joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp + 8]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 4]
push ecx
push 0x1000
push edx
push ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x401644
cmp eax, 0x3e5
je 0x401644
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x401684
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x401662
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov dword [ebp - 4], 0
jmp 0x40168b
push 1
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x18]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x40168b
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x401696
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402700
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0x206
mov dword [ebp - 0xc], 1
test edi, edi
je 0x402766
test esi, esi
je 0x402766
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
push str.SoftwareIntelServicesDAL
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402766
lea ecx, [ebp - 4]
push ecx
push esi
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 8]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402766
mov eax, dword [ebp - 4]
shr eax, 1
cmp word [esi + eax*2], 0
je 0x40276c
xor ecx, ecx
mov word [esi + eax*2], cx
xor al, al
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x402780
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
test esi, esi
je 0x4027db
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push str.SoftwareIntelServicesDAL
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4027db
lea ecx, [ebp - 8]
push ecx
push esi
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 4]
push str.JHI_LOG
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4027e1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x402800
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20106
push 0
push str.SoftwareIntelServicesDAL
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402859
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push eax
push str.JHI_SERVICE_PORT
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40284f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x501
mov esp, ebp
pop ebp
ret

Function at 0x402870
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20106
push 0
push str.SoftwareIntelServicesDAL
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4028c9
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push eax
push str.JHI_ADDRESS_TYPE
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4028bf
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x501
mov esp, ebp
pop ebp
ret
Function at 0x40ae10
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b0c0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x425018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
sub esp, 8
mov eax, esp
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], esp
mov dword [eax], 0
mov dword [eax + 4], 0
push eax
lea eax, [ebp + 0x10]
call fcn.0040b7d0
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.0040abe0
lea edi, [esi + 0x18]
push edi
mov byte [ebp - 4], 1
push 0x202
mov dword [esi], vtable.intel_dal::CommandsServerSocketsWin32.0
mov dword [esi + 0x1a8], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40aeb2
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp + 0xc], str.WSAStartup_failed
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x42047c
lea edx, [ebp - 0x1c]
push edx
call sub.MSVCR100.dll__CxxThrowException
cmp byte [edi], 2
jne 0x40aee1
cmp byte [edi + 1], 2
jne 0x40aee1
lea eax, [ebp + 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.0040e220
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp + 0xc], str.Could_not_find_a_usable_version_of_Winsock.dll
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x42047c
lea ecx, [ebp - 0x1c]
push ecx
call sub.MSVCR100.dll__CxxThrowException
int3
Function at 0x40b2c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
test edi, edi
je 0x40b2fa
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_recv]
mov ecx, dword [ebp + 0xc]
push 0
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp + 8]
lea edx, [esi + ecx]
push edx
push eax
call ebx
cmp eax, 0xffffffff
je 0x40b2f4
test eax, eax
je 0x40b2f4
add esi, eax
cmp esi, edi
jne 0x40b2d1
pop ebx
mov eax, esi
pop esi
pop ebp
ret
mov eax, esi
pop esi
pop ebp
ret

