joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70e5d8
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, edx
xor eax, eax
push ebp
push 0x70e67a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x70e669
push 0x24
mov eax, esi
call fcn.0040c824
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x70e663
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x70e65d
lea eax, [ebp - 0x1c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x70e65d
jmp 0x70e657
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x1c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x70e65d
cmp edi, dword [ebp - 8]
ja 0x70e65d
cmp dword [ebp - 0x18], 1
jne 0x70e638
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x18], 1
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x70e686
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x70e690
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x70e716
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [edi], 0
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov dword [ebp - 0x1c], 1
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x70e70c
push 4
mov eax, esi
call fcn.0040c824
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x70e706
mov byte [edi], 1
lea eax, [ebp - 0x20]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x70e700
cmp dword [ebp - 0x1c], 4
mov eax, dword [ebp - 4]
sete byte [eax]
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x70e720
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x70ef9c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x250], edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b9a8
xor eax, eax
push ebp
push 0x70f136
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetCurrentProcessId
mov edi, eax
xor edx, edx
mov eax, 2
call fcn.005fc8a8
mov esi, eax
mov dword [ebp - 0x234], 0x22c
lea edx, [ebp - 0x234]
mov eax, esi
call fcn.005fc8c8
mov ebx, eax
jmp 0x70f100
cmp edi, dword [ebp - 0x22c]
je 0x70f0f1
lea eax, [ebp - 0x240]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.0040c8d8
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x23c]
call fcn.00430b20
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.0042efe0
mov eax, dword [ebp - 0x238]
push eax
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 4]
call fcn.0042efe0
mov edx, dword [ebp - 0x244]
pop eax
call fcn.0040cc24
je 0x70f0d6
lea eax, [ebp - 0x24c]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.0040c8d8
mov eax, dword [ebp - 0x24c]
lea edx, [ebp - 0x248]
call fcn.0042efe0
mov eax, dword [ebp - 0x248]
push eax
lea edx, [ebp - 0x250]
mov eax, dword [ebp - 4]
call fcn.0042efe0
mov edx, dword [ebp - 0x250]
pop eax
call fcn.0040cc24
jne 0x70f0f1
push 0
mov eax, dword [ebp - 0x22c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 8], eax
lea edx, [ebp - 0x234]
mov eax, esi
call fcn.005fc8e8
mov ebx, eax
test ebx, ebx
jne 0x70f025
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70f13d
lea eax, [ebp - 0x250]
mov edx, 7
call fcn.0040b914
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax

Function at 0x70fb40
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffdfc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x70fb71
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.0040c8d8
jmp 0x70fb78
mov eax, ebx
call fcn.0040b8b4
add esp, 0x204
pop ebx
ret
Function at 0x70fbbc
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
push ebp
push 0x70fcd5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x40
call fcn.00408280
mov dword [ebp - 0x40], 0x40
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea eax, [ebp - 0x44]
call fcn.0070ff48
mov edx, dword [ebp - 0x44]
mov eax, dword [0x8d18dc]
call fcn.0040bca4
mov eax, dword [0x8d1368]
mov edx, dword [ebp - 0x38]
mov dword [eax], edx
mov edx, dword [ebp - 0x34]
mov dword [eax + 4], edx
mov eax, dword [0x8d1368]
mov edx, dword [eax + 4]
mov eax, dword [eax]
test edx, edx
jge 0x70fc34
neg eax
adc edx, 0
neg edx
mov ecx, dword [0x8d1368]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [0x8d1b90]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [0x8d1b90]
mov edx, dword [eax + 4]
mov eax, dword [eax]
test edx, edx
jge 0x70fc64
neg eax
adc edx, 0
neg edx
mov ecx, dword [0x8d1b90]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
sub eax, dword [ebp - 0x30]
sbb edx, dword [ebp - 0x2c]
mov ecx, dword [0x8d1c84]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
sub eax, dword [ebp - 0x30]
sbb edx, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
sub edx, 0x80000000
