joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a300
Capabilities:
Terminate thread

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov rcx, qword [0x004399f0]
xor edx, edx
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x41a339
mov rcx, qword [0x004399f0]
lea rdx, [rbp + 0x2c]
call sub.kernel32.dll_GetExitCodeThread
mov rcx, qword [0x004399f0]
mov edx, dword [rbp + 0x2c]
call sub.kernel32.dll_TerminateThread
mov rcx, qword [0x004399f8]
xor edx, edx
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x41a36a
mov rcx, qword [0x004399f8]
lea rdx, [rbp + 0x2c]
call sub.kernel32.dll_GetExitCodeThread
mov rcx, qword [0x004399f8]
mov edx, dword [rbp + 0x2c]
call sub.kernel32.dll_TerminateThread
mov rcx, qword [0x00439a00]
xor edx, edx
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x41a39b
mov rcx, qword [0x00439a00]
lea rdx, [rbp + 0x2c]
call sub.kernel32.dll_GetExitCodeThread
mov rcx, qword [0x00439a00]
mov edx, dword [rbp + 0x2c]
call sub.kernel32.dll_TerminateThread
mov rcx, qword [0x00439a08]
xor edx, edx
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x41a3cc
mov rcx, qword [0x00439a08]
lea rdx, [rbp + 0x2c]
call sub.kernel32.dll_GetExitCodeThread
mov rcx, qword [0x00439a08]
mov edx, dword [rbp + 0x2c]
call sub.kernel32.dll_TerminateThread
lea rsp, [rbp + 0x30]
pop rbp
ret
Function at 0x41a3e0
Capabilities:
Get disk information

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x70], rcx
nop
lea rcx, [rbp + 0x48]
call fcn.00409a40
mov word [rbp + 0x5e], 0x41
lea rcx, [rbp + 0x38]
movzx rdx, word [rbp + 0x5e]
call fcn.0040ae40
lea rcx, [rbp + 0x38]
lea rdx, [0x0041a62c]
call fcn.0040b150
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x38]
xor r8, r8
call fcn.0040ac80
lea rcx, [rbp + 0x30]
movzx rdx, word [rbp + 0x5e]
call fcn.0040ae40
lea rcx, [rbp + 0x30]
lea rdx, [0x0041a62c]
call fcn.0040b150
mov rcx, qword [rbp + 0x30]
call fcn.0040ae00
mov rcx, rax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 4
jg 0x41a49b
cmp eax, 4
je 0x41a51c
sub eax, 2
test eax, eax
je 0x41a4b6
sub eax, 1
test eax, eax
jne 0x41a5aa
jmp 0x41a4e9
sub eax, 5
test eax, eax
je 0x41a54c
sub eax, 1
test eax, eax
jne 0x41a5aa
jmp 0x41a57c
lea rcx, [rbp + 0x48]
mov edx, 4
mov r8, qword [rbp + 0x48]
mov r9, qword [rbp + 0x50]
lea rax, [0x0041a640]
mov qword [rsp + 0x20], rax
lea rax, [0x0041a650]
mov qword [rsp + 0x28], rax
call fcn.0040a970
jmp 0x41a5aa
lea rcx, [rbp + 0x48]
mov edx, 4
mov r8, qword [rbp + 0x48]
mov r9, qword [rbp + 0x50]
lea rax, [0x0041a660]
mov qword [rsp + 0x20], rax
lea rax, [0x0041a650]
mov qword [rsp + 0x28], rax
call fcn.0040a970
jmp 0x41a5aa
lea rcx, [rbp + 0x48]
mov edx, 4
mov r8, qword [rbp + 0x48]
mov r9, qword [rbp + 0x50]
lea rax, [0x0041a670]
mov qword [rsp + 0x20], rax
lea rax, [0x0041a650]
mov qword [rsp + 0x28], rax
call fcn.0040a970
jmp 0x41a5aa
lea rcx, [rbp + 0x48]
mov edx, 4
mov r8, qword [rbp + 0x48]
mov r9, qword [rbp + 0x50]
lea rax, [0x0041a680]
mov qword [rsp + 0x20], rax
lea rax, [0x0041a650]
mov qword [rsp + 0x28], rax
call fcn.0040a970
jmp 0x41a5aa
lea rcx, [rbp + 0x48]
mov edx, 4
mov r8, qword [rbp + 0x48]
mov r9, qword [rbp + 0x50]
lea rax, [0x0041a690]
mov qword [rsp + 0x20], rax
lea rax, [0x0041a650]
mov qword [rsp + 0x28], rax
call fcn.0040a970
add word [rbp + 0x5e], 1
cmp word [rbp + 0x5e], 0x5b
jne 0x41a41c
nop
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x48]
call fcn.0040a030
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.00409ad0
lea rcx, [rbp + 0x48]
mov edx, 2
call fcn.00409b20
mov rax, qword [rbp + 0x70]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x41b130
Capabilities:
Log keystrokes

