd0de
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x7a
je 0x5dd0e3
call fcn.0042eb9c
mov eax, dword [ebp - 0x10]
call fcn.0040668c
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
call fcn.0042ec58
mov eax, dword [ebp - 0x14]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x5dd14e
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x5dd14a
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x10
cmp eax, 0x10
setne byte [ebp - 1]
jmp 0x5dd14e
inc ebx
dec esi
jne 0x5dd117
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dd18f
cmp dword [ebp - 0x14], 0
je 0x5dd169
mov eax, dword [ebp - 0x14]
call fcn.004066dc
cmp byte [ebp - 0x15], 0
je 0x5dd178
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 8], 0
je 0x5dd187
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret