joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ce2a0b7
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b0
push ebx
push esi
push edi
push 0x34
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
je 0x7ce2a0dd
mov eax, 0x80004003
jmp 0x7ce2a25c
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 0x10
push dword [ebp + 8]
call esi
test eax, eax
jne 0x7ce2a0ff
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
shl eax, 4
push eax
push edi
call esi
test eax, eax
je 0x7ce2a109
mov eax, 0x80070057
jmp 0x7ce2a25c
lea eax, [ebp - 0x58]
push 0x28
push eax
push dword [ebp + 8]
call sym.ole32.dll_StringFromGUID2
test eax, eax
je 0x7ce2a269
push dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x2b0]
push eax
call fcn.7ce29e21
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push 0xf003f
lea eax, [ebp - 0x2b0]
push ebx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x7ce2a24c
cmp dword [ebp + 0xc], ebx
mov dword [ebp + 0x14], ebx
jbe 0x7ce2a241
mov dword [ebp + 0x10], edi
xor eax, eax
mov dword [ebp + 8], 0x7ce4d9b8
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push 0x10
xor edx, edx
pop ecx
repe cmpsb byte [esi], byte es:[edi]
je 0x7ce2a197
add dword [ebp + 8], 0x114
inc eax
cmp dword [ebp + 8], 0x7ce4df1c
jl 0x7ce2a175
jmp 0x7ce2a1c8
imul eax, eax, 0x114
add eax, str.Insertable
mov ecx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x2b0]
push eax
call fcn.7ce29e21
lea eax, [ebp - 0x2b0]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0xa8]
push 0x28
push eax
push dword [ebp + 0x10]
call sym.ole32.dll_StringFromGUID2
test eax, eax
je 0x7ce2a269
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xa8]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call esi
lea edi, [eax + 1]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.7ce2956c
mov dword [ebp + 8], esp
push ebx
push ebx
push edi
push dword [ebp + 8]
lea eax, [ebp - 0xa8]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call esi
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.7ce29ce6
mov esi, eax
cmp esi, ebx
jne 0x7ce2a241
inc dword [ebp + 0x14]
add dword [ebp + 0x10], 0x10
mov eax, dword [ebp + 0x14]
cmp eax, dword [ebp + 0xc]
jb 0x7ce2a16c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jle 0x7ce2a25a
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
lea esp, [ebp - 0x2bc]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov eax, 0x8007000e
jmp 0x7ce2a25c
Function at 0x7ce2cbe2
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x7ce4df68]
cmp eax, 0xffffffff
jne 0x7ce2cc2d
and dword [ebp - 0x2c], 0
push edi
push esi
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
push eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push 0x2c
push eax
push 0
mov esi, 0x1f4
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x7ce2cc24
movsx esi, byte [ebp - 4]
imul esi, esi, 0x1f4
mov eax, esi
pop esi
mov dword [0x7ce4df68], eax
pop edi
leave
ret

Function at 0x7ce2cd6a
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1c]
push 1
pop ecx
mov dword [0x7ce4df70], eax
cmp ecx, eax
sbb eax, eax
and eax, 0x1f4
mov dword [0x7ce50f3c], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x7cd84770
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7ce2cdee
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x7cd84758
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7ce2cde5
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x7d0
mov dword [0x7ce4df6c], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x7ce2d33d
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor esi, esi
mov edi, ecx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 0x10], eax
jne 0x7ce2d3fa
dec word [edi + 0x1a]
cmp word [edi + 0x1a], si
jne 0x7ce2d422
lea ebx, [edi + 0xc]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [edi + 0x10], esi
mov esi, dword [ebx]
test esi, 0x7fe000
mov ebp, esi
mov eax, 0xfffff000
je 0x7ce2d39e
mov ecx, edi
call fcn.7ce2ce47
test eax, eax
mov dword [esp + 0x10], eax
je 0x7ce2d3b5
mov eax, 0xfffff400
jmp 0x7ce2d3c8
test esi, 0xff800000
je 0x7ce2d3c8
mov ecx, edi
call fcn.7ce2ce11
test eax, eax
mov dword [esp + 0x14], eax
jne 0x7ce2d3c3
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebx]
xor ebp, ebp
jmp 0x7ce2d3d5
mov eax, 0xfffff800
add eax, esi
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
mov esi, eax
cmp esi, ebp
jne 0x7ce2d379
test ebp, 0x7fe000
je 0x7ce2d3e7
push dword [esp + 0x10]
jmp 0x7ce2d3f3
test ebp, 0xff800000
je 0x7ce2d422
push dword [esp + 0x14]
call fcn.7ce2d42e
jmp 0x7ce2d422
cmp dword [0x7ce50f44], esi
mov dword [esp + 0x18], 0x80070120
je 0x7ce2d410
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x7ce2d45f
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp + 0x10], eax
jne 0x7ce2d483
mov ecx, ebp
call fcn.7ce2d33d
mov dword [esp + 0x10], eax
jmp 0x7ce2d59a
mov eax, dword [ebp]
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebp
call dword [eax + 8]
xor edx, edx
mov dword [esp + 0x10], eax
cmp eax, edx
jl 0x7ce2d56a
mov eax, dword [esp + 0x20]
mov cx, word [eax]
cmp cx, 1
jbe 0x7ce2d4b4
dec ecx
mov word [eax], cx
jmp 0x7ce2d572
jne 0x7ce2d56a
lea edi, [ebp + 0xc]
mov word [eax], dx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
mov esi, dword [edi]
mov edx, esi
push 1
and edx, 0x7ff
pop ecx
or eax, 0xffffffff
cmp edx, ecx
mov ebx, esi
jne 0x7ce2d52c
test esi, 0xff800000
mov dword [esp + 0x14], ecx
je 0x7ce2d500
mov ecx, ebp
call fcn.7ce2ce11
test eax, eax
mov dword [esp + 0x18], eax
je 0x7ce2d517
mov eax, 0x7ff
jmp 0x7ce2d531
test esi, 0x7fe000
je 0x7ce2d531
mov ecx, ebp
call fcn.7ce2ce47
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x7ce2d525
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [edi]
xor ebx, ebx
jmp 0x7ce2d53e
mov eax, 0x3ff
jmp 0x7ce2d531
and dword [esp + 0x14], 0
add eax, esi
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
mov esi, eax
cmp esi, ebx
jne 0x7ce2d4ca
cmp dword [esp + 0x14], 0
je 0x7ce2d572
test ebx, 0xff800000
je 0x7ce2d557
push dword [esp + 0x18]
jmp 0x7ce2d563
test ebx, 0x7fe000
je 0x7ce2d572
push dword [esp + 0x1c]
call fcn.7ce2d42e
jmp 0x7ce2d572
mov dword [esp + 0x10], 0x80070120
cmp dword [esp + 0x10], 0
jge 0x7ce2d59a
cmp dword [0x7ce50f44], 0
je 0x7ce2d588
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x7ce2d5a6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
test eax, eax
je 0x7ce2d5c8
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
cmp dword [esi + 0x10], edi
jne 0x7ce2d5fc
mov dword [ebx], 0x22
mov ax, word [esi + 0x1a]
mov word [ebx + 0xe], ax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x7ce2d5ed
and dword [eax], 0
mov ecx, esi
call fcn.7ce2d132
mov dword [ebp - 4], eax
jmp 0x7ce2d6fd
test byte [esi + 0x18], 1
jne 0x7ce2d608
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
mov ecx, esi
call dword [eax + 8]
test eax, eax
mov dword [ebp - 4], eax
jl 0x7ce2d6fd
mov eax, dword [ebp + 8]
and dword [ebp - 8], 0
cmp word [eax], 0
je 0x7ce2d690
mov dword [ebx], 0x42
mov dword [ebx + 8], eax
mov ax, word [eax]
push 1
mov word [ebx + 0xc], ax
lea eax, [esi + 0xc]
push 0x1000
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
jne 0x7ce2d673
mov ecx, dword [ebp + 8]
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp + 0xc]
inc dword [esi + 0x14]
cmp ecx, eax
mov dword [esi + 0x10], edi
mov word [esi + 0x1a], 1
je 0x7ce2d66e
mov dword [ecx], eax
inc dword [esi + 0x24]
jmp 0x7ce2d699
mov eax, dword [esi + 0x14]
mov ecx, esi
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov word [eax], 1
call fcn.7ce2d45f
push 1
mov dword [ebp - 4], eax
pop eax
jmp 0x7ce2d699
push 1
mov dword [ebx], 0x12
pop eax
test eax, eax
je 0x7ce2d6fd
mov ecx, esi
call fcn.7ce2d132
test eax, eax
mov dword [ebp - 4], eax
jl 0x7ce2d6c0
mov eax, dword [ebp - 8]
inc eax
cmp dword [esi + 0x14], eax
jne 0x7ce2d6fd
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x7ce2d6fd
and dword [eax], 0
jmp 0x7ce2d6fd
test byte [ebx], 0x40
je 0x7ce2d6fd
mov ecx, esi
call fcn.7ce2ce7e
test eax, eax
jl 0x7ce2d6dc
mov ecx, dword [ebp + 8]
mov ax, word [ebx + 0xc]
mov word [ecx], ax
jmp 0x7ce2d6fd
cmp dword [0x7ce50f44], 0
je 0x7ce2d6eb
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 4]
test eax, eax
jge 0x7ce2d70a
mov dword [ebx], 1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x7ce2d711
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
xor edi, edi
test byte [ebx], 2
mov esi, ecx
je 0x7ce2d79f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, eax
cmp dword [esi + 0x10], ebp
jne 0x7ce2d775
mov ecx, esi
call fcn.7ce2d33d
mov edi, eax
test edi, edi
jl 0x7ce2d77e
cmp dword [esi + 0x10], ebp
jne 0x7ce2d757
test byte [ebx], 0x20
je 0x7ce2d750
mov ax, word [ebx + 0xe]
cmp ax, word [esi + 0x1a]
je 0x7ce2d77a
mov edi, 0x80004005
jmp 0x7ce2d77a
test byte [ebx], 0x40
je 0x7ce2d77a
mov ecx, esi
call fcn.7ce2ce7e
mov edi, eax
test edi, edi
jl 0x7ce2d77e
mov eax, dword [ebx + 8]
mov cx, word [ebx + 0xc]
mov word [eax], cx
jmp 0x7ce2d77a
mov edi, 0x80070120
test edi, edi
jge 0x7ce2d79f
cmp dword [0x7ce50f44], 0
je 0x7ce2d78d
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x7ce2d840
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x7ce2d85a
mov dword [ebx], 1
mov esi, dword [ebp + 8]
test byte [esi], 4
je 0x7ce2d8df
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x7ce2d875
cmp word [ecx], 0
ja 0x7ce2d87a
cmp dword [edi + 0x10], eax
jne 0x7ce2d89d
cmp dword [0x7ce50f44], 0
je 0x7ce2d889
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x7ce2d8df
mov eax, dword [esi]
test al, 0x20
je 0x7ce2d8b7
mov ecx, edi
call fcn.7ce2d132
mov dword [ebp - 4], eax
mov ax, word [esi + 0xe]
mov word [edi + 0x1a], ax
jmp 0x7ce2d8cf
test al, 0x40
je 0x7ce2d8df
mov ecx, edi
call fcn.7ce2ce7e
mov cx, word [esi + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi + 8]
mov word [eax], cx
mov eax, dword [esi + 4]
inc eax
cmp dword [edi + 0x14], eax
jne 0x7ce2d8df
test ebx, ebx
je 0x7ce2d8df
and dword [ebx], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x7ce3520e
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x10], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
dec eax
push edi
je 0x7ce35235
dec eax
jne 0x7ce3524a
mov edi, dword [ebx + 0x18]
lea esi, [ebx + 0x10]
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
jmp 0x7ce35250
mov ecx, dword [ebx + 0x18]
lea eax, [ebx + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x10]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*8]
mov dword [ebp - 8], eax
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x18]
add eax, dword [ebx + 0x14]
and dword [ebp + 0x14], 0
lea eax, [eax + eax*2]
lea eax, [ecx + eax*8 - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
test eax, eax
jbe 0x7ce3535d
cmp dword [ebp + 0x14], eax
jae 0x7ce35349
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 1
jne 0x7ce35296
push dword [edi + 0x10]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x7ce352bd
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x7ce35349
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x7ce35349
push ecx
push dword [eax + 0x10]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x7ce35349
dec dword [esi]
dec dword [ebx + 0x2c]
mov eax, dword [edi + 0x14]
test eax, eax
je 0x7ce352de
push eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [ebp + 0x10]
sub dword [ecx + 8], eax
push dword [edi + 0x14]
call fcn.7cd87d70
push dword [edi + 0x10]
call fcn.7cd87d70
mov eax, dword [ebp + 0xc]
dec eax
je 0x7ce35314
dec eax
jne 0x7ce35326
mov eax, dword [esi]
cmp dword [ebp + 0x14], eax
jae 0x7ce35307
mov ecx, dword [ebx + 0x18]
lea eax, [eax + eax*2]
push 6
lea esi, [ecx + eax*8]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 4]
mov esi, dword [esi]
mov ecx, dword [ebx + 0x18]
lea eax, [esi + esi*2]
lea edi, [ecx + eax*8]
jmp 0x7ce3531b
mov eax, dword [ebp + 0x14]
cmp eax, dword [esi]
jae 0x7ce35326
mov esi, dword [ebp - 0xc]
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
sub dword [ebp - 0xc], 0x18
push 6
xor eax, eax
pop ecx
mov dword [ebp - 0x10], 1
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp - 8]
cmp eax, dword [esi]
jb 0x7ce3527a
mov eax, dword [esi]
add edi, 0x18
inc dword [ebp + 0x14]
mov dword [ebp - 8], edi
cmp dword [ebp + 0x14], eax
jb 0x7ce3527a
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x7ce35986
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.7ce35925
mov esi, eax
cmp esi, ebx
jl 0x7ce35a6c
cmp dword [edi + 8], 1
jne 0x7ce359eb
lea eax, [ebp + 8]
push ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.ole32.dll_CoQueryClientBlanket
test eax, eax
jge 0x7ce359cd
mov eax, 0x80010128
jmp 0x7ce35a6e
push dword [edi + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x7ce35a6c
mov eax, 0x80010127
jmp 0x7ce35a6e
call sym.ole32.dll_CoImpersonateClient
mov esi, eax
cmp esi, ebx
jl 0x7ce35a59
lea eax, [ebp - 4]
push eax
push 1
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
cmp eax, ebx
jne 0x7ce35a17
mov esi, 0x80010125
cmp esi, ebx
jl 0x7ce35a59
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x108]
push 0x100
push eax
push 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, ebx
jne 0x7ce35a41
mov esi, 0x80010126
jmp 0x7ce35a59
push dword [edi + 0x10]
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x7ce35a59
mov esi, 0x80010127
call sym.ole32.dll_CoRevertToSelf
cmp dword [ebp - 4], ebx
je 0x7ce35a6c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x7ce35beb
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp word [edi], 0x2a
mov dword [ebp - 4], esi
jne 0x7ce35c47
cmp word [edi + 2], si
jne 0x7ce35c47
mov eax, dword [ebp + 0x10]
cmp dword [eax], 2
je 0x7ce35c1a
mov eax, 0x80070057
jmp 0x7ce35d26
push 0xc
call fcn.7ce35a75
mov ecx, dword [ebp + 8]
cmp eax, esi
mov dword [ecx], eax
je 0x7ce35c3d
push 0x7ce4dff8
push eax
push 0xc
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x7ce35d24
mov eax, 0x8007000e
jmp 0x7ce35d26
push 0x40
pop eax
push eax
mov dword [ebp + 0xc], eax
mov dword [ebp - 8], eax
call fcn.7cd87d85
mov ebx, eax
cmp ebx, esi
je 0x7ce35cac
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
call fcn.7ce35a75
cmp eax, esi
mov dword [ebp - 4], eax
je 0x7ce35cac
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp + 0xc]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call esi
test eax, eax
jne 0x7ce35cd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x7ce35ccc
push ebx
call fcn.7cd87d70
push dword [ebp - 8]
call fcn.7cd87d85
mov ebx, eax
test ebx, ebx
jne 0x7ce35cb3
mov esi, 0x8007000e
jmp 0x7ce35cfb
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push dword [ebp - 4]
push eax
push ebx
push edi
push 0
call esi
test eax, eax
jne 0x7ce35cd3
mov esi, 0x80010132
jmp 0x7ce35cfb
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
cmp ecx, 1
jne 0x7ce35ce3
cmp dword [eax], 1
je 0x7ce35d17
cmp ecx, 2
jne 0x7ce35cec
cmp dword [eax], ecx
je 0x7ce35d17
cmp ecx, 5
je 0x7ce35d17
cmp ecx, 4
je 0x7ce35d17
mov esi, 0x8001012f
cmp dword [ebp - 4], 0
je 0x7ce35d09
push dword [ebp - 4]
call fcn.7ce35a87
test ebx, ebx
je 0x7ce35d13
push ebx
call fcn.7cd87d70
mov eax, esi
jmp 0x7ce35d26
push dword [ebp - 4]
call fcn.7ce35a87
mov eax, dword [ebp + 8]
mov dword [eax], ebx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7ce35d2d
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push 0x7ce4dff8
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x7ce35d91
mov esi, dword [ebp + 0x10]
cmp dword [esi], 2
je 0x7ce35d5f
mov eax, 0x80070057
jmp 0x7ce35f12
push 4
call fcn.7ce35a75
mov ecx, dword [ebp + 8]
cmp eax, ebx
mov dword [ecx], eax
je 0x7ce35d87
mov word [eax], 0x2a
mov eax, dword [ecx]
mov word [eax + 2], bx
mov dword [esi], 2
xor eax, eax
jmp 0x7ce35f12
mov eax, 0x8007000e
jmp 0x7ce35f12
push 0x40
mov dword [ebp - 4], 0x20
pop edi
push edi
mov dword [ebp - 0x10], edi
call fcn.7ce35a75
test eax, eax
mov dword [ebp - 0xc], eax
je 0x7ce35eaa
mov eax, dword [ebp - 0x10]
add eax, eax
push eax
call fcn.7ce35a75
mov ebx, eax
test ebx, ebx
je 0x7ce35eaa
lea eax, [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push dword [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0xc]
push 0
call esi
test eax, eax
jne 0x7ce35e57
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x7ce35e4b
cmp dword [ebp - 4], 0x20
jbe 0x7ce35e14
push dword [ebp - 0xc]
call fcn.7ce35a87
mov eax, dword [ebp - 4]
add eax, eax
push eax
call fcn.7ce35a75
test eax, eax
mov dword [ebp - 0xc], eax
je 0x7ce35eaa
cmp dword [ebp - 0x10], edi
jbe 0x7ce35e30
push ebx
call fcn.7ce35a87
mov eax, dword [ebp - 0x10]
add eax, eax
push eax
call fcn.7ce35a75
mov ebx, eax
test ebx, ebx
je 0x7ce35eaa
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push dword [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0xc]
push 0
call esi
test eax, eax
jne 0x7ce35e57
mov dword [ebp - 8], 0x80010130
jmp 0x7ce35ef7
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x10]
cmp ecx, 1
jne 0x7ce35e67
cmp dword [eax], 1
je 0x7ce35e83
cmp ecx, 2
jne 0x7ce35e70
cmp dword [eax], ecx
je 0x7ce35e83
cmp ecx, 5
je 0x7ce35e83
cmp ecx, 4
je 0x7ce35e83
mov dword [ebp - 8], 0x8001012f
jmp 0x7ce35ef7
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
push ebx
mov dword [ebp - 4], eax
call esi
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], eax
add eax, ecx
lea eax, [eax + eax + 4]
push eax
call fcn.7cd87d85
test eax, eax
jne 0x7ce35eb3
mov dword [ebp - 8], 0x8007000e
jmp 0x7ce35ef7
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
add ecx, ecx
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 4]
mov esi, ebx
mov word [eax + ecx*2], 0x5c
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
lea ecx, [ecx + ecx + 2]
lea edi, [eax + edx*2 + 2]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test ebx, ebx
je 0x7ce35f01
push ebx
call fcn.7ce35a87
cmp dword [ebp - 0xc], 0
je 0x7ce35f0f
push dword [ebp - 0xc]
call fcn.7ce35a87
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7ce4696a
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, dword [eax]
mov esi, ecx
mov eax, dword [ebx + 0x10]
test al, 0x20
je 0x7ce46a5f
mov ecx, eax
not ecx
test cl, 4
je 0x7ce4698f
and dword [ebx + 0x70], 0
mov edi, 0x100
test edi, eax
je 0x7ce469a3
push ebx
call fcn.7ce46930
jmp 0x7ce46ab9
call fcn.7cdb7d2d
test eax, eax
je 0x7ce46a1e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf80]
and byte [eax + 0xd], 0xf7
mov eax, dword [esi + 0x18]
test byte [eax + 0x30], 0x40
je 0x7ce469df
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf80]
test byte [eax + 0xc], 0x80
jne 0x7ce469f1
push ebx
call fcn.7ce46930
jmp 0x7ce46a07
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf80]
test byte [eax + 0xc], 0x80
je 0x7ce469fe
push dword [ebp + 8]
push dword [esi + 0x18]
call fcn.7cdd46c8
jmp 0x7ce46a07
push ebx
push dword [esi + 0x18]
call fcn.7cdd4592
mov ecx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf80]
or byte [eax + 0xd], 8
jmp 0x7ce46abb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf80]
mov esi, dword [esi + 0x18]
test byte [eax + 0xc], 0x80
je 0x7ce46a49
test dword [esi + 0x30], edi
je 0x7ce46a3e
cmp dword [esi + 0x38], 0
je 0x7ce46a4f
push dword [ebp + 8]
push esi
call fcn.7cdd46c8
jmp 0x7ce46ab9
test byte [esi + 0x30], 0x40
je 0x7ce46a56
mov ecx, 0x80010012
jmp 0x7ce46abb
push ebx
push esi
call fcn.7cdd4592
jmp 0x7ce46ab9
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 0x30]
test al, 2
je 0x7ce46ab3
test ah, 1
je 0x7ce46ab3
mov esi, dword [ebx + 0x68]
mov eax, dword [ebx + 0x60]
and dword [ebp + 8], 0
add esi, 4
cmp eax, 0xb
jne 0x7ce46a8a
push 0x10
mov edi, 0x7cd76618
pop ecx
jmp 0x7ce46a97
cmp eax, 7
jne 0x7ce46aa4
push 0x10
mov edi, 0x7cd76258
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x7ce46aa4
mov dword [ebp + 8], 1
cmp dword [ebp + 8], 0
je 0x7ce46ab3
push dword [edx + 8]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push ebx
call fcn.7ce46aff
mov ecx, eax
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret 4