joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b1200
Capabilities:
Encode data using xor

Disassembly:
add dl, ah
xor al, 0xc0
pop edx
lodsb al, byte [esi]
stosd dword es:[edi], eax
mov cs, word [edi]
sbb dword [eax + eax*4 - 0x57], 0x7b
scasd eax, dword es:[edi]
push esp
xchg ecx, eax
loop 0x5b127a
invalid
jns 0x5b124f
dec ebp
popal
jl 0x5b1240
mov dh, byte gs:[eax]
push ds
sub eax, ebx
mov esp, 0xc45f353d
sub eax, 0xfa84b2d1
daa
mov dword [0x9f28fc98], eax
sub ecx, ebx
or eax, 0x5f0cb64f
sal byte [esi], 0x25
push ebp
sbb ah, byte [ebx - 0x31f104e8]
inc edi
inc ebp
sub dword [edx + 0x6059dd8], ecx
ljmp 0xa291
enter 0xffffffffffff97f4, 0xffffffffffffffc4
sub al, 0x99
aas
or al, byte [esi + 0x51]
or al, 0x7b
jmp 0x5b11ed
loope 0x5b12a1
pushal
movsd dword es:[edi], dword [esi]
invalid
test ecx, ebx
lodsd eax, dword [esi]
movsb byte es:[edi], byte [esi]
cmp eax, 0xd88c4fb4
push esi
outsd dx, dword [esi]
mov eax, dword [0xc103be78]
sub esi, dword [ebx + 0x36f5282e]
enter 0xffffffffffffd815, 0x20
shr dword [ebx], 0xb3
sub ch, dh
enter 0xffffffffffffd815, 0x20
loopne 0x5b12cc
clc
dec eax
xor byte [ebx], dh
js 0x5b1289
jo fcn.005b12c0
mov al, 0x4f
dec eax
pop edi
pop eax
test al, 0xce
mov ch, 0xc8
dec edi
call 0x29402b0d
cli
inc eax
rol al, 0x1e
in al, 0x4b
invalid
and ebp, dword [ecx - 0xf]
push ebp
enter 0x19c8, 0x11
jae 0x5b12fa
jmp dword [ebx + ebp*4 - 0x5c6a603c]
pop ds
invalid

Function at 0x5b1fc0
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
test eax, 0x24084c5f
xchg esp, eax
wait
std
add eax, 0xa50ef4b2
shl byte [eax], 0x8e
pop ebx
mov al, byte [0x1212cd64]
cmp eax, 0xab6f724b
xor dh, dh
mov edi, 0xfc5bc02a
mov dword [0x8730fde3], eax
mov bl, 0xba
pop ds
in al, 0x1b
pop ebx
mov al, byte [0xeb93bfc4]
and dl, byte [edx]
Function at 0x401ee5
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x401ff0
cmp dword [ebp + 0x10], esi
je 0x401ff0
cmp dword [ebp + 0xc], esi
je 0x401ff0
cmp dword [ebp + 0x14], esi
je 0x401ff0
xor eax, eax
mov byte [ebp + eax - 0x104], al
inc eax
cmp eax, 0x100
jb 0x401f17
push edi
xor edi, edi
push ebx
xor edx, edx
mov eax, edi
div dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
lea ecx, [ebp + edi - 0x104]
movzx eax, byte [edx + eax]
movzx edx, byte [ecx]
add eax, esi
add eax, edx
and eax, 0x800000ff
jns 0x401f54
dec eax
or eax, 0xffffff00
inc eax
mov dl, byte [ecx]
movzx esi, al
lea eax, [ebp + esi - 0x104]
mov bl, byte [eax]
inc edi
mov byte [ecx], bl
mov byte [eax], dl
cmp edi, 0x100
jb 0x401f2a
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0xc], edi
jbe 0x401fee
xor esi, esi
lea eax, [esi + 1]
and eax, 0x800000ff
jns 0x401f8c
dec eax
or eax, 0xffffff00
inc eax
movzx esi, al
lea eax, [ebp + esi - 0x104]
movzx ecx, byte [eax]
add ecx, edi
and ecx, 0x800000ff
jns 0x401fab
dec ecx
or ecx, 0xffffff00
inc ecx
mov dl, byte [eax]
movzx edi, cl
lea ecx, [ebp + edi - 0x104]
mov bl, byte [ecx]
mov byte [eax], bl
mov ebx, dword [ebp + 8]
mov byte [ecx], dl
movzx ecx, byte [ecx]
movzx eax, byte [eax]
mov edx, dword [ebp - 4]
add ecx, eax
and ecx, 0x800000ff
jns 0x401fdb
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [ebp + ecx - 0x104]
xor byte [ebx + edx], al
inc edx
mov dword [ebp - 4], edx
cmp edx, dword [ebp + 0xc]
jb 0x401f7b
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4011a0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47dc7c
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [0x49f56c]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x5c
mov ecx, dword [ebp + 8]
call fcn.00401eb0
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
add eax, 1
push eax
lea ecx, [ebp - 0x270]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401f70
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x278]
add edx, 1
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401f00
mov byte [ebp - 4], 1
push 0x485764
lea ecx, [ebp - 0x10]
call fcn.00401c40
lea ecx, [ebp - 0x10]
call fcn.00402a30
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x26c], 0
push 0x24c
push 0
lea ecx, [ebp - 0x268]
push ecx
call fcn.00464570
add esp, 0xc
lea edx, [ebp - 0x26c]
push edx
push 0x485768
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x27c]
push ecx
call fcn.004020e0
add esp, 0xc
mov dword [ebp - 0x284], eax
mov edx, dword [ebp - 0x284]
mov dword [ebp - 0x288], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x288]
call fcn.0041a040
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x274], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x27c]