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x50], rcx
mov rcx, qword [rbp + 0x50]
call fcn.00409bc0
nop
mov dword [rbp + 0x3c], 0
jmp 0x41b1fe
add dword [rbp + 0x3c], 1
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rbp + 0x3c]
cmp word [rax + rcx*2 - 2], 0x23
jne 0x41b1b3
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
mov r8d, dword [rbp + 0x3c]
add r8d, 1
mov r9d, 2
call fcn.0040b440
lea rcx, [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
xor r8, r8
call fcn.0040ac80
mov rcx, qword [rbp + 0x20]
call fcn.00419520
mov dword [rbp + 0x38], eax
add dword [rbp + 0x3c], 2
jmp 0x41b1c3
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rbp + 0x3c]
movzx eax, word [rax + rcx*2 - 2]
mov dword [rbp + 0x38], eax
mov ecx, dword [rbp + 0x38]
xor edx, edx
call sub.user32.dll_MapVirtualKeyW
movzx rcx, byte [rbp + 0x38]
mov edx, eax
xor r8, r8
xor r9, r9
call sub.user32.dll_keybd_event
mov ecx, dword [rbp + 0x38]
xor edx, edx
call sub.user32.dll_MapVirtualKeyW
movzx rcx, byte [rbp + 0x38]
mov edx, eax
mov r8d, 2
xor r9, r9
call sub.user32.dll_keybd_event
mov dword [rbp + 0x34], 0
cmp qword [rbp + 0x50], 0
je 0x41b216
mov rax, qword [rbp + 0x50]
mov eax, dword [rax - 4]
mov dword [rbp + 0x34], eax
mov eax, dword [rbp + 0x34]
add eax, 1
cmp dword [rbp + 0x3c], eax
jl 0x41b162
nop
lea rcx, [rbp + 0x20]
call fcn.00409a40
lea rcx, [rbp + 0x28]
call fcn.004099f0
lea rcx, [rbp + 0x50]
call fcn.004099f0
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x41c320
Capabilities:
Create thread

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
xor ecx, ecx
xor edx, edx
lea r8, [0x0041c2f0]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rbp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
lea rsp, [rbp + 0x40]
pop rbp
ret

Function at 0x41c3a0
Capabilities:
Create thread
Terminate thread

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x60], rcx
nop
xor ecx, ecx
xor edx, edx
lea r8, [0x0041c360]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [0x00439b40]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov qword [0x00439b38], rax
mov rcx, qword [0x00439b38]
mov edx, 0x1f4
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x41c43e
call sub.ole32.dll_CoUninitialize
mov rcx, qword [0x00439b38]
mov rax, qword [rbp + 0x60]
lea rdx, [rax + 0x67c]
call sub.kernel32.dll_GetExitCodeThread
mov rcx, qword [0x00439b38]
mov rax, qword [rbp + 0x60]
mov edx, dword [rax + 0x67c]
call sub.kernel32.dll_TerminateThread
mov ecx, dword [0x00439b40]
call sub.kernel32.dll_CloseHandle
jmp 0x41c533
call sub.ole32.dll_CoUninitialize
cmp dword [0x00439b0c], 1
jne 0x41c533
mov dword [rbp + 0x4c], 0
cmp qword [0x004399e8], 0
je 0x41c46e
mov rax, qword [0x004399e8]
mov eax, dword [rax - 4]
mov dword [rbp + 0x4c], eax
lea rcx, [0x004399e8]
mov edx, dword [rbp + 0x4c]
mov r8d, 1
call fcn.0040b4a0
mov rax, qword [rbp + 0x60]
lea rcx, [rax + 0x670]
mov edx, 3
lea r8, [0x0041c574]
mov r9, qword [0x004399e8]
lea rax, [0x0041c584]
mov qword [rsp + 0x20], rax
call fcn.0040b350
lea rcx, [rbp + 0x38]
mov edx, 0x552d9c82
call fcn.00410b70
mov rax, qword [rbp + 0x60]
lea rcx, [rax + 0x670]
mov edx, 3
mov rax, qword [rbp + 0x60]
mov r8, qword [rax + 0x670]
lea r9, [0x0041c598]
mov rax, qword [rbp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.0040b350
mov rax, qword [rbp + 0x60]
lea rcx, [rax + 0x668]
mov edx, 4
mov rax, qword [rbp + 0x60]
mov r8, qword [rax + 0x668]
mov rax, qword [rbp + 0x60]
mov r9, qword [rax + 0x670]
lea rax, [0x0041c5a8]
mov qword [rsp + 0x20], rax
lea rax, [0x0041c5b8]
mov qword [rsp + 0x28], rax
call fcn.0040b350
nop
lea rcx, [rbp + 0x38]
call fcn.004099f0
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x41d1e0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov byte [0x0043a058], 0
xor ecx, ecx
xor edx, edx
lea r8, [0x0041c5c0]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [0x00439d44]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov qword [0x004399f0], rax
add rsp, 0x38
ret

Function at 0x41d420
Capabilities:
Create thread

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov rcx, qword [0x004399f8]
lea rdx, [rbp + 0x38]
call sub.kernel32.dll_GetExitCodeThread
cmp dword [rbp + 0x38], 0x103
je 0x41d46c
xor ecx, ecx
xor edx, edx
lea r8, [0x0041d220]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rbp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov qword [0x004399f8], rax
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x41dae0
Capabilities:
Create thread

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
nop
xor ecx, ecx
xor edx, edx
lea r8, [0x0041d480]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [0x00439d44]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov qword [0x00439a08], rax
nop
lea rsp, [rbp + 0x30]
pop rbp
ret

Function at 0x41db30
Capabilities:
Create thread

Disassembly:
push rbp
sub rsp, 0x150
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x160], rcx
mov dword [rbp + 0x168], edx
mov rcx, qword [rbp + 0x160]
call fcn.00409be0
nop
mov ecx, 0x120
call fcn.00404cb0
mov qword [rbp + 0x140], rax
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x160]
mov r8d, 1
mov r9d, 0xff
call fcn.0040aac0
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
mov r8d, 0xff
call fcn.0040a550
mov rcx, qword [rbp + 0x140]
lea rdx, [rbp + 0x40]
call fcn.0040a310
mov rax, qword [rbp + 0x140]
mov ecx, dword [rbp + 0x168]
mov dword [rax + 0x11c], ecx
xor ecx, ecx
xor edx, edx
lea r8, [0x0041d580]
mov r9, qword [rbp + 0x140]
mov dword [rsp + 0x20], 0
lea rax, [rbp + 0x14c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov qword [0x00439a08], rax
nop
lea rcx, [rbp + 0x38]
call fcn.00409a40
lea rcx, [rbp + 0x160]
call fcn.00409a40
lea rsp, [rbp + 0x150]
pop rbp
ret

Function at 0x41e3d0
Capabilities:
Create thread

Disassembly:
push rbp
sub rsp, 0x150
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x160], rcx
mov rcx, qword [rbp + 0x160]
call fcn.00409be0
nop
mov ecx, 0x120
call fcn.00404cb0
mov qword [rbp + 0x148], rax
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x160]
mov r8d, 1
mov r9d, 0x1f4
call fcn.0040aac0
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x38]
mov r8d, 0xff
call fcn.0040a550
mov rcx, qword [rbp + 0x148]
lea rdx, [rbp + 0x48]
call fcn.0040a310
xor ecx, ecx
xor edx, edx
lea r8, [0x0041e0f0]
mov r9, qword [rbp + 0x148]
mov dword [rsp + 0x20], 0
lea rax, [rbp + 0x44]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
nop
lea rcx, [rbp + 0x38]
call fcn.00409a40
lea rcx, [rbp + 0x160]
call fcn.00409a40
lea rsp, [rbp + 0x150]
pop rbp
ret
Function at 0x4249a0
Capabilities:
Create thread

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
xor ecx, ecx
xor edx, edx
lea r8, [0x0041ed10]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov dword [rbp + 0x3c], eax
mov eax, dword [rbp + 0x3c]
mov qword [0x004399b8], rax
mov byte [0x004399d1], 0
mov eax, dword [rbp + 0x3c]
lea rsp, [rbp + 0x40]
pop rbp
ret

Function at 0x4249f0
Capabilities:
Log keystrokes

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x38], 0
call sub.kernel32.dll_GetCurrentThreadId
mov eax, eax
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x50]
xor edx, edx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, eax
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x30]
cmp rax, qword [rbp + 0x28]
jne 0x424a35
call sub.user32.dll_GetFocus
mov qword [rbp + 0x38], rax
jmp 0x424a5f
mov ecx, dword [rbp + 0x28]
mov edx, dword [rbp + 0x30]
or r8d, 0xffffffff
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x424a5f
call sub.user32.dll_GetFocus
mov qword [rbp + 0x38], rax
mov ecx, dword [rbp + 0x28]
mov edx, dword [rbp + 0x30]
xor r8, r8
call sub.user32.dll_AttachThreadInput
mov rax, qword [rbp + 0x38]
lea rsp, [rbp + 0x40]
pop rbp
ret

Function at 0x424a70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x50], rcx
movzx rcx, byte [0x0043269c]
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
mov dword [rbp + 0x34], eax
mov rcx, qword [rbp + 0x50]
mov rax, qword [0x00432eb0]
call qword [rax]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x424ab1
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x28]
call fcn.004249f0
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x424acf
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x50], rax
jmp 0x424afc
call sub.kernel32.dll_GetTickCount
mov dword [rbp + 0x30], eax
mov eax, dword [rbp + 0x34]
sub eax, dword [rbp + 0x30]
movsxd rcx, eax
shr rcx, 0x20
xor eax, ecx
sub eax, ecx
cmp eax, 0x64
jg 0x424afc
movzx rcx, byte [0x0043269c]
call sub.kernel32.dll_Sleep
jmp 0x424a91
nop
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x425ee0
Capabilities:
Create thread
Terminate thread

