joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401bd0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x204
push ebx
mov ebx, dword [esp + 0x214]
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
xor esi, esi
xor ecx, ecx
mov eax, ecx
mov byte [esp + ecx + 0x14], cl
cdq
idiv edi
inc ecx
cmp ecx, 0x100
mov al, byte [edx + ebx]
mov byte [esp + ecx + 0x113], al
jl 0x401bec
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0x114]
mov dl, byte [esp + eax + 0x14]
add esi, ecx
add esi, edx
and esi, 0x800000ff
jns 0x401c2d
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esp + eax + 0x14]
mov cl, byte [esp + esi + 0x14]
mov byte [esp + esi + 0x14], dl
mov byte [esp + eax + 0x14], cl
inc eax
cmp eax, 0x100
jl 0x401c0a
mov ebp, dword [esp + 0x21c]
xor esi, esi
test ebp, ebp
jle 0x401cce
mov ecx, dword [esp + 0x228]
mov edi, dword [esp + 0x218]
sub edi, ecx
inc eax
and eax, 0x800000ff
jns 0x401c71
dec eax
or eax, 0xffffff00
inc eax
xor edx, edx
mov dl, byte [esp + eax + 0x14]
add esi, edx
and esi, 0x800000ff
jns 0x401c89
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esp + esi + 0x14]
mov bl, byte [esp + eax + 0x14]
mov byte [esp + 0x10], dl
mov byte [esp + esi + 0x14], bl
mov ebx, dword [esp + 0x10]
mov byte [esp + eax + 0x14], dl
xor edx, edx
and ebx, 0xff
mov dl, byte [esp + esi + 0x14]
add edx, ebx
and edx, 0x800000ff
jns 0x401cbf
dec edx
or edx, 0xffffff00
inc edx
mov dl, byte [esp + edx + 0x14]
mov bl, byte [edi + ecx]
xor dl, bl
mov byte [ecx], dl
inc ecx
dec ebp
jne 0x401c62
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x204
ret

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x473e6fd3
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x299d28a8
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x100053c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [0x10020c00], 1
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0x1001f7d8
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 8
cmp esi, esp
call fcn.10014010
mov esi, esp
push 0
push 0
push 0
push 0x10004890
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.10014010
mov dword [ebp - 8], eax
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret

Function at 0x10005640
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1300
call fcn.10014220
push ebx
push esi
push edi
lea edi, [ebp - 0x1300]
mov ecx, 0x4c0
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1001f140]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, esp
call fcn.10014010
mov dword [ebp - 0x1014], eax
lea eax, [ebp - 0x1020]
push eax
push 0x1000
lea ecx, [ebp - 0x1008]
push ecx
mov edx, dword [ebp - 0x1014]
push edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x10005723
mov dword [ebp - 0x102c], 0
jmp 0x100056bf
mov eax, dword [ebp - 0x102c]
add eax, 1
mov dword [ebp - 0x102c], eax
mov eax, dword [ebp - 0x1020]
shr eax, 2
cmp dword [ebp - 0x102c], eax
jae 0x10005723
push 0x104
lea eax, [ebp - 0x123c]
push eax
mov ecx, dword [ebp - 0x102c]
mov edx, dword [ebp + ecx*4 - 0x1008]
push edx
mov eax, dword [ebp - 0x1014]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x10005721
push str.speed
lea eax, [ebp - 0x123c]
push eax
call fcn.100057b0
add esp, 8
test eax, eax
je 0x10005721
push str.CHEAT_ENGINE
call fcn.100047e0
add esp, 4
jmp 0x10005739
jmp 0x100056b0
mov esi, esp
mov eax, dword [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10014010
push edx
mov ecx, ebp
push eax
lea edx, [0x10005768]
call fcn.10014040
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10014000
add esp, 0x1300
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret
Function at 0x10005800
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
call fcn.100179b0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10014010
push eax
call fcn.10017e80
push 0x10004f70
push 0x10020c20
call fcn.100171e0
call fcn.10017a10
test eax, eax
je 0x10005873
push str.Debugger_didnt_attach_properly
call fcn.10005e10
add esp, 4
mov esi, esp
push 0
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
jmp 0x100059bf
call fcn.100179b0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10014010
push eax
call fcn.10017e80
push 0x10005550
push 0x10020c1c
call fcn.100171e0
call fcn.10017a10
test eax, eax
je 0x100058c8
push str.WriteMem_didnt_attach_properly
call fcn.10005e10
add esp, 4
mov esi, esp
push 0
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
jmp 0x100059bf
call fcn.100179b0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10014010
push eax
call fcn.10017e80
push 0x10004b50
push 0x10020c24
call fcn.100171e0
call fcn.10017a10
test eax, eax
je 0x1000591d
push str.Connect_didnt_attach_properly
call fcn.10005e10
add esp, 4
mov esi, esp
push 0
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
jmp 0x100059bf
call fcn.100179b0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10014010
push eax
call fcn.10017e80
push 0x10004cc0
push 0x10020c14
call fcn.100171e0
call fcn.10017a10
test eax, eax
je 0x1000596f
push str.MoveWind::_didnt_attach_properly
call fcn.10005e10
add esp, 4
mov esi, esp
push 0
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
jmp 0x100059bf
call fcn.100179b0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10014010
push eax
call fcn.10017e80
push 0x10004d50
push 0x10020c2c
call fcn.100171e0
call fcn.10017a10
test eax, eax
je 0x100059bf
push str.pOpen_didnt_attach_properly
call fcn.10005e10
add esp, 4
mov esi, esp
push 0
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret
Function at 0x408560
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c38b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4643c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0043592c
push 4
mov dword [ebp - 4], 0
call fcn.00436630
mov edi, eax
add esp, 4
test edi, edi
je 0x4085dc
call fcn.00435727
mov dword [edi], eax
call fcn.004354e6
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00435810
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4085d2
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00435838
jmp 0x4085de
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x413e90
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44d9d8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4643c8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
cmp dword [eax + 0x14], 8
mov dword [esp + 0x10], edi
mov dword [eax + 0x10], edi
jb 0x413ed0
mov eax, dword [eax]
mov ebx, dword [sym.imp.Secur32.dll_GetUserNameExW]
lea edx, [esp + 0x10]
push edx
push edi
xor ecx, ecx
push 2
mov word [eax], cx
call ebx
test al, al
jne 0x413ef6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x413f60
mov eax, dword [esp + 0x10]
inc eax
lea esi, [esp + 0x14]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call fcn.00414a30
lea eax, [esp + 0x10]
mov dword [esp + 0x30], edi
mov edi, dword [esp + 0x14]
push eax
push edi
push 2
call ebx
test al, al
jne 0x413f30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x413f51
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413f35
mov esi, dword [ebp + 8]
sub eax, edx
sar eax, 1
push eax
mov eax, edi
call fcn.00413470
xor esi, esi
test edi, edi
je 0x413f5e
push edi
call fcn.0043644d
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4143e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ea68
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4643c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
xor edi, edi
mov eax, 0x10
lea esi, [ebp - 0x48]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
call fcn.00414a30
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], edi
mov ebx, dword [ebp - 0x48]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x4144f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov edx, edi
lea ecx, [ebp - 0x30]
mov ebx, SysReAllocStringLen
call fcn.00419240
mov ecx, eax
sub esp, 0x1c
mov byte [ebp - 4], 1
mov eax, esp
mov dword [ebp - 0x34], esp
push ecx
mov edx, str.Querying_the_computer_name_failed_with:
call fcn.00408410
sub esp, 0x18
mov esi, esp
mov byte [ebp - 4], 2
mov dword [ebp - 0x4c], esp
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push 0x19
mov eax, str.GetComputerNameAPIWrapper
mov word [esi], dx
call fcn.00413470
push 4
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.00419f60
add esp, 0x3c
cmp dword [ebp - 0x1c], 8
jb 0x4144c2
mov eax, dword [ebp - 0x30]
push eax
call fcn.0043644d
add esp, 4
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x4144d2
push ebx
call fcn.0043644d
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00436268
mov esp, ebp
pop ebp
ret
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4144f5
mov esi, dword [ebp - 0x34]
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
call fcn.00413470
jmp 0x4144c5
Function at 0x42ad20
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4643c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x14], esi
cmp edi, esi
je 0x42ae47
cmp ebx, esi
je 0x42ae47
push 2
push 0xc
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x42ae47
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x10], esi
jbe 0x42ae47
xor eax, eax
jmp 0x42ad70
lea ecx, [ebp - 0x14]
push ecx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x42ae34
mov edx, dword [ebp - 0x14]
add edx, 8
push edx
lea eax, [edi + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x42ae34
mov cl, byte [edi]
mov edx, dword [ebp - 0x14]
cmp cl, byte [edx]
jne 0x42ae34
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
mov edx, dword [edi + 4]
push ecx
push edx
call fcn.00435200
mov edx, dword [ebp - 0x14]
mov esi, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
mov eax, dword [edx + 4]
push ecx
push eax
call fcn.00435200
add esp, 0x10
cmp esi, eax
jne 0x42ae34
cmp byte [ebp + 0xc], 0
