joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13007240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x13029bd8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x13034c40]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.1301623e
mov dword [esp + 0x28], 0
mov edi, dword [0x13035fe0]
mov ecx, 0x13035fe4
mov dword [esp + 0xc], edi
call fcn.13002910
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x130072bb
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x130072bf
cmp byte [eax + 0x14], 0
je 0x130072bf
call fcn.130162cc
cmp esi, dword [eax + 0xc]
jae 0x130072c5
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x130072c1
xor ecx, ecx
jmp 0x130072a3
mov esi, ecx
test esi, esi
jne 0x13007316
test edi, edi
je 0x130072cd
mov esi, edi
jmp 0x13007316
lea eax, [esp + 0xc]
push eax
call fcn.13006ff0
add esp, 4
cmp eax, 0xffffffff
jne 0x130072fc
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.1301704b
push 0x13030ae8
lea ecx, [esp + 0x18]
push ecx
call fcn.13017769
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x13035fe0], esi
call fcn.13002990
push esi
call fcn.1301639a
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.1301625f
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x1300a4a0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
xor eax, eax
mov byte [esi], al
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov eax, dword [esp + 0xc]
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
call fcn.1300a2c0
mov ecx, esi
call fcn.1300a380
mov eax, esi
pop esi
ret 8

Function at 0x1300a640
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x13029fc8
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x13034c40]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push esi
mov eax, dword [0x13034c40]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
mov esi, dword [esp + 0x94]
xor ebx, ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x8c], 1
cmp dword [esp + 0xb0], 0x10
mov eax, dword [esp + 0x9c]
mov byte [esp + 0x14], bl
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], 0x67452301
mov dword [esp + 0x64], 0xefcdab89
mov dword [esp + 0x68], 0x98badcfe
mov dword [esp + 0x6c], 0x10325476
jae 0x1300a6d3
lea eax, [esp + 0x9c]
mov ecx, dword [esp + 0xac]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.1300a2c0
lea ecx, [esp + 0x14]
call fcn.1300a380
push esi
lea ecx, [esp + 0x18]
call fcn.1300a550
mov dword [esp + 0xc], 1
mov byte [esp + 0x8c], bl
cmp dword [esp + 0xb0], 0x10
jb 0x1300a721
mov edx, dword [esp + 0x9c]
push edx
call fcn.130174d1
add esp, 4
mov dword [esp + 0xb0], 0xf
mov dword [esp + 0xac], ebx
mov byte [esp + 0x9c], bl
mov eax, esi
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.13016f4a
add esp, 0x84
ret
Function at 0x1300ac50
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1302a14a
mov eax, dword fs:[0]
push eax
sub esp, 0x1cc
mov eax, dword [0x13034c40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1a4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1300ac9b
mov eax, 1
jmp 0x1300adf9
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xffffffff
jne 0x1300acc6
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x1300adf9
mov word [ebp - 0x1b4], 2
mov cx, word [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1b2], ax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1b8], 0x3e8
push 4
lea eax, [ebp - 0x1b8]
push eax
push 0x1006
push 0xffff
mov ecx, dword [ebp - 0x1bc]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea edx, [ebp - 0x1b4]
push edx
mov eax, dword [ebp - 0x1bc]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1300ad50
mov ecx, dword [ebp - 0x1bc]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x1300adf9
movzx edx, byte [ebp + 0x10]
test edx, edx
je 0x1300ade1
cmp dword [0x13034804], 0
je 0x1300ade1
lea eax, [ebp - 0x1d0]
push eax
call fcn.1300ab60
add esp, 4
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x1d0]
call fcn.1300b5e0
push eax
push 0
lea ecx, [ebp - 0x1d0]
call fcn.1300b5f0
push eax
mov ecx, dword [ebp - 0x1bc]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x1c0], eax
mov edx, dword [ebp - 0x1bc]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [ebp - 0x1d4], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d0]
call fcn.13014f90
mov eax, dword [ebp - 0x1d4]
jmp 0x1300adf9
mov eax, dword [ebp - 0x1bc]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.13016f4a
mov esp, ebp
pop ebp
ret
