joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415259
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x144
mov dword [ebp - 0x10], 0
mov eax, dword [0x5701f4]
mov eax, dword [eax + 0xc]
test eax, eax
js 0x41527b
call dbg.ExecdTimeoutRun
mov eax, dword [0x5701f4]
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
jne 0x41529e
mov dword [esp], 0x1388
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x41546a
call dbg.run_notify
mov dword [selecttime.tv_sec], 0
mov dword [ebp - 0xc], 0
jmp 0x4152d0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + eax*4 - 0x110]
mov eax, dword [0x5701f4]
mov eax, dword [eax + 8]
cmp edx, eax
je 0x4152db
add dword [ebp - 0xc], 1
mov eax, dword [selecttime.tv_sec]
cmp dword [ebp - 0xc], eax
jb 0x4152b6
mov eax, dword [selecttime.tv_sec]
cmp dword [ebp - 0xc], eax
jne 0x415314
mov eax, dword [selecttime.tv_sec]
cmp eax, 0x3f
ja 0x415314
mov eax, dword [0x5701f4]
mov eax, dword [eax + 8]
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x110], edx
mov eax, dword [selecttime.tv_sec]
add eax, 1
mov dword [selecttime.tv_sec], eax
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x118], 0
mov eax, dword [0x5701f4]
mov eax, dword [eax + 8]
lea edx, [eax + 1]
lea eax, [ebp - 0x11c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [selecttime.tv_sec]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WSOCK32.DLL_select]
call eax
sub esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4153c7
mov eax, dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
call eax
mov dword [esp], eax
call dbg.win_strerror
mov ebx, eax
mov eax, dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
call eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4ed1f0
mov dword [esp + 8], global___func__.208
mov dword [esp + 4], 0x16d
mov dword [esp], str.client_agent_receiver.c
call dbg._merror
mov dword [esp], 0x7530
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x41546a
cmp dword [ebp - 0x10], 0
je 0x415469
call dbg.receive_msg
test eax, eax
jns 0x41526a
mov dword [esp + 4], 0xd
mov dword [esp], 0
call dbg.w_agentd_state_update
mov dword [esp + 0xc], str._1137_:_Lost_connection_with_manager._Setting_lock.
mov dword [esp + 8], global___func__.208
mov dword [esp + 4], 0x176
mov dword [esp], str.client_agent_receiver.c
call dbg._merror
call dbg.os_setwait
mov dword [esp], 0
call dbg.start_agent
mov dword [esp + 0xc], str.Server_responded._Releasing_lock.
mov dword [esp + 8], global___func__.208
mov dword [esp + 4], 0x179
mov dword [esp], str.client_agent_receiver.c
call dbg._minfo
call dbg.os_delwait
mov dword [esp + 4], 0xc
mov dword [esp], 0
call dbg.w_agentd_state_update
jmp 0x41526a
nop
jmp 0x41526a
Function at 0x417e43
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov dword [ebp - 0xc], 0
mov edx, dword [0x57ff88]
mov eax, dword [0x5701f4]
mov eax, dword [eax + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.wnet_select
cmp eax, 0xffffffff
je 0x417e7a
test eax, eax
je 0x418004
jmp 0x417ec7
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._1114_:_Error_during_select___call_due_to____d____s__.
mov dword [esp + 8], global___func__.24
mov dword [esp + 4], 0x109
mov dword [esp], str.client_agent_start_agent.c
call dbg._merror
jmp 0x418005
mov eax, dword [0x5701f4]
mov edx, dword [eax]
mov eax, dword [0x5701f4]
mov eax, dword [eax + 0x14]
mov ecx, eax
mov eax, ecx
add eax, eax
add eax, ecx
shl eax, 3
add eax, edx
mov eax, dword [eax + 8]
cmp eax, 0x11
jne 0x417f1c
mov eax, dword [ebp + 0xc]
mov edx, dword [0x5701f4]
mov edx, dword [edx + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WSOCK32.DLL_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
jmp 0x417f3d
mov eax, dword [0x5701f4]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.OS_RecvSecureTCP
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x417f4b
mov eax, dword [ebp - 0xc]
jmp 0x41800a
cmp dword [ebp - 0xc], 0xfffffffa
jne 0x417f7a
mov dword [esp + 0xc], str.Corrupt_payload__exceeding_size__received.
mov dword [esp + 8], global___func__.24
mov dword [esp + 4], 0x121
mov dword [esp], str.client_agent_start_agent.c
call dbg._merror
jmp 0x418005
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
cmp eax, 0xb
je 0x417f98
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
cmp eax, 0x8c
jne 0x417fbe
mov dword [esp + 0xc], str.Unable_to_receive_start_response:_Timeout_reached
mov dword [esp + 8], global___func__.24
mov dword [esp + 4], 0x125
mov dword [esp], str.client_agent_start_agent.c
call dbg._minfo
jmp 0x418005
mov eax, dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
call eax
mov ebx, eax
mov eax, dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
call eax
mov dword [esp], eax
call dbg.win_strerror
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Connection_socket:__s___d_
mov dword [esp + 8], global___func__.24
mov dword [esp + 4], 0x128
mov dword [esp], str.client_agent_start_agent.c
call dbg._mdebug1
jmp 0x418005
nop
mov eax, 0
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x420378
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
jmp 0x42042f
mov eax, dword [0x57ffd4]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 0xc]
shl edx, 2
add eax, edx
mov eax, dword [eax]
test eax, eax
je 0x42042b
mov eax, dword [0x57ffd4]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 0xc]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
test eax, eax
je 0x42042b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], dbg.w_output_thread@4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x42042b
mov dword [esp + 0xc], 0x4eeb5c
mov dword [esp + 8], global___func__.225
mov dword [esp + 4], 0x7f5
mov dword [esp], str.logcollector_logcollector.c
call dbg._merror_exit
add dword [ebp - 0xc], 1
mov eax, dword [0x57ffd4]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc]
jae 0x42038a
nop
nop
leave
ret

Function at 0x420dc6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 8], 1
mov dword [esp + 4], str.input_threads
mov dword [esp], 0x4eef3b
call dbg.getDefine_Int
mov dword [0x4e904c], eax
mov dword [esp + 4], 0x57ffe8
mov dword [esp], 0x57ffe4
call dbg.pthread_mutex_init
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x420e45
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4eeb82
mov dword [esp + 8], global___func__.161
mov dword [esp + 4], 0x921
mov dword [esp], str.logcollector_logcollector.c
call dbg._merror_exit
mov dword [esp], 0x57ffe8
call dbg.pthread_mutexattr_destroy
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x420e8d
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.At_pthread_mutexattr_destroy__:__s
mov dword [esp + 8], global___func__.161
mov dword [esp + 4], 0x922
mov dword [esp], str.logcollector_logcollector.c
call dbg._merror_exit
mov dword [ebp - 0xc], 0
jmp 0x420f00
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.w_input_thread@4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x420efc
mov dword [esp + 0xc], 0x4eeb5c
mov dword [esp + 8], global___func__.161
mov dword [esp + 4], 0x929
mov dword [esp], str.logcollector_logcollector.c
call dbg._merror_exit
add dword [ebp - 0xc], 1
mov eax, dword [0x4e904c]
cmp dword [ebp - 0xc], eax
jl 0x420e96
nop
nop
leave
ret
Function at 0x421a6e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x10034
call fcn.004d7290
sub esp, eax
call dbg.OSHash_Create
mov dword [0x57ffd8], eax
mov eax, dword [0x57ffd8]
test eax, eax
jne 0x421abe
mov eax, dword [str.file_status]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4ef760
mov dword [esp + 8], global___func__.37
mov dword [esp + 4], 0xa2b
mov dword [esp], str.logcollector_logcollector.c
call dbg._merror_exit
mov eax, dword [0x57ffd8]
mov dword [esp + 4], 0x28
mov dword [esp], eax
call dbg.OSHash_setSize
test eax, eax
jne 0x421b04
mov eax, dword [str.file_status]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4ef78c
mov dword [esp + 8], global___func__.37
mov dword [esp + 4], 0xa2f
mov dword [esp], str.logcollector_logcollector.c
call dbg._merror_exit
mov eax, dword [0x57ffd8]
mov dword [esp + 4], sym._free
mov dword [esp], eax
call dbg.OSHash_SetFreeDataPointer
mov dword [ebp - 0xc], 0
mov dword [esp + 4], 0x4ef08d
mov dword [esp], str.queuelogcollector_file_status.json
call sym._fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x421c2a
mov dword [ebp - 0x10010], 0
lea eax, [ebp - 0x1000c]
mov edx, 0xfffc
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 1
lea eax, [ebp - 0x10010]
mov dword [esp], eax
call sym._fread
test eax, eax
jne 0x421bf0
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.queuelogcollector_file_status.json
mov dword [esp + 0xc], 0x4ef62c
mov dword [esp + 8], global___func__.37
mov dword [esp + 4], 0xa3b
mov dword [esp], str.logcollector_logcollector.c
call dbg._merror
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._clearerr
jmp 0x421c1d
lea eax, [ebp - 0x10010]
mov dword [esp], eax
call sym._cJSON_Parse_4
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dbg.w_load_files_status
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._cJSON_Delete_4
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
jmp 0x421c88
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
cmp eax, 2
je 0x421c88
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.queuelogcollector_file_status.json
mov dword [esp + 0xc], 0x4ef058
mov dword [esp + 8], global___func__.37
mov dword [esp + 4], 0xa45
mov dword [esp], str.logcollector_logcollector.c
call dbg._merror
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x421c8e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
call dbg.w_save_files_status_to_cJSON
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x421dd4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0x4ef7e0
mov dword [esp], str.queuelogcollector_file_status.json
call dbg.wfopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x421d70
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fwrite
test eax, eax
jne 0x421d5d
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.queuelogcollector_file_status.json
mov dword [esp + 0xc], 0x4ef7e4
mov dword [esp + 8], global___func__.191
mov dword [esp + 4], 0xa56
mov dword [esp], str.logcollector_logcollector.c
call dbg._merror
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._clearerr
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
cmp dword [ebp - 0xc], 0
je 0x421dd5
jmp 0x421dc0
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.queuelogcollector_file_status.json
mov dword [esp + 0xc], 0x4ef058
mov dword [esp + 8], global___func__.191
mov dword [esp + 4], 0xa5b
mov dword [esp], str.logcollector_logcollector.c
call dbg._merror_exit
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0xc], 0
jmp 0x421dd5
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x42663c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
sub eax, dword [ebp - 0x30]
sbb edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov edx, 0
mov eax, 0
cmp edx, dword [ebp - 0x18]
sbb eax, dword [ebp - 0x14]
jge 0x4266ab
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.w_fseek
test eax, eax
je 0x4266b3
mov eax, dword [ebp - 0xc]
jmp 0x426772
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._calloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42671a
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f0408
mov dword [esp + 8], global___func__.183
mov dword [esp + 4], 0x227
mov dword [esp], str.logcollector_read_multiline_regex.c
call dbg._merror_exit
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
or eax, edx
test eax, eax
je 0x42676f
cmp dword [ebp - 0xc], 0
je 0x42676f
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x42a6ea
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
call eax
sub esp, 8
mov edx, dword [ebp + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x42a754
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._4106_:_Unable_to_open_event_log:__s.
mov dword [esp + 8], global___func__.16
mov dword [esp + 4], 0x30
mov dword [esp], str.logcollector_read_win_el.c
call dbg._merror
mov eax, 0xffffffff
jmp 0x42a84b
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp + 0xc]
lea edx, [eax + 0x10]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_GetOldestEventLogRecord]
call eax
sub esp, 8
test eax, eax
jne 0x42a7cd
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._4107_:_Unable_to_query_last_event_log_from:__s.
mov dword [esp + 8], global___func__.16
mov dword [esp + 4], 0x37
mov dword [esp], str.logcollector_read_win_el.c
call dbg._merror
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseEventLog]
call eax
sub esp, 4
mov eax, dword [ebp + 0xc]
mov dword [eax + 0xc], 0
mov eax, 0xffffffff
jmp 0x42a84b
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_GetNumberOfEventLogRecords]
call eax
sub esp, 8
test eax, eax
jne 0x42a83a
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._4107_:_Unable_to_query_last_event_log_from:__s.
mov dword [esp + 8], global___func__.16
mov dword [esp + 4], 0x3e
mov dword [esp], str.logcollector_read_win_el.c
call dbg._merror
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseEventLog]
call eax
sub esp, 4
mov eax, dword [ebp + 0xc]
mov dword [eax + 0xc], 0
mov eax, 0xffffffff
jmp 0x42a84b
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x42a848
mov eax, 0
jmp 0x42a84b
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x42a907
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x240
mov dword [ebp - 0x21c], 0
lea edx, [ebp - 0x218]
mov eax, 0
mov ecx, 0x7f
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.SystemCurrentControlSetServicesEventLog_s_s
mov dword [esp + 4], 0x1fe
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._snprintf_28
lea eax, [ebp - 0x21c]
add eax, 0x2a
mov edx, dword [0x58033c]
mov dword [esp + 4], eax
mov dword [esp], edx
call dbg.OSHash_Get
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42a996
mov eax, dword [ebp - 0x14]
jmp 0x42ab28
lea eax, [ebp - 0x18]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
lea eax, [ebp - 0x21c]
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
je 0x42a9d6
mov eax, 0
jmp 0x42ab28
mov dword [ebp - 0x1c], 0x103
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x1c]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.EventMessageFile
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
je 0x42aa37
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, 0
jmp 0x42ab28
lea eax, [ebp - 0x21c]
add eax, 0x2a
mov dword [esp], eax
call sym._strdup
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._strdup
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
je 0x42aa9d
cmp dword [ebp - 0x10], 0
je 0x42aa9d
mov eax, dword [0x58033c]
mov edx, dword [ebp - 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.OSHash_Add
cmp eax, 2
je 0x42aa90
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
jmp 0x42ab07
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f0e74
mov dword [esp + 8], global___func__.129
mov dword [esp + 4], 0x9a
mov dword [esp], str.logcollector_read_win_el.c
call dbg._merror
cmp dword [ebp - 0xc], 0
je 0x42aaf6
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
cmp dword [ebp - 0x10], 0
je 0x42ab07
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [ebp + 0x10]
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x42abef
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x228], 0
mov byte [ebp - 0x11e], 0
mov byte [ebp - 0x1d], 0
or dword [ebp - 0x10], 0x800
or dword [ebp - 0x10], 0x100
or dword [ebp - 0x10], 0x2000
lea eax, [ebp - 0x222]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.el_getEventDLL
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42ad34
mov eax, 0
jmp 0x42ae1e
mov eax, dword [ebp - 0x14]
mov byte [eax], 0
mov dword [esp + 8], 0xff
lea eax, [ebp - 0x11d]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0x14]
mov byte [eax], 0x3b
mov dword [esp + 8], 3
mov dword [esp + 4], 0
lea eax, [ebp - 0x11d]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
call eax
sub esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42ad2b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp + 0x14]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 0
lea edx, [ebp - 0x228]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FormatMessageA]
call eax
sub esp, 0x1c
test eax, eax
jne 0x42ad06
mov dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call eax
sub esp, 4
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x42ad2b
mov eax, dword [ebp - 0x228]
jmp 0x42ae1e
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0x3b
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x42ac5c
mov dword [esp + 8], 0xff
lea eax, [ebp - 0x11d]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call eax
sub esp, 0xc
mov dword [esp + 8], 3
mov dword [esp + 4], 0
lea eax, [ebp - 0x11d]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
call eax
sub esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42ae19
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp + 0x14]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 0
lea edx, [ebp - 0x228]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FormatMessageA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x42adf7
mov dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call eax
sub esp, 4
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x42ae19
mov eax, dword [ebp - 0x228]
jmp 0x42ae1e
mov eax, 0
leave
ret