joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404666
Capabilities:
Identify system language via api

Disassembly:
push ecx
cmp byte [0x42b000], 0
push ebx
push ebp
push esi
push edi
mov ebx, 0xffff
mov ebp, 0x42b000
je 0x404686
push ebp
call fcn.00406bd8
jmp 0x40468c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [esp + 0x10], eax
xor edi, edi
mov esi, dword [0x424f84]
mov eax, esi
dec esi
test eax, eax
je 0x4046e8
mov eax, dword [0x424f48]
mov ecx, dword [eax + 0x5c]
mov edx, ecx
imul ecx, esi
neg edx
add ecx, dword [0x424f80]
mov ax, word [esp + 0x10]
mov edi, ecx
xor ax, word [ecx]
and eax, ebx
test ax, ax
je 0x4046d0
mov eax, esi
dec esi
add ecx, edx
test eax, eax
jne 0x4046b4
jmp 0x4046e8
mov eax, dword [edi + 2]
mov dword [0x424720], eax
mov eax, dword [edi + 6]
mov dword [0x424fc4], eax
lea eax, [edi + 0xa]
mov dword [0x42471c], eax
cmp dword [0x42471c], 0
jne 0x404703
cmp bx, 0xffff
jne 0x4046ff
mov ebx, 0x3ff
jmp 0x404692
xor ebx, ebx
jmp 0x404692
movzx eax, word [edi]
push eax
push ebp
call fcn.00406bbf
push 0xfffffffffffffffe
push 0x424740
call fcn.00406c80
push eax
push dword [0x42190c]
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40647e
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x423130], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x4064a2
test al, 0x10
jne 0x4064a5
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x423130
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4064d0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x40655f
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00406844
test eax, eax
je 0x4065c4
test byte [ebp + 0xc], 1
je 0x4065ac
mov eax, dword [0x424f44]
push esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
call fcn.00406c73
and byte [eax + esi + 1], 0
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], esi
push eax
mov word [ebp - 0x10], 0x414
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
jmp 0x4065c4
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4065c4
test byte [ebp + 0xc], 2
je 0x4065c4
push eax
push esi
call fcn.0040699e
pop esi
leave
ret 8
Function at 0x402ebe
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
push edi
mov dword [ebp - 0x2c8], ecx
mov byte [ebp - 0x134], 0
xor eax, eax
mov dword [ebp - 0x133], eax
mov dword [ebp - 0x12f], eax
mov byte [ebp - 0x12b], al
mov byte [ebp - 0x14], 0
xor ecx, ecx
mov dword [ebp - 0x13], ecx
mov dword [ebp - 0xf], ecx
mov dword [ebp - 0xb], ecx
mov dword [ebp - 7], ecx
mov word [ebp - 3], cx
mov byte [ebp - 1], cl
mov byte [ebp - 0x118], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x2c4], 0
mov ecx, 0x63
xor eax, eax
lea edi, [ebp - 0x2c3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp + 8]
push eax
push 0x41b6c4
lea ecx, [ebp - 0x134]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov edx, dword [ebp - 0x122]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x126]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x128]
and ecx, 0xffff
push ecx
push 0x41b6cc
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x41b6d8
lea ecx, [ebp - 0x118]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x118]
push edx
push 0x190
lea eax, [ebp - 0x2c4]
push eax
push 0x41c440
lea ecx, [ebp - 0x14]
push ecx
push 0x41b6e4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x134]
push edx
lea eax, [ebp - 0x2c4]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x40302d
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 0x2c4]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x2c4]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0x41b6ec
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x403034
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
push edi
mov dword [ebp - 0x2c8], ecx
mov byte [ebp - 0x134], 0
xor eax, eax
mov dword [ebp - 0x133], eax
mov dword [ebp - 0x12f], eax
mov byte [ebp - 0x12b], al
mov byte [ebp - 0x14], 0
xor ecx, ecx
mov dword [ebp - 0x13], ecx
mov dword [ebp - 0xf], ecx
mov dword [ebp - 0xb], ecx
mov dword [ebp - 7], ecx
mov word [ebp - 3], cx
mov byte [ebp - 1], cl
mov byte [ebp - 0x118], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x2c4], 0
mov ecx, 0x63
xor eax, eax
lea edi, [ebp - 0x2c3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp + 8]
push eax
push str._d
lea ecx, [ebp - 0x134]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov edx, dword [ebp - 0x122]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x126]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x128]
and ecx, 0xffff
push ecx
push str._d_02d_02d
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x41b708
lea ecx, [ebp - 0x118]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x118]
push edx
push 0x190
lea eax, [ebp - 0x2c4]
push eax
push 0x41c444
lea ecx, [ebp - 0x14]
push ecx
push 0x41b714
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x134]
push edx
lea eax, [ebp - 0x2c4]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x403174
mov al, 1
jmp 0x403176
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x403197
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
mov dword [ebp - 0x11c], ecx
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x114], 0
xor eax, eax
mov dword [ebp - 0x113], eax
mov dword [ebp - 0x10f], eax
mov byte [ebp - 0x10b], al
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x41b71c
lea edx, [ebp - 0x104]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x104]
push eax
push 0
push 0x41b728
push 0x41b72c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x4032a2
push 0
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x64
idiv ecx
add edx, 1
mov dword [ebp - 0x118], edx
push 0xa
push 0
lea edx, [ebp - 0x114]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x118]
push eax
push 0x41b734
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x114]
push eax
push 0x41b738
push str.gtag
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x108]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x404fdc
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417920
push 0x4151f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x1c], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
nop
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
nop
cmp ebx, 0x564d5868
sete byte [ebp - 0x1c]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xffffffff
jmp 0x405054
mov al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40bb0a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
push str.DSound.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40bb91
push str.DirectSoundCreate
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40bb91
lea ecx, [ebp - 4]
push ecx
push 0x40
push 8
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 8
push 0x41ba94
mov eax, dword [ebp - 8]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
push 8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.Winmm.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40bc4b
push str.midiStreamOpen
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40bbfa
lea edx, [ebp - 4]
push edx
push 0x40
push 8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 8
push 0x41ba9c
mov ecx, dword [ebp - 8]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
push 8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.waveOutWrite
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40bc4b
lea eax, [ebp - 4]
push eax
push 0x40
push 8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 8
push 0x41ba94
mov edx, dword [ebp - 8]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 8
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40c3b9
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416926
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x15c]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x15c]
call sub.MFC42.DLL_CString::operator_1
push str..
lea ecx, [ebp - 0x15c]
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp - 0x158]
push ecx
lea ecx, [ebp - 0x15c]
call fcn.00405140
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x40c470
mov dword [ebp - 0x160], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x15c]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x160]
jmp 0x40c5b7
push 1
push 0x41bc2c
lea edx, [ebp - 0x12c]
push edx
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x40c4a4
push 1
push 0x41bc30
lea eax, [ebp - 0x12c]
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x40c4a9
jmp 0x40c566
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::operator_1
push 0x41bc34
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::operator
lea edx, [ebp - 0x12c]
push edx
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp - 0x18]
call fcn.00405140
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 1
test eax, eax
je 0x40c509
mov ecx, dword [ebp - 0x14]
and ecx, 0xfffffffe
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x18]
call fcn.00405140
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x158]
and eax, 0x10
test eax, eax
je 0x40c53b
push 0
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040c3b9
lea ecx, [ebp - 0x18]
call fcn.00405140
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x40c566
push 9
push str.index.dat
lea edx, [ebp - 0x12c]
push edx
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x40c557
jmp 0x40c566
lea ecx, [ebp - 0x18]
call fcn.00405140
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40c470
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x164], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x15c]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x40c5c7
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40c6cb
push 0
push 0x84000000
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40c6c1
cmp dword [ebp + 0xc], 0
je 0x40c6c1
mov dword [ebp - 0x1c], 0x194
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 4
push 0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0x20000013
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x40c66f
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x40c6ce
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x10], 0
je 0x40c6b0
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp + 0x10]
jb 0x40c67d
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40cdfb
Capabilities:
Copy file
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push edi
push 0x44
push 0
lea eax, [ebp - 0x24c]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x24c], 0x44
mov dword [ebp - 0x244], 0x41bcc8
push 0x10
push 0
push 0x41c588
call sub.MSVCRT.dll_memset
add esp, 0xc
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x208], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x104]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5c
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov byte [eax], 0
push str.msofty.exe
lea edx, [ebp - 0x104]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x41c588
lea edx, [ebp - 0x24c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x41bcdc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40cf0e
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41077a
Capabilities:
Delete internet cache
Enumerate internet cache
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov dword [ebp - 0x80c], 0
lea eax, [ebp - 0x808]
push eax
push 0
push 0
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x808]
push ecx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x810], eax
mov edx, dword [ebp - 0x810]
mov dword [ebp - 0x80c], edx
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [ebp - 0x80c]
push ecx
push 0
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x410852
cmp dword [ebp - 0x80c], 0
je 0x410805
mov edx, dword [ebp - 0x80c]
mov dword [ebp - 0x814], edx
mov eax, dword [ebp - 0x814]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
push 0
push 0x21
lea ecx, [ebp - 0x404]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edx, [ebp - 0x404]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040c3b9
push 0
push 0x20
lea ecx, [ebp - 0x404]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edx, [ebp - 0x404]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040c3b9
xor eax, eax
jmp 0x41095d
mov ecx, dword [ebp - 0x80c]
mov edx, dword [ecx + 0xc]
and edx, 0x100000
test edx, edx
je 0x410875
mov eax, dword [ebp - 0x80c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov dword [ebp - 0x808], 0
lea edx, [ebp - 0x808]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
mov ecx, dword [ebp - 0x80c]
mov dword [ebp - 0x818], ecx
mov edx, dword [ebp - 0x818]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [ebp - 0x808]
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x81c], eax
mov ecx, dword [ebp - 0x81c]
mov dword [ebp - 0x80c], ecx
lea edx, [ebp - 0x808]
push edx
mov eax, dword [ebp - 0x80c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x410852
cmp dword [ebp - 0x80c], 0
je 0x410912
mov edx, dword [ebp - 0x80c]
mov dword [ebp - 0x820], edx
mov eax, dword [ebp - 0x820]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
push 0
push 0x21
lea ecx, [ebp - 0x404]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edx, [ebp - 0x404]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040c3b9
push 0
push 0x20
lea ecx, [ebp - 0x404]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edx, [ebp - 0x404]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040c3b9
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x412bfb
Capabilities:
Create directory
Get common file path
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
push edi
mov dword [ebp - 0x33c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x210], 0
mov al, byte [0x41c658]
mov byte [ebp - 0x314], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
push 0
lea ecx, [ebp - 0x20c]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x108]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x108]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x314]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x41c19c
lea edx, [ebp - 0x20c]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x41c1a8
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x41c1b0
lea ecx, [ebp - 0x314]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
lea edx, [ebp - 0x314]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0xffffffff
je 0x412d8d
mov dword [ebp - 0x338], 0
lea ecx, [ebp - 0x330]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov word [ebp - 0x330], 0x7bd
mov word [ebp - 0x32e], 0xa
mov word [ebp - 0x32a], 0x14
lea edx, [ebp - 0x320]
push edx
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0
lea ecx, [ebp - 0x320]
push ecx
mov edx, dword [ebp - 0x318]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0xffffffff
je 0x412de5
push 0
lea edx, [ebp - 0x210]
push edx
push 2
push 0x41c1bc
mov eax, dword [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov esp, ebp
pop ebp
ret