joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c4ba4
Capabilities:
Encode data using xor

Disassembly:
sbb esp, dword [ecx - 0x4b]
sbb byte [esp + ecx + 0x6388d84d], ah
push esp
or cl, byte [edx + 0x44]
popal
mov ch, 0x18
movsb byte es:[edi], byte [esi]
or al, 0x4d
fmul dword [eax + 0x4a0a5463]
inc esp
loop 0x5c4bd2
push eax
fbld tbyte [edx]
sal dword [edx - 0x74aac1f2], 1
mov dh, 0xf
cld
adc al, ah
invalid
pop ds
loope 0x5c4b44
lodsb al, byte [esi]
loope 0x5c4c00
je 0x5c4b45
push ss
movsb byte es:[edi], byte [esi]
add al, 0x40
clc
sub byte [edi - 0x6cf7274a], bh
sbb al, ch
mov esi, 0x3bd21a18
and byte [edx], bl
sar dword [eax - 6], cl
in eax, dx
sbb byte [eax - 0x7f1445cc], bh
das
mov esi, 0x24402947
sbb byte [ecx], 0x6b
xor cl, 0x2e
imul esp, dword [edx + eax*4 - 0xf], 0x2e
dec edi
push eax
mov al, 0x15
test eax, 0x4b5481d0
mov al, byte [0x22d05163]
adc al, 0x46
adc byte [ecx + ebx*8 - 0x68], dh
in al, 0xa6
test al, 0x38
test eax, 0x2462feac
arpl word [edx + 0x70070677], bp
lahf
cmp byte [ebx], ch
int1
xchg byte [ebx + 5], dh
jae 0x5c4c07
invalid
sbb byte [edi + 0xe], ah
nop
jae 0x5c4c54
std
mov al, 0x87
push es
xchg dword [esi], eax
xchg ecx, eax
outsd dx, dword [esi]
das
push 0x7d5a1ac6
mov cl, 0x21
add cl, byte [0x39f6bef0]
sbb ah, dl
adc al, 0xb8
adc ebx, edi
sub byte [edx - 0x461e9679], 0xb9
push ebp
nop
mov dword [ebx - 0x7e487cdc], edx
xor edx, dword [eax + ebx*4 + 0x23]
jb 0x5c4c10
mov ah, 0x31
cmp dh, bl
mov ah, al
fsin
mov ebx, 0x8115393f
inc edi
cmpsb byte [esi], byte es:[edi]
jle 0x5c4c92
adc eax, 0x7ea64781
inc esp
jecxz 0x5c4c48
invalid
nop
rol dword [eax], 0x99
mov ebp, 0x2013236f
dec edx
invalid
out 0xb2, al
stosb byte es:[edi], al
inc eax
mov ah, 7
xchg ecx, eax
jns 0x5c4cb4
sbb bh, ch
pop ebx
mov ebp, 0xb8900c7
adc dword [esi - 0x4f], ecx
aam 0x70
pop ds
push cs
insb byte es:[edi], dx
sub dl, byte [esi]
push ss
jae 0x5c4cf0
push 0x34
mov eax, dword [0xc9b07098]
pop edx
sub dword [ebx - 0x2c99aa0d], esi
push 0xffffffffffffff84
shr dword [edx - 0x7c], cl
xor edx, dword [ecx]
mov eax, dword [0x28354431]
xchg dword [ecx - 0x54], ebx
dec esi
movsb byte es:[edi], byte [esi]
scasb al, byte es:[edi]
mov bh, 0x24
pop ebx
push ss
out dx, al
xchg ebx, eax
loopne 0x5c4caa
or al, 0x48
ja 0x5c4c8e
mov cl, 0xb8
popal
dec edx
sbb byte [0x8856fbe5], bh
push ebp
sub al, 0xbd
fstp dword [ebp - 0xe314b9b]
in eax, dx
jl 0x5c4cba
or dl, byte [ebp - 0x37a3c06d]
sal byte [edx + 0x2e], cl
pop esp
enter 0x72d2, 0x2e
cli
pushal
push ss
mov al, byte [0xc1f4cdea]
mov ah, 0x38
aaa
nop
push 0xffffffffffffffe8
pop ebp
add byte [eax - 0x1130b726], dh
and bh, byte [esi + 0x58]
mov ebp, 0x574d9943
invalid
Function at 0x5db0c9
Capabilities:
Encode data using xor

Disassembly:
into
add al, 0x64
and edi, dword [eax]
popal
add bl, byte [eax - 0x32]
add bl, ch
ret
cmpsb byte [esi], byte es:[edi]
dec ebp
cdq
out 0xc, al
mov eax, 0x908aea58
je 0x5db14b
insb byte es:[edi], dx
stosd dword es:[edi], eax
dec esi
paddusw mm2, mm3
imul dword [eax]
sub eax, 0xcd66e5fd
add ebx, dword [eax - 0x5c]
in al, dx
ficomp dword [edx + 0x194ebb7f]
jne 0x5db07b
add byte [ecx - 0x6155f360], bl
or al, 0xaa
sahf
xor al, 0x2a
mov word [ecx], gs
in al, dx
ja 0x5db0f1
cwde
in al, 0x6d
pop esi
mov ecx, 0xa93fafa1
sbb al, 0x2f
add dword [esi + 0x2c], esi
push esp
add ebx, dword [eax - 0x4a7f8d7f]
sub byte [0x5cf8e9e8], dh
add dword [ebx + 0x33b21411], 0x8e84f9f
dec edi
cmp eax, 0xfa7145f2
daa
invalid
imul eax, dword [eax - 0x61], 0xffffffe5
xor al, 0x98
xchg esi, eax
push cs
enter 0xffffffffffffa1ed, 0x53
xor dword [0x3a06f432], ebp
js 0x5db0f4
cmp dword [esi - 0x712935e6], ecx
push ss
or ah, byte [0x555f7724]
pop edi
push ebp
mov al, byte [edx]
add eax, 0x110058ca
test byte [edx + 0x3e], bl
jl 0x5db1cf
sbb esp, dword [edx]
inc esi
mov ch, 0x38
cmpsb byte [esi], byte es:[edi]
lea edx, [eax + 0x643ad725]
jle 0x5db140
nop
and eax, 0x7e643ad7
fmul dword [eax - 0x14a4abf3]
cwde
mov byte [0x98eb5b54], cl
pop ebx
jmp 0x5db106
jo 0x5db12c
pushal
pop esi
push cs
jo 0x5db1f3
sub ebx, edx
nop
loopne 0x5db16b
adc ebp, dword [esi - 0x40]
sbb dword [edi + ebx*2], esi
in eax, dx
jnp 0x5db161
or byte [ebp + 0xb], bh
cmp dword [eax - 0x17], edx
jg 0x5db1f8
mov eax, esi
inc esi
push edx
fisub word [esi - 0x43a8b71d]
mov al, 0x6a
invalid
add ecx, dword [esi + 0x52]
xor eax, dword [ecx]
or al, 0xed
fsubr st(4)
das
xor dword [ecx - 0x10], edx
aad 0x15
loop 0x5db23c
retf 0xd353
sahf
retf 0x847a
sar dword [esp - 0x38], 1
aam 0x3b
cmp byte [ecx - 0x74], ch
ret
cmp byte [edx], ch
add eax, edx
jge 0x5db1cc
out dx, eax
sbb dword [edx - 0x1f], esi
ret
aam 0x2f
mov cl, 0x79
jg 0x5db212
mov al, 0xd1
lds esi, fs:[edi + 0x21]
ljmp 0x42a0

Function at 0x5efb84
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], ch
sbb ebx, edi
inc ebx
mov byte [eax + 0x67], dh
invalid
Function at 0x5efe64
Capabilities:
Encode data using xor

Disassembly:
dec edx
xor bl, byte [edx + 0x64]
movsb byte es:[edi], byte [esi]
fidiv dword [edi - 0x39fb27f8]
int3
invalid
or al, 0x3d
ja 0x5efe21
add byte [edx + 0x44], dh
push ebp
mov ah, 0x68
inc eax
outsd dx, dword [esi]
jo 0x5efee0
bnd jbe 0x5efe87
invalid
ficomp dword [ebp - 0x72]
inc eax
fst dword [esp + edi*4 - 0x6b]
test al, 0xc2
test eax, 0xbe0f369f
nop
add al, 0xd
test dl, bl
sar byte [ebx + 0x70], 0x7c
jo 0x5efe2c
sub byte [edi - 0x5a], bh
cli
push 0xa1b9d05c
mov ebx, 0xec0b209d
scasb al, byte es:[edi]
into
jecxz 0x5efec2
mov dword [eax], esi
mov dl, pe_nt_image_headers32
neg byte [eax - 0x5c]
pop esi
pushfd
push 0x56105dd9
movsd dword es:[edi], dword [esi]
mov byte [edx - 0x71], dh
xchg ecx, eax
pushfd
push edx
std
test al, 0xc5
jne 0x5eff2c
mov edi, 0xeb83481d
fstp xword [eax + 0x5016caae]
jo 0x5eff1e
shr dword [edx - 0x4e], 0x3c
and al, 0xcb
inc eax
pop edx
push es
cld
je 0x5eff17
dec edi
jbe 0x5efeef
mov dword [edi], ebx
sal byte [edx - 0x5ca51e2f], 0x49
add cl, byte [ebx - 0x6c]
shl ecx, 1
pop edx
mov dword [0x944b0249], eax
and dword [edx], ecx
sbb cl, dl
jp 0x5eff27
sahf
xor byte [ecx], bl
daa
or ebx, dword [ebp - 0x46]
les ecx, [eax]
jg 0x5eff71
pop ebp
mov edx, 0x697f08c4
bound esi, qword [edi + 0x657431f1]
getsec
dec eax
adc dword [edx + 0x78], esp
pushal
mov eax, dword [esi - 0x58]
rcr byte [edx], 0x71
or byte [edi], dh
test al, 0xc0
sbb dh, byte [ecx + 8]
aaa
cmp cl, ah
push edx
loope 0x5eff72
loope 0x5eff8a
dec eax
ja 0x5eff02
out dx, eax
pop esp
test dword [ebp - 0x7d], esp
sbb byte [edi - 0x28], al
sub dh, ch
xchg ecx, eax
out 0x1c, al
insb byte es:[edi], dx
mov esp, 0x6200b51f
invalid
cwde
and edx, ebp
push ds
insb byte es:[edi], dx
mov cl, 0x4d
mov al, 0x31

Function at 0x622924
Capabilities:
Encode data using xor

Disassembly:
jmp 0x622981
pop ecx
xor al, 0x57
sub eax, 0x11b951fc
pop edx
ljmp 0x43ae
in eax, dx
scasb al, byte es:[edi]
inc ebx
cmp al, 0x3d
lea esp, [ecx - 2]
mov ebp, ebx
xor eax, 0x481bed27
dec ebx
bound esp, qword [edx - 0x4f76cbe9]
xchg ecx, eax
sbb byte [esi*8 + 0x6440bb19], 0x3c
pop ebp
jno 0x6229c7
mov esp, 0x5d0518e6
adc byte [edx], cl
xchg edx, eax
mov esp, 0x453479e2
jno 0x622979
iretd
and ebx, dword [ebx - 0x1b]
jle 0x6229a9
fisttp word [edx + 0x4e052bfe]
add eax, 0x5eb7cbff
popal
push cs
dec ebx
enter 0x10a8, 0xffffffffffffff9c
push ss
cmp edi, ebx
and eax, 0xd447bb0a
push ecx
rcl dword [ebx]
jne 0x62296c
sal dword [edi + 0xeec8d7d], 0x34
mov dword [ebp + 0x39a18ccd], ecx
mov ecx, dword [ecx + edx*8 + 0x27cb1409]
wait
and bh, byte [ebx + 0x70]
add edx, eax
fistp qword [ebp - 0x1b]
cmp al, 0xe7
pop ds
or bh, byte [ebx]
sbb al, 0x6c
je 0x6229d2
mov bh, 0x7d
invalid
dec edi
int3
Function at 0x64d7dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x656338
cmp edx, dword [eax]
je 0x64d7ff
add eax, 8
inc ecx
cmp eax, 0x6563c8
jl 0x64d7f0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x656338]
jne 0x64d92d
mov eax, dword [0xa59c90]
cmp eax, 1
je 0x64d907
test eax, eax
jne 0x64d830
cmp dword [0x656264], 1
je 0x64d907
cmp edx, 0xfc
je 0x64d92d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d867
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064e1c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e650
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64d8aa
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064e650
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
lea eax, [ebp + 8]
lea esi, [esi + 0x65633c]
push 0
push eax
push dword [esi]
call fcn.0064e650
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x40a618
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
push edi
lea ebx, [ecx + eax + 0x18]
jbe 0x40a6fa
add ebx, 0x10
mov eax, dword [ebx]
test eax, eax
jne 0x40a695
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x40a6e5
push dword [esi + 0x34]
mov eax, dword [ebx - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push edi
push eax
call dword [esi + 0x1c]
test eax, eax
je 0x40a704
mov edx, dword [ebx - 4]
add edx, dword [ebp - 4]
mov ecx, edi
mov dword [ebx - 8], edx
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x40a6e5
mov ecx, dword [ebx + 4]
add ecx, eax
mov eax, dword [ebp + 0xc]
push ecx
call fcn.0040a600
test eax, eax
je 0x40a704
push dword [esi + 0x34]
mov eax, dword [ebx - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push dword [ebx]
push eax
call dword [esi + 0x1c]
test eax, eax
je 0x40a704
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
add eax, dword [ebp - 4]
mov esi, dword [ebx + 4]
add esi, dword [ebp + 8]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov dword [ebx - 8], eax
mov eax, dword [esi]
movzx eax, word [eax + 6]
inc dword [ebp - 8]
add ebx, 0x28
cmp dword [ebp - 8], eax
jl 0x40a645
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x40a6fd
Function at 0x40b345
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x414050]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 8
pop ecx
push 0xf0000000
push 0x18
push 0x4013a4
xor ebx, ebx
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x30], cl
mov byte [ebp - 0x2f], 2
mov word [ebp - 0x2e], bx
mov dword [ebp - 0x2c], 0x6610
mov dword [ebp - 0x28], 0x20
lea edi, [ebp - 0x24]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x40b431
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push 0x2c
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
xor edi, edi
test eax, eax
je 0x40b425
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push ebx
lea eax, [ebp - 0x34]
push eax
push 4
push dword [ebp + 0xc]
inc edi
mov dword [ebp - 0x34], edi
