joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62ddf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040aa94
xor eax, eax
push ebp
push 0x62df0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [0x6468e4]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.0040add8
lea eax, [ebp - 0x406]
mov edx, dword [ebp - 4]
call fcn.00426d3c
lea eax, [ebp - 0x44c]
xor ecx, ecx
mov edx, 0x44
call fcn.00407ec4
mov dword [ebp - 0x44c], 0x44
mov dword [ebp - 0x420], 1
mov word [ebp - 0x41c], si
mov eax, 0x62df20
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x44c]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x406]
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
jne 0x62dea5
xor ebx, ebx
jmp 0x62def5
call fcn.0062ddb0
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x45c]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
mov esi, eax
test esi, esi
jbe 0x62decc
call fcn.0062ddb0
test esi, esi
jne 0x62deaa
push edi
mov eax, dword [ebp - 0x45c]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
mov eax, dword [ebp - 0x45c]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x458]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62df14
lea eax, [ebp - 4]
call fcn.0040a9b0
pop eax
jmp eax

Function at 0x62e358
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push 0x20a
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040b520
add esp, 0x20c
pop ebx
ret
Function at 0x62f4d4
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040aa94
xor eax, eax
push ebp
push 0x62f664
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push 0xf003f
push 0
push edi
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x62f645
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0
jne 0x62f532
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
jmp 0x62f62c
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.0040b480
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x62f625
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x14], 0
jne 0x62f56d
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
jmp 0x62f60c
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_StartServiceW
test eax, eax
jne 0x62f58f
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
jmp 0x62f60c
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x62f5ff
cmp word [ebx + 0xa], 0
je 0x62f5e7
lea ecx, [ebp - 0x30]
mov edx, ebx
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
jmp 0x62f5e7
inc esi
cmp esi, dword [ebp + 8]
ja 0x62f5ed
push 0x3e8
call sub.KERNEL32.DLL_Sleep
cmp word [ebx + 0xa], 0
je 0x62f5d6
lea ecx, [ebp - 0x30]
mov edx, ebx
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x62f5ed
cmp dword [ebp - 0x2c], 4
jne 0x62f5b4
cmp word [ebx + 0xa], 0
je 0x62f5ff
lea ecx, [ebp - 0x30]
mov edx, ebx
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
cmp dword [ebp - 0x2c], 4
je 0x62f60c
mov dword [ebp - 8], 0x102
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62f62c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62f64c
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax
Function at 0x62f678
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040aa94
xor eax, eax
push ebp
push 0x62f803
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push 0xf003f
push 0
push edi
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x62f7e4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
jne 0x62f6d6
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
jmp 0x62f7cb
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.0040b480
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x62f7c4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0
jne 0x62f711
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
jmp 0x62f7ab
lea eax, [ebp - 0x2c]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x62f72e
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
jmp 0x62f7ab
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x62f79e
cmp word [ebx + 0xa], 0
je 0x62f786
lea ecx, [ebp - 0x2c]
mov edx, ebx
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
jmp 0x62f786
inc esi
cmp esi, dword [ebp + 8]
ja 0x62f78c
push 0x3e8
call sub.KERNEL32.DLL_Sleep
cmp word [ebx + 0xa], 0
je 0x62f775
lea ecx, [ebp - 0x2c]
mov edx, ebx
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x62f78c
cmp dword [ebp - 0x28], 1
jne 0x62f753
cmp word [ebx + 0xa], 0
je 0x62f79e
lea ecx, [ebp - 0x2c]
mov edx, ebx
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
cmp dword [ebp - 0x28], 1
je 0x62f7ab
mov dword [ebp - 8], 0x102
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62f7cb
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62f7eb
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax
Function at 0x62fb58
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov eax, dword [ebp - 4]
call fcn.0040aa94
xor eax, eax
push ebp
push 0x62fc6b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
push 0xf003f
push 0
push ebx
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x62fc4c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
jne 0x62fbb0
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
jmp 0x62fc33
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.0040b480
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x62fc2c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0
jne 0x62fbe8
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
jmp 0x62fc13
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
jne 0x62fc13
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62fc33
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62fc53
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax
Function at 0x62fd90
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0040aa94
xor eax, eax
push ebp
push 0x62fece
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, ebx
call fcn.0040a9b0
push 0xf003f
push 0
push esi
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x62fea7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x62fe8e
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.0040b480
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x62fe87
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0
je 0x62fe55
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
je 0x62fe41
cmp byte [ebp + 0xc], 0
jne 0x62fe3b
mov eax, ebx
mov edx, 0x62fef0
call fcn.0040ad90
mov byte [ebp - 5], 1
jmp 0x62fe6e
cmp byte [ebp + 0xc], 0
jne 0x62fe6e
mov eax, ebx
mov edx, 0x62ff40
call fcn.0040ad90
jmp 0x62fe6e
call sub.KERNEL32.DLL_GetLastError
lea ecx, [ebp - 0x14]
xor edx, edx
call fcn.0042a82c
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0040ad90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62fe8e
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62feae
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax
Function at 0x62ff70
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x6300b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.0040a9b0
push 0xf003f
push 0
push esi
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x630098
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x63007f
push 0xf01ff
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x630078
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x630046
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x24]
push eax
mov eax, dword [ebp + 0x28]
push eax
mov eax, dword [ebp + 0x2c]
push eax
mov eax, dword [ebp + 0x30]
push eax
mov eax, dword [ebp + 0x34]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CreateServiceW
test eax, eax
jne 0x630038
mov byte [ebp - 1], 1
mov eax, ebx
mov edx, 0x6300d8
call fcn.0040ad90
jmp 0x63005f
mov eax, ebx
mov edx, 0x630108
call fcn.0040ad90
jmp 0x63005f
call sub.KERNEL32.DLL_GetLastError
lea ecx, [ebp - 0x10]
xor edx, edx
call fcn.0042a82c
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0040ad90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63007f
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63009f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax

Function at 0x63021c
Capabilities:
Query service status

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov esi, edx
xor edi, edi
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
je 0x63026a
push 0xf01ff
mov eax, esi
call fcn.0040b480
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
je 0x630264
push esp
push esi
call sub.advapi32.dll_QueryServiceStatus
mov edi, dword [esp + 4]
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov eax, edi
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x633298
Capabilities:
Get user security identifier
Manipulate user privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040aa94
mov eax, dword [ebp - 8]
call fcn.0040aa94
xor eax, eax
push ebp
push 0x633421
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x18
call fcn.00407ec4
lea eax, [ebp - 0x18]
push eax
push 0x810
lea eax, [ebp - 0x48]
push eax
push 0
call sub.advapi32.dll_LsaOpenPolicy
test eax, eax
je 0x633304
push eax
call sub.advapi32.dll_LsaNtStatusToWinError
mov dword [ebp - 0x14], eax
jmp 0x633404
xor ecx, ecx
push ebp
push 0x6333fd
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov dword [ebp - 0x2c], 0xf
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x2c]
call fcn.0040b5f8
mov dword [ebp - 0x28], 0x44
mov eax, dword [ebp - 0x28]
call fcn.00406eec
mov dword [ebp - 0x24], eax
xor ecx, ecx
push ebp
push 0x6333dd
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040b480
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b480
push eax
push 0
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
je 0x6333bd
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040add8
mov eax, dword [ebp - 0x10]
call fcn.0040b480
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x633393
sub eax, 4
mov eax, dword [eax]
mov edx, eax
add edx, edx
mov word [ebp - 0x20], dx
mov word [ebp - 0x1e], dx
push 1
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_LsaAddAccountRights
push eax
call sub.advapi32.dll_LsaNtStatusToWinError
mov dword [ebp - 0x14], eax
jmp 0x6333c5
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6333e4
mov eax, dword [ebp - 0x24]
call fcn.00406f08
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x633428
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040aa10
pop eax
jmp eax
Function at 0x633430
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040aa94
mov eax, dword [ebp - 8]
call fcn.0040aa94
xor eax, eax
push ebp
push 0x6335bb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x18
call fcn.00407ec4
lea eax, [ebp - 0x18]
push eax
push 0x810
lea eax, [ebp - 0x48]
push eax
push 0
call sub.advapi32.dll_LsaOpenPolicy
test eax, eax
je 0x63349c
push eax
call sub.advapi32.dll_LsaNtStatusToWinError
mov dword [ebp - 0x14], eax
jmp 0x63359e
xor ecx, ecx
push ebp
push 0x633597
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov dword [ebp - 0x2c], 0xf
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x2c]
call fcn.0040b5f8
mov dword [ebp - 0x28], 0x44
mov eax, dword [ebp - 0x28]
call fcn.00406eec
mov dword [ebp - 0x24], eax
xor ecx, ecx
push ebp
push 0x633577
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040b480
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b480
push eax
push 0
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
je 0x633557
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040add8
mov eax, dword [ebp - 0x10]
call fcn.0040b480
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x63352b
sub eax, 4
mov eax, dword [eax]
mov edx, eax
add edx, edx
mov word [ebp - 0x20], dx
mov word [ebp - 0x1e], dx
push 1
lea eax, [ebp - 0x20]
push eax
push 0
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_LsaRemoveAccountRights
push eax
call sub.advapi32.dll_LsaNtStatusToWinError
mov dword [ebp - 0x14], eax
jmp 0x63355f
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63357e
mov eax, dword [ebp - 0x24]
call fcn.00406f08
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6335c2
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040aa10
pop eax
jmp eax
Function at 0x6335cc
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040aa94
xor eax, eax
push ebp
push 0x633770
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, esi
mov edx, dword [0x412258]
call fcn.0040d614
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x18
call fcn.00407ec4
lea eax, [ebp - 0x10]
push eax
push 0x810
lea eax, [ebp - 0x40]
push eax
push 0
call sub.advapi32.dll_LsaOpenPolicy
test eax, eax
je 0x633641
push eax
call sub.advapi32.dll_LsaNtStatusToWinError
mov dword [ebp - 0xc], eax
jmp 0x633753
xor edx, edx
push ebp
push 0x63374c
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x1c], 0xf
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x1c]
call fcn.0040b5f8
mov dword [ebp - 0x18], 0x44
mov eax, dword [ebp - 0x18]
call fcn.00406eec
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x63372c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
call fcn.0040b480
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b480
push eax
push 0
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
je 0x63370c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_LsaEnumerateAccountRights
test eax, eax
jne 0x633701
mov eax, dword [ebp - 0x28]
push eax
mov eax, esi
mov ecx, 1
mov edx, dword [0x412258]
call fcn.0040d4f0
add esp, 4
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x633714
inc ebx
xor edi, edi
mov eax, dword [esi]
lea eax, [eax + edi*4]
mov edx, dword [ebp - 0x24]
mov edx, dword [edx + 4]
call fcn.0040b4e4
inc edi
dec ebx
jne 0x6336eb
jmp 0x633714
push eax
call sub.advapi32.dll_LsaNtStatusToWinError
mov dword [ebp - 0xc], eax
jmp 0x633714
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x633733
mov eax, dword [ebp - 0x14]
call fcn.00406f08
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x633777
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040aa10
pop eax
jmp eax
Function at 0x404580
Capabilities:
Set current directory

Disassembly:
push ecx
mov al, byte [esp + 8]
mov byte [esp + 3], dl
mov edx, ecx
push ebx
mov ebx, dword [0x4f48cc]
test al, al
je 0x4045a8
inc dword [0x4f78d4]
add ebx, 0x108
mov dword [0x4f48cc], ebx
mov ecx, 0x42
push esi
mov esi, 0x4f77b8
push edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x2c], edx
pop edi
pop esi
test al, al
je 0x4045cd
push 0
mov ecx, 0x4f9a70
call fcn.00423190
cmp dword [0x4f78e8], 0
xorps xmm0, xmm0
movlpd qword [0x4fa570], xmm0
je 0x4045fd
mov eax, dword [0x4f62b4]
mov ecx, 0x4cd2cc
test eax, eax
je 0x4045f6
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 7], 0
jne 0x404680
mov cl, byte [ebx + 0xee]
test cl, cl
jne 0x404632
cmp byte [esp + 0x10], 0x65
sete cl
mov byte [ebx + 0xee], cl
jne 0x404632
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0x24], 0xffffffff
cmp dword [0x4fa57c], 0
je 0x404644
cmp dword [0x4fa578], 0
jne 0x404648
test cl, cl
je 0x404680
mov byte [ebx + 0xec], 0
test cl, cl
jne 0x404680
cmp dword [0x4fa57c], 0
jge 0x404669
mov dword [ebx + 0xe0], 0xffffffff
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0xdc], eax
mov eax, dword [0x4fa57c]
mov dword [ebx + 0xe0], eax
pop ebx
pop ecx
ret

Function at 0x405900
Capabilities:
Write clipboard data

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
jne 0x405922
call fcn.00405c40
test eax, eax
jne 0x405922
push str.Cant_open_clipboard_for_writing.
mov ecx, esi
call fcn.00405a30
pop esi
ret 4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x405968
cmp dword [esi + 0x18], eax
je 0x405958
cmp dword [esi + 8], eax
je 0x405945
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x4cd84c
mov ecx, esi
call fcn.00405a30
pop esi
ret 4
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
je 0x4059aa
mov ecx, dword [esi + 0xc]
push ebx
xor bl, bl
test ecx, ecx
je 0x40599b
cmp word [ecx], 0
push eax
sete bl
call edi
mov eax, dword [esi + 4]
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
test bl, bl
pop ebx
push eax
je 0x4059de
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], 0
je 0x4059d4
cmp dword [esi + 8], 0
je 0x4059c1
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
pop edi
mov eax, 1
pop esi
ret 4
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4059f3
mov dword [esi + 4], 0
jmp 0x4059aa
cmp dword [esi + 0x18], 0
je 0x405a1d
cmp dword [esi + 8], 0
je 0x405a0a
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x4cd86c
mov ecx, esi
call fcn.00405a30
pop edi
pop esi
ret 4