joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b8a6
Capabilities:
Delete directory
Delete internet cache
Enumerate internet cache
Get common file path

Disassembly:
push 0x840
push 0x5267e8
call fcn.004f3600
mov edi, 0xa000
mov dword [ebp - 0x848], edi
call fcn.0042b68f
mov dword [ebp - 0x850], eax
push edi
call fcn.004d4f20
pop ecx
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x42bae6
push edi
push ebx
push esi
call fcn.004dbcc0
add esp, 0xc
mov eax, dword [ebp - 0x848]
mov dword [esi], eax
lea eax, [ebp - 0x848]
push eax
push esi
push str.cookie:
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov dword [ebp - 0x84c], eax
cmp eax, ebx
je 0x42b992
push dword [esi + 0x34]
push dword [esi + 0x30]
push dword [ebp - 0x850]
call fcn.0042b6b9
add esp, 0xc
test eax, eax
je 0x42b955
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
test eax, eax
jne 0x42b955
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x42b955
push ebx
push dword [esi + 4]
call dword [sym.imp.WININET.dll_UnlockUrlCacheEntryFileA]
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
mov dword [ebp - 0x848], edi
push edi
push ebx
push esi
call fcn.004dbcc0
add esp, 0xc
mov eax, dword [ebp - 0x848]
mov dword [esi], eax
lea eax, [ebp - 0x848]
push eax
push esi
push dword [ebp - 0x84c]
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x42b912
push dword [ebp - 0x84c]
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
push esi
call fcn.004d5a72
pop ecx
cmp dword [ebp - 0x850], ebx
jne 0x42bae6
xor eax, eax
mov word [ebp - 0x844], ax
mov esi, 0x206
push esi
push ebx
lea eax, [ebp - 0x842]
push eax
call fcn.004dbcc0
add esp, 0xc
mov edi, 0x507b1c
push ebx
push 0x21
lea eax, [ebp - 0x844]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42b9e4
lea edi, [ebp - 0x844]
cmp edi, ebx
je 0x42ba57
cmp word [edi], bx
je 0x42ba57
xor eax, eax
mov word [ebp - 0x63c], ax
push esi
push ebx
lea eax, [ebp - 0x63a]
push eax
call fcn.004dbcc0
add esp, 0xc
push str._.txt
push edi
push 0x507a0c
push 0x104
lea eax, [ebp - 0x63c]
push eax
call fcn.004d5add
add esp, 0x14
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x63c]
call fcn.00437917
mov dword [ebp - 4], 0xfffffffe
jmp 0x42ba57
xor eax, eax
mov word [ebp - 0x434], ax
push esi
push ebx
lea eax, [ebp - 0x432]
push eax
call fcn.004dbcc0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x22c], ax
push esi
push ebx
lea eax, [ebp - 0x22a]
push eax
call fcn.004dbcc0
add esp, 0xc
push ebx
lea eax, [ebp - 0x434]
call fcn.0040239a
push str.Cookies
lea eax, [ebp - 0x434]
push eax
push 0x515d5c
push 0x103
lea eax, [ebp - 0x22c]
push eax
call fcn.004d5add
add esp, 0x14
xor eax, eax
cmp ax, word [ebp - 0x22c]
je 0x42bae6
push ebx
push ebx
push ebx
lea eax, [ebp - 0x22c]
push eax
call fcn.0043f4cc
add esp, 0x10
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call fcn.004f3648
ret
Function at 0x42baec
Capabilities:
Delete file
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, 0xa000
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
mov dword [ebp - 4], edi
neg ecx
or ecx, eax
push ecx
call fcn.004d4f20
mov esi, eax
pop ecx
test esi, esi
je 0x42bbd6
mov ebx, 0x14000
push ebx
push 0
push esi
call fcn.004dbcc0
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push esi
push 0
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
mov dword [ebp - 8], eax
test eax, eax
je 0x42bbcf
mov ecx, dword [ebp + 8]
call fcn.0042b68f
mov dword [ebp - 0xc], eax
test dword [esi + 0xc], 0x100008
jne 0x42bba3
push dword [esi + 0x34]
push dword [esi + 0x30]
push dword [ebp - 0xc]
call fcn.0042b6b9
add esp, 0xc
test eax, eax
je 0x42bba3
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
test eax, eax
jne 0x42bb95
push eax
push dword [esi + 4]
call dword [sym.imp.WININET.dll_UnlockUrlCacheEntryFileW]
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
mov eax, dword [esi + 8]
test eax, eax
je 0x42bba3
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push 0
push esi
call fcn.004dbcc0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 4], edi
mov dword [esi], edi
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
test eax, eax
jne 0x42bb57
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
push esi
call fcn.004d5a72
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42be86
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [0x5bf694], 0
push ebx
je 0x42bee2
mov ebx, dword [0x5bf66c]
test bl, 1
je 0x42beaa
push 0
call fcn.0042baec
pop ecx
test bl, 2
je 0x42beb7
push 0
call fcn.0042b7ed
pop ecx
test bl, 4
je 0x42bec3
xor ecx, ecx
call fcn.0042b8a6
test bl, 8
je 0x42bed8
push str.SoftwareMicrosoftInternet_ExplorerTypedURLs
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test bl, 0x10
je 0x42bee2
call fcn.0042bbdb
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42bee7
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov bl, byte [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], esi
cmp dword [0x548468], esi
je 0x42bf39
lea eax, [esp + 0xc]
push eax
push 0x515f00
push 1
push esi
push 0x505500
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x42bf39
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x42bf39
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push 1
push esi
push eax
call dword [ecx + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
pop edi
test bl, 1
je 0x42bf53
push dword [ebp + 0xc]
call fcn.0042baec
pop ecx
push edi
call esi
test bl, 2
je 0x42bf64
push dword [ebp + 0xc]
call fcn.0042b7ed
pop ecx
push edi
call esi
test bl, 4
je 0x42bf74
mov ecx, dword [ebp + 0xc]
call fcn.0042b8a6
push edi
call esi
test bl, 8
je 0x42bf8c
push str.SoftwareMicrosoftInternet_ExplorerTypedURLs
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push edi
call esi
test bl, 0x10
je 0x42bf99
call fcn.0042bbdb
push edi
call esi
test bl, bl
jns 0x42bfa0
push edi
call esi
push 0x12c
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42bfd9
Capabilities:
Check if file exists

Disassembly:
push 0x20
mov eax, 0x4f64a9
call fcn.004de80b
lea eax, [ebp - 0x2c]
push eax
call fcn.0042b360
xor ebx, ebx
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.0042c46b
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
mov ecx, 0x45c
cdq
idiv ecx
test eax, eax
jbe 0x42c0ae
push ebx
lea esi, [ebp - 0x2c]
call fcn.0042c7cf
push ebx
lea edi, [eax + 0x458]
call fcn.0042c7cf
mov ecx, dword [edi]
cmp ecx, dword [eax + 0x24c]
jbe 0x42c097
cmp dword [ebp + 8], 0
jne 0x42c056
push ebx
call fcn.0042c7cf
cmp dword [eax + 0x40], 0
je 0x42c097
push ebx
call fcn.0042c7cf
add eax, 0x44
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42c097
push ebx
lea esi, [ebp - 0x2c]
call fcn.0042c7cf
add eax, 0x44
push ebx
mov dword [ebp - 0x14], eax
call fcn.0042c7cf
mov edi, eax
mov eax, dword [ebp - 0x14]
add edi, 0x250
mov esi, eax
call fcn.0043738b
test eax, eax
je 0x42c097
push ebx
lea esi, [ebp - 0x2c]
call fcn.0042c7cf
mov ecx, eax
add ecx, 0x250
call fcn.004372a5
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
mov ecx, 0x45c
cdq
idiv ecx
inc ebx
cmp ebx, eax
jb 0x42c011
lea esi, [ebp - 0x2c]
call fcn.004617d1
call fcn.004de8e3
ret 4
Function at 0x42c46b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x498
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
inc eax
push edi
mov dword [ebp - 0x490], str.adbraw
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x488], str.adblock_adbraw.dat
mov dword [ebp - 0x484], str.adbraw.dat
mov dword [ebp - 0x480], str.adbept
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], str.adblock_adbept.dat
mov dword [ebp - 0x474], str.adbept.dat
lea edi, [ebp - 0x48c]
mov dword [ebp - 0x46c], 2
push 0x3f
lea eax, [ebp - 0x467]
push 0
push eax
mov byte [ebp - 0x468], 0
call fcn.004dbcc0
add esp, 0xc
push 0x41c
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.004dbcc0
add esp, 0xc
push dword [edi - 4]
lea eax, [ebp - 0x468]
push 0x514d4c
push 0x40
push eax
call fcn.004da5bb
mov eax, dword [edi]
add esp, 0x10
push dword [edi + 4]
mov dword [ebp - 0x428], eax
call fcn.0040235b
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
lea eax, [ebp - 0x424]
push eax
call ebx
call fcn.00412adf
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42c56d
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.00412c4d
push str.Installer
push 0x549db4
lea eax, [ebp - 0x218]
push eax
call ebx
push dword [edi + 8]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00412adf
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42c5b6
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00412c4d
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x42c5c5
and dword [ebp - 0x470], ecx
jmp 0x42c5d8
mov eax, dword [esi + 0x14]
sub eax, ecx
cdq
mov ebx, 0x45c
idiv ebx
mov dword [ebp - 0x470], eax
mov ebx, dword [esi + 0x10]
mov eax, ebx
sub eax, ecx
cdq
mov ecx, 0x45c
idiv ecx
cmp eax, dword [ebp - 0x470]
jae 0x42c603
lea eax, [ebp - 0x468]
push eax
push 1
push ebx
call fcn.0042c8ab
mov dword [esi + 0x10], eax
jmp 0x42c626
cmp dword [esi + 0xc], ebx
jbe 0x42c60d
call fcn.004d6d23
mov eax, dword [esi]
push ebx
push eax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x498]
push eax
mov eax, esi
call fcn.0042c7f8
add edi, 0x10
dec dword [ebp - 0x46c]
jne 0x42c4db
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004d5a7d
leave
ret
Function at 0x42c643
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push 0xa90
mov eax, 0x4f5abb
call fcn.004de874
mov eax, dword [ebp + 8]
mov edi, ecx
mov esi, edx
xor ebx, ebx
push edi
mov dword [ebp - 0xa94], esi
mov dword [ebp - 0xa98], eax
mov dword [ebp - 0xa9c], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42c7c5
cmp esi, ebx
je 0x42c7c5
cmp dword [ebp - 0xa98], ebx
je 0x42c7c5
lea esi, [ebp - 0xa90]
call fcn.0046e89d
push edi
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0046e9a7
test eax, eax
je 0x42c7ae
mov eax, esi
push eax
call fcn.0046ea08
mov edi, eax
xor esi, esi
cmp edi, ebx
jle 0x42c7a3
push 0x22c
lea eax, [ebp - 0x23c]
push ebx
push eax
mov dword [ebp - 0x240], ebx
call fcn.004dbcc0
add esp, 0xc
push esi
lea edx, [ebp - 0x240]
lea ecx, [ebp - 0xa90]
call fcn.0046ea5c
test eax, eax
je 0x42c7a3
test byte [ebp - 0x34], 0x10
jne 0x42c715
push dword [ebp - 0xa94]
lea eax, [ebp - 0x23c]
push eax
call fcn.004d5d48
pop ecx
pop ecx
test eax, eax
je 0x42c71f
inc esi
cmp esi, edi
jl 0x42c6c2
jmp 0x42c7a3
push dword [ebp - 0x240]
lea esi, [ebp - 0xa90]
call fcn.0046eb49
mov esi, eax
cmp esi, ebx
je 0x42c7a3
mov ecx, dword [ebp - 0xa98]
call fcn.004372a5
push 5
push dword [ebp - 0xa98]
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
push 0x51145c
push dword [ebp - 0xa98]
lea eax, [ebp - 0xa94]
push eax
mov dword [ebp - 0xa94], ebx
call fcn.004d91eb
add esp, 0xc
test eax, eax
jne 0x42c79c
push dword [ebp - 0xa94]
xor edi, edi
push dword [ebp - 0x14]
inc edi
push edi
push esi
call fcn.004d9977
push dword [ebp - 0xa94]
call fcn.004d9a70
add esp, 0x14
mov dword [ebp - 0xa9c], edi
push esi
call fcn.004d5e58
pop ecx
lea ecx, [ebp - 0xa90]
call fcn.0046e9e8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa90]
call fcn.0046e91c
mov eax, dword [ebp - 0xa9c]
jmp 0x42c7c7
xor eax, eax
call fcn.004de8f7
ret 4
Function at 0x42cc44
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, ebx
cdq
push 3
pop ecx
idiv ecx
lea eax, [ebx + 2]
xor esi, esi
mov dword [ebp - 8], edx
cdq
idiv ecx
lea eax, [eax*4 + 1]
push eax
call fcn.004d4f20
pop ecx
mov ecx, eax
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
jle 0x42cceb
cdq
push 3
pop ebx
idiv ebx
mov eax, dword [ebp - 4]
test edx, edx
jne 0x42cc90
movzx edx, byte [eax + edi]
shr edx, 2
jmp 0x42ccd6
cmp edx, 1
jne 0x42ccb0
movzx edx, byte [eax + edi - 1]
movzx ebx, byte [eax + edi]
and edx, 3
shl edx, 4
shr ebx, 4
mov dl, byte [edx + ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x42ccdc
cmp edx, 2
jne 0x42cce0
movzx edx, byte [eax + edi - 1]
movzx ebx, byte [eax + edi]
and edx, 0xf
shr ebx, 6
mov dl, byte [ebx + edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
movzx edx, byte [eax + edi]
inc esi
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
inc esi
mov ebx, dword [ebp + 8]
inc eax
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x42cc7a
cmp dword [ebp - 8], 1
jne 0x42cd0c
movzx eax, byte [edi + ebx - 1]
and eax, 3
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
inc esi
mov byte [ecx + esi], 0x3d
jmp 0x42cd24
cmp dword [ebp - 8], 2
jne 0x42cd2a
movzx eax, byte [edi + ebx - 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
inc esi
mov byte [ecx + esi], 0x3d
inc esi
mov byte [ecx + esi], 0
pop esi
mov eax, ecx
pop ebx
leave
ret

Function at 0x42cd69
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
xor esi, esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.004dbcc0
push 4
push str.__class
push 0x549bac
push str.__s___s_d
lea eax, [ebp - 0x210]
push 0x103
push eax
call fcn.004d5add
push 0x40
lea eax, [ebp - 0x264]
push esi
push eax
call fcn.004dbcc0
xor eax, eax
mov dword [ebp - 0x220], esi
lea edi, [ebp - 0x21c]
stosd dword es:[edi], eax
add esp, 0x30
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x268]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x210]
push eax
push esi
mov dword [ebp - 0x268], 0x44
mov dword [ebp - 0x23c], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x42ce34
push dword [ebp - 0x21c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x220]
call esi
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004d5a7d
leave
ret
Function at 0x42da81
Capabilities:
Read file on windows

Disassembly:
push 0x28
mov eax, 0x4f5dc9
call fcn.004de874
mov edi, ecx
xor esi, esi
push 0x511450
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x34], edi
mov ebx, edx
mov dword [ebp - 0x30], esi
call fcn.0040617e
push 0x515f88
lea eax, [ebp - 0x30]
push ebx
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x30], esi
call fcn.004d91eb
add esp, 0xc
test eax, eax
je 0x42dadf
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call fcn.0040648c
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040653b
mov eax, edi
jmp 0x42db66
push 2
push esi
push dword [ebp - 0x30]
call fcn.004d92c8
push dword [ebp - 0x30]
call fcn.004d94ea
push esi
push esi
push dword [ebp - 0x30]
mov ebx, eax
call fcn.004d92c8
lea eax, [ebx + 1]
push eax
call fcn.004d4f20
mov edi, eax
add esp, 0x20
cmp edi, esi
jne 0x42db1a
push dword [ebp - 0x30]
call fcn.004d9a70
jmp 0x42db4b
lea eax, [ebx + 1]
push eax
push esi
push edi
call fcn.004dbcc0
push dword [ebp - 0x30]
push ebx
push 1
push edi
call fcn.004d97f8
push dword [ebp - 0x30]
call fcn.004d9a70
add esp, 0x20
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040615b
push edi
call fcn.004d5e58
pop ecx
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
push eax
call fcn.0040648c
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040653b
mov eax, dword [ebp - 0x34]
call fcn.004de8f7
ret
Function at 0x42dd8a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4b95
mov eax, dword fs:[0]
push eax
mov eax, 0x126c
call fcn.004e84e0
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x5162ac
push edi
call fcn.0043743e
pop ecx
pop ecx
test eax, eax
je 0x42df00
xor esi, esi
push esi
lea ebx, [ebp - 0x1058]
mov ecx, edi
call fcn.00437467
pop ecx
test eax, eax
je 0x42de5e
push str.iexplore.exe
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x42de16
push 1
mov ecx, edi
call fcn.00437467
pop ecx
cmp word [ebp - 0x1058], si
jne 0x42de16
push esi
mov ecx, edi
call fcn.00437467
pop ecx
lea eax, [ebp - 0x1058]
push eax
push 0x50e498
push 0x824
mov ebx, 0x54d8c0
push ebx
call fcn.004d5add
add esp, 0x10
xor eax, eax
mov word [0x54e906], ax
call fcn.0046c2bd
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d5a7d
leave
ret
push 0x208
lea eax, [ebp - 0x1260]
push esi
push eax
mov dword [ebp - 0x1270], 0x517b78
mov dword [ebp - 0x126c], esi
mov dword [ebp - 0x1268], esi
mov dword [ebp - 0x1264], esi
call fcn.004dbcc0
add esp, 0xc
lea eax, [ebp - 0x1270]
push eax
mov dword [ebp - 4], esi
call fcn.0043e7bd
mov edi, eax
mov ebx, 0x54d8c0
cmp edi, esi
je 0x42deec
lea eax, [ebp - 0x1274]
push eax
mov esi, 0x10000
push edi
lea eax, [ebp - 0x1270]
mov dword [ebp - 0x1274], esi
call fcn.0043e977
test eax, eax
je 0x42dee0
test dword [ebp - 0x1274], esi
je 0x42dee0
push ebx
push edi
lea eax, [ebp - 0x1270]
call fcn.0043e8a2
push edi
lea eax, [ebp - 0x1270]
call fcn.0043e81d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1270]
call fcn.0043e776
jmp 0x42de3d
push 0x515a6c
push edi
call fcn.0043743e
pop ecx
pop ecx
push edi
test eax, eax
je 0x42de1d
push 0x824
mov ebx, 0x54d8c0
push ebx
push 0x507b1c
push 0x5162b4
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x42de3d
Function at 0x42f386
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
mov eax, dword [0x52ec00]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
xor ebx, ebx
cmp esi, edi
je 0x42f49d
cmp word [esi], di
je 0x42f49d
xor eax, eax
push 0x1fe
mov word [esp + 0x64], ax
lea eax, [esp + 0x66]
push edi
push eax
call fcn.004dbcc0
add esp, 0xc
push 0x38
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.004dbcc0
add esp, 0xc
lea eax, [esp + 0x60]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x24]
push eax
push edi
push edi
push esi
mov dword [esp + 0x34], 0x3c
mov dword [esp + 0x48], 0xff
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x42f49d
xor esi, esi
push dword [esi + 0x5304c4]
lea eax, [esp + 0x64]
call fcn.0041756a
pop ecx
test eax, eax
jne 0x42f461
add esi, 4
cmp esi, 0x24
jb 0x42f414
lea eax, [esp + 0xc]
push eax
call fcn.0042b360
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x18]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
jbe 0x42f490
push edi
lea esi, [esp + 0x10]
call fcn.004055de
cmp dword [eax + 0x18], 8
jb 0x42f466
mov eax, dword [eax + 4]
jmp 0x42f469
xor ebx, ebx
inc ebx
jmp 0x42f499
add eax, 4
push eax
lea eax, [esp + 0x64]
call fcn.0041756a
pop ecx
test eax, eax
jne 0x42f48d
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x18]
push 0x1c
cdq
pop ecx
idiv ecx
inc edi
cmp edi, eax
jb 0x42f44c
jmp 0x42f490
xor ebx, ebx
inc ebx
lea esi, [esp + 0xc]
call fcn.004055b1
mov eax, ebx
jmp 0x42f49f
xor eax, eax
mov ecx, dword [esp + 0x264]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004d5a7d
mov esp, ebp
pop ebp
ret

Function at 0x4300cf
Capabilities:
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x1c4]
sub esp, 0x244
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp + 0x1c0], eax
push edi
xor edi, edi
mov dword [ebp - 0x44], edi
cmp word [esi], di
je 0x430167
cmp ebx, edi
je 0x430167
xor eax, eax
push 0x1fe
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push edi
push eax
call fcn.004dbcc0
push 0x38
lea eax, [ebp - 0x7c]
push edi
push eax
call fcn.004dbcc0
add esp, 0x18
lea eax, [ebp - 0x40]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push esi
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x6c], 0xff
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x430162
lea eax, [ebp - 0x40]
push eax
push 0x50e498
push 0xffffffffffffffff
push 0x100
push ebx
call fcn.004d78c1
add esp, 0x14
mov dword [ebp - 0x44], 1
mov eax, dword [ebp - 0x44]
jmp 0x430169
xor eax, eax
mov ecx, dword [ebp + 0x1c0]
xor ecx, ebp
pop edi
call fcn.004d5a7d
add ebp, 0x1c4
leave
ret
Function at 0x431125
Capabilities:
Create new key via cryptacquirecontext
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ecx
push ebx
push ebp
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 8
push 1
mov ebx, str.Microsoft_Base_Cryptographic_Provider_v1.0
push ebx
xor ebp, ebp
push ebp
push esi
mov dword [esp + 0x20], ebp
call edi
mov eax, dword [esi]
cmp eax, ebp
jne 0x43115b
push 0xf0000048
push 1
push ebx
push ebp
push esi
call edi
mov eax, dword [esi]
cmp eax, ebp
je 0x431184
push dword [esp + 0x14]
push ebp
push ebp
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x43117b
mov dword [esp + 0xc], 1
jmp 0x431184
push ebp
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
pop ecx
ret

Function at 0x43136c
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x5a0]
sub esp, 0x620
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp + 0x59c], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor ebx, ebx
push edi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x78], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4314a1
cmp esi, ebx
je 0x4314a1
push 0x511454
lea eax, [ebp - 0x74]
push edi
push eax
mov dword [ebp - 0x74], ebx
call fcn.004d91eb
add esp, 0xc
test eax, eax
jne 0x43149c
lea eax, [ebp - 0x70]
push eax
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x70], ebx
call fcn.00431125
pop ecx
test eax, eax
je 0x4314a1
push 0x3ff
lea eax, [ebp - 0x6b]
push ebx
xor edi, edi
push eax
inc edi
mov byte [ebp - 0x6c], bl
call fcn.004dbcc0
push dword [ebp - 0x74]
mov esi, 0x400
push esi
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.004d97f8
add esp, 0x1c
jmp 0x43143a
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x70]
call fcn.0043118d
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x43143e
push dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push esi
push 1
push eax
call fcn.004d97f8
add esp, 0x10
cmp eax, ebx
jne 0x431412
xor eax, eax
push 0x206
mov word [ebp + 0x394], ax
lea eax, [ebp + 0x396]
push ebx
push eax
call fcn.004dbcc0
add esp, 0xc
cmp edi, ebx
je 0x43148f
push dword [ebp - 0x70]
lea edi, [ebp + 0x394]
call fcn.004311b2
pop ecx
test eax, eax
je 0x43148f
mov eax, edi
push eax
push 0x50e498
push 0x3f
push dword [ebp - 0x80]
call fcn.004d5add
add esp, 0x10
mov dword [ebp - 0x78], 1
push dword [ebp - 0x70]
push dword [ebp - 0x7c]
call fcn.00431276
pop ecx
pop ecx
mov eax, dword [ebp - 0x78]
jmp 0x4314a3
xor eax, eax
mov ecx, dword [ebp + 0x59c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5a7d
add ebp, 0x5a0
leave
ret

Function at 0x4314bb
Capabilities:
Check if file exists
Set file attributes

Disassembly:
mov eax, esi
call fcn.0043155a
xor eax, eax
cmp dword [esp + 4], eax
je 0x4314f4
push dword [esp + 4]
mov ecx, 0x104
mov edx, esi
call fcn.00402b1f
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4314f1
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
inc eax
ret 4