Function at 0x40b300
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
test edi, edi
je 0x40b336
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp + 0xc]
push 0
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp + 8]
lea edx, [esi + ecx]
push edx
push eax
call ebx
cmp eax, 0xffffffff
je 0x40b330
add esi, eax
cmp esi, edi
jne 0x40b311
pop ebx
mov eax, esi
pop esi
pop ebp
ret
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40b630
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ad78
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x425018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x14
mov dword [ebp - 4], ebx
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
cmp eax, ebx
je 0x40b67f
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov edi, eax
jmp 0x40b681
xor edi, edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
mov dword [edi], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
add eax, 0x10
push ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.0040b7d0
mov esi, dword [edi + 8]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov dword [edi + 8], eax
mov dword [edi + 4], edx
cmp esi, ebx
je 0x40b6de
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x40b6de
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x40b6de
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
mov eax, dword [ebp + 8]
push eax
lea esi, [ebp - 0x20]
call fcn.0040ad00
lea esi, [ebp - 0x18]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 4], 2
cmp esi, eax
je 0x40b706
mov ecx, dword [eax + 4]
mov dword [eax + 4], ebx
mov edx, dword [eax]
mov dword [eax], ebx
mov esi, dword [edi + 0x10]
mov dword [edi + 0x10], ecx
mov dword [edi + 0xc], edx
cmp esi, ebx
je 0x40b73c
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x40b73c
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
lea eax, [esi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x40b73c
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
je 0x40b773
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x40b773
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
lea eax, [esi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x40b773
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
push ebx
push ebx
push edi
push 0x40b340
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x40b78e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40d010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x40d04f
mov eax, dword [ebp - 4]
push 0
and eax, 0xffff02ff
lea ecx, [ebp - 8]
push ecx
or eax, 0x2ff
push 4
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40d058
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
mov edx, esi
call fcn.0040d090
test al, al
setne al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40d090
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a9f0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x425018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov edi, edx
xor ecx, ecx
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x18], ecx
cmp ebx, ecx
je 0x40d141
mov eax, dword [edi + 0x10]
cmp eax, ecx
je 0x40d141
push eax
mov dword [ebp - 4], ecx
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
mov eax, dword [edi + 0x10]
add esp, 4
push eax
push 0
push esi
call sub.MSVCR100.dll_memset
mov eax, dword [edi + 0x10]
mov edi, dword [edi + 0xc]
add esp, 0xc
push 0
lea ecx, [ebp - 0x18]
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d133
cmp byte [esi + 3], 0
jne 0x40d133
movzx edx, word [esi + 6]
mov word [ebx], dx
mov ax, word [esi + 4]
mov word [ebx + 2], ax
mov cx, word [esi + 0xa]
mov word [ebx + 4], cx
movzx edx, word [esi + 8]
mov word [ebx + 6], dx
mov byte [ebp - 0x11], 1
test esi, esi
je 0x40d141
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40dcc0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41c9be
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x425018]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x425018]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
test byte [0x425c0c], 1
jne 0x40dd29
or dword [0x425c0c], 1
mov dword [esp + 0x70], 0
call fcn.0040d580
push 0x41cf70
call fcn.00419c3d
add esp, 4
mov dword [esp + 0x70], 0xffffffff
cmp byte [0x425c14], 0
je 0x40dd39
xor eax, eax
jmp 0x40debf
call fcn.004174d0
test al, al
jne 0x40dd80
push 0x41ef14
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40dd76
push 0
push 0
push 0
push 0
push 0
push 0xc0000005
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, 0x300
jmp 0x40debf
call fcn.0040d870
test eax, eax
jne 0x40debf
call fcn.00403e40
cmp byte [eax + 5], 0
je 0x40ddb6
push 0x1010
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_n
call fcn.00401000
add esp, 0x10
lea esi, [esp + 0x48]
call fcn.0040dc60
test al, al
jne 0x40dddc
push 0xc0000005
push 1
call fcn.0040c2a0
add esp, 8
mov eax, 0x300
jmp 0x40debf
call fcn.00403e40
mov esi, eax
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x18
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esi + 0x74]
push 0x18
push edx
call dword [sym.imp.MSVCR100.dll_memcpy_s]
mov eax, dword [esi]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea edi, [esp + 0x48]
lea esi, [esp + 0x14]
call fcn.00415330
mov edi, eax
test edi, edi
jne 0x40de93
call fcn.00403e40
mov ebx, eax
mov ecx, dword [ebx]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebx]
lea edi, [ebx + 0x40]
mov ecx, 0xd
push edx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esp + 0x44]
push eax
call dword [esp + 0x18]
mov edi, eax
add esp, 4
test edi, edi
jne 0x40de93
call fcn.00409030
mov edi, eax
call fcn.00402aa0
test al, al
jne 0x40de6e
mov edi, 0x601
jmp 0x40de93
call fcn.0040aa90
mov ecx, eax
call fcn.0040c620
mov edi, eax
test edi, edi
jne 0x40de93
call fcn.0040f9e0
push 1
call fcn.00403e40
mov esi, eax
call fcn.0040d840
call fcn.00403e40
cmp byte [eax + 5], 0
je 0x40debd
push edi
push 0x1011
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_RET:_0x_08x_n
call fcn.00401000
add esp, 0x14
mov eax, edi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00419b16
mov esp, ebp
pop ebp
ret
Function at 0x40f210
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x425018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40f2f4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x40f2f4
push 0xffffffffffffffff
push 0x41ef7c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR100.dll_wcsncat_s]
add esp, 0x10
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40f2f4
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40f2a0
sub eax, edx
sar eax, 1
push edi
lea edi, [eax + 1]
lea edx, [edi + edi]
push edx
call fcn.00401700
mov esi, eax
add esp, 4
test esi, esi
je 0x40f305
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
test eax, eax
mov eax, esi
je 0x40f307
call fcn.00401770
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419b16
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419b16
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00419b16
mov esp, ebp
pop ebp
ret

Function at 0x40fe20
Capabilities:
Access the windows event log
Create thread

Disassembly:
push esi
push 0
push 0
push 0
push 0x40fe10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x41ef14
push 0
mov dword [0x425d00], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40fe6f
push 0
push 0
push 0
push 0
push 0
push 0x40000000
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
ret

Function at 0x40fe80
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c55e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x425018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x427dec]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov eax, dword [0x425d00]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov dword [0x425d00], 0
test byte [0x425c0c], al
jne 0x40fefa
or dword [0x425c0c], eax
mov dword [ebp - 4], 0
call fcn.0040d580
push 0x41cf70
call fcn.00419c3d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [0x425c14], 0
je 0x40ff08
call fcn.0040def0
push 0x41ef14
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40ff3c
push 0
push 0
push 0
push 0
push 0
push 0x40000001
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414a05
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x414a40
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x414a27
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x414a38
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x414a42
inc edi
add eax, 0x28
cmp edi, esi
jb 0x414a1d
xor eax, eax
pop edi
pop esi
ret

Function at 0x414c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
invalid
cmp dword [ebp - 8], eax
jae 0x414c19
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x414c0a
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.004149c5
push edi
and ch, byte [0xa8458dc6]
push eax
call fcn.004149d5
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0041498a
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x414cb3
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
invalid
inc ebp
Function at 0x419b16
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425018]
jne 0x419b20
repz ret
jmp fcn.0041a018
Function at 0x418575
Capabilities:
Write file on windows