je 0x42ae2b
mov ecx, dword [ebp - 0x14]
mov cl, byte [ecx + 1]
test cl, 3
je 0x42ae34
mov al, byte [edi + 1]
test cl, 4
je 0x42adfd
test al, 0xb
jne 0x42ae06
test al, 4
jmp 0x42ae04
mov dl, al
xor dl, cl
test dl, 0xb
je 0x42ae18
test cl, 8
je 0x42ae34
test cl, 2
je 0x42ae34
test al, 0xb
jne 0x42ae34
test al, 4
jne 0x42ae34
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00436268
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x14]
test byte [eax + 1], 1
jne 0x42ae18
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
movzx eax, ax
cmp eax, dword [ebp - 0x10]
jb 0x42ad70
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
pop esi
call fcn.00436268
mov esp, ebp
pop ebp
ret 8
Function at 0x42ae60
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4643c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
cmp eax, ebx
je 0x42b03a
cmp edi, ebx
je 0x42b03a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetAclInformation]
push 2
push 0xc
lea edx, [ebp - 0x10]
push edx
push eax
call esi
test eax, eax
je 0x42afeb
push 2
push 0xc
lea eax, [ebp - 0x1c]
push eax
push edi
call esi
test eax, eax
je 0x42afeb
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x1c], ebx
jbe 0x42afeb
xor eax, eax
lea esp, [esp]
lea ecx, [ebp - 0x20]
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x42afd8
mov bl, byte [ebp + 0x10]
mov ecx, dword [ebp - 0x20]
test bl, bl
je 0x42af09
mov al, byte [ecx + 1]
test al, 1
jne 0x42af13
test al, 2
jmp 0x42af0d
test byte [ecx + 1], 1
je 0x42afd8
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x180]
push eax
add ecx, 8
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x42af34
test bl, bl
jne 0x42af34
mov ebx, dword [ebp - 0x30]
jmp 0x42af3a
mov ebx, dword [ebp - 0x20]
add ebx, 8
xor edi, edi
cmp dword [ebp - 0x10], edi
jbe 0x42b025
xor eax, eax
mov edx, dword [ebp - 0x34]
lea ecx, [ebp - 0x24]
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x42b018
mov eax, dword [ebp - 0x24]
push ebx
add eax, 8
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x42b018
mov eax, dword [ebp - 0x24]
mov cl, byte [eax]
mov edx, dword [ebp - 0x20]
cmp cl, byte [edx]
jne 0x42b018
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x80]
mov eax, dword [eax + 4]
push edx
push eax
call fcn.00435200
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x80]
mov esi, eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push edx
push ecx
call fcn.00435200
add esp, 0x10
cmp esi, eax
jne 0x42b018
cmp byte [ebp + 0x10], 0
je 0x42afd5
mov edx, dword [ebp - 0x20]
mov cl, byte [edx + 1]
test cl, 4
je 0x42b000
mov eax, dword [ebp - 0x24]
mov al, byte [eax + 1]
test al, 0xb
jne 0x42b018
test al, 4
jne 0x42b018
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
movzx eax, ax
cmp eax, dword [ebp - 0x1c]
jb 0x42aee0
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00436268
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 0x24]
mov al, byte [edx + 1]
mov dl, al
xor dl, cl
test dl, 3
jne 0x42b018
test al, 8
je 0x42afd5
test cl, 8
jne 0x42afd5
inc edi
movzx eax, di
cmp eax, dword [ebp - 0x10]
jb 0x42af47
pop esi
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00436268
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor al, al
pop ebx
call fcn.00436268
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4305c0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov byte [eax], 0
mov byte [ecx], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [eax + 8]
sub ecx, dword [eax + 4]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov eax, edx
push edi
xor edi, edi
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xc], edi
je 0x430757
push ebx
mov dword [ebp - 8], edi
jmp 0x430602
xor edi, edi
mov ecx, dword [esi + 0x40]
mov ebx, dword [ecx + 4]
add ebx, dword [ebp - 8]
test byte [ebx + 0x24], 4
mov dword [ebp - 4], ebx
je 0x4306a2
mov eax, dword [ebx + 0x28]
mov ecx, dword [esi + 0xc]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4306a2
test dword [ebx + 0x20], 0x500
je 0x4306a2
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x430650
cmp byte [esi + 0x47], 0
je 0x430650
push eax
call fcn.00436ac3
add esp, 4
mov dword [esi + 0xc], edi
mov byte [esi + 0x47], 0
mov edi, dword [ebx + 0x54]
test edi, edi
jne 0x43065b
xor eax, eax
jmp 0x430697
push edi
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push eax
call fcn.0043747f
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x430694
push edi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push eax
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
jne 0x430692
push ebx
call fcn.00436ac3
add esp, 4
xor eax, eax
jmp 0x430694
mov eax, ebx
mov ebx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov byte [edx], 1
xor edi, edi
test byte [ebx + 0x24], 8
je 0x430729
mov eax, dword [ebx + 0x28]
push eax
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x430729
test dword [ebx + 0x20], 0x500
je 0x430729
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x4306e4
cmp byte [esi + 0x47], 0
je 0x4306e4
push eax
call fcn.00436ac3
add esp, 4
mov dword [esi + 0xc], edi
mov byte [esi + 0x47], 0
mov edi, dword [ebx + 0x54]
test edi, edi
je 0x43071e
push edi
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push eax
call fcn.0043747f
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x43071e
push edi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push eax
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
jne 0x430720
push ebx
call fcn.00436ac3
add esp, 4
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x10], ebx
mov byte [ecx], 1
mov eax, dword [esi + 0x40]
mov ecx, dword [eax + 8]
sub ecx, dword [eax + 4]
mov edi, dword [ebp - 0xc]
add dword [ebp - 8], 0x58
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
mov dword [ebp - 0xc], edi
cmp edi, eax
jb 0x430600
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x432140
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ed18
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4643c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], 0
test esi, esi
jne 0x432196
cmp dword [ebp + 0x1c], 8
jb 0x43218c
mov eax, dword [ebp + 8]
push eax
call fcn.0043644d
add esp, 4
mov eax, 0x57
jmp 0x4322d2
lea ebx, [ebp + 8]
call fcn.00431b80
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x4321a9
mov eax, ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x4321d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x68], edi
cmp edi, 2
je 0x4321cd
cmp edi, 3
jne 0x4321df
cmp byte [ebp + 0x24], 0
je 0x4321df
mov dword [ebp - 0x68], 0
jmp 0x4322bb
test edi, edi
je 0x4322be
mov bl, 1
cmp byte [ebp + 0x28], bl
jne 0x4322be
mov edx, edi
lea ecx, [ebp - 0x64]
mov esi, SysReAllocStringLen
call fcn.00419240
mov edi, eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
push str.FindFirstFile_for_path_
push ecx
lea ebx, [ebp + 8]
call fcn.00407830
push eax
mov eax, str._returned:
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00407910
mov ecx, eax
sub esp, 0x10
mov byte [ebp - 4], 3
mov eax, edi
mov ebx, esp
mov dword [ebp - 0x70], esp
call fcn.004190d0
sub esp, 0x1c
mov eax, str.FindFirstFileAPIWrapper
mov ecx, esp
mov byte [ebp - 4], 4
mov dword [ebp - 0x6c], esp
call fcn.00413560
push 4
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00419f60
mov esi, 8
add esp, 0x3c
cmp dword [ebp - 0x18], esi
jb 0x43227a
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0043644d
add esp, 4
xor edi, edi
xor eax, eax
mov ebx, 7
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], ax
cmp dword [ebp - 0x34], esi
jb 0x43229e
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.0043644d
add esp, 4
xor edx, edx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], edi
mov word [ebp - 0x48], dx
cmp dword [ebp - 0x50], esi
jb 0x4322bb
mov eax, dword [ebp - 0x64]
push eax
call fcn.0043644d
add esp, 4
mov edi, dword [ebp - 0x68]
cmp dword [ebp + 0x1c], 8
jb 0x4322d0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043644d
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00436268
mov esp, ebp
pop ebp
ret
Function at 0x435160
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [eax + 0x14]
cmp esi, 8
jb 0x43516d
mov ecx, dword [eax]
jmp 0x43516f
mov ecx, eax
mov edx, dword [eax + 0x10]
lea edx, [ecx + edx*2]
cmp esi, 8
jb 0x43517e
mov ecx, dword [eax]
jmp 0x435180
mov ecx, eax
xor eax, eax
cmp ecx, edx
je 0x4351a7
push edi
mov esi, eax
mov edi, eax
shl esi, 6
shr edi, 2
add esi, edi
movzx edi, word [ecx]
lea esi, [esi + edi - 0x61c88647]
add ecx, 2
xor eax, esi
cmp ecx, edx
jne 0x435187
pop edi
pop esi
ret

Function at 0x435280
Capabilities:
Get domain controller name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d568
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4643c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov ecx, 8
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], ecx
jb 0x4352c5
mov eax, dword [esi]
jmp 0x4352c7
mov eax, esi
xor edx, edx
mov word [eax], dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp dword [ebp + 0x1c], ecx
jae 0x4352da
lea eax, [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x435342
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, eax
lea edi, [ecx + 2]
mov edi, edi
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x435300
sub ecx, edi
sar ecx, 1
push ecx
call fcn.00413470
sub esp, 0x14
mov edi, esp
mov dword [ebp - 0x18], esp
push str.___
call fcn.00408050
add esp, 4
mov ecx, esi
call fcn.0041bdd0
mov eax, dword [ebp - 0x10]
add esp, 0x14
test eax, eax
je 0x435342
push eax
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp dword [ebp + 0x1c], 8
jb 0x435354
mov eax, dword [ebp + 8]
push eax
call fcn.0043644d
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret