joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6225
Capabilities:
Encode data using base64

Disassembly:
jne 0x45ebdb
movzx edi, word [eax + esi + 8]
test esp, 0x7a11bfb5
cmp si, ax
xor edi, edx
clc
cmp edi, dword [ecx + 0x24]
jmp 0x45ebd5
push 0x7018eb95
jne 0x4f24c3
mov edi, 0x2a290d2f
inc eax
shr bh, 0x61
inc ecx
movzx ecx, word [edx + edi - 0x2a290d17]
dec esi
lea edx, [edi + edx - 0x2a290d15]
inc cx
xor ecx, ebp
sub cx, 0xf107
ror cx, 1
jmp 0x4eb92a
xor edi, edx
cmp dx, 0x20b4
cmp edi, dword [ecx + 0x38]
jmp 0x496bfa
jae 0x4c2e9d
mov ebx, dword [eax + esi]
xor ebx, edx
test bp, cx
cmp cx, 0x6f98
cmp ebx, dword [ecx + 0x28]
jmp 0x4d3484
ret
jb 0x49526c
pop edi
xchg bx, bx
xor al, al
bswap bx
movsx ebx, dx
movsx bx, ah
pop ebx
jmp 0x4cfaa6
jmp 0x495272
je 0x462948
mov edi, dword [ebp - 8]
test di, 0x771c
stc
cmp edi, ebx
jmp 0x45d3f7
pop edi
mov al, 1
pop ebx
jmp fcn.004c1152
jne 0x496c00
movzx edi, byte [eax + esi + 8]
jmp 0x45c274
inc cx
mov dword [esp], edi
jmp 0x4d6191
mov ebx, dword [ebp - 4]
xchg di, di
lea edi, [eax + esi]
cmp ch, 0x14
lea edi, [edi + ebx]
rcl bh, 0x30
bsr bx, ax
test dx, dx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], edi
stc
add edi, 4
cmp edi, ebx
jmp 0x4cac75
je 0x462948
inc eax
cmp ebp, edi
cmp eax, ebx
jmp 0x45df30
jne 0x45ebdb
mov edi, dword [eax + esi + 4]
cmc
test ah, 0x28
xor edi, edx
cmp edi, dword [ecx + 0x20]
jmp 0x459020
cmp edi, dword [ecx + 0x34]
jmp 0x46f505
xor edi, edx
clc
cmp cl, 0x39
cmp edi, dword [ecx + 0x30]
jmp 0x4e4137
je 0x462948
mov ebx, dword [ebp + 8]
clc
lea edi, [edi + 3]
test edi, 0x9796c234
cmp dh, 0xa
cmp cx, dx
cmp edi, ebx
jae 0x496c00
mov edi, dword [eax + esi]
test bx, bx
stc
jmp 0x4be475
lea edx, [esp + edx + 0x10]
mov byte [edx], al
jne 0x45b2f9
mov dword [ebp - 4], ebx
jmp 0x45e870
jae 0x45ebdb
mov edi, dword [eax + esi]
clc
xor edi, edx
clc
cmp edi, dword [ecx + 0x1c]
jmp 0x4b5347
mov esp, ebp
not ebp
cmove bp, di
pop ebp
jmp 0x45d737
jne 0x4c2e99
movzx ebx, word [eax + esi + 4]
xor ebx, edx
cmp bp, cx
test esp, ebp
cmc
cmp ebx, dword [ecx + 0x2c]
jmp 0x4c2e93
call fcn.004e827b
test ebx, esp
cmc
jne 0x496c00
mov edi, dword [eax + esi + 4]
xor edi, edx
test ebx, 0xe239edb1
jmp 0x4bdecc
inc cx
dec eax
ror edi, 0x41
xor cx, 0x950e
rol cx, 1
shl di, 6
inc sp
xor ebp, ecx
dec eax
add ecx, esp
inc eax
shl bh, 0x44
dec edi
xor edi, 0xf9b4e39d
movzx di, byte [ecx]
push 0x808a3b3d
dec ecx
sbb esp, 2
push 0x530f8400
push 0x3e83ea38
jmp 0x46fcce
lea esp, [esp + 0x14]
jp fcn.004e0166
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x5f4a4580
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x39b7485f
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
jmp 0x403a1c
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405220], eax
mov dword [0x4051a8], 0x403098
mov dword [0x4051a4], 2
jmp 0x403a4c
mov dword [0x4051ac], 0
mov dword [0x4051b0], 0
mov dword [0x4051a0], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051b4], eax
mov dword [0x4051c8], 0x40426e
mov dword [0x4051c0], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051b8], eax
mov dword [0x4051cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051bc], eax
push 0x4051a0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.justam
push 0x40426e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405218], eax
push 5
push dword [0x405218]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405218]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x403b1f
push 0
push 0
push 0
push 0x4051d0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x403b4c
push 0x4051d0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4051d0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x403b1f
mov eax, dword [0x4051d8]
jmp 0x403b59
call 0x402be1
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x69144ced
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3aaa3f47
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x404340
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
jne 0x4043d0
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._n______________________________________________________________________________________________n
call edi
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
push 0x57
push str.ComposeVersionString
push 0x63
push str.c:devdragon_release_sync_srccore_newapiupdateservicepaar_api.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x63
push str.ComposeVersionString
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x4043c0
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call edi
pop edi
mov eax, 0x57
pop esi
pop ebp
ret
push 2
push 0x800
call fcn.00536986
mov ecx, dword [ebp + 0xc]
add esp, 8
mov dword [ecx], eax
test eax, eax
jne 0x40446c
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._n______________________________________________________________________________________________n
call edi
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
push 8
push str.ComposeVersionString
push 0x67
push str.c:devdragon_release_sync_srccore_newapiupdateservicepaar_api.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x67
push str.ComposeVersionString
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x40445c
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call edi
pop edi
mov eax, 8
pop esi
pop ebp
ret
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
push str._d._d._d._d
push 0x1000
push eax
call fcn.004064a0
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x405750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5c2b50]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [str.SOFTWAREComodoChromodo]
mov ax, word [0x56e798]
push esi
mov esi, dword [ebp + 8]
movdqu xmmword [ebp - 0x38], xmm0
push 0x208
movdqu xmm0, xmmword [0x56e778]
mov dword [ebp - 0x5c], 0
mov word [ebp - 8], ax
movdqu xmmword [ebp - 0x28], xmm0
movdqu xmm0, xmmword [0x56e788]
movdqu xmmword [ebp - 0x18], xmm0
movdqu xmm0, xmmword [str.PAAR_MACHINE_ID]
movdqu xmmword [ebp - 0x58], xmm0
movdqu xmm0, xmmword [0x56e7ac]
movdqu xmmword [ebp - 0x48], xmm0
call fcn.005369fe
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x4057d9
push 0x208
push 0
push eax
call fcn.00537300
add esp, 0xc
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x60], 0x208
push eax
push 0x20019
push 0
lea eax, [ebp - 0x38]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40584c
push str.record:_RegOpenKeyExW_failed__n
push 0x246
push str.GetMachineCode
call fcn.00404610
add esp, 0xc
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
je 0x40583b
push str.RegCloseKey_call_failed_.
push 0x24a
push str.GetMachineCode
call fcn.00404610
add esp, 0xc
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
push eax
push dword [esi]
lea eax, [ebp - 0x58]
push 0
push 0
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4058b5
push str.record:_RegQueryValueExW_failed__n
push 0x256
push str.GetMachineCode
call fcn.00404610
add esp, 0xc
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
je 0x40583b
push str.RegCloseKey_call_failed_.
push 0x25a
push str.GetMachineCode
call fcn.00404610
add esp, 0xc
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x4058c3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
Function at 0x405f00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5c2b50]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x405f2a
lea eax, [esi + 1]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405f30
sub ecx, edx
push ebx
push edi
lea ebx, [ecx + 1]
test ebx, ebx
je 0x405f5e
push ebx
call fcn.005369fe
mov edi, eax
add esp, 4
test edi, edi
je 0x405f64
push ebx
push esi
push edi
call fcn.00408dc0
add esp, 0xc
jmp 0x405f60
mov edi, esi
test edi, edi
jne 0x405f7a
pop edi
pop ebx
mov eax, 3
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405f80
sub ecx, edx
lea eax, [ecx + 1]
push eax
push edi
call fcn.00404890
mov ebx, eax
add esp, 8
test ebx, ebx
jle 0x405fb8
push edi
call fcn.005369c6
add esp, 4
mov eax, ebx
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push dword [0x5c80a0]
xor eax, eax
mov word [ebp - 0x30], ax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x5c8098]
mov eax, dword [0x5c809c]
add ecx, 1
mov dword [0x5c8098], ecx
adc eax, 0
push eax
push ecx
mov dword [0x5c809c], eax
lea eax, [ebp - 0x30]
push 0x56df78
push eax
call fcn.0040ae80
add esp, 0x10
lea ecx, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x406000
sub esi, ecx
lea eax, [esi + 1]
push eax
push edi
push 3
push 0
lea eax, [ebp - 0x30]
push eax
push dword [0x5c8004]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [0x5c80a0]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call fcn.005369c6
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop ebx
pop esi
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
Function at 0x40ab80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5c2b50]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x210], 0
call fcn.00537300
add esp, 0xc
xor esi, esi
test ebx, ebx
jne 0x40ac60
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._n______________________________________________________________________________________________n
call edi
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push ebx
push esi
call fcn.00537300
push 0x57
push str.splitStringVersion
push 0xfd
push str.c:devdragon_release_sync_srccore_newapiupdateservicepaar_api.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0xfd
push str.splitStringVersion
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x40ac43
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call edi
pop edi
pop esi
mov eax, 0x57
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x40acc5
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._n______________________________________________________________________________________________n
call edi
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
push 0x57
push str.splitStringVersion
push 0x100
push str.c:devdragon_release_sync_srccore_newapiupdateservicepaar_api.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x100
jmp 0x40ac29
push ebx
push 0x56dfc0
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.004064a0
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push 0x56e520
push eax
call fcn.00536424
add esp, 0x1c
test eax, eax
je 0x40ad41
jmp 0x40ad00
push eax
call fcn.0053671b
add esp, 4
cmp esi, 3
ja case.default.0x40ad0e
jmp dword [esi*4 + 0x40ad54]
mov dword [edi], eax
jmp case.default.0x40ad0e
mov dword [edi + 4], eax
jmp case.default.0x40ad0e
mov dword [edi + 8], eax
jmp case.default.0x40ad0e
mov dword [edi + 0xc], eax
lea eax, [ebp - 0x210]
inc esi
push eax
push 0x56e520
push 0
call fcn.00536424
add esp, 0xc
test eax, eax
jne 0x40ad00
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
Function at 0x40c0d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5c2b50]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
xorps xmm0, xmm0
mov word [ebp - 0x14], ax
movq qword [ebp - 0x12], xmm0
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
push edi
mov edi, dword [ebp + 0x10]
test esi, esi
je 0x40c21f
push eax
mov dword [edi], eax
lea eax, [ebp - 0x14]
push eax
push 0xb
call fcn.004218c8
test eax, eax
jne 0x40c1c3
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
je 0x40c21f
push str._n______________________________________________________________________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
add esp, 0x10
call edi
push eax
push str.CheckLastModifiedDate
push 0xd6
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservicewinhttp_update_api.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0xd6
push str.CheckLastModifiedDate
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x40c1a6
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
mov ax, word [esi]
cmp ax, word [ebp - 0x14]
jne 0x40c216
mov ax, word [esi + 2]
cmp ax, word [ebp - 0x12]
jne 0x40c216
mov ax, word [esi + 6]
cmp ax, word [ebp - 0xe]
jne 0x40c216
mov ax, word [esi + 8]
cmp ax, word [ebp - 0xc]
jne 0x40c216
mov ax, word [esi + 0xa]
cmp ax, word [ebp - 0xa]
jne 0x40c216
mov ax, word [esi + 0xc]
cmp ax, word [ebp - 8]
jne 0x40c216
mov dword [edi], 1
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
movdqu xmm0, xmmword [ebp - 0x14]
movdqu xmmword [esi], xmm0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
Function at 0x40e600
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call fcn.0040ea70
mov ebx, eax
test ebx, ebx
je 0x40e6ad
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.__n_Error_at_ImpersonateAsExplorer__n
call edi
push str._n______________________________________________________________________________________________n
call edi
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
push ebx
push str.CheckUserIfAdmin
push 0x5ba
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_systemservices.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x5ba
push str.CheckUserIfAdmin
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x40e69d
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call fcn.0040f220
mov esi, eax
add esp, 4
test esi, esi
jne 0x40e6d7
push str._n_The_user_is_not_admin__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str._n_The_user_is_admin__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e770
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x20]
push esi
push edi
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x40e819
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._n______________________________________________________________________________________________n
call edi
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateEventSecDesc
push 0x11a
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_systemservices.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x11a
push str.CreateEventSecDesc
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x40e80a
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call edi
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], 0xc
push 1
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x40e8a7
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._n______________________________________________________________________________________________n
call edi
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateEventSecDesc
push 0x125
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_systemservices.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x125
jmp 0x40e7f0
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e8c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
jne 0x40e93b
call esi
push str._n______________________________________________________________________________________________n
mov edi, eax
call ebx
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
push edi
push str.GetTokens
push 0x22e
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_systemservices.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x22e
jmp 0x40ea18
mov edi, dword [ebp + 8]
push edi
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x40e9a4
call esi
push str._n______________________________________________________________________________________________n
mov edi, eax
call ebx
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
push edi
push str.GetTokens
push 0x237
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_systemservices.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x237
jmp 0x40ea18
push dword [ebp + 0xc]
push 1
push 1
push 0
push 0xf
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x40ea5d
call esi
push str._n______________________________________________________________________________________________n
mov edi, eax
call ebx
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
push edi
push str.GetTokens
push 0x245
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_systemservices.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x245
push str.GetTokens
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x40ea32
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call ebx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x3f0
je 0x40e8d2
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret