joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bddb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5bde4a.0
jmp dword [ecx*4 + 0x5bdde3]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5bde15
sub dl, 8
je 0x5bde24
jmp case.0x5bde4a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5bda7c
jmp case.0x5bde4a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5bdad0
jmp case.0x5bde4a.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5bde4a.0
movzx ecx, byte [ecx + 0x5bde51]
jmp dword [ecx*4 + 0x5bde62]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5bdb70
jmp case.0x5bde4a.0
cmp dl, 3
jne 0x5bde8f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5bdbc8
jmp case.0x5bde4a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5bdb84
jmp case.0x5bde4a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5bdc0c
jmp case.0x5bde4a.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5bdeba
sub dl, 8
je 0x5bdec6
jmp case.0x5bde4a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5bdc38
jmp case.0x5bde4a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5bdc9c
jmp case.0x5bde4a.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5bdee5
sub dl, 8
je 0x5bdef1
jmp case.0x5bde4a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5bdd4c
jmp case.0x5bde4a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5bdd74
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x5bdf93
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005bcfb8
test eax, eax
je 0x5bdf93
mov eax, ebx
call fcn.005bdf9c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5bdf2c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5bdf9c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5bdfcd
dec al
je 0x5be008
dec al
je 0x5be04d
dec al
je 0x5be0b6
jmp 0x5be140
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5be140
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5bdfdd
jmp 0x5be140
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5be140
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5be018
jmp 0x5be140
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5be140
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5be07c
xor ebp, ebp
jmp 0x5be08c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x5be095
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5be05d
jmp 0x5be140
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5be140
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5be10f
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005bb0fc
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5be0ca
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5c7e1c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5c7e4a
mov eax, ebx
call fcn.005c88d8
cmp dword [ebx + 0x40], 0
je 0x5c7e43
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5c7ebb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5c7ead
cmp dword [ebx + 8], 0
je 0x5c7e6c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5c7e7e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5c7ead
cmp dword [ebx + 8], 0
je 0x5c7e5f
cmp eax, 3
je 0x5c7e91
dec eax
jne 0x5c7e5f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5c7e5f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5c7e5f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5c7ed9
cmp dword [ebx + 0x14], 0xcc
je 0x5c7ed9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005c7ee4
pop ebx
ret

Function at 0x5d8bd4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5d8ca7
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, dword [0x5eb1d0]
mov eax, dword [eax]
call fcn.00577cec
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00422fec
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00428f34
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0x5d8cc0
call fcn.00409edc
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.005d8a80
cmp dword [ebp - 8], 0
jne 0x5d8c52
lea edx, [ebp - 0x18]
mov ax, 0x409
call fcn.005d84b0
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005d8a80
cmp dword [ebp - 8], 0
je 0x5d8c8c
mov eax, dword [0x5eb1d0]
mov eax, dword [eax]
add eax, 0x54
mov edx, dword [ebp - 8]
call fcn.004094ec
push 1
push 0
push 0
mov eax, dword [0x5eb1d0]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
call fcn.00409c70
push eax
push 0x5d8ccc
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d8cae
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040916c
ret
Function at 0x4014d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414a00
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x41d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x21
xor eax, eax
mov dword [ebp - 0x224], 0
push str.Intel_R__WMI_Registration_Service
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
call fcn.00402600
push 2
push 0x4153d4
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0
call fcn.00402470
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push eax
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.00405ad0
mov ecx, dword [ebp - 0x224]
lea eax, [ebp + 0xc]
add esp, 0xc
push eax
push 0
push dword [ebp + 8]
mov eax, 0x104
sub eax, ecx
push eax
lea eax, [ebp - 0x21c]
lea eax, [eax + ecx*2]
push eax
call fcn.00402730
push dword [eax + 4]
push dword [eax]
call fcn.00407cca
add esp, 0x1c
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp - 0x220]
cmp edx, 8
jb 0x4015e8
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4015de
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401601
push edx
push ecx
call fcn.004027d2
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004027e0
mov esp, ebp
pop ebp
ret
call fcn.00405a7f
int3
Function at 0x40c0c6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40c163
push ebx
push esi
call fcn.0040c08f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040bfd8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40c110
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c162
push edi
push eax
call fcn.00409864
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40c130
call fcn.0040982a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c161
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040bfd8
add esp, 0x20
test eax, eax
jne 0x40c14f
push edi
call fcn.0040982a
jmp 0x40c157
push ebx
call fcn.0040982a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40d16b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x417ca0
push 0x417c98
push str.FlsAlloc
push 0x1e
call fcn.0040d02c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d19f
push dword [ebp + 8]
mov ecx, esi
call dword [0x415170]
call esi
jmp 0x40d1a5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d1e9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x417cb0
push 0x417ca8
push str.FlsGetValue
push 0x20
call fcn.0040d02c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d220
push dword [ebp + 8]
mov ecx, esi
call dword [0x415170]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x407ef8
mov ecx, 0x1dfc40b0
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x1cc33a61
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x402b08
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403778
test esi, esi
jne 0x402b3f
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00403868
jmp 0x402b60
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.004029a4
mov dword [esp], eax
test esi, esi
je 0x402b60
cmp dword [ebx], 0
je 0x402b60
dec esi
jmp 0x402b47
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x402d30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40f018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402dc8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402da8
xor eax, eax
push ebp
push 0x402da1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402de4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402da8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40f018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40f018], ax
mov esp, ebp
pop ebp
ret

Function at 0x4035f4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x410034], 0
je 0x403655
cmp word [0x410208], 0xd7b2
jne 0x40361d
cmp dword [0x410210], 0
jbe 0x40361d
mov eax, 0x410204
call dword [0x410220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40f060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40367c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40f024], 0
jne 0x403671
push 0
push 0x40f058
push 0x40f060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405080
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4050e6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004039e8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402bf4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4050d0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4050ed
lea eax, [ebp - 0x10]
call fcn.00403778
ret
Function at 0x405698
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x405716
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
push 0x3000
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403970
mov eax, dword [ebp - 8]
call fcn.00403a14
inc eax
push eax
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00403970
mov eax, dword [ebp - 0xc]
call fcn.00403a14
inc eax
push eax
push ebx
push edi
push esi
call sub.kernel32.dll_WriteProcessMemory
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40571d
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040379c
ret

Function at 0x405728
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov ebp, edx
mov ebx, eax
push 0x40
push 0x3000
push esi
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
push esp
push esi
push ebp
push edi
push ebx
call sub.kernel32.dll_WriteProcessMemory
mov eax, edi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x405758
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00405728
mov esi, eax
mov eax, edi
call fcn.00405688
mov ecx, eax
mov edx, edi
mov eax, ebx
call fcn.00405728
lea edx, [ebp - 0xc]
push edx
push 0
push esi
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
mov edi, eax
cmp byte [ebp + 8], 0
je 0x4057be
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_ReadProcessMemory
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x405b44
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x405b53
or edx, 0x200
test eax, 0x20000000
je 0x405b87
test eax, 0x40000000
je 0x405b72
test eax, 0x80000000
je 0x405b6d
or edx, 0x40
jmp 0x405bae
or edx, 0x20
jmp 0x405bae
test eax, 0x80000000
je 0x405b81
or edx, 0x80
jmp 0x405bae
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x405b9f
test eax, 0x80000000
je 0x405b9a
or edx, 4
jmp 0x405bae
or edx, 2
jmp 0x405bae
test eax, 0x80000000
je 0x405bab
or edx, 8
jmp 0x405bae
or edx, 1
mov eax, edx
ret
Function at 0x405fa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
mov edx, dword [0x405668]
call fcn.00404120
xor eax, eax
push ebp
push 0x4060b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edi, eax
mov esi, 0x10000000
add esi, 0x10000
push 0x40
push 0x3000
mov eax, dword [edi + 0x50]
push eax
mov eax, dword [edi + 0x34]
add eax, esi
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
test ebx, ebx
je 0x406039
push 0x8000
push 0
push ebx
call sub.kernel32.dll_VirtualFree_1
push 0x40
push 0x3000
mov eax, dword [edi + 0x50]
push eax
mov eax, dword [edi + 0x34]
add eax, esi
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov ebx, eax
test ebx, ebx
jne 0x406045
cmp esi, 0x30000000
jbe 0x405fee
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405d6c
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x406095
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x18]
push edx
mov edx, dword [ebp - 0x28]
push edx
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteProcessMemory
push 8
push 0
lea ecx, [ebp - 0x14]
mov edx, 0x405f78
mov eax, dword [ebp - 4]
call fcn.00405758
test eax, eax
je 0x406095
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4060b8
lea eax, [ebp - 0x2c]
mov edx, dword [0x405668]
call fcn.004041e4
ret

Function at 0x406188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403c04
xor eax, eax
push ebp
push 0x4061f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403a14
mov esi, eax
test esi, esi
jle 0x4061d7
mov ebx, 1
lea eax, [ebp - 4]
call fcn.00403c6c
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor dl, 0xbc
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4061bd
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004037cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4061fe
lea eax, [ebp - 4]
call fcn.00403778
ret
Function at 0x4065c0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406649
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403778
mov dword [ebp - 4], 0x64
mov eax, dword [ebp - 4]
call fcn.00402850
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0x108]
mov edx, ebx
call fcn.00402cc8
lea edx, [ebp - 0x108]
lea eax, [ebp - 8]
call fcn.004039dc
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, 0x406660
call fcn.00403a60
mov eax, ebx
call fcn.00402880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406650
lea eax, [ebp - 8]
call fcn.00403778
ret

Function at 0x406664
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4066ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403778
mov dword [ebp - 4], 0x64
mov eax, dword [ebp - 4]
call fcn.00402850
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0x108]
mov edx, ebx
call fcn.00402cc8
lea edx, [ebp - 0x108]
lea eax, [ebp - 8]
call fcn.004039dc
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, 0x406704
call fcn.00403a60
mov eax, ebx
call fcn.00402880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4066f4
lea eax, [ebp - 8]
call fcn.00403778
ret

Function at 0x406850
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4068d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403778
mov dword [ebp - 4], 0x64
mov eax, dword [ebp - 4]
call fcn.00402850
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0x108]
mov edx, ebx
call fcn.00402cc8
lea edx, [ebp - 0x108]
lea eax, [ebp - 8]
call fcn.004039dc
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, 0x4068f0
call fcn.00403a60
mov eax, ebx
call fcn.00402880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4068e0
lea eax, [ebp - 8]
call fcn.00403778
ret

Function at 0x4068f4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406969
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403778
mov dword [ebp - 4], 0x64
mov eax, dword [ebp - 4]
call fcn.00402850
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403970
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, 0x406980
call fcn.00403a60
mov eax, ebx
call fcn.00402880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406970
lea eax, [ebp - 8]
call fcn.00403778
ret