joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cd20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1001d731
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10025814]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x1c], esi
mov eax, dword [0x10026924]
mov edx, dword [eax + 0xc]
mov ecx, 0x10026924
mov dword [esp + 0x2c], esi
mov dword [esp + 0x18], esi
call edx
mov ebp, dword [esp + 0x34]
add eax, 0x10
mov dword [ebp], eax
mov eax, dword [0x10026924]
mov edx, dword [eax + 0xc]
mov ebx, 1
mov ecx, 0x10026924
mov dword [esp + 0x2c], esi
mov dword [esp + 0x1c], ebx
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x30], ebx
call fcn.1000ba30
mov ebx, eax
add esp, 4
cmp ebx, esi
je 0x1000ce90
push ebx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1000ce90
push ebx
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov cl, byte [eax]
test cl, cl
jne 0x1000ce02
cmp byte [eax + 1], cl
jne 0x1000ce02
movzx ecx, byte [eax + 2]
movzx edx, byte [eax + 3]
shl ecx, 8
add ecx, edx
movzx edx, byte [eax + 4]
movzx eax, byte [eax + 5]
shl ecx, 8
add ecx, edx
shl ecx, 8
add ecx, eax
push ecx
push str.S_1_
push str._s_d
push ebp
call fcn.1000ca40
add esp, 0x10
jmp 0x1000ce32
movzx edx, byte [eax + 5]
push edx
movzx edx, byte [eax + 4]
push edx
movzx edx, byte [eax + 3]
push edx
movzx edx, byte [eax + 2]
movzx eax, byte [eax + 1]
push edx
push eax
movzx ecx, cl
push ecx
push str.S_1_
push str._s0x_.2x_.2x_.2x_.2x_.2x_.2x_
push ebp
call fcn.1000ca40
add esp, 0x24
push ebx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
cmp byte [eax], 0
mov dword [esp + 0x20], eax
jbe 0x1000ce90
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1000ce8a
mov edx, dword [ebp]
push edx
lea eax, [esp + 0x18]
push 0x1001f128
push eax
call fcn.1000ca40
mov edi, dword [esp + 0x20]
mov eax, dword [edi - 0xc]
mov ecx, dword [esp + 0x40]
add esp, 0xc
push eax
push edi
call fcn.10002440
mov ecx, dword [esp + 0x20]
movzx edx, byte [ecx]
inc esi
cmp esi, edx
jl 0x1000ce42
mov ebp, dword [esp + 0x34]
xor esi, esi
mov eax, dword [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
add edi, 0xfffffff0
mov byte [esp + 0x2c], 0
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000cec4
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, ebp
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x1000d3d0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1001d809
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x10025814]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x14], esi
mov ebp, dword [esp + 0x2c]
push 0x1001eaf8
mov ecx, ebp
mov dword [esp + 0x28], 1
call fcn.10003620
mov edx, dword [esp + 0x30]
mov dword [esp + 0x10], esi
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
mov dword [esp + 0x14], 1
or ecx, eax
jge 0x1000d441
push esi
lea ecx, [esp + 0x34]
call fcn.10001780
mov edx, dword [esp + 0x30]
push 0x1001f1ac
push edx
lea eax, [esp + 0x18]
push eax
call fcn.100111cf
add esp, 0xc
cmp eax, esi
jne 0x1000d50c
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x1000d50c
push 2
push esi
push eax
call fcn.10011084
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.10010f8c
mov edx, dword [esp + 0x20]
push esi
push esi
push edx
mov edi, eax
call fcn.10011084
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000f3c0
mov esi, eax
lea eax, [edi + edi + 2]
push eax
push 0
push esi
call fcn.1000f7e0
mov ecx, dword [esp + 0x3c]
push ecx
push edi
push 2
push esi
call fcn.10010dd2
mov edx, dword [esp + 0x4c]
push edx
call fcn.10010ab6
add esp, 0x40
test esi, esi
je 0x1000d50c
push esi
lea ecx, [esp + 0x1c]
call fcn.10003620
push eax
mov ecx, ebp
mov byte [esp + 0x28], 2
call fcn.100028b0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x24], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000d50c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000d531
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
Function at 0x1000d790
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1001d899
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x10025814]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov esi, dword [esp + 0x28]
push 0x1001eaf8
mov ecx, esi
mov dword [esp + 0x24], ebx
call fcn.10003620
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], 1
call fcn.1000cee0
push str.resources_
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x30], 1
call fcn.1000a2c0
add esp, 0x10
push eax
mov ecx, esi
mov byte [esp + 0x24], 2
call fcn.100028b0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x20], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000d832
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x20], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000d856
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x1000d870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1001d899
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x10025814]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov esi, dword [esp + 0x28]
push 0x1001eaf8
mov ecx, esi
mov dword [esp + 0x24], ebx
call fcn.10003620
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], 1
call fcn.1000cee0
push str.libraries_
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x30], 1
call fcn.1000a2c0
add esp, 0x10
push eax
mov ecx, esi
mov byte [esp + 0x24], 2
call fcn.100028b0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x20], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000d912
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x20], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000d936
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x1000fcdf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10025814]
jne 0x1000fce9
repz ret
jmp fcn.1001341c

Function at 0x100194ee
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10011ea2
and dword [ebp - 4], 0
cmp dword [0x10027334], 0
mov ebx, eax
jne 0x1001959f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10019650
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10019650
push eax
call fcn.10011e30
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10027334], eax
call esi
push eax
call fcn.10011e30
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10027338], eax
call esi
push eax
call fcn.10011e30
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1002733c], eax
call esi
push eax
call fcn.10011e30
pop ecx
mov dword [0x10027344], eax
test eax, eax
je 0x1001959f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10011e30
pop ecx
mov dword [0x10027340], eax
mov eax, dword [0x10027340]
cmp eax, ebx
je 0x100195f7
cmp dword [0x10027344], ebx
je 0x100195f7
push eax
call fcn.10011eab
push dword [0x10027344]
mov esi, eax
call fcn.10011eab
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100195f7
test edi, edi
je 0x100195f7
call esi
test eax, eax
je 0x100195ee
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100195ee
test byte [ebp - 0xc], 1
jne 0x100195f7
or dword [ebp + 0x10], 0x200000
jmp 0x10019630
mov eax, dword [0x10027338]
cmp eax, ebx
je 0x10019630
push eax
call fcn.10011eab
pop ecx
test eax, eax
je 0x10019630
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10019630
mov eax, dword [0x1002733c]
cmp eax, ebx
je 0x10019630
push eax
call fcn.10011eab
pop ecx
test eax, eax
je 0x10019630
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10027334]
call fcn.10011eab
pop ecx
test eax, eax
je 0x10019650
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10019652
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403a74
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x44608c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x101
push 0
push eax
mov ecx, esi
mov dword [ebp - 0x390], eax
call fcn.004046c1
cmp dword [esi + 0x14], 8
jb 0x403aaa
mov eax, dword [esi]
jmp 0x403aac
mov eax, esi
lea ecx, [ebp - 0x390]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x403adf
push 0
push dword [ebp - 0x390]
mov ecx, esi
call fcn.004046c1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004065bb
mov esp, ebp
pop ebp
ret 4
push 0x4243c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.004018f5
push 0x442bc0
lea eax, [ebp - 0x38c]
push eax
call fcn.004073d4
int3

Function at 0x1000113f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000114e
pop dword [ebp - 0x20]
mov eax, 0x1000114e
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xd560f9b0
add dword [ebp - 0x30], 0x78f14b9b
mov dword [ebp - 0x2c], 0x2ceb15a3
sub dword [ebp - 0x2c], 0xfab7c95e
mov dword [ebp - 0x28], 0x8d5da415
sub dword [ebp - 0x28], 0x41115fe7
mov dword [ebp - 0x24], 0xab9530ce
add dword [ebp - 0x24], 0x546acf32
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x172ba170
sub dword [ebp - 0x30], 0xa2b9381a
mov dword [ebp - 0x2c], 0xba5a4c2b
sub dword [ebp - 0x2c], 0x78edeab6
mov dword [ebp - 0x28], 0x1f0f0a79
add dword [ebp - 0x28], 0x446061f3
mov dword [ebp - 0x24], 0x6211cff3
sub dword [ebp - 0x24], 0x6211cff3
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x4cb071ce
sub eax, 0x3cb041ce
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x35ac6
push 0
call eax
mov ecx, 0x7a07877f
sub ecx, 0x7a0742d0
xor edi, edi
add edi, eax
mov ebx, 0x9774d363
add ebx, 0x788b8e9d
add ebx, dword [ebp - 0x20]
mov esi, 0xdbce4a35
sub esi, 0xe15eabfa
add dword [ebp - 0xc], 0x116389a0
mov edx, dword [ebx]
mov dword [ebp - 4], 0xd417a88d
add edx, esi
xor dword [ebp - 0xc], 0x53a50ee6
mov dword [edi], edx
add edi, 4
add ebx, 0xa65af9a6
add ebx, 0x59a5065e
loop 0x10001268
add eax, 0x8422eda0
add eax, 0x7bde17ef
mov ebx, eax
add eax, 0xf952e743
sub eax, 0xf952e73e
mov ecx, 0xce19ddcc
add ecx, 0x41e62234
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x10001822
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x1000182c
repz ret
jmp fcn.10001bc2
Function at 0x406520
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b1d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x44
call fcn.00406a60
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x54
call fcn.00406a60
mov byte [ebp - 4], 1
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x64
call fcn.00406a60
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], 0
push 0x28
push 0
mov edx, dword [ebp - 0x1c]
add edx, 8
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x14
push 0
mov eax, dword [ebp - 0x1c]
add eax, 0x30
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x405159
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00405e11
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004052b9
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4052a3
test ebx, ebx
jl 0x405247
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcbb5bd
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x405268
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x40525a
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00406c29
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00406c29
add esp, 8
mov ebx, 0x80070057
jmp 0x405247
Function at 0x417c10
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x18
push esi
push edi
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x28
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x417cdf
lea ecx, [esp + 0xc]
push ecx
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
lea edx, [esp + 0x14]
mov eax, dword [esp + 0x24]
push edx
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x417cc2
test esi, esi
mov dword [esp + 0x1c], 2
je 0x417c85
mov ecx, dword [0x4c6aac]
push 0x4c679c
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [esp + 8]
push 0
push 0
lea edx, [esp + 0x18]
push 0
push edx
push 0
push eax
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, eax
mov ecx, dword [esp + 8]
neg esi
sbb esi, esi
push ecx
neg esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
add esp, 0x18
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 8]
xor esi, esi
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
add esp, 0x18
ret 4
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 4
Function at 0x41c1c9
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0041ce81
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0041c329
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x41c313
test ebx, ebx
jl 0x41c2b7
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcd262d
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41c2d8
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x41c2ca
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0041dc99
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0041dc99
add esp, 8
mov ebx, 0x80070057
jmp 0x41c2b7
Function at 0x433259
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00433f11
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004333b9
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4333a3
test ebx, ebx
jl 0x433347
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xce96bd
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x433368
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x43335a
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00434d29
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00434d29
add esp, 8
mov ebx, 0x80070057
jmp 0x433347
Function at 0x449e99
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0044ab51
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00449ff9
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x449fe3
test ebx, ebx
jl 0x449f87
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd002fd
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x449fa8
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x449f9a
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0044b969
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0044b969
add esp, 8
mov ebx, 0x80070057
jmp 0x449f87