Disassembly:
push rbp
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xa8], rdx
nop
mov dword [rbp + 0x64], 0x4000
mov qword [rbp + 0x48], 0
xor ecx, ecx
xor edx, edx
lea r8, [0x00425e50]
mov r9, qword [rbp + 0xa8]
mov dword [rsp + 0x20], 0
lea rax, [rbp + 0x58]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov qword [rbp + 0x78], rax
mov rcx, qword [rbp + 0x78]
mov edx, 0x1f4
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x425f8a
mov rcx, qword [rbp + 0x78]
lea rdx, [rbp + 0x60]
call sub.kernel32.dll_GetExitCodeThread
mov rcx, qword [rbp + 0x78]
mov edx, dword [rbp + 0x60]
call sub.kernel32.dll_TerminateThread
mov dword [0x0043aaf8], 5
mov qword [0x0043ab00], 0
cmp dword [0x0043aaf8], 0
jne 0x426126
mov ecx, dword [rbp + 0x64]
call fcn.00404cb0
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x68], 0xffffffff
mov rcx, qword [rbp + 0x48]
mov edx, dword [rbp + 0x64]
xor r8, r8
call fcn.00405ca0
xor ecx, ecx
xor edx, edx
lea r8, [0x00425e90]
mov r9, qword [rbp + 0x48]
mov dword [rsp + 0x20], 0
lea rax, [rbp + 0x54]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov qword [rbp + 0x70], rax
mov rcx, qword [rbp + 0x70]
mov edx, 0x1f4
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x42601b
mov rcx, qword [rbp + 0x70]
lea rdx, [rbp + 0x5c]
call sub.kernel32.dll_GetExitCodeThread
mov rcx, qword [rbp + 0x70]
mov edx, dword [rbp + 0x5c]
call sub.kernel32.dll_TerminateThread
mov dword [0x0043aafc], 5
cmp dword [0x0043aafc], 0
jne 0x426125
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0xa8], rax
mov eax, 1
mov ebx, dword [rbp + 0x68]
mov dword [rbp + 0x6c], eax
cmp dword [rbp + 0x6c], ebx
ja 0x42611f
sub ebx, eax
add ebx, 1
cmp qword [rbp + 0xa8], 0
je 0x426137
mov rax, qword [rbp + 0xa8]
cmp dword [rax + 0x18], 0
je 0x426137
mov rax, qword [rbp + 0xa8]
cmp dword [rax], 2
jne 0x42611f
mov rax, qword [rbp + 0xa8]
cmp dword [rax + 8], 3
jne 0x4260d7
mov rax, qword [rbp + 0xa8]
cmp dword [rax + 4], 1
jne 0x4260d7
lea rcx, [rbp + 0x30]
mov rax, qword [rbp + 0xa8]
mov rdx, qword [rax + 0x18]
call fcn.0040ae90
lea rcx, [rbp + 0x38]
mov edx, 3
lea r8, [0x00426178]
mov r9, qword [rbp + 0x30]
lea rax, [0x00426188]
mov qword [rsp + 0x20], rax
call fcn.0040b350
mov rcx, qword [rbp + 0x38]
call fcn.00425d50
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax + 0xc]
test eax, 2
jbe 0x426108
mov rax, qword [rbp + 0xa8]
cmp dword [rax], 2
jne 0x426108
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0xa8]
call fcn.00425ee0
add qword [rbp + 0xa8], 0x30
add dword [rbp + 0x6c], 1
sub ebx, 1
test ebx, ebx
jne 0x42604c
nop
jmp 0x425fa3
nop
cmp qword [rbp + 0x48], 0
je 0x426136
mov rcx, qword [rbp + 0x48]
call fcn.00404ce0
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.00409ad0
lea rsp, [rbp + 0x88]
pop rbx
pop rbp
ret
Function at 0x4265b0
Capabilities:
Copy file
Create directory

Disassembly:
push rbp
push rbx
sub rsp, 0xc8
mov rbp, rsp
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
nop
mov byte [0x00439a16], 0
lea rcx, [0x0043995c]
call sub.kernel32.dll_GetLocalTime
mov byte [0x0043a82c], 3
mov ecx, 8
mov dl, 1
call fcn.0041bb30
lea rcx, [rbp + 0xb8]
call fcn.00413d90
lea rcx, [rbp + 0xb8]
lea rdx, [0x004268d4]
call fcn.0040b150
mov rcx, qword [rbp + 0xb8]
call fcn.0040ae00
mov rbx, rax
lea rcx, [rbp + 0xa8]
call fcn.00413d90
lea rcx, [rbp + 0xa0]
movzx rdx, word [0x0043995e]
call fcn.00425e00
lea rcx, [rbp + 0x98]
movzx rdx, word [0x00439962]
call fcn.00425e00
lea rcx, [rbp + 0x90]
movzx rdx, word [0x00439964]
call fcn.00425e00
lea rcx, [rbp + 0x88]
movzx rdx, word [0x00439966]
call fcn.00425e00
lea rcx, [rbp + 0xb0]
mov edx, 0xa
mov r8, qword [rbp + 0xa8]
lea r9, [0x004268fc]
mov rax, qword [rbp + 0xa0]
mov qword [rsp + 0x20], rax
lea rax, [0x00426928]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x98]
mov qword [rsp + 0x30], rax
lea rax, [0x00426938]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [0x00426948]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x50], rax
lea rax, [0x00426958]
mov qword [rsp + 0x58], rax
call fcn.0040b350
mov rcx, qword [rbp + 0xb0]
call fcn.0040ae00
mov rcx, rbx
mov rdx, rax
xor r8, r8
call sub.kernel32.dll_CopyFileW
lea rcx, [rbp + 0x80]
call fcn.00413d90
lea rcx, [rbp + 0x80]
lea rdx, [0x00426970]
call fcn.0040b150
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x80]
xor r8, r8
call fcn.0040ac80
mov rcx, qword [rbp + 0x78]
xor edx, edx
mov r8b, 1
call fcn.0041a6a0
cmp eax, 0xc8
jle 0x426833
lea rcx, [rbp + 0x70]
call fcn.00413d90
lea rcx, [rbp + 0x70]
lea rdx, [0x00426970]
call fcn.0040b150
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x70]
xor r8, r8
call fcn.0040ac80
mov rcx, qword [rbp + 0x68]
mov dl, 1
xor r8, r8
call fcn.0041a6a0
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x60]
call fcn.00413d90
lea rcx, [rbp + 0x60]
lea rdx, [0x00426970]
call fcn.0040b150
mov rcx, qword [rbp + 0x60]
call fcn.0040ae00
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_CreateDirectoryW
nop
lea rcx, [rbp + 0x60]
call fcn.004099f0
lea rcx, [rbp + 0x68]
call fcn.00409a40
lea rcx, [rbp + 0x70]
call fcn.004099f0
lea rcx, [rbp + 0x78]
call fcn.00409a40
lea rcx, [rbp + 0x80]
mov edx, 8
call fcn.00409ad0
lea rsp, [rbp + 0xc8]
pop rbx
pop rbp
ret
Function at 0x426d40
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
sub rsp, 0x1a0
mov rbp, rsp
mov qword [rbp + 0x38], rbp
lea rcx, [0x00426ec0]
call sub.kernel32.dll_LoadLibraryW
mov rcx, rax
lea rdx, [0x00426eda]
call fcn.00410110
mov qword [rbp + 0x58], rax
lea rcx, [0x00426ec0]
call sub.kernel32.dll_LoadLibraryW
mov rcx, rax
lea rdx, [0x00426efc]
call fcn.00410110
mov qword [rbp + 0x50], rax
lea rcx, [0x00426ec0]
call sub.kernel32.dll_LoadLibraryW
mov rcx, rax
lea rdx, [0x00426f28]
call fcn.00410110
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x74], 0x114
lea rcx, [rbp + 0x74]
call sub.kernel32.dll_GetVersionExW
cmp dword [rbp + 0x84], 1
je 0x426e89
nop
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 0x20
lea r8, [rbp + 0x190]
call qword [rbp + 0x58]
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x188], rax
xor ecx, ecx
lea rdx, [0x00426f54]
lea r8, [rbp + 0x68]
call qword [rbp + 0x50]
mov dword [rbp + 0x64], 1
mov dword [rbp + 0x70], 2
mov dword [rbp + 0x60], 0
mov rcx, qword [rbp + 0x190]
xor edx, edx
lea r8, [rbp + 0x64]
xor r9, r9
mov qword [rsp + 0x20], 0
lea rax, [rbp + 0x60]
mov qword [rsp + 0x28], rax
call qword [rbp + 0x48]
mov dword [rbp + 0x64], 1
mov dword [rbp + 0x70], 2
mov dword [rbp + 0x60], 0
mov rcx, qword [rbp + 0x188]
xor edx, edx
lea r8, [rbp + 0x64]
xor r9, r9
mov qword [rsp + 0x20], 0
lea rax, [rbp + 0x60]
mov qword [rsp + 0x28], rax
call qword [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
call sub.kernel32.dll_CloseHandle
jmp 0x426e89
mov byte [rbp + 0x19f], 1
movzx rax, byte [rbp + 0x19f]
lea rsp, [rbp + 0x1a0]
pop rbp
ret

Function at 0x426f80
Capabilities:
Terminate thread

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x38
xor edi, edi
mov r13d, 0x1c20
mov rax, qword [0x00432d88]
mov rcx, qword [rax]
mov edx, 0x3e8
call sub.kernel32.dll_WaitForSingleObject
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0x102
jne 0x426fe6
add ebx, 1
cmp ebx, 0x12c
jle 0x426fd8
xor ebx, ebx
mov rax, qword [0x00432ea8]
cmp esi, dword [rax]
jne 0x426fcf
mov dil, 1
mov rax, qword [0x00432ea8]
mov esi, dword [rax]
test dil, dil
jne 0x426fe6
sub r13d, 1
test r13d, r13d
jne 0x426f92
nop
mov rax, qword [0x00432d88]
mov rcx, qword [rax]
mov edx, 0xea60
call sub.kernel32.dll_WaitForSingleObject
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0x102
jne 0x42703f
mov rax, qword [0x00432d88]
mov rcx, qword [rax]
lea rdx, [rsp + 0x2c]
call sub.kernel32.dll_GetExitCodeThread
mov rax, qword [0x00432d88]
mov rcx, qword [rax]
mov edx, dword [rsp + 0x2c]
call sub.kernel32.dll_TerminateThread
mov rax, qword [0x00432d88]
mov rcx, qword [rax]
call sub.kernel32.dll_CloseHandle
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x428b80
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
xor ecx, ecx
xor edx, edx
lea r8, [0x004287c0]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
test eax, eax
je 0x428bb3
mov dword [0x0043ab20], eax
add rsp, 0x48
ret
Function at 0x42a0e0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
nop
call sub.kernel32.dll_GetCommandLineW
lea rcx, [rbp + 0x58]
mov rdx, rax
call fcn.0040ae90
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x58]
call fcn.00410bc0
lea rcx, [rbp + 0x50]
lea rdx, [0x0042a2c0]
mov r8, qword [rbp + 0x68]
call fcn.0040b220
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x50]
xor r8, r8
call fcn.0040ac80
mov rcx, qword [rbp + 0x48]
call fcn.00411960
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x68]
xor r8, r8
call fcn.0040ac80
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x40]
call fcn.0040af30
lea rcx, [0x0042a2d4]
mov rdx, qword [rbp + 0x38]
mov r8d, 1
call fcn.0040b520
test eax, eax
jle 0x42a1be
xor ecx, ecx
xor edx, edx
lea r8, [0x0042a2e4]
xor r9, r9
call sym.msLpro64.aa.aa.dll_Control_RunDLL
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x68]
xor r8, r8
call fcn.0040ac80
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.0040af30
lea rcx, [0x0042a2f4]
mov rdx, qword [rbp + 0x28]
mov r8d, 1
call fcn.0040b520
test eax, eax
jle 0x42a208
xor ecx, ecx
xor edx, edx
lea r8, [0x0042a308]
xor r9, r9
call sym.msLpro64.aa.aa.dll_Control_RunDLL
nop
lea rcx, [rbp + 0x28]
call fcn.004099f0
lea rcx, [rbp + 0x30]
call fcn.00409a40
lea rcx, [rbp + 0x38]
call fcn.004099f0
lea rcx, [rbp + 0x40]
mov edx, 2
call fcn.00409b20
lea rcx, [rbp + 0x50]
mov edx, 2
call fcn.00409ad0
lea rcx, [rbp + 0x68]
call fcn.004099f0
mov eax, dword [rbp + 0x24]
lea rsp, [rbp + 0x70]
pop rbp
ret