call fcn.004029a0
cmp dword [ebp - 0x274], 0xffffffff
jne 0x4012d8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004029a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x270]
call fcn.004029a0
jmp 0x4013a0
mov eax, dword [ebp - 0x26c]
and eax, 0x10
je 0x4012e5
jmp 0x401359
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0041a040
push eax
lea edx, [ebp - 0x240]
push edx
call fcn.004644d0
add esp, 0xc
test eax, eax
jne 0x401359
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x270]
push ecx
lea edx, [ebp - 0x280]
push edx
call fcn.004020e0
add esp, 0xc
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x290], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x290]
call fcn.0041a040
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x280]
call fcn.004029a0
lea ecx, [ebp - 0x26c]
push ecx
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4012d8
mov eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004029a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x270]
call fcn.004029a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00464355
mov esp, ebp
pop ebp
ret
Function at 0x4016e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x223c
call fcn.004645f0
mov eax, dword [0x49f56c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x2238], ecx
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x218], ax
push 0
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x20
call fcn.0041a040
push eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041a040
push eax
call dword [sym.imp.WININET.dll_CreateUrlCacheEntryW]
push 0
push 0x80
push 2
push 0
push 7
push 0x40000000
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x401829
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocStringLen
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.0041a040
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xffffffff
je 0x40181f
mov dword [ebp - 0x220], 0x2000
mov edx, 1
test edx, edx
je 0x401812
push 0
lea eax, [ebp - 0x2228]
push eax
push 0x2000
lea ecx, [ebp - 0x2220]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40180e
cmp dword [ebp - 0x2228], 0
jne 0x4017df
jmp 0x401812
push 0
lea eax, [ebp - 0x2224]
push eax
mov ecx, dword [ebp - 0x2228]
push ecx
lea edx, [ebp - 0x2220]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x2224]
mov dword [ebp - 4], ecx
jmp 0x401810
jmp 0x401812
jmp 0x4017a5
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx + 8]
jne 0x40188e
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x20
call fcn.0041a040
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00402a30
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.0041a040
push eax
push 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [eax + 0x14]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [eax + 0xc]
push edx
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041a040
push eax
call dword [sym.imp.WININET.dll_CommitUrlCacheEntryW]
mov dword [ebp - 0x222c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2234], ecx
mov edx, dword [ebp - 0x2234]
mov dword [ebp - 0x2230], edx
cmp dword [ebp - 0x2230], 0
je 0x4018c1
push 1
mov ecx, dword [ebp - 0x2230]
call fcn.00401a70
mov dword [ebp - 0x223c], eax
jmp 0x4018cb
mov dword [ebp - 0x223c], 0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00464355
mov esp, ebp
pop ebp
ret 4
Function at 0x403480
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x4034f0
push 0
push 0
call fcn.00464955
add esp, 0x18
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x4034b5
xor al, al
jmp 0x4034e4
mov dword [ebp - 8], 0
jmp 0x4034c7
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x64
jge 0x4034e2
cmp dword [0x4a08c0], 0
je 0x4034d8
jmp 0x4034e2
push 0x19
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4034be
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x404300
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x80], 0
jne 0x40431c
mov eax, 1
jmp 0x404396
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0x80]
call fcn.00404c10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x404393
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0xa0], 0
je 0x404379
cmp dword [ebp + 8], 0
je 0x404379
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jbe 0x404379
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 4], 1
jne 0x404393
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xa0], 0
je 0x404393
mov ecx, dword [ebp - 0xc]
call fcn.004048c0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4043a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.004645f0
mov eax, dword [0x49f56c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x2018], ecx
mov eax, dword [ebp - 0x2018]
movzx ecx, byte [eax + 1]
test ecx, ecx
jne 0x404472
mov ecx, dword [ebp - 0x2018]
add ecx, 0x24
call fcn.0041a040
test eax, eax
je 0x404472
mov ecx, dword [ebp - 0x2018]
add ecx, 0x24
call fcn.0041a040
mov dword [ebp - 0x201c], eax
push 0x485870
push 1
mov edx, dword [ebp - 0x201c]
push edx
mov eax, dword [ebp - 0x201c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
call edx
mov ecx, dword [ebp - 0x2018]
add ecx, 0x24
call fcn.0041a040
mov dword [ebp - 0x2020], eax
push 0x485874
push 2
mov eax, dword [ebp - 0x2020]
push eax
mov ecx, dword [ebp - 0x2020]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [ebp - 0x2018]
add ecx, 0x24
call fcn.0041a040
mov dword [ebp - 0x2024], eax
push 0x485878
push 0xb
mov ecx, dword [ebp - 0x2024]
push ecx
mov edx, dword [ebp - 0x2024]
mov eax, dword [edx]
mov ecx, dword [eax + 0x10]
call ecx
mov dword [ebp - 4], 0x2000
mov byte [ebp - 0x2009], 0
mov dword [ebp - 0x2010], 0
jmp 0x40449b
mov edx, dword [ebp - 0x2010]
add edx, 1
mov dword [ebp - 0x2010], edx
mov eax, dword [ebp - 0x2018]
movzx ecx, byte [eax + 0xa4]
test ecx, ecx
jne 0x404530
push 0
lea edx, [ebp - 0x2014]
push edx
push 0x2000
lea eax, [ebp - 0x2008]
push eax
mov ecx, dword [ebp - 0x2018]
mov edx, dword [ecx + 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40450f
cmp dword [ebp - 0x2014], 0
jne 0x4044ee
mov byte [ebp - 0x2009], 1
jmp 0x404530
mov eax, dword [ebp - 0x2014]
push eax
lea ecx, [ebp - 0x2008]
push ecx
mov edx, dword [ebp - 0x2018]
mov ecx, dword [edx + 0x80]
call fcn.00404e00
jmp 0x404511
jmp 0x404530
mov eax, dword [ebp - 0x2010]
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x40452b
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40448c
movzx edx, byte [ebp - 0x2009]
test edx, edx
je 0x40454c
mov eax, dword [ebp - 0x2018]
mov ecx, dword [eax + 0x80]
call fcn.00404e40
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00464355
mov esp, ebp
pop ebp
ret
Function at 0x405ec0
Capabilities:
Delete file
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e269
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x49f56c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x10]
push eax
call fcn.00454640
add esp, 4
mov dword [ebp - 4], 0
push 0x20
call fcn.0046461b
add esp, 4
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x28], 0
je 0x405f20
mov ecx, dword [ebp - 0x28]
call fcn.0041b280
mov dword [ebp - 0x38], eax
jmp 0x405f27
mov dword [ebp - 0x38], 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0x84000000
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
call fcn.0041a040
push eax
lea ecx, [ebp - 0x10]
call fcn.0041a040
push eax
mov ecx, dword [ebp - 0x18]
call fcn.0041b390
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x405f76
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x18]
call fcn.0041b090
mov edx, dword [ebp - 0x18]
mov al, byte [edx + 0x14]
mov byte [ebp - 0x11], al
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0
je 0x405fac
push 1
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x3c], eax
jmp 0x405fb3
mov dword [ebp - 0x3c], 0
movzx ecx, byte [ebp - 0x11]
test ecx, ecx
je 0x40602f
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0x10]
call fcn.0041a040
push eax
lea edx, [ebp - 0x20]
push edx
call fcn.004414d0
add esp, 8
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.004063a0
add esp, 8
movzx edx, al
test edx, edx
je 0x406016
mov ecx, dword [ebp + 8]
call fcn.0041a040
push eax
lea ecx, [ebp - 0x10]
call fcn.0041a040
push eax
call fcn.004057d0
add esp, 8
movzx eax, al
test eax, eax
je 0x406014
mov byte [ebp - 0x11], 1
jmp 0x406021
push str.Error:_the_md5sum_of_res_file_is_wrong
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.004029a0
jmp 0x40603a
push str.Error:_can_not_download_res_file
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
movzx ecx, byte [ebp - 0x11]
test ecx, ecx
jne 0x406051
lea ecx, [ebp - 0x10]
call fcn.0041a040
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dl, byte [ebp - 0x11]
mov byte [ebp - 0x31], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004029a0
mov al, byte [ebp - 0x31]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x406270
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x405890
push 0
push 0
call fcn.00464955
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4062a2
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x407630
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e4c9
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x49f56c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x10]
call fcn.004028e0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004028e0
mov byte [ebp - 4], 2
push 0
push 0x1a
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00402a10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00408d40
push str.MacromediaFlash_PlayerSharedObjects_
lea ecx, [ebp - 0x18]
call fcn.00406ad0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.00407290
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00401c20
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.004029a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004029a0
lea ecx, [ebp - 0x14]
call fcn.00402190
movzx edx, al
test edx, edx
jne 0x407735
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402940
mov ecx, dword [ebp - 0x28]
or ecx, 1
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004029a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004029a0
mov eax, dword [ebp + 8]
jmp 0x4077df
push 0
push 0x1c
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00402a10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00408d40
push str.GoogleChromeUser_DataDefaultPepper_DataShockwave_FlashWritableRootSharedObjects_
lea ecx, [ebp - 0x20]
call fcn.00406ad0
mov byte [ebp - 4], 5
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.00407290
add esp, 0xc
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x38], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x38]
push eax
lea ecx, [ebp - 0x14]
call fcn.00401c20
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x24]
call fcn.004029a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.004029a0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402940
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004029a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004029a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x407f80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.00465a36
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x407fd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4a08c8], eax
mov esp, ebp
pop ebp
ret
Function at 0x4081a0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e671
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x49f56c]
xor eax, ebp
mov dword [ebp - 0x30], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x18]
call fcn.00448d50
mov dword [ebp - 4], 0
push 0x288
call fcn.00465a8b
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0x288
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x408237
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00464dcf
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
call fcn.00465a8b
add esp, 4
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x40832a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x40832a
lea ecx, [ebp - 0x44]
call fcn.004028e0
mov byte [ebp - 4], 1
mov dword [ebp - 0x48], 0
jmp 0x40827f
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
cmp eax, dword [edx + 0x190]
jae 0x4082ce
mov ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x48]
movzx edx, byte [ecx + 0x194]
push edx
push 0x485ac4
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [ebp - 0x48], 0
je 0x4082c0
push 0x485ad0
lea ecx, [ebp - 0x44]
call fcn.00401c40
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x44]
call fcn.00401c40
jmp 0x408276
lea ecx, [ebp - 0x44]
call fcn.00402190
movzx edx, al
test edx, edx
jne 0x408311
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x2c]
add eax, 8
push eax
call fcn.00408390
add esp, 4
test eax, eax
je 0x408305
lea ecx, [ebp - 0x44]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406470
jmp 0x408311
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x18]
call fcn.00406470
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.004029a0
jmp 0x408257
cmp dword [ebp - 0x1c], 0
je 0x40833c
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00464dcf
add esp, 4
cmp dword [ebp - 0x20], 0
je 0x40835a
mov ecx, dword [ebp + 8]
call fcn.00443890
test eax, eax
jne 0x40835a
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.00408920
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004063e0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.00464355
mov esp, ebp
pop ebp
ret