Disassembly:
push 0xe8
mov eax, 0x44c0c0
call fcn.00426584
mov esi, ecx
mov ebx, dword [ebp + 8]
and dword [ebp - 4], 0
push ecx
push ecx
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xf4], 0x460650
call fcn.00402ff8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xec]
mov eax, dword [ebp - 0xec]
push 0
mov eax, dword [eax + 4]
add ecx, eax
push dword [ecx + 0xc]
mov dword [ecx + 0x10], 6
call fcn.00402426
mov dword [ebp - 4], 2
lea eax, [ebp - 0xf4]
push dword [esi + 4]
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x30], eax
call fcn.0041d618
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe8]
call fcn.00403cbb
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0041afce
cmp dword [ebp - 0x18], 0
jne 0x41861f
mov esi, 0x45dc00
push esi
call fcn.0042c780
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403b2d
push ecx
push ecx
mov edx, ebx
lea ecx, [ebp - 0x3c]
call fcn.0041aef5
pop ecx
pop ecx
mov cl, byte [eax + 4]
mov edi, dword [eax]
mov byte [eax + 4], 0
mov dword [ebp - 0x44], edi
mov byte [ebp - 0x40], cl
mov byte [ebp - 4], 4
cmp byte [ebp - 0x38], 0
je 0x418659
cmp dword [ebp - 0x3c], 0
mov byte [ebp - 0x38], 0
je 0x418659
push dword [ebp - 0x3c]
call fcn.0042d7c9
pop ecx
mov edx, ebx
test edi, edi
jne 0x4186d2
lea ecx, [ebp - 0x34]
call fcn.0041aeae
mov cl, byte [eax + 4]
mov ebx, dword [eax]
mov byte [ebp - 0x29], cl
mov byte [eax + 4], 0
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x38], cl
mov byte [ebp - 4], 5
cmp byte [ebp - 0x30], 0
je 0x418696
cmp dword [ebp - 0x34], 0xffffffff
mov byte [ebp - 0x30], 0
je 0x418696
push dword [ebp - 0x34]
call fcn.0042f426
pop ecx
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push 0x132
push esi
push eax
push ebx
call fcn.0042fcc8
add esp, 0xc
mov edx, esi
mov ecx, eax
call fcn.0041989d
cmp byte [ebp - 0x29], 0
pop ecx
je 0x41873e
cmp ebx, 0xffffffff
je 0x41873e
push ebx
call fcn.0042f426
pop ecx
jmp 0x41873e
lea eax, [ebp - 0x44]
push eax
push ecx
lea ecx, [ebp - 0x34]
call fcn.0041af20
pop ecx
pop ecx
mov bl, byte [eax + 4]
mov esi, dword [eax]
mov byte [eax + 4], 0
mov dword [ebp - 0x3c], esi
mov byte [ebp - 0x38], bl
mov byte [ebp - 4], 6
cmp byte [ebp - 0x30], 0
je 0x41870d
cmp dword [ebp - 0x34], 0
mov byte [ebp - 0x30], 0
je 0x41870d
push dword [ebp - 0x34]
call fcn.0042d7c9
pop ecx
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push 1
push dword [ebp - 0x18]
push eax
call fcn.0042dda6
add esp, 0x10
cmp eax, 1
jne 0x41876a
test bl, bl
je 0x41873b
test esi, esi
je 0x41873b
push esi
call fcn.0042d7c9
pop ecx
mov edi, dword [ebp - 0x44]
cmp byte [ebp - 0x40], 0
je 0x41874f
test edi, edi
je 0x41874f
push edi
call fcn.0042d7c9
pop ecx
lea ecx, [ebp - 0x28]
call fcn.00403a8e
lea ecx, [ebp - 0xec]
call fcn.004025f1
call fcn.0042652e
ret 4
push 0x132
lea ecx, [ebp - 0x54]
call fcn.00415f92
push 0x46a42c
lea eax, [ebp - 0x54]
push eax
call fcn.0042906d
int3
Function at 0x419fa1
Capabilities:
Read file on windows

Disassembly:
push 0x2c
mov eax, 0x44c447
call fcn.00426550
mov eax, edx
mov edi, ecx
mov dword [ebp - 0x14], edi
push ecx
mov edx, 0x4605e8
mov ecx, eax
call fcn.0041ce7a
mov esi, eax
mov ecx, esi
call fcn.0041b208
pop ecx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], 1
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push 0x100001
mov ecx, eax
call fcn.0040ab53
push esi
mov ebx, 0x100000
push ebx
push 1
push dword [ebp - 0x28]
call fcn.0042e39c
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp eax, ebx
ja 0x41a07c
push esi
call fcn.004336cf
pop ecx
test eax, eax
je 0x41a021
push 0x133
jmp 0x41a081
push esi
call fcn.004336a3
pop ecx
test eax, eax
jne 0x41a033
push 0x13b
jmp 0x41a081
mov ebx, dword [ebp - 0x28]
mov ecx, ebx
mov edx, dword [ebp - 0x10]
call fcn.00419f6d
mov ecx, dword [ebp - 0x10]
and dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea eax, [ebx + ecx]
cmp ebx, eax
je 0x41a061
push ecx
push ebx
mov ecx, edi
call fcn.00403b2d
lea ecx, [ebp - 0x28]
call fcn.00406581
test esi, esi
je 0x41a074
push esi
call fcn.0042d7c9
pop ecx
mov eax, edi
call fcn.00426519
ret
push 0xc8
lea ecx, [ebp - 0x38]
call fcn.00415f92
push 0x46a42c
lea eax, [ebp - 0x38]
push eax
call fcn.0042906d
int3