call esi
test eax, eax
jne 0x40b3d4
xor edi, edi
jmp 0x40b41c
push ebx
lea eax, [ebp - 0x34]
push eax
push 3
push dword [ebp + 0xc]
mov dword [ebp - 0x34], edi
call esi
test eax, eax
je 0x40b3d0
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x40b3fc
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [ebp - 0x38]
push ecx
push eax
push ebx
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x40b3d0
push dword [ebp - 0x38]
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_int_]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00412b09
leave
ret 8
Function at 0x40cf7b
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push 0x28
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, eax
cmp edi, ebx
je 0x40d03d
mov eax, 0x1000
push esi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
xor eax, eax
cmp esi, ebx
setne al
pop ecx
mov edi, eax
cmp edi, ebx
je 0x40d022
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push 3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edi, eax
cmp edi, ebx
je 0x40d022
lea eax, [ebp - 0x10]
push eax
push 0x403928
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov edi, eax
cmp edi, ebx
je 0x40d022
mov dword [esi], 1
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 8], eax
lea eax, [ebp - 8]
push eax
push ebx
mov dword [esi + 0xc], 2
push dword [ebp - 8]
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edi, eax
cmp esi, ebx
je 0x40d02e
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - 4], ebx
pop esi
je 0x40d03d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebx
leave
ret
Function at 0x40e056
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x405e70
push 0xa
pop ebx
push ebx
call fcn.0040eaa1
push 0x405e28
push 0x14
call fcn.0040eaa1
add esp, 0x10
push 0x400007e2
call fcn.0040e5bb
call fcn.0040b63c
push 0x405e1c
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
cmp eax, esi
mov dword [0x414098], eax
jne 0x40e0d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x405dd8
push 0x20
call fcn.0040eaa1
push 0x405d78
push 0x20
call fcn.0040eaa1
push 0x405d30
push ebx
call fcn.0040eaa1
add esp, 0x1c
xor eax, eax
jmp 0x40e28d
push edi
push 0x405cf0
push ebx
call fcn.0040eaa1
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
pop ecx
pop ecx
push esi
push esi
push 1
push esi
call edi
cmp eax, esi
mov dword [0x41409c], eax
jne 0x40e13c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x405ca8
push 0x14
call fcn.0040eaa1
add esp, 0xc
push esi
push 0xc00007d0
call fcn.0040e62a
push 0x405c68
push 0x14
call fcn.0040eaa1
pop ecx
pop ecx
push 0xc00007e3
call fcn.0040e5bb
push 0x405d30
jmp 0x40e258
push eax
push 0x405c28
push esi
call fcn.0040eaa1
add esp, 0xc
call fcn.0040d043
test eax, eax
jne 0x40e16c
push 0x405be0
push 0x14
call fcn.0040eaa1
pop ecx
pop ecx
push 0xc00003fc
jmp 0x40e236
push 0x405b90
push ebx
call fcn.0040eaa1
pop ecx
pop ecx
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [0x4140a4], eax
jne 0x40e1a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x405b4c
push 0x14
call fcn.0040eaa1
add esp, 0xc
push esi
push 0xc00007d2
jmp 0x40e1fc
push eax
push 0x405b00
push esi
call fcn.0040eaa1
push 0x405ab8
push ebx
call fcn.0040eaa1
add esp, 0x14
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x411fee
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x4140a0], eax
jne 0x40e203
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x405a68
push 0x14
call fcn.0040eaa1
add esp, 0xc
push esi
push 0xc00007d5
call fcn.0040e62a
jmp 0x40e23b
push eax
push 0x405a18
push esi
call fcn.0040eaa1
add esp, 0xc
push dword [ebp + 0x10]
push 0x4141d0
call fcn.0040b727
test eax, eax
jne 0x40e269
push 0x4059d0
push 0x14
call fcn.0040eaa1
pop ecx
pop ecx
push 0xc00003ff
call fcn.0040e5bb
push 0x405980
push 0x14
call fcn.0040eaa1
pop ecx
pop ecx
push 0xc00007e3
call fcn.0040e5bb
push 0x405928
push ebx
call fcn.0040eaa1
pop ecx
pop ecx
call sym.snmpelea.dll_SnmpExtensionClose
xor eax, eax
jmp 0x40e28c
mov eax, dword [ebp + 8]
mov ecx, dword [0x4140a4]
mov dword [0x414074], eax
mov eax, dword [ebp + 0xc]
push 0x4058d8
push ebx
mov dword [eax], ecx
call fcn.0040eaa1
pop ecx
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40e293
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x4142f8], 0
je 0x40e3a2
push 0x405ed8
push 0x4142f8
call dword [sym.imp.msvcrt.dll_fopen]
test eax, eax
pop ecx
pop ecx
mov dword [0x415520], eax
je 0x40e3a2
cmp dword [ebp + 0xc], 0
je 0x40e317
push 0x415510
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [0x41551c]
push eax
movzx eax, word [0x41551a]
push eax
movzx eax, word [0x415518]
push eax
movzx eax, word [0x415510]
push eax
movzx eax, word [0x415516]
push eax
movzx eax, word [0x415512]
push eax
push 0x405eb8
push dword [0x415520]
call dword [sym.imp.msvcrt.dll_fprintf]
add esp, 0x20
cmp dword [ebp + 8], 0
je 0x40e364
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
mov esi, 0x414510
push 0xfff
push esi
mov byte [0x41550f], 0
call dword [sym.imp.msvcrt.dll__vsnprintf]
mov eax, esi
add esp, 0x10
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40e345
push dword [0x415520]
sub eax, ecx
push 1
push eax
push esi
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
pop esi
jmp 0x40e388
mov eax, dword [ebp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e36a
push dword [0x415520]
sub eax, edx
push 1
push eax
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
push dword [0x415520]
call dword [sym.imp.msvcrt.dll_fflush]
push dword [0x415520]
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
pop ecx
pop ebp
ret

Function at 0x40e3a4
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x414050]
push ebx
mov dword [ebp + 0x94], eax
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x406060
push 0x80000002
mov dword [ebp - 0x7c], 0x104
mov byte [ebp + 0x90], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x40e408
push eax
push 0x406000
push 1
push 1
call fcn.0040e293
add esp, 0x10
mov dword [0x4142f0], ebx
jmp 0x40e4bc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x405fec
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x40e44a
push eax
push 0x405f90
push 1
push 1
call fcn.0040e293
add esp, 0x10
push dword [ebp - 0x78]
mov dword [0x4142f0], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40e4bc
push esi
push edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x105
push edi
mov esi, 0x414400
push esi
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
je 0x40e49e
cmp eax, edi
ja 0x40e49e
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
cmp eax, ebx
mov dword [0x4142f0], eax
jne 0x40e4ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x405f40
push 1
push 1
call fcn.0040e293
jmp 0x40e4b7
push eax
lea eax, [ebp - 0x74]
push eax
push 0x405ee0
push 1
push 1
call fcn.0040e293
mov dword [0x4142f0], ebx
add esp, 0x14
pop edi
pop esi
mov ecx, dword [ebp + 0x94]
pop ebx
call fcn.00412b09
add ebp, 0x98
leave
ret
Function at 0x40e5bb
Capabilities:
Access the windows event log

Disassembly:
mov ecx, dword [0x414098]
push esi
xor esi, esi
cmp ecx, esi
je 0x40e60c
push dword [esp + 8]
call fcn.0040e58e
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x1c]
mov word [0x415530], ax
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
cmp eax, esi
mov dword [0x41552c], eax
jne 0x40e626
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4061a4
push 1
push 1
call fcn.0040e293
add esp, 0x10
jmp 0x40e61c
push 0x406164
push 1
push esi
call fcn.0040e293
add esp, 0xc
push esi
push dword [esp + 0xc]
call fcn.0040e4d0
pop esi
ret 4

Function at 0x40e62a
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x22
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
xor edi, edi
cmp dword [0x414098], edi
mov ecx, eax
mov dword [0x41553c], ecx
je 0x40e6b6
cmp ecx, edi
je 0x40e6e5
push dword [ebp + 8]
call fcn.0040e58e
push 0xa
push ecx
push dword [ebp + 0xc]
mov word [0x415538], ax
call dword [sym.imp.msvcrt.dll__ultoa]
add esp, 0xc
push edi
mov esi, 0x41553c
push esi
push edi
push 1
push edi
push dword [ebp + 8]
xor eax, eax
mov ax, word [0x415538]
push edi
push eax
push dword [0x414098]
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
cmp eax, edi
mov dword [0x415534], eax
jne 0x40e6fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4061a4
push 1
push 1
call fcn.0040e293
add esp, 0x10
push esi
jmp 0x40e6f6
push 0x406164
push 1
push edi
call fcn.0040e293
mov eax, dword [0x41553c]
add esp, 0xc
cmp eax, edi
je 0x40e6e5
push 0xa
push eax
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__ultoa]
add esp, 0xc
push 0x41553c
jmp 0x40e6f6
push 0x4061d8
push 1
push edi
call fcn.0040e293
add esp, 0xc
push edi
push dword [ebp + 8]
call fcn.0040e4d0
push dword [0x41553c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
pop ebp
ret 8
Function at 0x40e710
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x22
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
push 0x22
mov dword [0x415548], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
xor edi, edi
cmp dword [0x414098], edi
pop ecx
pop ecx
mov dword [0x41554c], eax
je 0x40e7c7
mov ecx, dword [0x415548]
cmp ecx, edi
je 0x40e80d
cmp eax, edi
je 0x40e80d
push dword [ebp + 8]
call fcn.0040e58e
mov esi, dword [sym.imp.msvcrt.dll__ultoa]
push 0xa
push ecx
push dword [ebp + 0xc]
mov word [0x415544], ax
call esi
push 0xa
push dword [0x41554c]
push dword [ebp + 0x10]
call esi
add esp, 0x18
push edi
mov esi, 0x415548
push esi
push edi
push 2
push edi
push dword [ebp + 8]
xor eax, eax
mov ax, word [0x415544]
push edi
push eax
push dword [0x414098]
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
cmp eax, edi
mov dword [0x415540], eax
jne 0x40e826
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4061a4
push 1
push 1
call fcn.0040e293
add esp, 0x10
push esi
jmp 0x40e81e
push 0x406164
push 1
push edi
call fcn.0040e293
mov eax, dword [0x415548]
add esp, 0xc
cmp eax, edi
je 0x40e80d
cmp dword [0x41554c], edi
je 0x40e80d
mov esi, dword [sym.imp.msvcrt.dll__ultoa]
push 0xa
push eax
push dword [ebp + 0xc]
call esi
push 0xa
push dword [0x41554c]
push dword [ebp + 0x10]
call esi
add esp, 0x18
push 0x415548
jmp 0x40e81e
push 0x4061d8
push 1
push edi
call fcn.0040e293
add esp, 0xc
push edi
push dword [ebp + 8]
call fcn.0040e4d0
push dword [0x415548]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [0x41554c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
pop edi
pop esi
pop ebp
ret 0xc