joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13157bd8
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.13157910
xor eax, eax
push ebp
push 0x13157c57
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.13143dac
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x13157c11
call fcn.131438b8
jmp 0x13157c5e
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x13157c41
push dword [ebp - 0x14]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.13143fa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13157c5e
mov eax, dword [ebp - 4]
call fcn.1315791c
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x13157c64
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.1314426c
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.13142b00
test ebx, ebx
je 0x13157caf
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret

Function at 0x13157d8c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x13157dbd
mov ecx, dword [0x1315c55c]
mov dl, 1
mov eax, dword [0x13156c24]
call fcn.1314a624
call fcn.1314380c
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x13157dea
mov ecx, dword [0x1315c520]
mov dl, 1
mov eax, dword [0x13156c24]
call fcn.1314a624
call fcn.1314380c
xor eax, eax
push ebp
push 0x13157e66
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.13143294
cmp byte [ebp + 8], 0
je 0x13157e42
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.13157cf4
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.13157b50
jmp 0x13157e5c
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.13157654
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13157e83
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x13158064
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.13157910
xor eax, eax
push ebp
push 0x131581d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x131581bf
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x131580af
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x131580b9
call fcn.131438b8
jmp 0x131581dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.13152c64
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x131581b4
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x13158167
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x13158154
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.13143294
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.1315801c
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x131581e8]
cmp dl, byte [eax + 0x28]
je 0x131581bb
call fcn.1314a548
jmp 0x131581bb
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.13152c84
jmp 0x131581bb
cmp ecx, ebx
jge 0x13158183
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.13152c84
jmp 0x131580b9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.13152c64
cmp edx, dword [esp + 4]
jne 0x131581a3
cmp eax, dword [esp]
pop edx
pop eax
jne 0x131580b9
push ebp
call fcn.1315801c
pop ecx
jmp 0x131581bb
push ebp
call fcn.1315801c
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131581dc
mov eax, dword [ebp - 4]
call fcn.1315791c
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x131581ec
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x1315830e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.13157910
xor eax, eax
push ebp
push 0x131582f1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x1315823c
call fcn.131438b8
jmp 0x131582f8
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x131582db
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x131582db
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.13143294
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x131582db
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.13149d3c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x13158328
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x1315c5cc]
mov dl, 1
mov eax, dword [0x13156c24]
call fcn.1314a660
call fcn.1314380c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131582f8
mov eax, dword [ebp - 4]
call fcn.1315791c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13158315
lea eax, [ebp - 0x28]
call fcn.13143dac
ret
Function at 0x13158374
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x131584be
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.13157910
xor eax, eax
push ebp
push 0x131584a1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x131583d9
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x131583d9
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x1315848b
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x131583ec
call fcn.131438b8
jmp 0x131584a8
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1315848b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x1315848b
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.13143294
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x1315848b
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.13149d3c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x131584d8
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x1315c5cc]
mov dl, 1
mov eax, dword [0x13156c24]
call fcn.1314a660
call fcn.1314380c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131584a8
mov eax, dword [ebp - 4]
call fcn.1315791c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131584c5
lea eax, [ebp - 0x28]
call fcn.13143dac
ret
Function at 0x13158fa4
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x13158fe8
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x13158fe8
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x1315907f
mov eax, 0x400
call fcn.1314267c
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x13159078
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x1315c3ec
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x1315906e
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x1315906a
mov byte [esp], 1
jmp 0x1315906e
inc edi
dec ebx
jne 0x13159051
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.1314269c
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x13159128
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.1314425c
xor eax, eax
push ebp
push 0x13159233
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.131590c4
mov esi, eax
test esi, esi
jle 0x13159215
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.131442cc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.1314426c
push eax
push edi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x13159215
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.1314406c
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.131442cc
cmp dword [ebp - 0xc], 0
jne 0x131591e7
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
jmp 0x1315920c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.1314426c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1315923a
lea eax, [ebp - 0xc]
call fcn.13143dac
lea eax, [ebp - 4]
call fcn.13143dac
ret
Function at 0x13159248
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.1314425c
xor eax, eax
push ebp
push 0x1315937c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.131590c4
mov esi, eax
test esi, esi
jle 0x1315935e
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.131442cc
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0xc]
call fcn.1314426c
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x1315935e
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.1314406c
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.131442cc
cmp dword [ebp - 0xc], 0
jne 0x131592e5
xor esi, esi
jmp 0x131592ef
mov eax, dword [ebp - 0xc]
call fcn.1314426c
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x13159355
mov eax, dword [ebp - 0x18]
call fcn.1314267c
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x1315934e
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jne 0x13159345
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov bl, 1
jmp 0x13159355
mov eax, edi
call fcn.1314269c
jmp 0x13159355
mov eax, edi
call fcn.1314269c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13159383
lea eax, [ebp - 0xc]
call fcn.13143dac
lea eax, [ebp - 4]
call fcn.13143dac
ret
Function at 0x131594d0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.1314425c
xor eax, eax
push ebp
push 0x13159593
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.131590c4
mov esi, eax
test esi, esi
jle 0x13159578
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.131442cc
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 8]
call fcn.1314426c
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x13159578
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.1314406c
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.131442cc
mov eax, dword [ebp - 8]
call fcn.1314426c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1315959a
lea eax, [ebp - 8]
mov edx, 2
call fcn.13143dd0
ret
Function at 0x13159923
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [eax], 0xfffff000
jne 0x13159938
mov dl, byte [eax + 5]
cmp dl, 0xe8
je 0x1315993d
cmp dl, 0xcc
je 0x1315993d
dec eax
dec ecx
jne fcn.13159923
ret
add eax, 0xa
add eax, dword [eax - 4]
ret

Function at 0x13159fc4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
push 0
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x1315a057
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x1315a068
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SizeofResource
mov edi, eax
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
push ebx
call sub.kernel32.dll_LockResource
mov esi, eax
test esi, esi
je 0x1315a040
mov edx, edi
dec edx
mov eax, dword [ebp - 4]
call fcn.1314439c
mov eax, dword [ebp - 4]
call fcn.131442c4
mov ecx, edi
mov edx, esi
call fcn.13145e30
push ebx
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1315a05e
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x1315a268
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.1314425c
xor eax, eax
push ebp
push 0x1315a314
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.1314426c
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
test edi, edi
je 0x1315a2fe
push 0
push edi
call sub.kernel32.dll_GetFileSize
mov esi, eax
push 0
push 0
push 0
push edi
call sub.kernel32.dll_SetFilePointer
push esi
mov eax, dword [ebp - 8]
mov ecx, 1
mov edx, dword [0x13158bf0]
call fcn.13144c10
add esp, 4
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
push edi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x1315a2f8
mov bl, 1
push edi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1315a31b
lea eax, [ebp - 4]
call fcn.13143dac
ret

Function at 0x1315a3d0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe70
mov ebp, edx
mov ebx, eax
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
call fcn.13143dac
mov eax, ebx
call fcn.1314426c
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x1315a425
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x1315a419
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebp
call fcn.13143fa4
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x1315a408
call sub.wsock32.dll_WSACleanup
add esp, 0x190
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1315a834
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1315a8ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.1314439c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.1314426c
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x1315a88c
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.131442cc
jmp 0x1315a898
mov eax, ebx
mov edx, 0x1315a8c4
call fcn.13143e00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1315a8b5
lea eax, [ebp - 4]
call fcn.13143dac
ret

Function at 0x1315ab42
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov esi, eax
mov eax, esi
mov edx, 0x1315ab94
call fcn.13143e00
push 5
lea eax, [esp + 9]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp eax, 3
sete bl
test bl, bl
je 0x1315ab70
push 5
lea eax, [esp + 4]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp eax, 3
je 0x1315ab74
xor eax, eax
jmp 0x1315ab76
mov al, 1
mov ebx, eax
test bl, bl
je 0x1315ab85
mov eax, esi
mov edx, esp
call fcn.13143fa4
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x403e59
pop dword [ebp - 0x34]
mov eax, 0x1c9121b1
add eax, 0xe3af1ca8
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xd175e3cf
sub dword [ebp - 0x44], 0x83239e84
mov dword [ebp - 0x40], 0xe286b19c
sub dword [ebp - 0x40], 0xb0536557
mov dword [ebp - 0x3c], 0x5c7b1db9
add dword [ebp - 0x3c], 0xefd12675
mov dword [ebp - 0x38], 0xb0e08e5f
add dword [ebp - 0x38], 0x4f1f71a1
lea eax, [ebp - 0x44]
push eax
mov eax, 0x98b5633f
add eax, 0x678b0d25
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x6700bc11
add dword [ebp - 0x44], 0xd71ad45
mov dword [ebp - 0x40], 0xef3ec244
add dword [ebp - 0x40], 0x522d9f31
mov dword [ebp - 0x3c], 0xe831c1cd
add dword [ebp - 0x3c], 0x7b3daa9f
mov dword [ebp - 0x38], 0x806f79d8
add dword [ebp - 0x38], 0x7f908628
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3919d
push 0
call eax
mov ecx, 0xe5822895
sub ecx, 0xe581d72b
xor esi, esi
add esi, eax
mov edx, 0x410000
add edx, dword [ebp - 0x34]
mov ebx, 0xa454be4b
sub ebx, 0xa50cea6
mov edi, dword [edx]
sub dword [ebp - 0x18], eax
xor edi, ebx
mov dword [ebp - 0x2c], 0x9319e324
mov dword [esi], edi
xor dword [ebp - 0x20], 0x769a1ff5
add esi, 0x2642a878
sub esi, 0x2642a874
add edx, 0xc38e474b
add edx, 0x3c71b8b9
loop 0x403f72
add eax, 0x1387b
mov ebx, eax
add eax, 0xf613c117
sub eax, 0xf613c112
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x100012a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x30]
mov esi, dword [ecx + eax + 0x20]
dec edx
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x18], edx
test esi, esi
jne 0x100012e3
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x100012dc
mov esi, dword [eax + 0x20]
jmp 0x100012e3
test bl, bl
jns 0x100012e3
mov esi, dword [eax + 0x24]
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 0x24]
mov dword [ebp - 0x10], esi
mov esi, 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
cmp si, word [eax + 6]
jae 0x100013b0
lea ebx, [ecx + 0x4c]
lea esp, [esp]
mov esi, dword [edi + 0x30]
mov ecx, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
dec esi
not esi
and esi, ecx
mov dword [ebp - 4], ecx
test edi, edi
jne 0x10001338
mov ecx, dword [ebx]
test cl, 0x40
je 0x10001331
mov edi, dword [eax + 0x20]
jmp 0x10001338
test cl, cl
jns 0x10001338
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x10001367
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
cmp eax, esi
ja 0x10001367
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.100011f0
test eax, eax
je 0x100013d0
mov edx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [ebp - 0x1c], edx
mov edx, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
jmp 0x1000138f
mov eax, dword [ebx]
test eax, 0x2000000
je 0x1000137e
test dword [ebp - 0x10], 0x2000000
je 0x1000137e
or dword [ebp - 0x10], eax
jmp 0x10001389
or eax, dword [ebp - 0x10]
and eax, 0xfdffffff
mov dword [ebp - 0x10], eax
sub edi, dword [ebp - 0x1c]
add edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
movzx esi, word [eax + 6]
inc ecx
add ebx, 0x28
mov dword [ebp - 0x14], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp ecx, esi
jl 0x10001310
lea ecx, [ebp - 0x1c]
mov edx, edi
mov dword [ebp - 0xc], 1
call fcn.100011f0
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4