joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9a3cf6
Capabilities:
Encode data using xor

Disassembly:
adc edi, 6
ror ax, 0x44
btc ax, ax
jb 0x9d435d
lea eax, [edx + 0x1907a996]
add dword [esp + eax - 0x1f1157], ebp
ret
or cl, dl
lea edx, [eax + eax*4 + 0x48a7d2a]
dec ax
not cl
rol ax, 0x83
mov word [edx + edi - 0x4857edb], cx
js 0x925cd8
movzx eax, word [esi + edx*2 - 0x90afdc0]
lea ecx, [edx*2 - 0x506d4045]
lea esi, [esi + edx*4 - 0x1215fb7a]
rol byte [esp + edx*8 - 0x242bf6e4], 0xe1
or cx, dx
add cl, byte [esp + edx - 0x4857ed9]
xor ax, bx
xor ax, 0x831
btc edx, edx
mov dword [esp + edx*2 - 0x490afdba], 0xa126cb27
dec ax
xor edx, ecx
xor ax, 0xb825
dec ax
or edx, 0x53b2be86
xor ax, 0x6592
inc ax
xchg byte [esi + 0x356653b2], bh
xchg edx, eax
inc ax
neg ecx
dec dx
neg ax
add dword [esp + ecx - 0x4762009e], 0xb10e0ca1
call fcn.009269af
push 0xfc075c2b
dec eax
sub edi, 4
mov ecx, dword [esp + 4]
not byte [esp + 1]
inc esp
movzx esp, cl
inc edx
mov esi, dword [edi - 0x7f8]
dec esp
lea ebp, [ecx - 0x4dfe44c8]
inc esi
mov esi, dword [esp - 0x7f6]
inc ecx
xor esi, edx
dec ebp
imul ebp, ebp
adc esi, ecx
call fcn.009d20ed
imul bx, sp, 0x3ce3
jp 0x9a3d61
xor edi, edx
cmp eax, 0x1fa8d1a1
out dx, eax
cmp eax, 0xe95fd1a1
adc byte [edi + 0x1d], bh
pop ss
mov esp, 0x70b2d6fb
and edx, dword [edi + 0x61e2b133]
imul edx, dword [ebx + 0x45c0c84f], 0x9d755435
xchg ebx, eax
dec ecx
and byte [edx - 0x28747516], dh
mov dword [0x8885cc55], eax
outsd dx, dword [esi]
dec esp
fist dword [edi + 0x22]
pushfd
pushfd
iretd
mov byte [edx], cl
lea edx, [eax*4 - 0x51db4bce]
neg dl
sbb esi, 3
lea ecx, [eax + edx + 0xc81ce80]
bts ax, ax
bts edx, ecx
mov eax, dword [esi]
xor eax, ebx
shl edx, cl
sbb eax, 0xe2318c11
shl cx, 0x6a
bts dx, 0xa2
ror eax, 3
sub cx, dx
not dx
lea edx, [ecx*4 + 0x18cceb3]
xor eax, 0xe7adcb36
push ecx
xor dx, word [esp + 2]
xor dword [esp], ecx
rol eax, 1
rol ecx, 0xe2
add word [esp + 1], dx
shl dword [esp], 0xd9
xor ebx, eax
inc ecx
add ebp, eax
jmp 0x94f3fb
Function at 0x9c7c5d
Capabilities:
Encode data using xor

Disassembly:
int3
inc ebp
mov esp, esi
dec ebx
mov eax, dword [edi + esi - 0x310f2b27]
inc ebp
mov ebp, esp
inc ebp
movzx ebx, ah
dec ebx
lea ecx, [esi + ebp*2 + 0x3384c929]
inc ebx
mov cl, byte [edi - 0x621e5646]
inc ebp
movsx eax, dh
mov esi, 0xa0999217
push esi
dec eax
shr eax, cl
dec ebx
mov dword [edi + esi*2 - 0x621e564c], eax
inc edx
movzx esi, word [edi + esi - 0x310f2b29]
dec edi
lea ecx, [ebx - 0x5ce5684b]
mov dword [0x749c3146], eax
mov ah, 0xa9
loope 0x9c7c4a
inc esi
xor dword [esp + esi*2 - 0x621e564c], ebx
inc cx
xor esi, edx
dec si
xor si, 0x6b2b
call fcn.009fa39d
cld
dec edi
imul edx, esi, 0x77
in al, 0x36
rcr dword [ebx - 0x2a], 0x14
daa
and al, 0x87
jnp 0x9c7ca4
adc al, 0x27
sbb al, 0xc5
aas
salc
adc al, 0x27
je 0x9c7ca5
sub edx, esi
adc al, 0x27
cmp ah, dl
fldcw word [ecx - 0x62]
mov dword [0xe16ae8ca], eax
sbb eax, 0x9bc78b8b
xor dword [edi + 0x30622e3c], ebp
call 0x68cdba0d
jmp 0x39c674fb

Function at 0x9ca2fd
Capabilities:
Encode data using xor

Disassembly:
dec ecx
adc edi, 3
inc ecx
or dh, cl
inc al
dec esp
btc eax, esp
inc sp
shld ebx, esi, cl
cbw
dec ecx
not ecx
inc cx
rol esp, 0x84
inc cx
mov dword [edi], ebx
dec eax
lea ebx, [esi*2 + 0x17ae121d]
dec eax
cdq
dec eax
or edx, ebp
jmp edx
inc esp
movsx ebp, bx
dec eax
mov dword [esp + ecx - 0xd326], 0xff34269c
rol edx, 1
lea edx, [edx + ecx*4 - 0x23fe4c4]
ror edx, 2
dec esi
lea ecx, [ebp*8 + 0x222564a0]
inc edx
lea edx, [edx + ebp - 0x53e7d67f]
inc word [esp + ecx*2 - 0x1a64a]
mov esi, 0xe2804115
dec edi
lea ebp, [ebx + 0x7c3d909b]
dec esi
mov dword [esp + ebx - 0xd326], edx
xor dword [esp + ecx - 0xd326], edx
inc cx
ror ecx, 0x6f
dec esp
sbb ecx, ecx
inc ecx
pop edx
dec eax
inc ecx
inc esp
mov eax, esi
dec ecx
shl ebx, 0x90
dec eax
arpl dx, dx
inc cx
inc ebx
inc esp
movsx esi, bx
dec eax
adc ebp, edx
inc bp
btr ecx, esi
inc esp
add eax, ebx
inc ecx
adc cl, 0xc
inc cx
mov ebx, dword [edi + ecx*2 - 0x1a64e]
inc bp
mov esi, dword [edi + ecx - 0xd325]
inc sp
imul esp, eax
inc ecx
mov cl, byte [edi + ecx*8 - 0x69934]
jb 0x98b3b1
jmp [esi]
xor eax, dword cs:[edi + edi*4 - 0x2d4fea3f]
inc edi
mov ebx, 0xde1bd0c0
xchg ebx, eax
rcl al, 0x1b
and edx, dword [ecx]
mov ch, 0xe6
xor eax, dword [ecx - 0x76]
sbb al, 0x96
lea edx, [edx + 0x5d]
in eax, dx
rcl byte [ebx + 0x3ee8d5a9], cl
add bh, byte [esi + 0x26]
cmp al, 0x9f
mov al, 8
or eax, 0x742770de
sbb eax, 0xc23d42db
pushfd
adc byte [edx], dl
clc
sbb al, 0xd6
dec edi
mov ch, 0xcc
jg 0x9ca39f
inc ebx
popfd
jno 0x9ca445
xchg esp, eax
pop ss
and al, 0x8d
sbb cl, byte [edi - 0x34]
mov bh, 0xb6
out dx, al
and edi, dword [eax - 0x7e]
pop esi
mov byte [0x3c612616], al
mov al, byte [ebp + 0x494fd42d]
invalid
push esi
mov byte [eax], bl
mov es, word [ebp + 0x338783aa]
push 0xfffffffffffffff2
invalid
Function at 0x9d1279
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov dword [esp + ebp*2 - 0xc010], edx
inc ebp
movzx ebx, dh
cwd
inc esi
xor dword [esp + ebp - 0x6008], eax
jmp 0xa126e3
inc cx
bt esi, 0x87
dec ecx
not ebp
cwd
inc ecx
movsx ebx, cl
btr bx, ax
dec eax
not esi
sal dl, 0xa3
dec esp
and ebp, esi
dec ebp
mov dword [edi + eax - 0x47], ebp
inc esp
xadd ecx, esp
call fcn.00913073
jns 0x9a6bcb
invalid
inc ecx
dec eax
dec ecx
sal ecx, 0xcf
dec eax
ror esi, 0x25
inc ecx
bswap eax
dec edx
mov dword [esp + ebp*4 - 0x18020], edx
dec ecx
lea ecx, [esp + esi*2 - 0x5c7f6946]
jne 0x8f09ba
sub esi, 4
mov eax, dword [esi]
mov ecx, 0xf8255b8
mov edx, ecx
btc edx, ecx
xor eax, ebx
add dx, 0x8234
inc eax
sal ecx, cl
btr edx, ecx
and ecx, ecx
ror eax, 1
bts cx, 0x85
inc edx
jae 0x9fbc69
dec eax
shl edx, 0xdc
sbb dl, 0xae
xadd dl, cl
rol eax, 1
shr edx, cl
add ecx, 0xe9adb705
xor ebx, eax
add ebp, eax
shl ecx, cl
lea eax, [ecx*2 - 0x5dd9b451]
mov edx, edi
cmovns ecx, eax
sbb edi, 3
mov dword [edi], edx
lea edx, [ecx*8 - 0x65da2b53]
jmp fcn.009d640f
inc bp
bts ebx, esi
inc bp
sbb ebx, ebx
inc ecx
pop edx
dec eax
sub esi, edx
dec ecx
inc esi
inc ecx
add al, ch
dec ebp
arpl ax, ax
dec ebp
add esp, ebx
dec ecx
adc ebp, eax
shr edx, cl
dec edi
mov ebp, dword [edi + ebp - 0x6008]
dec dx
dec ecx
or esi, dword [edi + esi + 8]
dec ebp
xor esp, ebx
inc ecx
shr cl, 0xa7
dec ebp
lea edi, [edi + eax - 0x3f]
jns 0x9a6bc9
xchg ebx, eax
or byte [ecx + edi], dh
xor al, 0x39
push 0x24c275a5
cmp dword [ebx], ecx
push cx
sbb al, 0x39
or esp, dword [esi + 0x61]
shl byte [ecx + edi], cl
or esp, dword [esi + 0x53]
mov edx, 0x660b3940
push ecx
mov dword [esi], esi
jbe 0xa12726
invalid

Function at 0x9d4fd0
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
dec esi
mov dword [ebx + edi - 0x84], esi
dec eax
ror dword [esp + ecx - 0x8c], cl
dec esi
lea edi, [ecx + edi - 0x84]
sbb bl, bh
ja 0x8e69eb
lea esi, [esi + edx*8 - 0x240cc]
mov ecx, dword [esi + edx*8 - 0x240c8]
movsx eax, dl
add ax, dx
xor ecx, ebx
bswap ecx
dec al
sub ecx, 0xaf083780
xchg edx, eax
rol ecx, 3
sar dl, 0x81
sbb edx, edx
xor ecx, edx
cdq
idiv eax
xor ebx, ecx
shr al, 0xc1
mov dword [esp + edx], eax
add ebp, ecx
add dword [esp + edx*2], ebp
ret
mov ebx, ecx
dec eax
mov dword [esp + ecx - 0x94], 0x8fa8a92e
dec edi
mov ebp, dword [ebp + edi - 0x5593b78c]
dec ebp
add esi, ebp
dec esi
mov ecx, dword [ecx + edi - 0x84]
dec ebp
add esi, ecx
push ecx
jmp 0x8e6bfe
Function at 0x9e8d6e
Capabilities:
Encode data using xor

Disassembly:
dec eax
lea edi, [edi + ebx - 0x5806c408]
inc edx
mov edx, dword [edi + ebx - 0x5806c404]
dec esp
lea esi, [ebx + ebx*8 - 0x65436df1]
inc ecx
movzx eax, al
inc ebp
xchg dh, al
inc ecx
xor edx, edx
cwde
sal eax, 0xbf
bswap edx
dec eax
mov dword [esp + ebx - 0x5806c404], ebx
mov edi, 0x8948ca0f
pushfd
sbb al, 0xfc
cmp edi, ecx
cmpsd dword [esi], dword es:[edi]
inc si
xor dword [esp + eax - 0x5806c431], ebx
stc
cmpsd dword [esi], dword es:[edi]
dec edx
not edx
call fcn.009f4c55
mov eax, 0xcf0bf693
movsx ecx, ax
movsx edx, ax
sub esi, 4
ror edx, cl
push eax
inc word [esp + 1]
mov edx, dword [esi]
xchg dword [esp], ecx
call fcn.00e97aaf
mov edi, 0x2421c501
salc
fidiv word [ebp - 0x51]
and dword [esi + edx*2], edi
jne 0x9e8d93
and ebp, esi
xor dh, byte [esi + 0x75]
scasd eax, dword es:[edi]
and dword [ebp - 0x508ae1be], ebx
and dword [edx + esi*8 - 0x62], ebp
jne 0x9e8da5
and dword [0xaf75feb2], ecx
and dword [edx + eax*8], esi
invalid

Function at 0x9f5315
Capabilities:
Encode data using xor

Disassembly:
dec esp
mov dword [esp + eax - 0x1f8c], esi
dec eax
lea edi, [edi + eax*8 - 0xfc64]
neg dl
dec eax
sub dword [esp + eax - 0x1f8c], eax
inc cx
bts eax, ebx
inc esp
mov ebp, dword [eax + edi - 0x1f8c]
inc ebp
xor ebp, edx
inc ecx
sub ebp, 0x9ab6a98b
inc ecx
movzx esi, al
inc ebp
movsx esp, dh
inc ecx
rol ebp, 1
sar dword [esp + eax - 0x1f8a], 0x5a
bt ax, 0xa2
inc ebp
lea ebp, [ebp + eax*2 + 0x6fa8690c]
cwde
inc bl
inc ecx
xor ebp, 0x5e0d0138
dec eax
or edx, 0x2197389f
sar word [esp + eax*2 - 0x3f14], 0xcd
inc ecx
cmp byte [edi - 0x433e99df], dl
inc esp
in al, dx
sar bh, 0xff
int 0x41
setae al
inc ebp
adc ebp, esi
rol dword [esp + eax*4 - 0x7e2d], 0x7f
inc ecx
rol ebp, 3
inc ecx
xor ebp, 0x469d022e
pop eax
inc ecx
btc eax, 0x34
inc ecx
dec esp
inc ecx
push edx
call fcn.009edea0
mov edi, 0x5ab50436
pop esp
dec ebp
fidiv dword [esi*4 - 0x13b660c7]
adc byte [ebp - 0x119460c7], dh
sbb al, 0xb5
cmp dword [edi - 0x4af3179d], ebx
cmp dword [edi + 0x44baf54d], ebx
movsd dword es:[edi], dword es:[esi]
cmc
mov edx, 0xf5a52644
test cl, dl
or al, 0x92
mov bl, 0x33
out 0x8e, eax
xchg ebx, eax
fdiv qword [eax - 0x17ccb346]
adc dword [ebx], 0x32
push 0x714fc65
cmp ch, al
cmp eax, ebp
sbb al, 7
cmp ch, al
jne 0x9f5374
adc al, 7
cmp ch, al
jne 0x9f53ca
dec ebx
ljmp 0x2c94

Function at 0xa0ae01
Capabilities:
Encode data using xor

Disassembly:
call fcn.0099c726
inc ecx
bswap esp
inc ecx
bswap eax
inc ecx
movsx eax, dh
push eax
inc ecx
not esp
cdq
pop edx
dec eax
ror edx, 0x23
inc esi
lea esp, [esi - 0x239420d9]
push edx
inc si
inc ecx
not esp
inc esp
movzx ebp, cl
bswap ecx
dec esi
mov dword [esp + esi*2 - 0x5a4b4b2a], edx
inc edx
sar dword [esp + esi - 0x2d25a59f], cl
dec esi
mov dword [esp + esi*2 - 0x5a4b4b3a], esi
inc esp
xor dword [esp + esi - 0xa58a], esp
inc esi
movzx ecx, word [esp + esi - 0x2d25a592]
inc esi
movsx edx, word [esp + esi*2 - 0x5a4b4b33]
dec esi
mov edx, dword [esp + ebp - 0x89]
dec ebp
arpl sp, sp
dec esi
lea ebx, [ecx + esi + 0x78015e8e]
jmp 0x927e4e
Function at 0xa17d78
Capabilities:
Encode data using xor

Disassembly:
shl word [esp + 6], 0x6b
sub dl, 0x94
dec eax
rol eax, 2
neg edx
neg eax
and ecx, 0xd3ab4310
xchg byte [esp + edx - 0x3745], cl
ror eax, 1
inc edx
mov dword [esp + edx*2 - 0x6e96], ecx
neg eax
xor ebx, eax
shl dword [esp + edx*4 - 0xdd2c], cl
neg cl
ror dl, 4
add ebp, eax
mov ax, word [edx + edi - 0x37b4]
shl word [esp + edx*8 - 0x1bda0], 0xcd
Function at 0x401aa6
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov esi, edi
mov dword [ebp - 4], edi
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x401abf
sub esi, ecx
push ebx
sar esi, 1
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileType]
and eax, 0xffff7fff
cmp eax, 2
jne 0x401aff
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleMode]
test eax, eax
je 0x401aff
push 0
lea eax, [ebp - 8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_WriteConsoleW]
jmp 0x401b41
lea eax, [esi + esi]
push eax
push 0
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x401b41
xor ecx, ecx
lea eax, [esi + esi]
push ecx
push ecx
push eax
push edi
push esi
push dword [ebp - 4]
push ecx
push 1
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
test eax, eax
je 0x401b3a
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push edi
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
push edi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ccf
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
push esi
push edi
push eax
mov edi, edx
xor esi, esi
push esi
lea edx, [ebp - 0xc]
push edx
push ecx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U]
test al, al
jne 0x401d05
push 3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
or eax, 0xffffffff
jmp 0x401e10
mov eax, dword [ebp - 0x2c]
push ebx
mov ebx, dword [ebp - 8]
test ax, ax
je 0x401d1f
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
jmp 0x401d24
mov eax, esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x1c]
push 0x200000
push 7
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x18
push eax
mov eax, dword [ebp + 8]
shr eax, 1
not eax
mov dword [ebp - 0x38], 0x40
and eax, 0x80
mov dword [ebp - 0x34], esi
or eax, edi
mov dword [ebp - 0x30], esi
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
test esi, esi
js 0x401de2
test dword [ebp + 8], 0x100
jne 0x401de2
push 0x23
push 8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov esi, eax
test esi, esi
jns 0x401da6
cmp esi, 0xc000000d
je 0x401de2
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x401dde
test dword [ebp - 0x14], 0x400
je 0x401de2
cmp dword [ebp - 0x10], 0xa000000c
jne 0x401de2
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
push 0
push 7
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x44]
push eax
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
test esi, esi
jns 0x401de2
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
mov eax, dword fs:[0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x40203c
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], ecx
xor eax, eax
xor ebx, ebx
lea esi, [edi + 8]
cmp ax, word [edi + 4]
jae 0x4020a6
lea eax, [esi + 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
je 0x402097
test byte [esi + 1], 0x10
jne 0x402097
mov eax, dword [ebp - 4]
test al, 0x10
je 0x40207a
cmp byte [esi], 0
je 0x402083
test al, 0x20
je 0x402097
cmp byte [esi], 1
jne 0x402097
push ebx
push edi
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DeleteAce]
test eax, eax
jne 0x40209e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x4020b3
movzx eax, word [esi + 2]
inc ebx
add esi, eax
movzx eax, word [edi + 4]
cmp ebx, eax
jl 0x402057
mov ecx, edi
call fcn.00401e7a
mov word [edi + 2], ax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4020ba
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
or dword [ebp - 0x10], 0xffffffff
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
push edi
mov dword [ebp - 0xc], esi
xor edi, edi
mov eax, edi
mov ecx, dword [esi]
xor esi, esi
mov dword [ebp - 4], eax
cmp si, word [ecx + 4]
lea ebx, [ecx + 8]
mov esi, dword [ebp - 0xc]
jae 0x402188
cmp dword [ebp - 0x10], 0xffffffff
jne 0x402111
mov cl, byte [ebx + 1]
test cl, 0x10
jne 0x40210e
cmp byte [ebx], 0
je 0x40210e
mov al, byte [edx + 0xc]
and cl, 3
and al, 3
cmp cl, al
jb 0x402111
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov al, byte [ebx + 1]
test al, 0x10
jne 0x402174
cmp al, byte [edx + 0xc]
jne 0x402174
cmp byte [ebx], 0
jne 0x402174
lea eax, [ebx + 8]
push eax
push dword [edx + 8]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
mov edx, dword [ebp - 8]
test eax, eax
je 0x402174
mov eax, dword [edx + 0x10]
mov ecx, 0xffefffff
and eax, ecx
not eax
and dword [ebx + 4], eax
test dword [ebx + 4], ecx
jne 0x402174
push dword [ebp - 4]
push dword [esi]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DeleteAce]
test eax, eax
je 0x4021d7
mov esi, dword [esi]
mov ecx, esi
call fcn.00401e7a
mov edx, dword [ebp - 8]
mov word [esi + 2], ax
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
jmp 0x4020ec
mov ecx, dword [esi]
movzx eax, word [ebx + 2]
inc dword [ebp - 4]
add ebx, eax
movzx eax, word [ecx + 4]
cmp dword [ebp - 4], eax
jl 0x40216c
mov eax, dword [edx + 0x14]
movzx ebx, word [ecx + 2]
movzx eax, word [eax + 2]
add ebx, eax
push ebx
push ecx
call dword [sym.imp.msvcrt.dll_realloc]
mov esi, eax
pop ecx
pop ecx
cmp ebx, 0xffff
ja 0x4021e8
test esi, esi
je 0x4021f8
mov ecx, dword [ebp - 8]
mov word [esi + 2], bx
mov ecx, dword [ecx + 0x14]
movzx eax, word [ecx + 2]
push eax
push ecx
push dword [ebp - 0x10]
push 2
push esi
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AddAce]
test eax, eax
jne 0x4021df
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x4021fb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x402205
mov eax, dword [ebp - 0xc]
mov dword [eax], esi
mov esi, edi
jmp 0x4021fb
test esi, esi
je 0x4021f8
mov eax, dword [ebp - 0xc]
mov dword [eax], edi
mov edi, 0x53c
jmp 0x4021fb
push 8
pop edi
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40220a
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
or dword [ebp - 0xc], 0xffffffff
mov eax, ecx
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], eax
mov ecx, dword [eax]
mov esi, edx
xor eax, eax
mov dword [ebp - 0x10], esi
mov edx, ebx
push edi
lea edi, [ecx + 8]
mov dword [ebp - 4], edx
cmp ax, word [ecx + 4]
jae 0x4022e7
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40225c
mov cl, byte [edi + 1]
test cl, 0x10
jne 0x402259
cmp byte [edi], bl
jne 0x40225c
mov al, byte [esi + 0xc]
and cl, 3
and al, 3
cmp cl, al
jb 0x40225c
mov dword [ebp - 0xc], edx
mov al, byte [edi + 1]
test al, 0x10
jne 0x4022cc
cmp al, byte [esi + 0xc]
jne 0x4022cc
lea eax, [edi + 8]
push eax
push dword [esi + 8]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
je 0x4022c9
mov al, byte [edi]
test al, al
je 0x40233e
cmp al, 1
jne 0x4022c9
mov eax, dword [esi + 0x10]
mov ecx, 0xffefffff
and eax, ecx
not eax
and dword [edi + 4], eax
test dword [edi + 4], ecx
jne 0x4022c9
mov esi, dword [ebp - 8]
push dword [ebp - 4]
push dword [esi]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DeleteAce]
test eax, eax
je 0x402336
mov esi, dword [esi]
mov ecx, esi
call fcn.00401e7a
mov edx, dword [ebp - 4]
mov word [esi + 2], ax
mov esi, dword [ebp - 0x10]
jmp 0x40223b
mov edx, dword [ebp - 4]
movzx eax, word [edi + 2]
inc edx
add edi, eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
movzx eax, word [ecx + 4]
cmp edx, eax
jl 0x40223b
mov eax, dword [esi + 0x14]
movzx edi, word [eax + 2]
movzx eax, word [ecx + 2]
add edi, eax
push edi
push ecx
call dword [sym.imp.msvcrt.dll_realloc]
mov esi, eax
pop ecx
pop ecx
cmp edi, 0xffff
ja 0x402359
test esi, esi
je 0x402369
mov ecx, dword [ebp - 0x10]
mov word [esi + 2], di
mov ecx, dword [ecx + 0x14]
movzx eax, word [ecx + 2]
push eax
push ecx
push dword [ebp - 0xc]
push 2
push esi
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AddAce]
test eax, eax
jne 0x402350
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
jmp 0x40236c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x402376
test byte [esi], 0x40
mov eax, dword [esi + 0x10]
je 0x40234b
mov dword [edi + 4], eax
jmp 0x402374
or dword [edi + 4], eax
jmp 0x402374
mov eax, dword [ebp - 8]
mov dword [eax], esi
mov esi, ebx
jmp 0x40236c
test esi, esi
je 0x402369
mov eax, dword [ebp - 8]
mov dword [eax], ebx
mov ebx, 0x53c
jmp 0x40236c
push 8
pop ebx
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402890
Capabilities:
Get user security identifier

Disassembly:
push 0x28
push 0x405c50
call fcn.00405a98
mov dword [ebp - 0x2c], edx
mov eax, ecx
mov dword [ebp - 0x1c], eax
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov esi, edx
mov dword [ebp - 0x20], esi
mov ebx, edx
mov dword [ebp - 0x34], ebx
mov edi, edx
mov dword [ebp - 0x38], edi
mov dword [ebp - 4], edx
cmp word [eax], 0x2a
jne 0x402971
mov dword [ebp - 0x1c], edx
lea ecx, [ebp - 0x1c]
push ecx
add eax, 2
push eax
call dword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSidToSidW]
test eax, eax
je 0x40295b
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
push ecx
lea eax, [ebp - 0x28]
push eax
push ecx
push dword [ebp - 0x1c]
push ecx
call dword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountSidW]
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0x40291c
push dword [ebp - 0x1c]
call dword [sym.imp.ntdll.dll_RtlIsPackageSid]
test al, al
jne 0x40291c
push dword [ebp - 0x1c]
call dword [sym.imp.ntdll.dll_RtlIsCapabilitySid]
test al, al
je 0x40295b
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalSize]
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
test eax, eax
je 0x402955
push dword [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalSize]
push eax
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CopySid]
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
jmp 0x40295b
push 8
pop esi
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x2c]
cmp dword [eax], 0
jne 0x4029f0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
jmp 0x4029ed
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push edx
lea ecx, [ebp - 0x28]
push ecx
push edx
push eax
push edx
call dword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountNameW]
test eax, eax
jne 0x4029e8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x402967
push dword [ebp - 0x28]
call dword [sym.imp.msvcrt.dll_malloc]
mov ebx, eax
mov dword [ebp - 0x34], ebx
mov ecx, dword [ebp - 0x24]
add ecx, ecx
push ecx
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
pop ecx
mov edi, eax
mov dword [ebp - 0x38], edi
test ebx, ebx
je 0x4029e3
test edi, edi
je 0x4029e3
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0x28]
push eax
push ebx
push dword [ebp - 0x1c]
push 0
call dword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountNameW]
test eax, eax
je 0x402967
mov eax, dword [ebp - 0x2c]
mov dword [eax], ebx
jmp 0x4029f0
push 8
pop esi
jmp 0x4029ed
mov esi, 0x54f
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.00402a17
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret