joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56d3c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aaf42
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x634ba0]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [ebp - 0x14]
lea esi, [eax + 1]
push esi
call fcn.00443930
push esi
push eax
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push 0
push 0x147
push dword [edi + 0x94]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 0x40]
add eax, 0x90
mov dword [ebp - 0x20], eax
mov ecx, dword [eax]
mov eax, dword [ecx]
mov dword [ebp - 0x1c], eax
test esi, esi
je 0x56d489
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax*4 + 4]
mov eax, ebx
call fcn.004c6740
mov edi, esp
test edi, edi
je 0x56d489
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, edi
jmp 0x56d48b
xor eax, eax
mov edi, dword [ebp - 0x1c]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call dword [0x5c3794]
mov ecx, dword [ebp - 0x20]
call edi
lea eax, [esi - 0xc]
cmp eax, 0x634ba4
je 0x56d4c1
add esi, 0xfffffff4
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x56d4c1
push esi
call fcn.004c59d6
add esp, 4
xor eax, eax
lea esp, [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret 0x10

Function at 0x56d550
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
push dword [edi + 0xc8]
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push dword [edi + 0xcc]
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push dword [edi + 0xb8]
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push dword [edi + 0xbc]
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push dword [edi + 0xc0]
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push dword [edi + 0xc4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [edi + 0x90]
test esi, esi
pop edi
pop esi
je 0x56d5c1
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
Function at 0x574eb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x230]
push edi
push eax
push esi
lea ecx, [ebp - 0x22c]
call fcn.0058a720
lea ecx, [ebp - 0x22c]
call fcn.0058a690
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x574f18
push 0
push 0
push eax
push str.CWinsecApiImpersonateUserFromToken
push 0x45
push 0x64
push str.C:drone_src_srcCommonIPCProcessAPI.cpp
push str.CProcessApi::IsProfileLoaded
call fcn.00573980
add esp, 0x20
xor al, al
jmp 0x575087
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0
push eax
call dword [sym.imp.USERENV.dll_GetProfileType]
test eax, eax
jne 0x574f62
push str.User_profile_is_not_loaded___cannot_get_profile_type_
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.::GetProfileType
push 0x49
push 0x6d
push str.C:drone_src_srcCommonIPCProcessAPI.cpp
push str.CProcessApi::IsProfileLoaded
call fcn.00573980
add esp, 0x20
xor al, al
jmp 0x575087
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004c76f0
add esp, 0xc
mov dword [ebp - 0x234], 0x104
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x574fd0
push dword [ebp - 0x228]
push str.User_profile_is_not_loaded___cannot_get_profile_directory__profile_type__u_
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.::GetUserProfileDirectory
push 0x49
push 0x79
push str.C:drone_src_srcCommonIPCProcessAPI.cpp
push str.CProcessApi::IsProfileLoaded
call fcn.00573980
add esp, 0x24
xor al, al
jmp 0x575087
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00444ee0
lea ecx, [ebp - 0x224]
call fcn.00583300
lea ecx, [ebp - 0x224]
mov bl, al
call fcn.00444ea0
test bl, bl
jne 0x575085
lea eax, [ebp - 0x20c]
push eax
call fcn.004d4367
inc eax
add esp, 4
cmp eax, 0x3fffffff
jg 0x57504c
lea edi, [eax + eax]
mov eax, edi
call fcn.004c6740
mov esi, esp
test esi, esi
je 0x57504c
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
mov byte [esi], bl
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x57504e
xor eax, eax
push dword [ebp - 0x228]
push eax
push str.User_profile_is_not_loaded___profile_directory___s__does_not_exist__profile_type__u_
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.::GetUserProfileDirectory
push 0x49
push 0x82
push str.C:drone_src_srcCommonIPCProcessAPI.cpp
push str.CProcessApi::IsProfileLoaded
call fcn.00573980
add esp, 0x28
xor al, al
jmp 0x575087
mov al, 1
lea esp, [ebp - 0x240]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret 4
Function at 0x57bcd0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac2d8
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004c76f0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x57bd93
push str.CSIDL_value_provided_to_CStoragePath::GetUILogPath_returned_an_empty_string.
push 0x57
push 0x253
push str.C:drone_src_srcCommonUtilityStoragePath.cpp
push str.CStoragePath::GetUILogPath
call fcn.00573940
push 0x18
lea eax, [ebp - 0x234]
mov dword [esi + 0x10], 0
push eax
push esi
mov dword [esi + 0x14], 0
call fcn.004c7170
add esp, 0x20
jmp 0x57be7c
xor eax, eax
mov dword [ebp - 0x23c], 0
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x57bdc0
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x24c]
call fcn.004459d0
mov eax, dword [ebp - 0x220]
cmp eax, 8
jb 0x57be03
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x234]
call fcn.00446620
add esp, 8
xor eax, eax
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x24c]
push 0x18
push eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x220], 7
push eax
call fcn.004c7170
add esp, 0xc
lea ecx, [ebp - 0x234]
push 1
push 0x5e2170
call fcn.00447e80
push 0xf
push str..cisco_vpnlog_
lea ecx, [ebp - 0x234]
call fcn.00447e80
push 0x18
lea eax, [ebp - 0x234]
mov dword [esi + 0x10], 0
push eax
push esi
mov dword [esi + 0x14], 0
call fcn.004c7170
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret 4
Function at 0x581a50
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 0x14], 0
jne 0x581a87
mov eax, 0xfe58000a
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x581b00
lea ecx, [ebp - 0x25c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x581b41
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x581ac6
mov eax, 0xfe58000c
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push eax
push str.::FindNextFile
push 0x45
push 0xb3
push str.C:drone_src_srcCommonUtilityDirectory.cpp
push str.Directory::ReadDir
call fcn.00573980
add esp, 0x20
mov eax, 0xfe580009
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x18], 8
lea eax, [esi + 4]
jb 0x581b0b
mov eax, dword [eax]
push 0
push 0
push 0
lea ecx, [ebp - 0x25c]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x581b41
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.::FindFirstFile
push 0x45
push 0xbe
jmp 0x581ad7
lea edx, [ebp - 0x230]
lea esi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x581b50
sub edx, esi
lea eax, [ebp - 0x230]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.004459d0
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004c59c5
mov esp, ebp
pop ebp
ret 4
Function at 0x581ca0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5acbff
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x10], 0
jne 0x581cdd
mov eax, 0xfe580002
jmp 0x581e46
push edi
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x60]
call fcn.00581c30
xor esi, esi
mov dword [ebp - 4], 0
cmp dword [ebp - 0x68], esi
je 0x581e3c
nop dword [eax]
inc esi
mov dword [ebp - 0x64], edi
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x581d11
mov ecx, dword [edi]
mov dword [ebp - 0x64], ecx
mov ebx, dword [edi + 0x10]
cmp esi, ebx
jae 0x581d4e
mov edx, ebx
lea eax, [ecx + esi*2]
sub edx, esi
mov esi, 0
je 0x581d44
cmp word [eax], 0x5c
je 0x581d3f
nop dword [eax]
cmp edx, 1
je 0x581d41
add eax, 2
dec edx
cmp word [eax], 0x5c
jne 0x581d30
mov esi, eax
mov ecx, dword [ebp - 0x64]
test esi, esi
je 0x581d4e
sub esi, ecx
sar esi, 1
jmp 0x581d51
or esi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp ebx, esi
mov eax, esi
mov dword [ebp - 0x14], 7
cmovb eax, ebx
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x581d76
mov ecx, dword [edi]
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.004459d0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x14]
mov ebx, eax
cmp ecx, 8
jb 0x581db1
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x28]
call fcn.00446620
add esp, 8
test ebx, ebx
jne 0x581dc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x581e08
cmp esi, 0xffffffff
jne 0x581d00
push edi
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x44]
call fcn.00581c30
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x68]
test esi, esi
je 0x581e32
push 0
push 0
push esi
push str.Directory
push 0x45
push 0x13b
push str.C:drone_src_srcCommonUtilityDirectory.cpp
push str.Directory::CreateNewDirectory
call fcn.00573980
add esp, 0x20
jmp 0x581e34
push 0
push 0
push eax
push str.::CreateDirectory
push 0x45
push 0x126
push str.C:drone_src_srcCommonUtilityDirectory.cpp
push str.Directory::CreateNewDirectory
call fcn.00573980
add esp, 0x20
mov esi, 0xfe58000d
jmp 0x581e3c
xor esi, esi
lea ecx, [ebp - 0x44]
call fcn.00581b90
lea ecx, [ebp - 0x60]
call fcn.00581b90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret
Function at 0x582c10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.CExceptionHandlerEx_0x_.8X
lea eax, [ebp - 0x54]
push 0x28
push eax
call fcn.005850a0
add esp, 0x10
lea eax, [ebp - 0x54]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x680858], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x680858], 0
mov esi, eax
je 0x582d8c
cmp esi, 0xb7
jne 0x582ca9
lea eax, [ebp - 0x54]
push eax
push str.Mutex_lock_already_exists___ls__for_this_process.
push 0
push esi
push str.CExceptionHandlerEx::InstallGlobalExceptionHandler
push 0x49
push 0x9a
push str.C:drone_src_srcCommonUtilityMinidump.cpp
push str.CExceptionHandlerEx::InstallGlobalExceptionHandler
call fcn.00573980
add esp, 0x24
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret
push ecx
push str.Dbghelp.dll
mov ecx, 0x6810d0
call fcn.00581310
test eax, eax
jne 0x582cea
push eax
push str.MiniDumpWriteDump
push 0x6802a4
mov ecx, 0x6810d0
call fcn.00581290
test eax, eax
je 0x582cea
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret
push 0
mov byte [0x68085c], 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x6803b0
push 0x104
mov dword [0x680860], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x6803b0
call fcn.004d4367
add esp, 4
cmp word [eax*2 + 0x6803ae], 0x5c
jne 0x582d66
push 0x6803b0
call fcn.004d4367
add esp, 4
lea eax, [eax*2 - 2]
cmp eax, 0x208
jae 0x582dd4
xor ecx, ecx
push 0x6803b0
mov word [eax + 0x6803b0], cx
call fcn.004d4367
add esp, 4
cmp word [eax*2 + 0x6803ae], 0x5c
je 0x582d26
push 0x582bd0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [0x6802a8], eax
call fcn.005821b0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
push str.Mutex_lock___ls__could_not_be_created
push 0
push esi
push str.CExceptionHandlerEx::InstallGlobalExceptionHandler
push 0x45
push 0xa4
push str.C:drone_src_srcCommonUtilityMinidump.cpp
push str.CExceptionHandlerEx::InstallGlobalExceptionHandler
call fcn.00573980
add esp, 0x24
test esi, esi
jle 0x582dc3
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004c59c5
mov esp, ebp
pop ebp
ret
call fcn.004c6102
int3
Function at 0x583420
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
je 0x583452
push dword [ebp + 8]
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
je 0x5834d5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
xor eax, eax
test esi, esi
je 0x5834d5
push 0x4ff
mov ecx, esi
sub ecx, eax
push ecx
push 0
push ebx
push edi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, edi
jne 0x5834da
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x5834ac
cmp dword [ebp - 0x1c], 0x12
je 0x5834c5
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, esi
jb 0x583464
pop edi
pop esi
mov eax, 0x102
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x12
push 0
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 0x102
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x587d10
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x587d26
mov eax, 0xfe000002
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ecx + 4]
test edx, edx
je 0x587d82
cmp edx, 0xffffffff
je 0x587d82
mov ecx, dword [ebp + 8]
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
push 1
push 0
push ecx
push dword [ebp + 0x14]
call fcn.00587c10
push eax
xor eax, eax
cmp ecx, 7
sete al
movzx eax, ax
push eax
push dword [ebp + 0x18]
push ecx
call fcn.00587c80
movzx eax, ax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
neg eax
sbb eax, eax
and eax, 0x1fffff7
add eax, 0xfe000009
mov esp, ebp
pop ebp
ret 0x14
mov eax, 0xfe000007
mov esp, ebp
pop ebp
ret 0x14

Function at 0x587dc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push 0x5e52fc
push 0
mov dword [esi], vtable.CEventLogLogger.0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [esi + 4], eax
test eax, eax
jne 0x587e22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CEventLogLogger::CEventLogLogger
push str._s:_RegisterEventSourceA_failed___d__n
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.00448510
add esp, 0x14
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004c59c5
mov esp, ebp
pop ebp
ret 4
Function at 0x589930
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x234], eax
push edi
xor edi, edi
mov dword [ebp - 0x238], esi
mov ebx, ecx
test esi, esi
je 0x5899b7
push 0x22c
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.004c76f0
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x5899d0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Process32First
push 0x45
push 0x72c
push str.C:drone_src_srcCommonIPCWinsecAPI.cpp
push str.CWinsecApiUtil::searchProcessesForUserToken
call fcn.00573980
add esp, 0x20
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x228]
push 1
push 0x450
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x589a24
cmp esi, 0xffffffff
je 0x589a24
test ebx, ebx
je 0x589a06
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004d879e
add esp, 8
test eax, eax
jne 0x589a19
push dword [ebp - 0x234]
push ecx
mov ecx, esi
call fcn.00589c20
mov edi, eax
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x589a4c
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x5899d0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c59c5
mov esp, ebp
pop ebp
ret

Function at 0x589a60
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov esi, ecx
mov word [ebp - 8], 0x500
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x589aca
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x10]
test eax, eax
setne bl
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.004c59c5
mov esp, ebp
pop ebp
ret
Function at 0x589b20
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 4
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov esi, ecx
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
mov eax, dword [ebp - 0x10]
setne bl
test eax, eax
je 0x589b85
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.004c59c5
mov esp, ebp
pop ebp
ret

Function at 0x589ba0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov esi, ecx
mov word [ebp - 8], 0x200
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
mov eax, dword [ebp - 0x10]
setne bl
test eax, eax
je 0x589c05
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.004c59c5
mov esp, ebp
pop ebp
ret
Function at 0x58c040
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
test ebx, ebx
jne 0x58c068
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret
push esi
push edi
push ebx
call fcn.004d4367
xor ecx, ecx
mov edx, 2
lea esi, [eax*2 + 2]
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c5d8d
add esp, 8
mov edi, eax
shr esi, 1
je 0x58c0d6
mov edx, SysReAllocString
mov ecx, edi
sub edx, esi
sub ebx, edi
lea eax, [edx + esi]
test eax, eax
je 0x58c0cf
movzx eax, word [ebx + ecx]
test ax, ax
je 0x58c0c8
mov word [ecx], ax
add ecx, 2
sub esi, 1
jne 0x58c0a3
sub ecx, 2
xor eax, eax
mov word [ecx], ax
jmp 0x58c0df
test esi, esi
jne 0x58c0cf
sub ecx, 2
xor eax, eax
mov word [ecx], ax
jmp 0x58c0df
test esi, esi
je 0x58c0df
xor eax, eax
mov word [edi], ax
push 0x5c
push edi
call fcn.004c8cc7
mov esi, eax
add esp, 8
test esi, esi
je 0x58c148
mov ebx, 0x5c
xor eax, eax
xorps xmm0, xmm0
mov word [esi], ax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x28]
push eax
push 0
push edi
movups xmmword [ebp - 0x28], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x58c131
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x58c131
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x58c166
lea eax, [esi + 2]
mov word [esi], bx
push 0x5c
push eax
call fcn.004c8cc7
mov esi, eax
add esp, 8
test esi, esi
jne 0x58c0f5
mov bl, 1
push edi
call fcn.004c59d6
mov ecx, dword [ebp - 4]
add esp, 4
mov al, bl
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004c59c5
mov esp, ebp
pop ebp
ret
xor bl, bl
jmp 0x58c14a