joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438ed2
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4d45a8]
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
je 0x438eeb
push eax
call fcn.0045038b
pop ecx
mov ebx, 0x4000
push ebx
push 1
call fcn.00450903
pop ecx
pop ecx
push esi
push esi
push 3
push esi
push 3
push Ordinal_2
push dword [ebp + 8]
mov dword [0x4d45a8], eax
push str..PhysicalDrive_d
mov dword [ebp - 4], eax
call fcn.0042f614
pop ecx
pop ecx
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CreateFileA]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x439008
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.00455611
mov edi, dword [sym.imp.___total_physical_size__lu_MB_DeviceIoControl]
pop ecx
push eax
push dword [ebp - 4]
push esi
push esi
push 0x70050
push dword [ebp + 8]
call edi
test eax, eax
jle 0x438fe1
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jne 0x438fe1
push ebx
call fcn.00452122
mov edi, eax
pop ecx
cmp edi, esi
jne 0x438f7b
push str.Not_enough_memory_to_allocate_16384_bytes_n
call fcn.0043c16a
pop ecx
push dword [ebp - 4]
call fcn.00455611
push eax
push dword [ebp - 4]
push edi
call fcn.00451390
mov edx, dword [edi + 4]
mov eax, dword [0x4d45a8]
add esp, 0x10
mov dword [eax], edx
cmp edx, esi
jbe 0x438fca
add eax, 8
lea ecx, [edi + 0x38]
mov esi, dword [ecx + 8]
mov dword [eax + 8], esi
mov esi, dword [ecx + 0xc]
mov dword [eax + 0xc], esi
mov esi, dword [ecx]
mov dword [eax], esi
mov esi, dword [ecx + 4]
mov dword [eax + 4], esi
mov byte [eax + 0x18], 7
add ecx, 0x90
add eax, 0x20
dec edx
jne 0x438fa4
push edi
call fcn.0045038b
pop ecx
push dword [ebp + 8]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
mov eax, dword [0x4d45a8]
jmp 0x43901c
push esi
push dword [ebp + 0xc]
push dword [0x4d45a8]
call fcn.00455611
pop ecx
push eax
push dword [0x4d45a8]
push esi
push esi
push 0x7400c
push dword [ebp + 8]
call edi
test eax, eax
jne 0x438fd1
push dword [0x4d45a8]
call fcn.0045038b
pop ecx
mov dword [0x4d45a8], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x43c2b2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push esi
call fcn.0043c20b
test eax, eax
jne 0x43c2df
xor eax, eax
jmp 0x43c335
push edi
call fcn.0043c1a0
mov ecx, eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x43c2ea
lea edx, [ebp - 0x130]
push edx
sub ecx, edi
push ecx
push eax
lea eax, [esi + 0x1c]
push eax
call fcn.0041d1a8
mov eax, dword [ebp - 0x130]
cmp eax, dword [esi + 0x148]
jne 0x43c2db
lea edi, [ebp - 0x12c]
xor ecx, ecx
sub edi, ebx
lea eax, [ebx + ecx]
mov dl, byte [edi + eax]
xor dl, byte [esi + ecx + 0x14c]
inc ecx
mov byte [eax], dl
cmp ecx, 0x10
jb 0x43c31d
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 0xc
Function at 0x43c365
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.0043c35a
test eax, eax
je 0x43c41f
mov eax, dword [0x4bcc8b]
push esi
push edi
mov dword [ebx + 0x18], eax
mov dword [ebx + 4], 0x15c
lea edi, [ebx + 8]
mov esi, 0x4bcc7b
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push str.someJunk
lea eax, [ebp - 0x14]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0040bff8
lea eax, [ebx + 0x1c]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [0x4bcc8b]
call fcn.0041d1fd
lea eax, [ebp - 0x140]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0x4bcc8f
call fcn.0041d1a8
mov eax, dword [ebp - 0x140]
mov edi, dword [ebp + 8]
mov dword [ebx + 0x148], eax
lea eax, [ebp - 0x13c]
xor esi, esi
sub edi, eax
lea eax, [ebp + esi - 0x13c]
mov cl, byte [edi + eax]
xor cl, byte [eax]
inc esi
mov byte [ebx + esi + 0x14b], cl
cmp esi, 0x10
jb 0x43c3f9
push ebx
call fcn.0043c183
mov dword [ebx], eax
xor eax, eax
pop edi
inc eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 8

Function at 0x43c42e
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetSystemDirectoryA]
test eax, eax
je 0x43c494
push esi
push 0x4777b4
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push 0x4696e0
push eax
call fcn.00450c76
add esp, 0x10
call fcn.004430cb
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_DeleteFileA]
mov esi, eax
call fcn.004430e1
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00450b32
leave
ret
Function at 0x43c4a0
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
call fcn.00420af9
dec eax
neg eax
sbb eax, eax
add eax, 0xbe
movzx eax, ax
push str.BINARY
push eax
push esi
call dword [sym.imp.___total_physical_size__lu_MB_FindResourceA]
mov edi, eax
cmp edi, esi
jne 0x43c4e3
xor eax, eax
jmp 0x43c5f0
push edi
push esi
call dword [sym.imp.___total_physical_size__lu_MB_SizeofResource]
mov dword [ebp - 0x210], eax
cmp eax, esi
je 0x43c4dc
push edi
push esi
call dword [sym.imp.___total_physical_size__lu_MB_LoadResource]
cmp eax, esi
je 0x43c4dc
push eax
call dword [sym.imp.___total_physical_size__lu_MB_LockResource]
mov edi, eax
cmp edi, esi
je 0x43c4dc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetSystemDirectoryA]
test eax, eax
je 0x43c4dc
push ebx
push 0x4777b4
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push 0x4696e0
push eax
call fcn.00450c76
add esp, 0x10
call fcn.004430cb
push esi
push 0x80
push 2
push esi
push esi
push 0xc0000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43c591
lea eax, [ebp - 0x108]
push eax
push str.Cant_open_file__s
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x5a
push str.REGNATIVE
call fcn.0044dc85
add esp, 0x14
jmp 0x43c5e8
push esi
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x210]
push edi
push ebx
call dword [sym.imp.___total_physical_size__lu_MB_WriteFile]
test eax, eax
mov eax, dword [ebp - 0x214]
je 0x43c5be
cmp eax, dword [ebp - 0x210]
jne 0x43c5be
xor esi, esi
inc esi
jmp 0x43c5e1
push eax
lea eax, [ebp - 0x108]
push eax
push str.File_write_to__s_failed._Bytes_witten:_u
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x60
push str.REGNATIVE
call fcn.0044dc85
add esp, 0x18
push ebx
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
call fcn.004430e1
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00450b32
leave
ret
Function at 0x43c85c
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00453130
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0xfff
lea eax, [ebp - 0x1003]
push 0
push eax
mov dword [ebp - 0x1018], ebx
mov byte [ebp - 0x1004], 0
call fcn.00450230
mov esi, dword [sym.imp.ical_size__lu_MB_RegOpenKeyA]
and dword [ebp - 0x1014], 0
add esp, 0xc
lea eax, [ebp - 0x1008]
push eax
push str.SYSTEMCurrentControlSetControl
mov edi, reloc.lu_heads___lu_sectors___lu_byte_Ordinal_2
push edi
mov dword [ebp - 0x100c], 0x1000
call esi
push 0x469ec0
push dword [ebp - 0x1008]
call dword [sym.imp.ical_size__lu_MB_RegDeleteKeyA]
push dword [ebp - 0x1008]
call dword [sym.imp.ical_size__lu_MB_RegCloseKey]
and dword [0x4d45d0], 0
test ebx, ebx
je 0x43c8f2
and dword [ebx], 0
lea eax, [ebp - 0x1008]
push eax
push str.SYSTEMCurrentControlSetControlSession_Manager
push edi
call esi
test eax, eax
je 0x43c90c
xor eax, eax
jmp 0x43ca01
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x477a80
push dword [ebp - 0x1008]
call dword [sym.imp.ical_size__lu_MB_RegQueryValueExA]
test eax, eax
jne 0x43c9ef
push 1
push dword [ebp - 0x100c]
call fcn.00450903
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0x1010], esi
cmp dword [ebp - 0x100c], ebx
jbe 0x43c9be
lea eax, [ebp + ebx - 0x1004]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43c960
sub eax, edi
mov edi, eax
jne 0x43c970
inc ebx
jmp 0x43c9b5
push 0xe
lea eax, [ebp + ebx - 0x1004]
push 0x4777b4
push eax
call fcn.00450c23
add esp, 0xc
test eax, eax
jne 0x43c99d
mov eax, dword [ebp - 0x1018]
test eax, eax
je 0x43c9b3
mov dword [eax], 1
jmp 0x43c9b3
push edi
lea eax, [ebp + ebx - 0x1004]
push eax
push esi
call fcn.00451390
add esp, 0xc
lea esi, [esi + edi + 1]
add ebx, edi
inc ebx
cmp ebx, dword [ebp - 0x100c]
jb 0x43c956
sub esi, dword [ebp - 0x1010]
inc esi
push esi
push dword [ebp - 0x1010]
push 7
push 0
push 0x477a80
push dword [ebp - 0x1008]
call dword [sym.imp.ical_size__lu_MB_RegSetValueExA]
test eax, eax
jne 0x43c9ef
mov dword [ebp - 0x1014], 1
push dword [ebp - 0x1008]
call dword [sym.imp.ical_size__lu_MB_RegCloseKey]
mov eax, dword [ebp - 0x1014]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 4
Function at 0x43cbb9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00453130
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0xfff
xor esi, esi
lea eax, [ebp - 0x1003]
push esi
push eax
mov byte [ebp - 0x1004], 0
call fcn.00450230
add esp, 0xc
lea eax, [ebp - 0x1010]
push eax
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.lu_heads___lu_sectors___lu_byte_Ordinal_2
mov dword [ebp - 0x100c], 0x1000
xor ebx, ebx
mov dword [ebp - 0x1008], esi
call dword [sym.imp.ical_size__lu_MB_RegOpenKeyA]
test eax, eax
je 0x43cc24
xor eax, eax
jmp 0x43cd1b
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
push esi
push esi
push 0x477a80
push dword [ebp - 0x1010]
call dword [sym.imp.ical_size__lu_MB_RegQueryValueExA]
test eax, eax
jne 0x43cd0d
push edi
cmp dword [ebp - 0x100c], esi
jbe 0x43ccb2
lea ebx, [ebp + esi - 0x1004]
mov eax, ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43cc62
sub eax, ecx
mov edi, eax
jne 0x43cc72
inc esi
jmp 0x43cca7
push 0xe
push 0x4777b4
push ebx
call fcn.00450c23
add esp, 0xc
test eax, eax
jne 0x43cca5
cmp dword [ebp - 0x1008], eax
jne 0x43cc99
push str._nScheduled_restore_for_the_next_reboot:_n
call fcn.00450f5c
pop ecx
mov dword [ebp - 0x1008], 1
jmp 0x43cca7
add esi, edi
inc esi
cmp esi, dword [ebp - 0x100c]
jb 0x43cc56
xor esi, esi
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x1008], esi
jne 0x43ccc4
push str.No_scheduled_tasks_found_n
jmp 0x43cd06
call fcn.0043ca12
push esi
push 0x477ba8
call fcn.0041efad
push esi
push 0x477b9c
mov edi, eax
call fcn.0041efad
cmp eax, esi
jne 0x43ccf0
cmp edi, esi
jne 0x43ccfc
push str.Automatic_reboot_is_disabled_n
jmp 0x43cd06
cmp eax, 1
jne 0x43ccfc
push str.Automatic_reboot_after_restore_is_enabled_n
jmp 0x43cd06
cmp edi, 1
jne 0x43cd0c
push str.Automatic_reboot_after_successful_restore_is_enabled_n
call fcn.00450f5c
pop ecx
pop edi
push dword [ebp - 0x1010]
call dword [sym.imp.ical_size__lu_MB_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret
Function at 0x43d330
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4cce9c], 0xffffffff
jne 0x43d346
xor eax, eax
xor edx, edx
jmp 0x43d41d
mov eax, dword [0x4d45e0]
push ebx
mov ebx, 0x10000
test eax, eax
jne 0x43d36a
push 1
push 0x10010
call fcn.00450903
pop ecx
pop ecx
mov dword [0x4d45e0], eax
jmp 0x43d376
push ebx
push 0
push eax
call fcn.00450230
add esp, 0xc
push esi
mov esi, dword [0x4d4668]
push edi
mov edi, dword [0x4d466c]
xor ecx, ecx
sub esi, dword [ebp + 0xc]
push ecx
sbb edi, ecx
push edi
push esi
push dword [0x4cce9c]
call fcn.0044df99
push dword [ebp + 8]
push edi
push esi
push str.Invalid_record_at_offset__I64x_in_file__s.