Function at 0x1300c1f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x13034c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x264], 0
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
je 0x1300c2b4
mov dword [ebp - 0x268], 0xffffffff
mov dword [ebp - 0x264], 0
mov edx, dword [ebp - 0x268]
add edx, 1
mov eax, dword [ebp - 0x264]
adc eax, 0
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x264], eax
mov ecx, dword [ebp - 0x23c]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x264]
push eax
mov ecx, dword [ebp - 0x268]
push ecx
call fcn.13017c90
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], edx
mov edx, dword [ebp - 0x238]
xor eax, eax
add edx, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x264]
adc ecx, eax
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x264], ecx
mov edx, dword [ebp - 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x264], 0
ja 0x1300c2d7
cmp dword [ebp - 0x268], 0
jbe 0x1300c3ad
mov dword [ebp - 0x26c], 0
push 0
push 0x80
push 4
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
je 0x1300c3a5
mov ecx, dword [ebp - 0x268]
add ecx, 2
mov edx, dword [ebp - 0x264]
adc edx, 0
push ecx
call fcn.13016ad7
add esp, 4
mov dword [ebp - 0x270], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x270]
mov dword [eax], ecx
mov edx, dword [ebp - 0x268]
add edx, 2
mov eax, dword [ebp - 0x264]
adc eax, 0
push edx
push 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call fcn.13016ed0
add esp, 0xc
push 0
lea eax, [ebp - 0x26c]
push eax
mov ecx, dword [ebp - 0x268]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1300c398
push 0x1388
mov edx, dword [ebp - 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x26c]
jmp 0x1300c3af
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.13016f4a
mov esp, ebp
pop ebp
ret
Function at 0x1300ca10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x13034c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x30], 0x63
mov byte [ebp - 0x2f], 0x6f
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x2e
mov byte [ebp - 0x2b], 0x64
mov byte [ebp - 0x2a], 0x6c
mov byte [ebp - 0x29], 0x6c
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x18], 0x3f
mov byte [ebp - 0x17], 0x61
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x15], 0x70
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xf], 0x40
mov byte [ebp - 0xe], 0x40
mov byte [ebp - 0xd], 0x59
mov byte [ebp - 0xc], 0x41
mov byte [ebp - 0xb], 0x58
mov byte [ebp - 0xa], 0x4d
mov byte [ebp - 9], 0x40
mov byte [ebp - 8], 0x5a
mov byte [ebp - 7], 0
mov byte [ebp - 0x24], 0x52
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x61
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0x46
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0
push 5
push 0x1300c400
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.13001420
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.13016f4a
mov esp, ebp
pop ebp
ret
Function at 0x1300cf10
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x13034c40]
xor eax, ebp
mov dword [ebp - 0x64], eax
push esi
push edi
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1300cf4d
xor eax, eax
jmp 0x1300d0f6
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x54], edx
jmp 0x1300cf68
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp - 0x24]
jae 0x1300d0e9
push 0x1c
lea edx, [ebp - 0x50]
push edx
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
jne 0x1300cf91
jmp 0x1300d0e9
cmp dword [ebp - 0x40], 0x1000
jne 0x1300d0e4
cmp dword [ebp - 0x3c], 1
je 0x1300d0e4
cmp dword [ebp - 0x44], 1
jb 0x1300d0e4
mov edx, dword [ebp - 0x44]
push edx
call fcn.13016ad7
add esp, 4
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x34], eax
push 0
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 4], edx
jmp 0x1300cff6
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x34]
lea eax, [edx + ecx - 1]
cmp dword [ebp - 4], eax
jae 0x1300d0cc
mov byte [ebp - 0x55], 1
mov dword [ebp - 0x5c], 0
jmp 0x1300d01f
mov ecx, dword [ebp - 0x5c]
add ecx, 1
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x5c]
movsx eax, byte [edx]
test eax, eax
je 0x1300d064
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x5c]
movsx edx, byte [ecx]
cmp edx, 0x3f
jne 0x1300d03c
jmp 0x1300d016
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x5c]
movsx ecx, byte [eax]
xor ecx, 1
mov byte [ebp - 0x5d], cl
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x5c]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 0x5d]
cmp eax, ecx
je 0x1300d062
mov byte [ebp - 0x55], 0
jmp 0x1300d064
jmp 0x1300d016
movzx edx, byte [ebp - 0x55]
test edx, edx
je 0x1300d0c7
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, 7
mov esi, str._desconocido_
lea edi, [ebp - 0x270]
rep movsd dword es:[edi], dword [esi]
push 0x1ec
push 0
lea ecx, [ebp - 0x254]
push ecx
call fcn.13016ed0
add esp, 0xc
push 0x208
lea edx, [ebp - 0x270]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
lea ecx, [ebp - 0x270]
push ecx
push 2
mov ecx, 0x13036028
call fcn.1300e300
jmp 0x1300cfed
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x278], edx
mov eax, dword [ebp - 0x278]
push eax
call fcn.13017867
add esp, 4
jmp 0x1300cf5f
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
mov ecx, dword [ebp - 0x64]
xor ecx, ebp
call fcn.13016f4a
mov esp, ebp
pop ebp
ret
Function at 0x1300d110
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1302a2d2
mov eax, dword fs:[0]
push eax
mov eax, 0x50ac
call fcn.13017cd0
mov eax, dword [0x13034c40]
xor eax, ebp
mov dword [ebp - 0x1024], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1020]
push eax
push 0x1000
lea ecx, [ebp - 0x101c]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x1300d31d
mov edx, dword [ebp - 0x1020]
shr edx, 2
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x5030], 0
jmp 0x1300d199
mov eax, dword [ebp - 0x5030]
add eax, 1
mov dword [ebp - 0x5030], eax
mov ecx, dword [ebp - 0x5030]
cmp ecx, dword [ebp - 0x10]
jae 0x1300d2ad
mov edx, dword [ebp - 0x5030]
cmp dword [ebp + edx*4 - 0x101c], 0
je 0x1300d2a8
mov eax, dword [ebp - 0x5030]
mov ecx, dword [ebp + eax*4 - 0x101c]
cmp ecx, dword [ebp - 0x18]
je 0x1300d2a8
mov dword [ebp - 0x5034], 0
mov dword [ebp - 0x503c], connect
mov edx, dword [ebp - 0x5030]
mov eax, dword [ebp + edx*4 - 0x101c]
mov dword [ebp - 0x5040], eax
mov ecx, dword [ebp - 0x503c]
push ecx
mov edx, dword [ebp - 0x5034]
push edx
mov eax, dword [ebp - 0x5040]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1300cf10
add esp, 0x14
mov dword [ebp - 0x5038], eax
cmp dword [ebp - 0x5038], 0
jle 0x1300d2a8
mov eax, dword [ebp - 0x5038]
push eax
push 0x1302d1fc
lea ecx, [ebp - 0x50b8]
push ecx
call fcn.13017966
add esp, 0xc
push 0x28
lea edx, [ebp - 0x50a4]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x50b8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 0x5030]
mov edx, dword [ebp + ecx*4 - 0x101c]
push edx
push 0x1302d200
lea eax, [ebp - 0x507c]
push eax
call fcn.13017966
add esp, 0xc
push 0x28
lea ecx, [ebp - 0x5068]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x507c]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x1300d18a
lea ecx, [ebp - 0x502c]
call fcn.1300ecf0
mov dword [ebp - 4], 0
push 0xa
lea ecx, [ebp - 0x502c]
call fcn.1300eda0
push 0x1c
lea ecx, [ebp - 0x502c]
call fcn.1300ede0
push 1
lea ecx, [ebp - 0x502c]
call fcn.1300ede0
lea ecx, [ebp - 0x502c]
call fcn.1300c170
push eax
lea ecx, [ebp - 0x502c]
call fcn.1300c160
push eax
mov eax, dword [0x13036020]
mov ecx, dword [eax + 0x48]
call fcn.1300c030
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x502c]
call fcn.1300ed00
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1024]
xor ecx, ebp
call fcn.13016f4a
mov esp, ebp
pop ebp
ret
Function at 0x1300d850
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
jmp 0x1300d868
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [0x13036028]
jbe 0x1300d99d
mov ecx, dword [ebp - 4]
add ecx, 0x384
mov dword [0x13036028], ecx
cmp dword [0x1303602c], 0
jne 0x1300d993
mov dword [0x1303602c], 1
mov edx, dword [0x13035ff0]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4ea914]
mov dword [0x13036650], ecx
push 0x1300c410
mov edx, dword [ebp - 8]
add edx, 0x4ea914
push edx
call fcn.13001090
add esp, 8
push 0x1300c510
push 1
mov ecx, 0x13036028
call fcn.1300c3c0
push 0x1300c6e0
push 2
mov ecx, 0x13036028
call fcn.1300c3c0
push 0x1300d340
push 3
mov ecx, 0x13036028
call fcn.1300c3c0
push 0x1300d3d0
push 4
mov ecx, 0x13036028
call fcn.1300c3c0
push 0x1300c830
push 5
mov ecx, 0x13036028
call fcn.1300c3c0
push 0x1300cae0
push 6
mov ecx, 0x13036028
call fcn.1300c3c0
push 0x1300d670
push 0xf
mov ecx, 0x13036028
call fcn.1300c3c0
push 0x1300caf0
push 0x11
mov ecx, 0x13036028
call fcn.1300c3c0
mov ecx, 0x13036770
call fcn.13015ff0
mov ecx, 0x130366b8
call fcn.1300f540
mov ecx, 0x130366b8
call fcn.13011a10
push 0
push 0
push 0x1300c930
call fcn.13017df9
add esp, 0xc
mov dword [0x13036048], eax
jmp 0x1300d99d
mov ecx, 0x130366b8
call fcn.13013d50
jmp 0x1300d9af
mov esp, ebp
pop ebp
ret
Function at 0x1300f540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x13034c40]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x34], ecx
jmp 0x1300f565
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov word [ebp - 0x24], 0x63
mov word [ebp - 0x22], 0x6c
mov word [ebp - 0x20], 0x69
mov word [ebp - 0x1e], 0x65
mov word [ebp - 0x1c], 0x78
mov word [ebp - 0x1a], 0x74
mov word [ebp - 0x18], 0x2e
mov word [ebp - 0x16], 0x64
mov word [ebp - 0x14], 0x6c
mov word [ebp - 0x12], 0x6c
mov word [ebp - 0x10], 0
mov byte [ebp - 5], 0
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1300f5d6
mov edx, dword [0x13035ff4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1300f60c
push 0xc
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
je 0x1300f60c
mov byte [ebp - 5], 1
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov dword [edx + 0x24], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x2c]
mov dword [ecx + 0x28], edx
movzx eax, byte [ebp - 5]
test eax, eax
jne 0x1300f627
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x24], edx
mov eax, dword [ebp - 0x34]
mov dword [eax + 0x28], 0xdbba0
jmp 0x1300f639
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.13016f4a
mov esp, ebp
pop ebp
ret
Function at 0x13015ff0
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x204
mov eax, dword [0x13034c40]
xor eax, esp
mov dword [esp + 0x200], eax
mov eax, ecx
cmp dword [eax], 0
jne 0x130160c3
push esi
mov dword [eax], 1
lea eax, [esp + 4]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push str.Client.ini
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea edx, [esp + 4]
push edx
push 0
push str.LowestId
push str.AutoType
call esi
mov dword [0x13036768], eax
lea eax, [esp + 4]
push eax
push 0
push str.HighestId
push str.AutoType
call esi
cmp dword [0x13036768], 0
mov dword [0x1303676c], eax
jbe 0x130160c2
test eax, eax
jbe 0x130160c2
push str.NWindow.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x130160c2
lea ecx, [eax + 0x205c50]
push 0
lea esi, [eax + 0x20835f]
lea edx, [ecx + 5]
lea eax, [esi + 5]
push 0x13015f90
push ecx
mov dword [0x13036760], edx
mov dword [0x13036764], eax
call fcn.13001220
push 0
push 0x13015fc0
push esi
call fcn.13001220
add esp, 0x18
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.13016f4a
add esp, 0x204
ret

Function at 0x13016f4a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x13034c40]
jne 0x13016f54
repz ret
jmp fcn.1301b669
Function at 0x130239dc
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x130357a0]
je 0x130239f7
inc edi
cmp edi, 0x17
jb 0x130239e8
cmp edi, 0x17
jae 0x13023b77
push ebp
push 3
call fcn.13026420
cmp eax, 1
pop ecx
je 0x13023b43
push 3
call fcn.13026420
test eax, eax
pop ecx
jne 0x13023a2b
cmp dword [0x130369bc], 1
je 0x13023b43
cmp ebx, 0xfc
je 0x13023b76
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x13037028
push ebp
call fcn.1301b76d
add esp, 0xc
test eax, eax
je 0x13023a61
push esi
push esi
push esi
push esi
push esi
call fcn.130175b6
add esp, 0x14
push 0x104
mov esi, 0x13037041
push esi
push 0
mov byte [0x13037145], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x13023aa5
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1301b76d
add esp, 0xc
test eax, eax
je 0x13023aa5
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.130175b6
add esp, 0x14
push esi
call fcn.13018e00
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x13023aea
push esi
call fcn.13018e00
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1303733c
push 0x1302ed04
sub ecx, eax
push ecx
push eax
call fcn.13021799
add esp, 0x14
test eax, eax
je 0x13023aea
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.130175b6
add esp, 0x14
jmp 0x13023aec
xor esi, esi
push 0x1302ed00
push ebx
push ebp
call fcn.13021728
add esp, 0xc
test eax, eax
je 0x13023b0c
push esi
push esi
push esi
push esi
push esi
call fcn.130175b6
add esp, 0x14
push dword [edi*8 + 0x130357a4]
push ebx
push ebp
call fcn.13021728
add esp, 0xc
test eax, eax
je 0x13023b2e
push esi
push esi
push esi
push esi
push esi
call fcn.130175b6
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.13026263
add esp, 0xc
jmp 0x13023b76
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x13023b76
cmp ebp, 0xffffffff
je 0x13023b76
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x130357a4]
push dword [esi]
call fcn.13018e00
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret