joyce8/EMBER2024-capa huggingface dataset:
Function at 0x91080
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
push 0x61
mov dword [esp + 0x1c], 0
call fcn.00049640
mov ebx, eax
mov dword [esp + 0x10], ebx
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, ebx
jne 0x910b3
xor ebx, ebx
mov dword [esp + 0x10], ebx
jmp 0x910c3
test ebx, ebx
je 0x910c3
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push 0x20
call fcn.00049640
push 0x21
mov esi, eax
call fcn.00049640
push 3
mov dword [esp + 0x18], eax
call fcn.00049640
push 0x20
mov dword [esp + 0x20], eax
mov edi, 0x1000000
call fcn.00049640
push 0x21
mov ecx, eax
call fcn.00049640
push 0x48b5
mov edx, eax
call fcn.00049640
test ecx, ecx
je 0x91122
test edx, edx
je 0x91122
test eax, eax
je 0x91122
cmp eax, edx
jae 0x91122
lea ebx, [eax + 5]
cmp ebx, edx
mov ebx, dword [esp + 0x10]
ja 0x91122
mov edi, dword [eax + ecx + 1]
push 0x42
call fcn.00049640
test esi, esi
je 0x9117a
cmp dword [esp + 0x14], 0
je 0x9117a
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x9117a
test edi, edi
je 0x9117a
cmp edi, eax
jae 0x9117a
call fcn.0008b350
mov ecx, eax
test ecx, ecx
je 0x9117a
cmp ecx, dword [esp + 0x14]
jae 0x9117a
push ecx
push 0x234
call fcn.00049620
lea edi, [ecx + esi]
push edi
push 0x186
call fcn.00049620
mov eax, 0x32
call fcn.00088810
jmp 0x9117e
mov edi, dword [esp + 0x18]
test ebx, ebx
je 0x9118d
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x93480
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
xor ecx, ecx
mov eax, 0xf
cmp dx, word [edi]
je 0x93499
mov edi, edi
inc ecx
xor edx, edx
cmp dx, word [edi + ecx*2]
jne 0x93490
xor edx, edx
push esi
test ecx, ecx
je 0x934ad
movzx esi, word [edi + edx*2]
add eax, esi
inc edx
xor eax, esi
cmp edx, ecx
jb 0x934a0
xor edx, edx
test ecx, ecx
je 0x934b6
movzx edx, byte [edi]
shl eax, 0xe
or eax, edx
add eax, eax
add eax, eax
push eax
push 0x1e0
call fcn.00049620
lea esi, [ecx + ecx]
xor eax, eax
mov dl, 0xf
test esi, esi
je 0x934ef
mov cl, byte [eax + edi]
test cl, cl
jne 0x934e8
mov cl, dl
shl cl, 4
shr dl, 4
add dl, cl
jmp 0x934ea
xor dl, cl
inc eax
cmp eax, esi
jb 0x934d5
movzx edx, dl
push edx
push 0x1e1
call fcn.00049620
pop esi
ret
Function at 0x95810
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
mov esi, dword [ebp + 8]
mov edx, dword [esi + 4]
push edi
xor cl, cl
push 0x494c
mov byte [esp + 0x11], cl
mov dword [esp + 0x18], edx
call fcn.00049640
push 0x48ad
mov edi, eax
call fcn.00049640
push 0x48d1
mov ebx, eax
call fcn.00049640
mov dword [esp + 0x24], eax
test ebx, ebx
je 0x95a07
test eax, eax
je 0x95a07
push 0
mov eax, edx
call fcn.00063350
cmp al, 1
jne 0x959fa
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov esi, dword [esi + 8]
mov eax, 0x1db0
cmp ax, word [ecx]
ja 0x95898
test edi, edi
je 0x95898
mov edx, dword [esp + 0x14]
cmp dword [edi], edx
jne 0x95898
or esi, 0x80000000
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov edi, dword [esp + 0x14]
cmp eax, edi
setne al
mov byte [esp + 0xe], al
cmp al, 1
jne 0x958f4
mov edx, edi
call fcn.0008a7b0
push 0x19
mov byte [esp + 0x13], al
call fcn.00088910
push 0xe
mov byte [esp + 0x1c], al
call fcn.00088910
mov byte [esp + 0x20], al
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov ecx, dword [esp + 0x20]
push ecx
push 0xe
call fcn.00088aa0
mov edx, dword [esp + 0x18]
push edx
push 0x19
call fcn.00088aa0
push 0x36
call fcn.00049640
test eax, eax
je 0x959ac
cmp dword [eax + edi], 0
je 0x959ac
push 2
call fcn.00088910
push 0
mov byte [esp + 0x24], al
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0x80000000
push esi
call ebx
mov ecx, dword [esp + 0x20]
push ecx
push 2
mov edi, eax
call fcn.00088aa0
test edi, edi
js 0x959a8
mov edi, dword [ebp + 8]
mov edx, dword [esp + 0x1c]
cmp edx, dword [edi + 0xc]
jne 0x9599e
push 0
push 2
lea eax, [esp + 0x18]
push eax
push 4
push esi
call dword [esp + 0x38]
test eax, eax
js 0x9599e
cmp byte [edi + 0x10], 0
jne 0x9596c
cmp byte [esp + 0x11], 0
jne 0x9599e
jmp 0x95992
cmp byte [esp + 0x11], 1
jne 0x95992
push 0x48d4
call fcn.00049640
test eax, eax
je 0x95992
push 2
lea ecx, [esp + 0x14]
push ecx
push 4
push esi
mov byte [esp + 0x21], 0
call eax
push esi
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov byte [esp + 0xd], 1
mov ecx, dword [esp + 0x1c]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov edi, dword [esp + 0x14]
cmp byte [esp + 0xe], 1
jne 0x959fa
push 0x19
call fcn.00088910
push 0xf
mov byte [esp + 0x1c], al
call fcn.00088910
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x28], al
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, dword [esp + 0x24]
push eax
push 0xf
call fcn.00088aa0
mov ecx, dword [esp + 0x18]
push ecx
push 0x19
call fcn.00088aa0
cmp byte [esp + 0xf], 1
jne 0x959fa
mov ecx, edi
call fcn.0008a870
mov al, byte [esp + 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x95ce0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
push ebx
push esi
push edi
push 0x4904
call fcn.00049640
push 0x48da
mov ecx, eax
call fcn.00049640
push 0x4a1b
mov esi, eax
call fcn.00049640
xor edi, edi
mov dword [esp + 0x14], eax
cmp ecx, edi
je 0x95f02
cmp esi, edi
je 0x95f02
cmp eax, edi
je 0x95f02
mov eax, 0x740066
mov edx, 0x6e0069
mov dword [esp + 0x58], eax
mov dword [esp + 0x74], eax
lea eax, [esp + 0x30]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x7c], edx
push eax
lea edx, [esp + 0xb4]
push edx
mov dword [esp + 0x38], 0x52005c
mov dword [esp + 0x3c], 0x670065
mov dword [esp + 0x40], 0x730069
mov dword [esp + 0x44], 0x720074
mov dword [esp + 0x48], 0x5c0079
mov dword [esp + 0x4c], 0x61004d
mov dword [esp + 0x50], 0x680063
mov dword [esp + 0x58], 0x5c0065
mov dword [esp + 0x5c], 0x6f0053
mov dword [esp + 0x64], 0x610077
mov dword [esp + 0x68], 0x650072
mov dword [esp + 0x6c], 0x4d005c
mov dword [esp + 0x70], 0x630069
mov dword [esp + 0x74], 0x6f0072
mov dword [esp + 0x78], 0x6f0073
mov dword [esp + 0x80], 0x57005c
mov dword [esp + 0x88], 0x6f0064
mov dword [esp + 0x8c], 0x730077
mov dword [esp + 0x90], 0x4e0020
mov dword [esp + 0x94], 0x5c0054
mov dword [esp + 0x98], 0x750043
mov dword [esp + 0x9c], 0x720072
mov dword [esp + 0xa0], 0x6e0065
mov dword [esp + 0xa4], 0x560074
mov dword [esp + 0xa8], 0x720065
mov dword [esp + 0xac], 0x690073
mov dword [esp + 0xb0], 0x6e006f
mov dword [esp + 0xb4], edi
call ecx
lea ecx, [esp + 0x18]
push ecx
push 0x20019
lea edx, [esp + 0x18]
lea eax, [esp + 0xb8]
push edx
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], 0x240
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
call esi
test eax, eax
js 0x95f02
call fcn.0008a110
mov ebx, eax
cmp ebx, edi
je 0x95ef9
mov esi, dword [ebx]
push 0x878
lea edx, [ebx + 4]
call fcn.00049640
xor ecx, ecx
cmp esi, edi
jbe 0x95ee7
mov edi, dword [esp + 0x10]
jmp 0x95ec0
cmp word [edx + 6], di
jne 0x95ecb
cmp word [edx], ax
je 0x95ed5
inc ecx
add edx, 0x10
cmp ecx, esi
jb 0x95ec0
jmp 0x95ee7
add ecx, ecx
movzx eax, byte [ebx + ecx*8 + 8]
push eax
push 0x316
call fcn.00049620
push 0x877
call fcn.00049640
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [esp + 0x10]
push ecx
call dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x96530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, 0x790073
push ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x5c]
xor bl, bl
mov dword [ebp - 0x5c], 0x53005c
mov dword [ebp - 0x58], 0x730079
mov dword [ebp - 0x54], 0x650074
mov dword [ebp - 0x50], 0x52006d
mov dword [ebp - 0x4c], 0x6f006f
mov dword [ebp - 0x48], 0x5c0074
mov dword [ebp - 0x40], 0x740073
mov dword [ebp - 0x3c], 0x6d0065
mov dword [ebp - 0x38], 0x320033
mov dword [ebp - 0x34], 0x64005c
mov dword [ebp - 0x30], 0x690072
mov dword [ebp - 0x2c], 0x650076
mov dword [ebp - 0x28], 0x730072
mov dword [ebp - 0x24], 0x77005c
mov dword [ebp - 0x20], 0x660064
mov dword [ebp - 0x1c], 0x310030
mov dword [ebp - 0x18], 0x300030
mov dword [ebp - 0x14], 0x2e0030
mov dword [ebp - 0xc], 0x73
call fcn.0004d700
test eax, eax
jne 0x9660d
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push esi
mov esi, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push edx
push eax
push ecx
push esi
call fcn.00014940
cmp al, 1
jne 0x965fa
mov bl, al
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x97070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
lea eax, [ebp - 0x24]
xor ebx, ebx
push eax
mov dword [ebp - 0x24], 0x44005c
mov dword [ebp - 0x20], 0x690072
mov dword [ebp - 0x1c], 0x650076
mov dword [ebp - 0x18], 0x5c0072
mov dword [ebp - 0x14], 0x640077
mov dword [ebp - 0x10], 0x300066
mov dword [ebp - 0xc], 0x300031
mov dword [ebp - 8], 0x300030
mov dword [ebp - 4], ebx
call fcn.0008b990
cmp eax, ebx
je 0x97118
lea edx, [eax + 0x3c]
mov eax, dword [ebp + 8]
lea ecx, [ebx + 2]
add eax, 0x24
push esi
mov edi, edi
lea esi, [ecx - 2]
mov dword [eax - 0x24], esi
mov esi, dword [edx - 4]
mov dword [eax - 0x18], esi
lea esi, [ecx - 1]
mov dword [eax], esi
mov esi, dword [edx]
mov dword [eax + 0xc], esi
mov dword [eax + 0x24], ecx
mov esi, dword [edx + 4]
mov dword [eax + 0x30], esi
lea esi, [ecx + 1]
mov dword [eax + 0x48], esi
mov esi, dword [edx + 8]
add ecx, 4
mov dword [eax + 0x54], esi
lea esi, [ecx - 2]
add edx, 0x10
add eax, 0x90
cmp esi, 0x1b
jbe 0x970d0
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x973b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
lea eax, [ebp - 0x34]
xor ebx, ebx
push eax
mov dword [ebp - 0x34], 0x44005c
mov dword [ebp - 0x30], 0x690072
mov dword [ebp - 0x2c], 0x650076
mov dword [ebp - 0x28], 0x5c0072
mov dword [ebp - 0x24], 0x640077
mov dword [ebp - 0x20], 0x300066
mov dword [ebp - 0x1c], 0x300031
mov dword [ebp - 0x18], 0x300030
mov dword [ebp - 0x14], ebx
call fcn.0008b990
cmp eax, ebx
je 0x97445
mov ecx, dword [esi]
cmp ecx, 0x1b
ja 0x97445
mov edx, dword [esi + 8]
lea eax, [eax + ecx*4 + 0x38]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ebx
push eax
cli
mov eax, cr0
mov dword [ebp - 4], eax
and eax, 0xfffeffff
mov cr0, eax
push ebx
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
lock xchg dword [eax], ebx
mov dword [ebp - 8], ebx
pop ebx
mov eax, dword [ebp - 4]
mov cr0, eax
sti
pop eax
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x97bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push 0x8f6
mov esi, eax
mov dword [ebp - 4], 0
call fcn.00049640
mov dword [ebp - 8], eax
test eax, eax
je 0x97cb1
push 0x8fb
call fcn.00049640
test eax, eax
jne 0x97cb1
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edi
mov dword [ebp - 0x20], 0x7355744e
mov dword [ebp - 0x1c], 0x75427265
mov dword [ebp - 0x18], 0x48646c69
mov dword [ebp - 0x14], 0x4c646e77
mov dword [ebp - 0x10], 0x747369
call fcn.00014f40
cmp al, 1
jne 0x97c5a
mov eax, dword [ebp - 4]
test eax, eax
je 0x97c5a
cmp eax, edi
jae 0x97c5a
mov edx, dword [ebp - 8]
add edx, eax
push edx
push 0x1f2
call fcn.00049620
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edi
mov dword [ebp - 0x20], 0x7355744e
mov dword [ebp - 0x1c], 0x75517265
mov dword [ebp - 0x18], 0x57797265
mov dword [ebp - 0x14], 0x6f646e69
mov dword [ebp - 0x10], 0x77
mov dword [ebp - 0xc], 0
call fcn.00014f40
cmp al, 1
jne 0x97cb1
mov eax, dword [ebp - 4]
test eax, eax
je 0x97cb1
cmp eax, edi
jae 0x97cb1
mov edx, dword [ebp - 8]
add edx, eax
push edx
push 0x1f7
call fcn.00049620
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x13142950
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.13143dac
test esi, esi
jne 0x13142986
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.13143e9c
jmp 0x131429a4
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.13142864
mov edi, eax
test esi, esi
je 0x131429a4
cmp dword [ebx], 0
je 0x131429a4
dec esi
jmp 0x1314298d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x13142f2c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x1315c020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x13142fc4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x13142fa4
xor eax, eax
push ebp
push 0x13142f9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x13142fe0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13142fa4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x1315c020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x1315c020], ax
mov esp, ebp
pop ebp
ret

Function at 0x13143c30
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x1315d044], 0
je 0x13143c91
cmp word [0x1315d218], 0xd7b2
jne 0x13143c59
cmp dword [0x1315d220], 0
jbe 0x13143c59
mov eax, 0x1315d214
call dword [0x1315d230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x1315c06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x13143cb8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x1315c030], 0
jne 0x13143cad
push 0
push 0x1315c064
push 0x1315c06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x13144ef0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x13145120
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x13144f73
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x13145120
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x13144f73
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x1314513c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x13144ffc
xor eax, eax
push ebp
push 0x13144ff5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.13144d38
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x13144fda
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x1314515c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x13144fda
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13144ffc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x13145116
cmp byte [ebp - 0xd], 0
jne 0x13145043
cmp byte [ebp - 0x12], 0
je 0x13145116
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x1314505c
dec ebx
cmp byte [ebx], 0x2e
je 0x1314506b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x1314505b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x13145116
inc ebx
cmp byte [ebp - 0x12], 0
je 0x131450a8
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x13145116
cmp byte [ebp - 0xd], 0
je 0x13145116
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x13145116
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x131457ac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x13145812
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.1314401c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.13142b20
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x131457fc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13145819
lea eax, [ebp - 0x10]
call fcn.13143dac
ret

Function at 0x13147578
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.1314426c
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x1314759a
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x13149d88
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x13149dc1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.13143e9c
jmp 0x13149dca
mov eax, ebx
mov edx, esi
call fcn.13143e00
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x13149dd4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x13149df5
mov al, byte [esp]
jmp 0x13149df7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x1314a47c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x1314a2f4
mov eax, dword [0x1315c5b4]
cmp byte [eax], 0
je 0x1314a4f8
mov eax, dword [0x1315c4a8]
call fcn.13142a2c
call fcn.13142790
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.13147728
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x1314a540
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x1314a52e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x1315c484]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x1315d660]
call fcn.13144cfc
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x1314b200
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x1314b264
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.1314401c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.13147270
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314b26b
lea eax, [ebp - 0xc]
call fcn.13143dac
ret

Function at 0x131566bc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x1315d87c
cmp dword [edi], 0
jne 0x13156738
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x1315d878]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x1315c3c0
mov ecx, 2
call fcn.13142824
mov edx, 0x13156694
lea eax, [esi + 5]
call fcn.131566b4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.131566b4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x1315670d
mov dword [0x1315d878], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x13157420
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x131574a9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1315d88c
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x13157493
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.13149d3c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x131574c0
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x1315c5cc]
mov dl, 1
mov eax, dword [0x13156c24]
call fcn.1314a660
call fcn.1314380c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131574b0
lea eax, [ebp - 0x1c]
call fcn.13143dac
ret

Function at 0x13157b50
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.13157a74
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.13143294
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x13157bb4
call fcn.13157368
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x13157ba6
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.13143294
pop esi
pop ebx
ret