joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401de0
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x42ac78
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x437368]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 1
push 0x42e888
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x401e51
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, 0x42e8a8
lea ebx, [esp + 0x18]
call fcn.0040a2d0
add esp, 4
push eax
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x68], esi
call fcn.0040a6e0
push 0x4340d8
lea ecx, [esp + 0x34]
push ecx
call fcn.004166ab
mov edx, dword [esp + 0x68]
push 2
add edx, 0xc
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea ecx, [esp + 0x10]
push ecx
mov edi, eax
mov eax, dword [esp + 0x70]
push 1
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x54
ret 8

Function at 0x401ea0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42ac48
mov eax, dword fs:[0]
push eax
sub esp, 0x90
push ebx
push esi
push edi
mov eax, dword [0x437368]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov edi, ecx
push 1
push 0x42e888
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x401f22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, 0x42e8a8
lea ebx, [esp + 0x40]
call fcn.0040a2d0
add esp, 4
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0xb0], esi
call fcn.0040a6e0
push 0x4340d8
lea ecx, [esp + 0x18]
push ecx
call fcn.004166ab
push 0x10000
add edi, 0xc
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x401f7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
mov ecx, 0x42e8c4
lea ebx, [esp + 0x40]
call fcn.0040a2d0
add esp, 4
push eax
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0xb0], 1
call fcn.0040a6e0
push 0x4340d8
lea eax, [esp + 0x18]
push eax
call fcn.004166ab
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x401fd7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call edi
push esi
call edi
push ebx
mov ecx, 0x42e908
lea ebx, [esp + 0x84]
call fcn.0040a2d0
add esp, 4
push eax
lea ecx, [esp + 0x5c]
push ecx
mov dword [esp + 0xb0], 2
call fcn.0040a6e0
push 0x4340d8
lea edx, [esp + 0x5c]
push edx
call fcn.004166ab
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402b10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42abd8
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push ebx
push esi
push edi
mov eax, dword [0x437368]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov eax, dword [0x439800]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push 0
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
push 0x402590
push 0
push 0
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x402bb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, 0x42e984
lea ebx, [esp + 0x70]
call fcn.0040a2d0
add esp, 4
push eax
lea ecx, [esp + 0x48]
push ecx
mov dword [esp + 0xe0], esi
call fcn.0040a6e0
push 0x4340d8
lea edx, [esp + 0x48]
push edx
call fcn.004166ab
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea esp, [esp]
push 0x3e8
push esi
call edi
cmp eax, 0x102
je 0x402bc0
test eax, eax
je 0x402c19
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov ecx, 0x42e9fc
lea ebx, [esp + 0x70]
call fcn.0040a2d0
add esp, 4
push eax
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0xe0], 1
call fcn.0040a6e0
push 0x4340d8
lea ecx, [esp + 0x48]
push ecx
call fcn.004166ab
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x402c78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov ecx, 0x42e9fc
lea ebx, [esp + 0xb4]
call fcn.0040a2d0
add esp, 4
push eax
lea eax, [esp + 0x8c]
push eax
mov dword [esp + 0xe0], 2
call fcn.0040a6e0
push 0x4340d8
lea ecx, [esp + 0x8c]
push ecx
call fcn.004166ab
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x402cd5
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push eax
push eax
push eax
lea edx, [esp + 0x34]
push edx
call esi
test eax, eax
je 0x402cca
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [esp + 0x28]
push eax
call edi
lea ecx, [esp + 0x28]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [esp + 0x34]
push edx
call esi
test eax, eax
jne 0x402ca7
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx]
mov edx, dword [eax + 0x1c]
mov ecx, ebx
call edx
xor eax, eax
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4088c0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42b353
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x437368]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push edi
mov eax, dword [0x437368]
xor eax, esp
push eax
lea eax, [esp + 0x128]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push eax
mov esi, edx
push ecx
lea edx, [esp + 0xbc]
push edx
call fcn.004090d0
lea eax, [esp + 0xb4]
push eax
mov dword [esp + 0x134], 0
call fcn.004092d0
mov edi, eax
test edi, edi
je 0x408a0b
lea ecx, [esp + 0x2c]
push ecx
call fcn.004041d0
push 0x42f120
push ecx
push edi
push ecx
lea edx, [esp + 0x44]
push 0x42f13c
push edx
mov byte [esp + 0x148], 1
call fcn.004072c0
add esp, 0xc
push eax
call fcn.00403d10
add esp, 4
push eax
call fcn.004072c0
add esp, 8
test esi, esi
je 0x4089dc
lea ecx, [esp + 0x10]
lea eax, [esp + 0x2c]
call fcn.00404300
mov edi, 8
cmp dword [eax + 0x18], edi
jb 0x408996
mov eax, dword [eax + 4]
jmp 0x408999
add eax, 4
cmp byte [esi], 0
je 0x4089c9
mov ecx, dword [esi + 0x210]
push 0
mov dword [esp + 0x10], eax
mov edx, dword [ecx]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 0x20c]
push 0
push 1
push edx
push 0
push 0x67
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp dword [esp + 0x28], edi
jb 0x4089dc
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00414041
add esp, 4
lea ecx, [esp + 0x80]
mov byte [esp + 0x130], 0
call fcn.00404270
lea edx, [esp + 0x80]
push edx
mov dword [esp + 0x84], 0x42ecf0
call fcn.00413b15
add esp, 4
lea esi, [esp + 0xb4]
call fcn.00409240
mov ecx, dword [esp + 0x128]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00414002
mov esp, ebp
pop ebp
ret
Function at 0x408a40
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42aae0
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
push ebx
push esi
push edi
mov eax, dword [0x437368]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x408ac7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, 0x42f168
lea ebx, [esp + 0x50]
call fcn.0040a2d0
add esp, 4
push eax
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0xc0], 0
call fcn.0040a6e0
push 0x4340d8
lea edx, [esp + 0x28]
push edx
call fcn.004166ab
lea eax, [esp + 0x18]
push eax
push 0x42f18c
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x408b27
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov ecx, 0x42f1b4
lea ebx, [esp + 0x50]
call fcn.0040a2d0
add esp, 4
push eax
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0xc0], 1
call fcn.0040a6e0
push 0x4340d8
lea eax, [esp + 0x28]
push eax
call fcn.004166ab
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push 0
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], 2
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov esi, eax
test esi, esi
je 0x408ba1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov ecx, 0x42f1e0
lea ebx, [esp + 0x50]
call fcn.0040a2d0
add esp, 4
push eax
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0xc0], 2
call fcn.0040a6e0
push 0x4340d8
lea edx, [esp + 0x28]
push edx
call fcn.004166ab
mov eax, dword [ebp + 8]
push 0x40001
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
test eax, eax
jne 0x408c05
call ebx
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov ecx, 0x42f20c
lea ebx, [esp + 0x94]
call fcn.0040a2d0
add esp, 4
push eax
lea edx, [esp + 0x6c]
push edx
mov dword [esp + 0xc0], 3
call fcn.0040a6e0
push 0x4340d8
lea eax, [esp + 0x6c]
push eax
call fcn.004166ab
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
push 0
push eax
mov dword [esp + 0x38], 0
call edi
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408c50
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x437368]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
push ebx
lea eax, [esp + 8]
push 0x104
push eax
call fcn.00414067
push 0x42f240
lea ecx, [esp + 0x14]
push 0x104
push ecx
call fcn.0041446b
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 0x18
lea edx, [esp + 4]
push edx
push esi
push edi
push 0x42e604
call ebp
cmp eax, esi
jne 0x408cae
push ebx
push esi
push edi
push 0x42e604
call ebp
mov ecx, dword [esp + 0x20c]
pop ebp
xor ecx, esp
call fcn.00414002
add esp, 0x20c
ret

Function at 0x408e60
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x450
mov eax, dword [0x437368]
xor eax, esp
mov dword [esp + 0x44c], eax
push ebp
push esi
push 0x104
lea eax, [esp + 0x250]
push eax
xor ebp, ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor esi, esi
cmp edi, ebp
mov word [esp + 0x44], bp
jle 0x408ec8
mov ecx, dword [ebx + esi*4]
push ecx
lea edx, [esp + 0x48]
push 0x104
push edx
call fcn.0041446b
push 0x42f250
lea eax, [esp + 0x54]
push 0x104
push eax
call fcn.0041446b
add esi, 1
add esp, 0x18
cmp esi, edi
jl 0x408e97
push 0x42eb34
lea ecx, [esp + 0x48]
push 0x104
push ecx
call fcn.0041446b
add esp, 0xc
lea ecx, [esp + 8]
lea edx, [esp + 0x24c]
lea eax, [esp + 0x44]
push ecx
mov dword [esp + 0xc], 0x3c
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 0x42f254
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], 3
mov dword [esp + 0x2c], ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [esp + 0x454]
pop esi
pop ebp
xor ecx, esp
call fcn.00414002
add esp, 0x450
ret
Function at 0x409560
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a9f0
mov eax, dword fs:[0]
push eax
sub esp, 0x860
mov eax, dword [0x437368]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
push 0
push 0x80
push 3
push 0
push 1
push 1
mov ebx, ecx
push eax
mov dword [ebp - 0x844], ebx
mov dword [ebp - 0x84c], 0x824
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4095ec
mov ecx, dword [ebp - 0x84c]
push 0
lea eax, [ebp - 0x84c]
push eax
push ecx
lea edx, [ebp - 0x840]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push esi
jne 0x40960f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x5e2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00414002
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x84c]
test eax, eax
jne 0x409626
mov eax, 0x5e3
jmp 0x4095f1
mov byte [ebp + eax - 0x840], 0
lea eax, [ebp - 0x840]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x409637
sub eax, edx
lea eax, [eax + eax*2 + 1]
mov dword [ebp - 0x848], eax
add eax, 0x35
push eax
call fcn.004134ab
add esp, 4
cmp dword [0x439808], 0
mov edi, eax
mov dword [ebp - 0x850], edi
jne 0x40966e
call fcn.0040ad70
cmp dword [0x438268], 8
mov eax, dword [0x438254]
jae 0x409681
mov eax, 0x438254
push eax
lea eax, [ebp - 0x86c]
push eax
call fcn.0040a030
mov esi, 0x10
add esp, 8
cmp dword [eax + 0x18], esi
jb 0x4096a0
mov eax, dword [eax + 4]
jmp 0x4096a3
add eax, 4
push eax
push 0x42f388
push 0x36
push edi
call fcn.0041450b
add esp, 0x10
cmp dword [ebp - 0x854], esi
jb 0x4096cb
mov ecx, dword [ebp - 0x868]
push ecx
call fcn.00414041
add esp, 4
lea eax, [edi + 0x35]
test eax, eax
mov dword [ebp - 0x854], 0xf
mov dword [ebp - 0x858], 0
mov byte [ebp - 0x868], 0
jne 0x409707
lea eax, [ebp - 0x840]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4096f6
sub eax, edx
lea eax, [eax + eax*2 + 1]
jmp 0x409727
lea edx, [ebp - 0x848]
mov ebx, eax
push edx
lea eax, [ebp - 0x840]
call fcn.004097b0
mov eax, dword [ebp - 0x848]
mov ebx, dword [ebp - 0x844]
mov dword [ebp - 4], 0
cmp dword [ebx + 0x40], 8
lea ecx, [eax + 0x34]
jb 0x40973c
mov eax, dword [ebx + 0x2c]
jmp 0x40973f
lea eax, [ebx + 0x2c]
lea edx, [ebp - 0x848]
push edx
lea edx, [ebp - 0x844]
push edx
mov edx, dword [ebx + 0x48]
push ecx
movzx ecx, word [ebx + 0x44]
push edi
push 0x42f39c
push ecx
push eax
push 0x42e6f4
push edx
push ebx
call fcn.00409b40
push edi
mov esi, eax
call fcn.00414062
add esp, 4
cmp esi, 0xc8
jne 0x40978f
mov eax, dword [ebp - 0x844]
test eax, eax
je 0x40978f
push eax
call fcn.00414527
add esp, 4
mov eax, esi
jmp 0x4095f1
Function at 0x40a590
Capabilities:
Read .ini file

Disassembly:
test eax, eax
push ebp
mov ebp, dword [esp + 8]
je 0x40a5b2
mov ecx, dword [esi]
push ebp
push ecx
push eax
push 0
push 0x42fa54
push 0x42fa4c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
pop ebp
ret
push ebx
mov dword [esi], 0x20
push edi
lea ebx, [ebx]
mov eax, dword [esi]
add eax, eax
xor ecx, ecx
mov dword [esi], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004134ab
add esp, 4
push ebp
mov edi, eax
mov eax, dword [esi]
push eax
push edi
push 0
push 0x42fa54
push 0x42fa4c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push edi
mov ebx, eax
call fcn.00414062
mov ecx, dword [esi]
sub ecx, 2
add esp, 4
cmp ebx, ecx
jae 0x40a5c0
pop edi
pop ebx
xor eax, eax
pop ebp
ret

Function at 0x40a6e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x42a8e0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437368]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov eax, ebp
lea esi, [esp + 0x14]
call fcn.0040a160
xor ebx, ebx
mov esi, 0x10
mov dword [esp + 0x38], ebx
cmp dword [eax + 0x18], esi
jb 0x40a72f
mov eax, dword [eax + 4]
jmp 0x40a732
add eax, 4
lea ecx, [esp + 0x44]
push ecx
mov ecx, edi
mov dword [esp + 0x48], eax
call fcn.0041415f
mov byte [esp + 0x38], 2
cmp dword [esp + 0x2c], esi
jb 0x40a75a
mov edx, dword [esp + 0x18]
push edx
call fcn.00414041
add esp, 4
lea ecx, [edi + 0xc]
mov dword [edi], 0x42f660
push 0xffffffffffffffff
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push ebx
mov eax, ebp
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
mov word [ecx + 4], bx
call fcn.00401600
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8

Function at 0x40a910
Capabilities:
Access the windows event log

Disassembly:
push ecx
cmp byte [eax], 0
je 0x40a947
push 0
lea edx, [esp + 4]
push edx
push 0
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0x210]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x18]
mov eax, dword [eax + 0x20c]
push 1
push edx
mov edx, dword [esp + 0x1c]
push 0
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
pop ecx
ret 8
Function at 0x40a950
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42b30b
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x437368]
xor eax, esp
mov dword [esp + 0xa8], eax
push esi
mov eax, dword [0x437368]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
mov esi, ecx
call fcn.004041d0
push esi
lea esi, [esp + 0x18]
mov dword [esp + 0xc4], 0
call fcn.0040ba60
add esp, 4
lea ecx, [esp + 0x94]
lea eax, [esp + 0xc]
call fcn.00404300
mov eax, dword [esp + 0x98]
mov esi, 8
cmp dword [esp + 0xac], esi
jae 0x40a9de
lea eax, [esp + 0x98]
cmp byte [edi], 0
je 0x40aa10
mov edx, dword [edi + 0x210]
push 0
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push 0
push 1
mov dword [esp + 0x18], eax
mov eax, dword [edx]
mov edx, dword [edi + 0x20c]
push eax
push 0
push ecx
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp dword [esp + 0xac], esi
jb 0x40aa29
mov eax, dword [esp + 0x98]
push eax
call fcn.00414041
add esp, 4
lea ecx, [esp + 0x60]
mov dword [esp + 0xac], 7
mov dword [esp + 0xa8], 0
mov word [esp + 0x98], 0
mov dword [esp + 0xc0], 0xffffffff
call fcn.00404270
lea ecx, [esp + 0x60]
push ecx
mov dword [esp + 0x64], 0x42ecf0
call fcn.00413b15
add esp, 4
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.00414002
mov esp, ebp
pop ebp
ret 4
Function at 0x40ae60
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x42a30b
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x437368]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437368]
xor eax, esp
push eax
lea eax, [esp + 0x250]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x260]
xor edi, edi
push edi
push ebp
mov esi, ecx
mov dword [esp + 0x24], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
cmp ebx, edi
jne 0x40aeca
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov word [esi + 4], di
jmp 0x40b02b
lea eax, [ebx + 1]
push eax
call fcn.004134ab
mov edi, eax
lea eax, [ebx + 1]
push eax
push 0
push edi
call fcn.0041a130
add esp, 0x10
push edi
push ebx
xor ebx, ebx
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x40af0c
push edi
call fcn.00414062
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov word [esi + 4], bx
jmp 0x40b028
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x42f6c0
push edi
mov dword [esp + 0x24], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x40af43
push edi
call fcn.00414062
add esp, 4
mov edx, 0x42f668
mov eax, esi
call fcn.00401520
jmp 0x40b037
test dword [esp + 0x18], 0xfffffffc
jbe 0x40b012
mov eax, dword [esp + 0x1c]
movzx edx, word [eax + ebx*4 + 2]
movzx eax, word [eax + ebx*4]
push 0x42f6f4
push edx
push eax
push 0x42f714
lea ecx, [esp + 0x54]
push 0x104
push ecx
call fcn.00414046
add esp, 0x18
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x4c]
push ecx
push edi
call sub.VERSION.dll_VerQueryValueW
xor ebp, ebp
cmp eax, ebp
je 0x40b014
mov eax, dword [esp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40afa2
sub eax, edx
sar eax, 1
jne 0x40afc3
mov edx, dword [esp + 0x18]
add ebx, 1
shr edx, 2
cmp ebx, edx
jb 0x40af51
jmp 0x40b014
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x28]
call fcn.00401520
push edi
mov dword [esp + 0x25c], ebp
call fcn.00414062
add esp, 4
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebp
push ebp
lea eax, [esp + 0x30]
mov ecx, esi
mov word [esi + 4], bp
call fcn.00401600
cmp dword [esp + 0x40], 8
jb 0x40b037
mov eax, dword [esp + 0x2c]
push eax
call fcn.00414041
add esp, 4
jmp 0x40b037
xor ebp, ebp
push edi
call fcn.00414062
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebp
mov word [esi + 4], bp
add esp, 4
push 7
push 0x42f668
call fcn.00401560
mov eax, esi
mov ecx, dword [esp + 0x250]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.00414002
add esp, 0x248
ret
Function at 0x40b070
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x42a2d2
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x437368]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push edi
mov eax, dword [0x437368]
xor eax, esp
push eax
lea eax, [esp + 0x12c]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x134], edi
mov esi, ecx
mov dword [esp + 0xc], edi
push 7
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0x42f74c
mov dword [esp + 0x18], esi
mov word [esi + 4], di
call fcn.00401560
lea eax, [esp + 0x14]
mov dword [esp + 0x134], edi
push eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x18], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40b1bf
mov eax, dword [esp + 0x24]
sub eax, edi
je 0x40b1b3
sub eax, 1
je 0x40b173
sub eax, 1
jne 0x40b1bf
mov eax, dword [esp + 0x18]
cmp eax, 4
ja 0x40b133
push esi
mov edx, 0x42f75c
call fcn.00409880
jmp 0x40b1bf
cmp eax, 5
mov ecx, dword [esp + 0x1c]
jne 0x40b15f
cmp ecx, edi
jne 0x40b14d
push esi
mov edx, 0x42f774
call fcn.00409880
jmp 0x40b1bf
cmp ecx, 1
jne 0x40b164
push esi
mov edx, 0x42f790
call fcn.00409880
jmp 0x40b1bf
jb 0x40b1bf
cmp ecx, 1
jbe 0x40b1bf
push esi
mov edx, 0x42f7a8
call fcn.00409880
jmp 0x40b1bf
cmp dword [esp + 0x18], 4
jne 0x40b1bf
mov eax, dword [esp + 0x1c]
cmp eax, edi
jne 0x40b18f
push esi
mov edx, 0x42f7c8
call fcn.00409880
jmp 0x40b1bf
cmp eax, 0xa
jne 0x40b1a1
push esi
mov edx, 0x42f7e0
call fcn.00409880
jmp 0x40b1bf
cmp eax, 0x5a
jne 0x40b1bf
push esi
mov edx, 0x42f7f8
call fcn.00409880
jmp 0x40b1bf
push 6
push 0x42f810
call fcn.00401560
mov eax, esi
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00414002
add esp, 0x12c
ret