call fcn.0041c7ee
add esp, 0x10
lea eax, [ebp - 4]
push 0
push eax
mov eax, dword [0x4d45e0]
jmp 0x43d403
mov eax, dword [ebp - 4]
cmp eax, 4
jb 0x43d421
mov dword [ebp + 0xc], ebx
cmp eax, ebx
ja 0x43d3ca
mov dword [ebp + 0xc], eax
mov eax, dword [0x4d45e0]
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
jbe 0x43d3ef
mov edx, dword [eax + ecx]
cmp edx, 0x30444e53
je 0x43d437
cmp edx, 0x30484e53
je 0x43d437
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x43d3d6
mov edx, dword [ebp + 0xc]
mov edx, dword [eax + edx - 4]
add esi, ecx
push 0
lea ecx, [ebp - 4]
mov dword [eax], edx
adc edi, 0
push ecx
push ebx
add eax, 4
push eax
push dword [0x4cce9c]
call dword [sym.imp.___total_physical_size__lu_MB_ReadFile]
test eax, eax
jne 0x43d3b8
xor edx, edx
pop edi
pop esi
pop ebx
leave
ret 8
push dword [ebp + 8]
push str.Break_at_EOF
call fcn.0041c7ee
pop ecx
or edx, 0xffffffff
pop ecx
mov eax, edx
jmp 0x43d41a
xor eax, eax
add esi, ecx
adc edi, eax
sub esi, 4
sbb edi, eax
push edi
push esi
push str.Resync_at_offset__I64x_n
call fcn.0041c7ee
add esp, 0xc
push 0
push edi
push esi
push dword [0x4cce9c]
call fcn.0044df99
jmp 0x43d41a
Function at 0x43e174
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x43e1a4
push 0x48
push edi
push 0x4d4730
call fcn.00450230
add esp, 0xc
call dword [sym.imp.___total_physical_size__lu_MB_GetTickCount]
mov dword [0x4d4730], eax
xor eax, eax
pop edi
pop ebx
leave
ret 8
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43e19c
push esi
call dword [sym.imp.___total_physical_size__lu_MB_GetTickCount]
or dword [ebp + 8], 0xffffffff
mov esi, eax
mov eax, dword [0x4d4734]
mov dword [eax*8 + 0x4d4738], esi
mov eax, dword [0x4d4734]
mov dword [eax*8 + 0x4d473c], edi
mov eax, dword [0x4d4734]
lea edi, [eax + 1]
and edi, 7
mov edx, dword [edi*8 + 0x4d4738]
mov dword [ebp - 4], esi
test edx, edx
je 0x43e211
mov ecx, dword [eax*8 + 0x4d473c]
sub ecx, dword [edi*8 + 0x4d473c]
je 0x43e211
mov eax, dword [eax*8 + 0x4d4738]
sub eax, edx
mov edx, ebx
sub edx, dword [ebp + 0xc]
imul eax, edx
xor edx, edx
div ecx
mov dword [ebp + 8], eax
sub ebx, dword [ebp + 0xc]
mov eax, esi
mov esi, dword [0x4d4730]
sub eax, esi
mul ebx
push 0
push dword [ebp + 0xc]
push edx
push eax
call fcn.004544c0
sub eax, esi
add eax, dword [ebp - 4]
cmp dword [ebp + 8], 0xffffffff
je 0x43e244
sub eax, esi
add eax, dword [ebp + 8]
add eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
sub esi, dword [ebp - 4]
mov dword [0x4d4734], edi
add esi, eax
xor eax, eax
cmp eax, esi
sbb eax, eax
and eax, esi
pop esi
jmp 0x43e19e
Function at 0x4409b2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push str.SoftwareSnapShotpasswords_s
call fcn.0042f614
pop ecx
pop ecx
push eax
push Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegCreateKeyA]
test eax, eax
je 0x4409e0
xor eax, eax
jmp 0x440a69
push ebx
push esi
push edi
push 1
push dword [ebp + 8]
call fcn.0044084d
mov ecx, 0x4d47a8
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4409f7
sub eax, esi
mov esi, dword [sym.imp.ical_size__lu_MB_RegSetValueExA]
inc eax
push eax
push ecx
push 1
push 0
push 0x46b938
push dword [ebp - 4]
call esi
push 0x40
push 0x4d49a8
push 3
push 0
push 0x46b92c
push dword [ebp - 4]
mov ebx, eax
call esi
mov ecx, 0x4d49e8
or ebx, eax
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x440a3a
sub eax, edi
inc eax
push eax
push ecx
push 1
push 0
push str.CmdLine
push dword [ebp - 4]
call esi
push dword [ebp - 4]
or ebx, eax
call dword [sym.imp.ical_size__lu_MB_RegCloseKey]
pop edi
xor eax, eax
test ebx, ebx
pop esi
sete al
pop ebx
leave
ret 4

Function at 0x440a6d
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x108], 0x100
call dword [sym.imp.ical_size__lu_MB_GetUserNameA]
lea eax, [ebp - 0x104]
push eax
mov esi, 0x4d47a8
push esi
call fcn.00450597
pop ecx
pop ecx
test eax, eax
je 0x440abc
xor eax, eax
inc eax
jmp 0x440ae5
push 0
call dword [sym.imp.___total_physical_size__lu_MB_SetLastError]
push esi
push str.You_are_already_logged_on_as_user__s_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x120
push str.RUNAS
call fcn.0044dc85
add esp, 0x14
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00450b32
leave
ret
Function at 0x440b5c
Capabilities:
Impersonate user
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, 0x400
push edi
lea eax, [ebp - 0x404]
push eax
call fcn.00440af2
xor ebx, ebx
cmp byte [0x4d47a8], bl
je 0x440c2d
cmp byte [0x4d48a8], bl
je 0x440c2d
cmp byte [0x4d49e8], bl
je 0x440c2d
call fcn.00440a6d
test eax, eax
jne 0x440bb9
xor eax, eax
jmp 0x440d78
push 0x4d4790
push ebx
push 2
push 0x4d48a8
push ebx
push 0x4d47a8
call dword [sym.imp.ical_size__lu_MB_LogonUserA]
test eax, eax
jne 0x440bf6
push str._nrunas:_Invalid_username_or_password._n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x145
push str.RUNAS
call fcn.0044dc85
add esp, 0x10
jmp 0x440bb2
cmp dword [0x4d4de8], 1
jne 0x440d75
lea eax, [ebp - 0x404]
push eax
call fcn.004409b2
test eax, eax
jne 0x440d75
push str.Cant_save_username_and_password_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x14a
jmp 0x440d68
cmp byte [ebp - 0x404], bl
je 0x440cfe
lea eax, [ebp - 0x40c]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x404]
push eax
push str.SoftwareSnapShotpasswords_s
call fcn.0042f614
pop ecx
pop ecx
push eax
push Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegOpenKeyExA]
test eax, eax
jne 0x440cfe
push esi
mov esi, dword [sym.imp.ical_size__lu_MB_RegQueryValueExA]
lea eax, [ebp - 0x408]
push eax
push 0x4d47a8
push ebx
push ebx
push str.UserName
push dword [ebp - 0x40c]
mov dword [ebp - 0x408], 0x100
call esi
lea eax, [ebp - 0x408]
push eax
push 0x4d49a8
push ebx
push ebx
push str.PassWord
push dword [ebp - 0x40c]
mov dword [ebp - 0x408], 0x40
call esi
lea eax, [ebp - 0x408]
push eax
push 0x4d49e8
push ebx
push ebx
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x40c]
mov dword [ebp - 0x408], edi
call esi
push dword [ebp - 0x40c]
call dword [sym.imp.ical_size__lu_MB_RegCloseKey]
push 2
lea eax, [ebp - 0x404]
push eax
call fcn.0044084d
pop esi
jmp 0x440d78
cmp dword [0x4cddcc], ebx
je 0x440d1a
push ebx
push 0x440683
mov eax, str.RUNASPASSWD
push eax
push eax
call fcn.00448ce4
jmp 0x440d1d
push 2
pop eax
dec eax
jne 0x440bb2
call fcn.00440a6d
test eax, eax
je 0x440bb2
push edi
lea eax, [ebp - 0x404]
push eax
call fcn.00440af2
cmp dword [0x4d4de8], 1
jne 0x440d75
lea eax, [ebp - 0x404]
push eax
call fcn.004409b2
test eax, eax
jne 0x440d75
push str.Cant_save_username_and_password_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x165
push str.RUNAS
call fcn.0044dc85
add esp, 0x10
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret
Function at 0x440d86
Capabilities:
Accept command line arguments
Impersonate user

Disassembly:
call fcn.004407d8
test eax, eax
jne 0x440d92
xor eax, eax
ret
call dword [sym.imp.___total_physical_size__lu_MB_GetCommandLineA]
push eax
push 0x469a48
push 0x400
push 0x4d49e8
call fcn.00450d91
add esp, 0x10
call fcn.00440b5c
test eax, eax
je 0x440d8f
push 0
push 5
call fcn.0044dfdf
cmp eax, 1
jne 0x440dce
push 3
pop eax
push 9
jmp 0x440dd2
xor eax, eax
push 2
pop ecx
push esi
push 0x4d4790
push eax
push ecx
push 0x4d48a8
push 0
mov esi, 0x4d47a8
push esi
call dword [sym.imp.ical_size__lu_MB_LogonUserA]
test eax, eax
jne 0x440e12
push str._nsnapshot:_Invalid_username_or_password._n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x19e
push str.RUNAS
call fcn.0044dc85
add esp, 0x10
jmp 0x440e46
push dword [0x4d4790]
call dword [sym.imp.ical_size__lu_MB_ImpersonateLoggedOnUser]
test eax, eax
jne 0x440e4a
push esi
push 0x469ec0
push str._n_s:_Impersonate_for_user__s_failed_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x1a4
push str.RUNAS
call fcn.0044dc85
add esp, 0x18
xor eax, eax
pop esi
ret
xor eax, eax
inc eax
pop esi
ret
Function at 0x4411c4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 2
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 8], 0xfffffff6
call fcn.004571bf
mov edi, eax
or ebx, 0xffffffff
add esp, 0xc
cmp edi, ebx
je 0x4412f3
push esi
push esi
push dword [ebp + 8]
call fcn.004571bf
add esp, 0xc
cmp eax, ebx
je 0x4412f3
cmp edi, 0x1e8480
jg 0x4412f3
push 1
push edi
call fcn.00450903
mov esi, eax
pop ecx
pop ecx
mov dword [ebp - 4], esi
test esi, esi
je 0x4412f3
push edi
push esi
push dword [ebp + 8]
call fcn.00457054
add esp, 0xc
cmp eax, edi
jne 0x4412ec
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4412ec
mov eax, dword [esi + 0x3c]
mov ecx, 0x478c84
mov ecx, dword [ecx]
add eax, esi
cmp ecx, dword [eax]
jne 0x4412ec
movzx ecx, word [eax + 4]
mov edx, 0x8664
cmp cx, dx
je 0x441277
mov edx, 0x14c
cmp cx, dx
jne 0x4412ec
movzx ecx, word [eax + 0x18]
mov edx, 0x10b
cmp cx, dx
jne 0x441293
lea esi, [eax + 0x98]
lea edi, [eax + 0x9c]
jmp 0x4412a9
mov edx, 0x20b
cmp cx, dx
jne 0x4412ec
lea esi, [eax + 0xa8]
lea edi, [eax + 0xac]
xor ebx, ebx
cmp dword [edi], ebx
jbe 0x4412cf
mov eax, dword [ebp - 4]
add eax, ebx
add eax, dword [esi]
push 9
push str.SNASERNUM
push eax
call fcn.00450f08
add esp, 0xc
test eax, eax
je 0x4412e0
inc ebx
cmp ebx, dword [edi]
jb 0x4412af
mov esi, dword [ebp - 8]
push dword [ebp - 4]
call fcn.0045038b
pop ecx
lea eax, [esi + 9]
jmp 0x4412f5
mov esi, dword [esi]
add esi, ebx
jne 0x4412d2
mov esi, dword [ebp - 4]
or ebx, 0xffffffff
push esi
call fcn.0045038b
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4