mov dword [ebp - 0x48], edx
fild qword [ebp - 0x4c]
fadd qword [0x70fce0]
fdiv dword [0x70fce8]
call fcn.00407cd8
mov ecx, dword [0x8d2738]
mov dword [ecx], eax
mov dword [ecx + 4], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70fcdc
lea eax, [ebp - 0x44]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x70fcec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x70fedc
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x70fd20
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040bcec
jmp 0x70fd2f
lea edx, [ebp - 4]
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
call fcn.005e90fc
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x70fef8
call fcn.0040cdb0
mov ebx, eax
test ebx, ebx
jle 0x70fd5b
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040cc5c
lea eax, [ebp - 0x20]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040cc5c
mov eax, dword [ebp - 0x20]
mov edx, 0x70ff08
call fcn.0040cc24
jne 0x70fd96
lea eax, [ebp - 4]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.0040cc5c
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x70ff08
call fcn.0040cdb0
mov ebx, eax
test ebx, ebx
jle 0x70fdc2
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040cc5c
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x70ff1c
call fcn.0040cdb0
mov ebx, eax
test ebx, ebx
jle 0x70fdee
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040cc5c
mov eax, dword [ebp - 4]
test eax, eax
je 0x70fdf8
mov eax, dword [eax - 4]
inc eax
call fcn.0043122c
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00430f6c
lea eax, [ebp - 0xc]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
mov eax, dword [ebp - 8]
call fcn.0040b8b4
test edi, edi
jle 0x70feb5
lea eax, [edi + 1]
call fcn.0043122c
mov esi, eax
push esi
push edi
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x70feae
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x70ff20
push esi
call sub.version.dll_VerQueryValueW
mov edi, dword [ebp - 0x10]
mov eax, dword [edi + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
movzx eax, word [edi + 8]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
mov eax, dword [ebp - 0x1c]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, word [edi + 0xc]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x40]
mov ecx, 3
mov eax, 0x70ff30
call fcn.004313e8
mov eax, esi
call fcn.0043126c
mov eax, ebx
call fcn.0043126c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70fee3
lea eax, [ebp - 0x20]
call fcn.0040b8b4
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x710238
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x7103d8
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
mov edx, 0x7103f4
call fcn.0040bcec
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x710284
bt dword [ebp - 0xc], eax
jae 0x71038b
mov edx, ebx
add dx, 0x61
mov eax, edx
mov ecx, edx
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x7102a3
mov eax, edx
and ax, 0xffdf
mov esi, eax
push dword [ebp - 4]
lea eax, [ebp - 0x24]
mov edx, esi
call fcn.0040c844
push dword [ebp - 0x24]
push 0x710404
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040cb14
push dword [ebp - 4]
lea edx, [ebp - 0x28]
mov eax, esi
call fcn.00710744
push dword [ebp - 0x28]
push 0x710404
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040cb14
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.0071014c
test al, al
jne 0x710332
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push dword [ebp - 4]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0x2c]
call fcn.0042fdb0
push dword [ebp - 0x2c]
push 0x710404
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040cb14
push dword [ebp - 4]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x30]
call fcn.0042fdb0
push dword [ebp - 0x30]
push 0x710404
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040cb14
lea eax, [ebp - 4]
mov edx, 0x710414
call fcn.0040ca34
inc ebx
cmp ebx, 0x1a
jne 0x710279
cmp dword [ebp - 4], 0
jne 0x7103a8
lea eax, [ebp - 4]
mov edx, 0x710424
call fcn.0040bcec
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040bca4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7103df
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.0040b914
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax

Function at 0x710428
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf0
mov ebx, eax
mov eax, ebx
mov edx, 0x710490
call fcn.0040bca4
push esp
push 0
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [esp], 0
je 0x71047c
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x71047c
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.0040c8d8
add esp, 0x210
pop ebx
ret
Function at 0x710744
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x710844
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040b8b4
xor eax, eax
push ebp
push 0x710802
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.0040c844
lea eax, [ebp - 0x18]
mov edx, 0x710860
call fcn.0040ca34
mov eax, dword [ebp - 0x18]
call fcn.0040c824
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x7107f8
lea ecx, [ebp - 0x1c]
movzx eax, word [ebp - 0xc]
mov edx, 4
call fcn.0042ff18
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
shr eax, 0x10
movzx eax, ax
mov edx, 4
call fcn.0042ff18
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
pop ecx
call fcn.0040ca8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp fcn.00710814

Function at 0x715ef8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x715fd0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040bcec
lea eax, [ebp - 4]
call fcn.0040be90
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x715fb8
mov eax, ebx
call fcn.00407160
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x715fb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x715f99
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x715fe0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x715f99
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x715fb8
mov eax, dword [ebp - 0x10]
call fcn.0040717c
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x715fd7
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x7240c4
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff2c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xd4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x72425a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xd0]
mov eax, esi
call fcn.007247d4
mov eax, ebx
call fcn.005050bc
dec al
je 0x724108
dec al
je 0x724111
jmp 0x72411a
mov byte [ebp - 0xb7], 2
jmp 0x724121
mov byte [ebp - 0xb7], 1
jmp 0x724121
mov byte [ebp - 0xb7], 0
mov eax, dword [ebp - 0xcc]
or eax, 0x80000000
or eax, 1
or eax, 2
or eax, 4
or eax, 8
or eax, 0x20000000
or eax, 0x40000000
mov dword [ebp - 0xcc], eax
mov eax, ebx
call fcn.00505028
shl eax, 2
lea eax, [eax + eax*4]
mov dword [ebp - 0xc4], eax
mov edi, dword [ebx + 0x18]
cmp edi, 0xff000008
je 0x72416e
cmp edi, 0x20000000
jne 0x72417a
or dword [ebp - 0xc8], 0x40000000
jmp 0x724187
mov eax, edi
call fcn.00504550
mov dword [ebp - 0xbc], eax
mov eax, ebx
call fcn.00505070
test al, 1
je 0x724199
or dword [ebp - 0xc8], 1
mov eax, ebx
call fcn.00505070
test al, 2
je 0x7241ab
or dword [ebp - 0xc8], 2
mov eax, ebx
call fcn.00505070
test al, 4
je 0x7241bd
or dword [ebp - 0xc8], 4
mov eax, ebx
call fcn.00505070
test al, 8
je 0x7241cf
or dword [ebp - 0xc8], 8
lea edx, [ebp - 0xd4]
mov eax, ebx
call fcn.00504fb4
mov edx, dword [ebp - 0xd4]
lea eax, [ebp - 0xb6]
mov ecx, 0x40
call fcn.00430f94
or dword [ebp - 0xcc], 0x8000000
mov eax, ebx
call fcn.00505144
mov byte [ebp - 0xb8], al
lea eax, [ebp - 0x5c]
push eax
push 0x5c
mov eax, ebx
call fcn.00504d20
push eax
call sub.gdi32.dll_GetObjectW
test eax, eax
je 0x724232
or dword [ebp - 0xcc], 0x400000
movzx eax, word [ebp - 0x4c]
mov word [ebp - 0x76], ax
lea edx, [ebp - 0xd0]
mov eax, esi
call fcn.00724834
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x724261
lea eax, [ebp - 0xd4]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x725a1c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, 0x8cb90c
xor eax, eax
push ebp
push 0x725bd0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x96d1b4], 1
mov edx, 0x8000
mov eax, 0x725bec
call fcn.0043b6f4
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x725a67
cmp dword [ebx], 0x20
jae 0x725a67
xor eax, eax
mov dword [ebx], eax
jmp 0x725a71
mov dword [0x96d1b4], 4
cmp dword [ebx], 0
jne 0x725aa1
mov edx, 0x8000
mov eax, 0x725c14
call fcn.0043b6f4
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x725a97
cmp dword [ebx], 0x20
jae 0x725a97
xor eax, eax
mov dword [ebx], eax
jmp 0x725aa1
mov dword [0x96d1b4], 2
cmp dword [ebx], 0
jne 0x725adc
mov dword [0x96d1b4], 1
mov edx, 0x8000
mov eax, 0x725c3c
call fcn.0043b6f4
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x725bb8
cmp dword [ebx], 0x20
jae 0x725bb8
xor eax, eax
mov dword [ebx], eax
jmp 0x725bb8
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.0043ab00
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040c824
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x725bb8
mov eax, ebx
call fcn.00407160
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x725bb1
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x725b99
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x725c58
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x725b99
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov eax, ecx
and eax, 0xffff0000
cmp eax, 0x50000
jne 0x725b75
and ecx, 0xffff
mov eax, 0xcccccccd
mul ecx
shr edx, 3
mov dword [0x96d1b4], edx
jmp 0x725b86
cmp eax, 0xc0000
jne 0x725b86
mov dword [0x96d1b4], 6
cmp dword [0x96d1b4], 0
jne 0x725b99
mov dword [0x96d1b4], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x725bb8
mov eax, dword [ebp - 0xc]
call fcn.0040717c
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x725bd7
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x7304c0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov byte [ebp - 1], 0
xor edx, edx
push ebp
push 0x7305b4
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x730513
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x730513
lea eax, [ebp - 8]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x7305aa
mov eax, 0x400
call fcn.00407160
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x400
push esi
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x7305a3
mov dword [ebp - 0x14], 0x8cb924
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x73059a
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x730596
mov byte [ebp - 1], 1
jmp 0x73059a
inc edi
dec ebx
jne 0x73057e
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.0040717c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7305c2
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7305d8
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
xor edx, edx
push ebp
push 0x7306e1
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x58]
push eax
call sub.kernel32.dll_GetStartupInfoW
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_WTSGetActiveConsoleSessionId
push eax
call sub.WTSAPI32.DLL_WTSQueryUserToken
test eax, eax
je 0x7306d7
xor edx, edx
push ebp
push 0x7306cb
push dword fs:[edx]
mov dword fs:[edx], esp
or esi, 0xffffffff
test esi, esi
je 0x7306c1
mov eax, 0x400
call fcn.00407160
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0x400
push edi
push 2
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
test esi, esi
je 0x7306ba
mov dword [ebp - 0x14], 0x8cb924
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
mov esi, dword [edi]
dec esi
test esi, esi
jl 0x7306b1
inc esi
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [edi + eax*8 + 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x7306ab
mov bl, 1
jmp 0x7306b1
inc dword [ebp - 0x10]
dec esi
jne 0x730692
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, edi
call fcn.0040717c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7306d7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7306ed
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7309c8
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x7309d0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x730ca2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040b8d8
xor edx, edx
push ebp
push 0x730ad4
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.DLL_WTSEnumerateSessionsW
test eax, eax
jne 0x730a1e
call fcn.0043ab30
xor edx, edx
push ebp
push 0x730ac3
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0x14], 0
jbe 0x730aaa
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
dec esi
test esi, esi
jb 0x730aaa
inc esi
cmp byte [ebx + 8], 0
jne 0x730aa4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 5
mov eax, dword [ebx]
push eax
push 0
call sub.WTSAPI32.DLL_WTSQuerySessionInformationW
test eax, eax
je 0x730aa4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x730aa4
cmp word [eax], 0
je 0x730aa4
cmp dword [ebp - 4], 0
je 0x730a7c
lea eax, [ebp - 4]
mov edx, 0x730cbc
call fcn.0040c0e8
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov ecx, 0
call fcn.0040c038
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.0040c0e8
lea eax, [ebp - 8]
mov edx, 0x730ccc
call fcn.0040bd94
add ebx, 0xc
dec esi
jne 0x730a3e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x730aca
mov eax, dword [ebp - 0x10]
push eax
call sub.WTSAPI32.DLL_WTSFreeMemory
pop eax
jmp eax

Function at 0x731320
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x73134d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x73135c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret