joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b2323
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x59f720]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4b2363
cmp byte [ebx], 0xa
jne 0x4b2363
or byte [eax + edi + 0x28], 4
jmp 0x4b2368
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4b2466
mov al, byte [edx]
cmp al, 0x1a
je 0x4b2448
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4b2397
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4b23bc
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4b23c6
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4b2379
jmp 0x4b2466
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b2443
cmp dword [ebp - 0xc], 0
je 0x4b2443
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x59f720]
test byte [eax + edi + 0x28], 0x48
je 0x4b241d
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4b2408
mov byte [esi], dl
jmp 0x4b2419
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x59f720]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4b2466
cmp byte [ebp - 1], 0xa
jne 0x4b242c
cmp esi, ebx
jne 0x4b242c
mov byte [esi], 0xa
jmp 0x4b2465
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00401ac8
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4b2466
mov byte [esi], 0xd
jmp 0x4b2465
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x59f720]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4b2462
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4b2466
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4b24c2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x59f720]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4b2505
cmp word [esi], dx
jne 0x4b2505
or byte [edi + eax + 0x28], 4
jmp 0x4b250a
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4b265d
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4b263d
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4b254c
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4b2582
cmp eax, edx
jae 0x4b258e
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4b2524
jmp 0x4b265d
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b2639
cmp dword [ebp - 0x14], 0
je 0x4b2639
mov eax, dword [ebx*4 + 0x59f720]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4b2611
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4b25da
mov word [esi], cx
jmp 0x4b260d
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x59f720]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x59f720]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x59f720]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4b265d
pop ebx
cmp word [ebp - 4], bx
jne 0x4b2622
cmp esi, dword [ebp + 0xc]
jne 0x4b2622
mov word [esi], bx
jmp 0x4b265a
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00401ac8
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4b265d
push 0xd
jmp 0x4b2656
mov ecx, dword [ebx*4 + 0x59f720]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4b2654
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4b265d
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4d31ee
Capabilities:
Encode data using xor

Disassembly:
loopne 0x4d3235
pop edi
cli
mov ch, byte [edi]
out 0x42, eax
xor dl, byte [edi + 0x7dd8a80d]
xchg ecx, eax
xor al, 0x44
loope 0x4d31fc
pop esi
mov eax, dword cs:[ebx - 0x1a]
xchg esi, eax
xor ebp, dword [ecx + 0x7ad97c0c]
fild qword [edi - 0x3a4aeff6]
pushal
test al, 0xd
jge 0x4d31f0
inc edx
out 0x97, eax
xor bl, dh
jnp 0x4d322a
scasb al, byte es:[edi]
mov ah, 0x11
popal
les ecx, [ecx + ebp*4]
fnstcw word [esi + 0x43]
xor edx, dword [esi - 0x2287f753]
invalid
fisubr dword [edx + 0x4030950f]
in eax, 9
lodsb al, byte [esi]
fdivr qword [ecx + 0x63]
invalid

Function at 0x56cc4e
Capabilities:
Encode data using xor

Disassembly:
inc esi
fld qword [ecx + 0x5f178de2]
scasb al, byte es:[edi]
xchg byte [ebx + 0x30fcbd9e], cl
cld
xor dh, ch
test dword [esi + 0x70e9dbb0], 0xe1589de
aaa
insd dword es:[edi], dx
pop eax
pop esp
outsb dx, byte [esi]
popfd
push cs
jb 0x56cc31
sbb bh, bh
daa
pop ebp
inc edx
fbstp tbyte [esi + edi*4 - 0x2cb42249]
movsb byte es:[edi], byte [esi]
sbb al, 0x91
pop es
mov bl, byte [ecx]
test byte [0x4cb7d3d6], bl
xchg esp, eax
adc dword [edx - 0x16], edx
out 0x13, eax
mov dword ss:[esi], esp
sahf
jbe 0x56cbe1
nop
dec esp
call 0x86d6b591
out dx, eax
mov dword [0xec2d0969], eax
push 0xffffffffffffffe4
or esi, esi
jbe 0x56cc86
or eax, 0xe744b259
out dx, eax
sbb byte [esi + 0x15], ah
jb 0x56cc05
arpl bp, di
inc eax
fcmovnb st(0), st(6)
mov ecx, 0xd7ea6e64
scasb al, byte es:[edi]
xchg dword [ebp + edi*2 - 0x5a79e37d], esi
inc ecx
sbb eax, 0xd627c956
xchg byte [ebp - 0x36a9e2bf], ah
daa
salc
xor al, byte [ebp + 0x5d]
pop ebx
push eax
lds ecx, [ebx + 0x61]
jno 0x56cc6b
jg 0x56cc4c
out dx, al
sti
dec ebp
invalid
or byte [esi + 0x1e2dd9fd], al
or edi, dword [eax + 0x4e]
imul ecx, dword [esi], 0xae28d2a8
std
invalid

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x523759d3
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x433060
nop
nop
nop
nop
mov eax, section..rdata
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x478014a3
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x76510d4d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x49be62fe
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401308
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
mov edi, eax
mov esi, 0x402097
mov ecx, dword [0x4012ef]
dec ecx
mov bl, byte [0x4012f3]
rdtsc
push eax
mov bh, byte [esi]
mov byte [edi], bh
inc edi
inc esi
inc esi
push eax
mov al, byte [esi]
stosb byte es:[edi], al
add byte [edi - 1], bl
pop eax
loop 0x401325
rdtsc
pop edx
sub eax, edx
sub esp, 0x18
push 0
push dword [0x40204f]
call dword [sym.imp.Msacm32.dll_acmStreamOpen]
pop edx
sub edx, eax
push edx
push 0
push 2
push 0x402062
push 0x402053
call dword [sym.imp.Winmm.dll_mciSendStringA]
pop edx
sub edx, eax
ret

Function at 0x40893c
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
mov eax, eax
add ecx, eax
call fcn.00408960
sub ecx, ecx
xor dword [ebx], edi
dec eax
add ebx, 1
sub ecx, 0x647311cc
cmp ebx, edx
jne fcn.0040893c
ret

Function at 0x414dd5
Capabilities:
Encode data using xor

Disassembly:
xor dword [eax], edi
add edx, 0x5b2c5d13
add eax, 4
add edx, esi
push edx
mov edx, dword [esp]
add esp, 4
add esi, edx
cmp eax, ebx
jne fcn.00414dd5
inc edx
ret
Function at 0x40a5f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x414068], 0
je 0x40a6ff
push 0x40123c
push 0x414068
call dword [sym.imp.msvcrt.dll_fopen]
test eax, eax
pop ecx
pop ecx
mov dword [0x415290], eax
je 0x40a6ff
cmp dword [ebp + 0xc], 0
je 0x40a674
push 0x415280
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [0x41528c]
push eax
movzx eax, word [0x41528a]
push eax
movzx eax, word [0x415288]
push eax
movzx eax, word [0x415280]
push eax
movzx eax, word [0x415286]
push eax
movzx eax, word [0x415282]
push eax
push 0x40121c
push dword [0x415290]
call dword [sym.imp.msvcrt.dll_fprintf]
add esp, 0x20
cmp dword [ebp + 8], 0
je 0x40a6c1
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
mov esi, 0x414280
push 0xfff
push esi
mov byte [0x41527f], 0
call dword [sym.imp.msvcrt.dll__vsnprintf]
mov eax, esi
add esp, 0x10
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40a6a2
push dword [0x415290]
sub eax, ecx
push 1
push eax
push esi
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
pop esi
jmp 0x40a6e5
mov eax, dword [ebp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a6c7
push dword [0x415290]
sub eax, edx
push 1
push eax
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
push dword [0x415290]
call dword [sym.imp.msvcrt.dll_fflush]
push dword [0x415290]
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
pop ecx
pop ebp
ret

Function at 0x40a701
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x414050]
push ebx
mov dword [ebp + 0x94], eax
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x4013c0
push 0x80000002
mov dword [ebp - 0x7c], 0x104
mov byte [ebp + 0x90], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x40a765
push eax
push 0x401360
push 1
push 1
call fcn.0040a5f0
add esp, 0x10
mov dword [0x414060], ebx
jmp 0x40a819
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x40134c
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x40a7a7
push eax
push 0x4012f0
push 1
push 1
call fcn.0040a5f0
add esp, 0x10
push dword [ebp - 0x78]
mov dword [0x414060], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40a819
push esi
push edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x105
push edi
mov esi, 0x414170
push esi
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
je 0x40a7fb
cmp eax, edi
ja 0x40a7fb
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
cmp eax, ebx
mov dword [0x414060], eax
jne 0x40a817
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x4012a0
push 1
push 1
call fcn.0040a5f0
jmp 0x40a814
push eax
lea eax, [ebp - 0x74]
push eax
push 0x401240
push 1
push 1
call fcn.0040a5f0
mov dword [0x414060], ebx
add esp, 0x14
pop edi
pop esi
mov ecx, dword [ebp + 0x94]
pop ebx
call fcn.00412b38
add ebp, 0x98
leave
ret
Function at 0x40a918
Capabilities:
Access the windows event log

Disassembly:
mov ecx, dword [0x416440]
push esi
xor esi, esi
cmp ecx, esi
je 0x40a969
push dword [esp + 8]
call fcn.0040a8eb
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x1c]
mov word [0x4152a0], ax
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
cmp eax, esi
mov dword [0x41529c], eax
jne 0x40a983
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x401504
push 1
push 1
call fcn.0040a5f0
add esp, 0x10
jmp 0x40a979
push 0x4014c4
push 1
push esi
call fcn.0040a5f0
add esp, 0xc
push esi
push dword [esp + 0xc]
call fcn.0040a82d
pop esi
ret 4

Function at 0x40a987
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x22
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
xor edi, edi
cmp dword [0x416440], edi
mov ecx, eax
mov dword [0x4152ac], ecx
je 0x40aa13
cmp ecx, edi
je 0x40aa42
push dword [ebp + 8]
call fcn.0040a8eb
push 0xa
push ecx
push dword [ebp + 0xc]
mov word [0x4152a8], ax
call dword [sym.imp.msvcrt.dll__ultoa]
add esp, 0xc
push edi
mov esi, 0x4152ac
push esi
push edi
push 1
push edi
push dword [ebp + 8]
xor eax, eax
mov ax, word [0x4152a8]
push edi
push eax
push dword [0x416440]
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
cmp eax, edi
mov dword [0x4152a4], eax
jne 0x40aa5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x401504
push 1
push 1
call fcn.0040a5f0
add esp, 0x10
push esi
jmp 0x40aa53
push 0x4014c4
push 1
push edi
call fcn.0040a5f0
mov eax, dword [0x4152ac]
add esp, 0xc
cmp eax, edi
je 0x40aa42
push 0xa
push eax
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__ultoa]
add esp, 0xc
push 0x4152ac
jmp 0x40aa53
push 0x401538
push 1
push edi
call fcn.0040a5f0
add esp, 0xc
push edi
push dword [ebp + 8]
call fcn.0040a82d
push dword [0x4152ac]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
pop ebp
ret 8
Function at 0x40aa6d
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x22
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
push 0x22
mov dword [0x4152b8], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
xor edi, edi
cmp dword [0x416440], edi
pop ecx
pop ecx
mov dword [0x4152bc], eax
je 0x40ab24
mov ecx, dword [0x4152b8]
cmp ecx, edi
je 0x40ab6a
cmp eax, edi
je 0x40ab6a
push dword [ebp + 8]
call fcn.0040a8eb
mov esi, dword [sym.imp.msvcrt.dll__ultoa]
push 0xa
push ecx
push dword [ebp + 0xc]
mov word [0x4152b4], ax
call esi
push 0xa
push dword [0x4152bc]
push dword [ebp + 0x10]
call esi
add esp, 0x18
push edi
mov esi, 0x4152b8
push esi
push edi
push 2
push edi
push dword [ebp + 8]
xor eax, eax
mov ax, word [0x4152b4]
push edi
push eax
push dword [0x416440]
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
cmp eax, edi
mov dword [0x4152b0], eax
jne 0x40ab83
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x401504
push 1
push 1
call fcn.0040a5f0
add esp, 0x10
push esi
jmp 0x40ab7b
push 0x4014c4
push 1
push edi
call fcn.0040a5f0
mov eax, dword [0x4152b8]
add esp, 0xc
cmp eax, edi
je 0x40ab6a
cmp dword [0x4152bc], edi
je 0x40ab6a
mov esi, dword [sym.imp.msvcrt.dll__ultoa]
push 0xa
push eax
push dword [ebp + 0xc]
call esi
push 0xa
push dword [0x4152bc]
push dword [ebp + 0x10]
call esi
add esp, 0x18
push 0x4152b8
jmp 0x40ab7b
push 0x401538
push 1
push edi
call fcn.0040a5f0
add esp, 0xc
push edi
push dword [ebp + 8]
call fcn.0040a82d
push dword [0x4152b8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [0x4152bc]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40aba1
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x105
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
push 0x22
mov dword [0x4152c8], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
xor ebx, ebx
cmp dword [0x416440], ebx
pop ecx
pop ecx
mov dword [0x4152cc], eax
je 0x40ac6f
mov ecx, dword [0x4152c8]
cmp ecx, ebx
je 0x40acc5
cmp eax, ebx
je 0x40acc5
push dword [ebp + 8]
mov byte [ecx + 0x104], bl
call fcn.0040a8eb
push 0x104
push dword [ebp + 0xc]
mov word [0x4152c4], ax
push dword [0x4152c8]
call dword [sym.imp.msvcrt.dll_strncpy]
push 0xa
push dword [0x4152cc]
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll__ultoa]
add esp, 0x18
push ebx
mov esi, 0x4152c8
push esi
push ebx
push 2
push ebx
push dword [ebp + 8]
xor eax, eax
mov ax, word [0x4152c4]
push ebx
push eax
push dword [0x416440]
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
cmp eax, ebx
mov dword [0x4152c0], eax
jne 0x40acde
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x401504
push 1
push 1
call fcn.0040a5f0
add esp, 0x10
push esi
jmp 0x40acd6
push 0x4014c4
push 1
push ebx
call fcn.0040a5f0
mov eax, dword [0x4152c8]
add esp, 0xc
cmp eax, ebx
je 0x40acc5
cmp dword [0x4152cc], ebx
je 0x40acc5
push 0x104
push dword [ebp + 0xc]
mov byte [eax + 0x104], bl
push dword [0x4152c8]
call dword [sym.imp.msvcrt.dll_strncpy]
push 0xa
push dword [0x4152cc]
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll__ultoa]
add esp, 0x18
push 0x4152c8
jmp 0x40acd6
push 0x401538
push 1
push ebx
call fcn.0040a5f0
add esp, 0xc
push ebx
push dword [ebp + 8]
call fcn.0040a82d
push dword [0x4152c8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [0x4152cc]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40acfc
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x105
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
xor ebx, ebx
cmp dword [0x416440], ebx
pop ecx
mov dword [0x4152d8], eax
je 0x40ad96
cmp eax, ebx
je 0x40add3
push dword [ebp + 8]
mov byte [eax + 0x104], bl
call fcn.0040a8eb
push 0x104
push dword [ebp + 0xc]
mov word [0x4152d4], ax
push dword [0x4152d8]
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
push ebx
mov esi, 0x4152d8
push esi
push ebx
push 1
push ebx
push dword [ebp + 8]
xor eax, eax
mov ax, word [0x4152d4]
push ebx
push eax
push dword [0x416440]
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
cmp eax, ebx
mov dword [0x4152d0], eax
jne 0x40adec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x401504
push 1
push 1
call fcn.0040a5f0
add esp, 0x10
push esi
jmp 0x40ade4
push 0x4014c4
push 1
push ebx
call fcn.0040a5f0
mov eax, dword [0x4152d8]
add esp, 0xc
cmp eax, ebx
je 0x40add3
push 0x104
push dword [ebp + 0xc]
mov byte [eax + 0x104], bl
push dword [0x4152d8]
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
push 0x4152d8
jmp 0x40ade4
push 0x401538
push 1
push ebx
call fcn.0040a5f0
add esp, 0xc
push ebx
push dword [ebp + 8]
call fcn.0040a82d
push dword [0x4152d8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40adfe
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
xor ebx, ebx
cmp dword [0x414278], ebx
push esi
push edi
jne 0x40af23
push 0x4163f8
push 0x20019
push ebx
push 0x401594
push 0x80000002
mov byte [0x4163f4], bl
mov dword [0x414278], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
mov dword [0x4162e8], eax
je 0x40ae53
push eax
push 0x800003e8
call fcn.0040a987
jmp 0x40af23
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x414018
push 0x4162f0
mov edi, 0x4162e4
push edi
push ebx
push 0x401584
push dword [0x4163f8]
call esi
cmp eax, ebx
mov dword [0x4162e8], eax
jne 0x40aeaf
cmp dword [0x4162e4], 1
je 0x40ae95
push 0x414068
push 0x800003f5
jmp 0x40aeb9
push 0x104
push 0x4162f0
push 0x414068
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
jmp 0x40aebe
push 0x414068
push 0x800003eb
call fcn.0040acfc
push 0x414014
push 0x4162e0
push edi
push ebx
push 0x401578
push dword [0x4163f8]
call esi
cmp eax, ebx
mov dword [0x4162e8], eax
jne 0x40af02
cmp dword [0x4162e4], 4
jne 0x40aef5
mov eax, dword [0x4162e0]
mov dword [0x414010], eax
jmp 0x40af12
push dword [0x414010]
push 0x800003f6
jmp 0x40af0d
push dword [0x414010]
push 0x800003f7
call fcn.0040a987
push dword [0x4163f8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x4162e8], eax
mov edi, dword [esp + 0x10]
cmp edi, dword [0x414010]
jb 0x40af6e
cmp byte [0x414068], bl
je 0x40af6e
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
mov esi, 0x4152e0
push 0xfff
push esi
mov byte [0x4162df], bl
call dword [sym.imp.msvcrt.dll__vsnprintf]
add esp, 0x10
cmp edi, 0xffffffff
push esi
jne 0x40af63
push ebx
jmp 0x40af65
push 1
push ebx
call fcn.0040a5f0
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x40af8a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
push edi
lea ebx, [ecx + eax + 0x18]
jbe 0x40b06c
add ebx, 0x10
mov eax, dword [ebx]
test eax, eax
jne 0x40b007
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x40b057
push dword [esi + 0x34]
mov eax, dword [ebx - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push edi
push eax
call dword [esi + 0x1c]
test eax, eax
je 0x40b076
mov edx, dword [ebx - 4]
add edx, dword [ebp - 4]
mov ecx, edi
mov dword [ebx - 8], edx
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x40b057
mov ecx, dword [ebx + 4]
add ecx, eax
mov eax, dword [ebp + 0xc]
push ecx
call fcn.0040af72
test eax, eax
je 0x40b076
push dword [esi + 0x34]
mov eax, dword [ebx - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push dword [ebx]
push eax
call dword [esi + 0x1c]
test eax, eax
je 0x40b076
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
add eax, dword [ebp - 4]
mov esi, dword [ebx + 4]
add esi, dword [ebp + 8]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov dword [ebx - 8], eax
mov eax, dword [esi]
movzx eax, word [eax + 6]
inc dword [ebp - 8]
add ebx, 0x28
cmp dword [ebp - 8], eax
jl 0x40afb7
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x40b06f