joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a0e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9648
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x510a50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
or eax, 0xffffffff
mov dword [ebp - 4], 0
mov esi, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x1c], esi
jae 0x40a12d
lea eax, [ebp + 8]
push eax
call fcn.004a0260
mov edi, eax
push 0x4f5960
lea ecx, [ebp - 0x10]
push edi
push ecx
call fcn.00485860
mov eax, dword [ebp - 0x10]
add esp, 0xc
test eax, eax
jne 0x40a17d
push edi
call fcn.00460bb0
add esp, 4
cmp dword [ebp + 0x1c], esi
jb 0x40a168
mov edx, dword [ebp + 8]
push edx
call fcn.00460bb0
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x20
push 2
push 0
push eax
call fcn.00485d69
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
push ecx
call fcn.00485749
mov edx, dword [ebp - 0x10]
push 0
push 0
push edx
call fcn.00485d69
mov eax, dword [ebp - 0x18]
add eax, 2
push eax
call fcn.00460bbb
mov ecx, dword [ebp - 0x18]
add ecx, 2
push ecx
mov esi, eax
push 0
push esi
call fcn.00488a00
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push edx
push eax
push 1
push esi
call fcn.00485af1
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov byte [ecx + esi], 0
mov edx, dword [ebp - 0x18]
inc edx
add esp, 0x40
shr edx, 1
mov dword [ebx], esi
push edi
mov dword [eax], edx
call fcn.00460bb0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00485e52
add esp, 8
cmp dword [ebp + 0x1c], 8
jb 0x40a209
mov edx, dword [ebp + 8]
push edx
call fcn.00460bb0
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x20
Function at 0x40add0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ce938
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x510a50]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
mov eax, dword [0x510a50]
xor eax, esp
push eax
lea eax, [esp + 0x140]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
cmp dword [edi + 0x90], 1
je 0x40ae38
mov eax, dword [edi + 0x88]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + 4]
cmp eax, ebx
jne 0x40ae3f
mov dword [edi + 0xd8], 0x2b5
xor al, al
jmp 0x40aff5
mov edx, dword [eax]
mov eax, dword [edx + 0x2c]
mov al, byte [eax + 1]
or esi, 0xffffffff
cmp al, bl
je 0x40ae8b
cmp dword [edi + 0x7c], ebx
jne 0x40ae86
lea eax, [esp + 0x14]
push eax
call fcn.00429840
mov dword [esp + 0x148], ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0xa8], ebx
call fcn.0046bb42
lea ecx, [esp + 0x14]
mov dword [esp + 0x148], esi
call fcn.00429940
jmp 0x40ae8b
call fcn.00429ea0
mov ecx, dword [edi + 0x8c]
cmp ecx, ebx
je 0x40aeb5
mov edx, dword [ecx]
mov eax, dword [edx + 0x60]
call eax
mov ecx, dword [edi + 0x8c]
cmp ecx, ebx
je 0x40aeaf
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
mov dword [edi + 0x8c], ebx
push 0x9c
call fcn.00460b81
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x148], 1
cmp eax, ebx
je 0x40aedd
push eax
call fcn.00426fb0
jmp 0x40aedf
xor eax, eax
mov dword [esp + 0x148], esi
mov dword [edi + 0x8c], eax
cmp eax, ebx
je 0x40ae38
mov dword [eax + 0x88], edi
mov ecx, dword [edi + 0x88]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov eax, dword [eax + 0x2c]
mov ecx, dword [edi + 0x8c]
mov dword [ecx + 0x80], eax
mov edx, dword [edi + 0x20]
lea ecx, [esp + 0x128]
push ecx
push edx
mov dword [esp + 0x130], ebx
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [edi + 0x8c]
push ebx
push ebx
push edi
lea eax, [esp + 0x134]
push eax
push 0x40000000
push ebx
push ebx
call fcn.00463027
test eax, eax
je 0x40ae38
mov esi, dword [edi + 0x8c]
call fcn.004286e0
push ebx
push ebx
push ebx
push 0x40c200
push ebx
push ebx
call fcn.004851bb
add esp, 0x18
mov esi, edi
mov dword [edi + 0x78], eax
mov byte [edi + 0x94], bl
mov dword [edi + 0x90], 1
mov byte [edi + 0xa0], bl
mov byte [edi + 0x96], 1
call fcn.004117a0
mov eax, dword [edi + 0x88]
call fcn.00409a40
mov ecx, dword [edi + 0x20]
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push ebx
push 0x64
push 0x64
push ecx
call esi
cmp dword [edi + 0x7c], 1
jne 0x40aff3
mov edx, dword [edi + 0x88]
mov eax, dword [edx + 4]
mov eax, dword [eax + 4]
mov ecx, dword [eax]
cmp dword [ecx + 0x28], ebx
je 0x40aff3
mov eax, dword [ecx + 0x28]
push ebx
push eax
mov eax, dword [edi + 0x20]
push 0xc8
push eax
call esi
mov al, 1
mov ecx, dword [esp + 0x140]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.004840ae
mov esp, ebp
pop ebp
ret
Function at 0x40c960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cccd6
mov eax, dword fs:[0]
push eax
sub esp, 0x448
mov eax, dword [0x510a50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
lea esi, [ebp - 0x218]
mov dword [ebp - 0x444], ebx
call fcn.00411750
call fcn.0040c8d0
cmp eax, 5
ja 0x40c9e3
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
mov word [edi], ax
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40c9c0
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x218]
push ecx
mov ecx, edi
call fcn.00404900
jmp 0x40cbb2
lea edx, [ebp - 0x216]
mov dword [ebp - 0x444], edx
call fcn.0049f8b7
mov ebx, eax
mov dword [ebp - 0x450], ebx
call fcn.0049f732
push 0
lea ecx, [ebp - 0x44c]
mov esi, eax
call fcn.0049f667
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x40ca1c
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x44c]
call fcn.0049f68f
push ecx
mov dword [ebp - 4], 0
mov eax, esp
mov dword [ebp - 0x448], esp
push 0
lea ecx, [ebp - 0x448]
mov dword [eax], ebx
call fcn.0049f667
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40ca52
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x448]
call fcn.0049f68f
lea eax, [ebp - 0x444]
push eax
call fcn.00413670
add esp, 8
test al, al
push 0
lea ecx, [ebp - 0x444]
sete byte [ebp - 0x43d]
mov dword [ebp - 4], 0xffffffff
call fcn.0049f667
mov eax, dword [ebx + 4]
test eax, eax
je 0x40ca99
cmp eax, 0xffffffff
jae 0x40ca99
dec eax
mov dword [ebx + 4], eax
mov esi, dword [ebx + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [ebp - 0x444]
and esi, ebx
call fcn.0049f68f
xor ebx, ebx
cmp esi, ebx
je 0x40cabf
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [ebp - 0x43d], bl
je 0x40cb03
xor ecx, ecx
lea eax, [ebp - 0x218]
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
mov word [edi], cx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40cae0
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
mov ecx, edi
call fcn.00404900
jmp 0x40cbb2
push ebx
push 0x1a
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40cb29
push 0x4f54c8
mov ecx, edi
call fcn.004049f0
jmp 0x40cbb2
lea ecx, [ebp - 0x420]
push ecx
lea ecx, [ebp - 0x43c]
call fcn.004049f0
push 0x16
mov eax, str...LocalVirtualStore
lea esi, [ebp - 0x43c]
mov dword [ebp - 4], 1
call fcn.00409210
lea eax, [ebp - 0x214]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40cb60
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x214]
lea esi, [ebp - 0x43c]
call fcn.00409210
mov eax, esi
xor edx, edx
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
push eax
mov ecx, edi
mov word [edi], dx
call fcn.00409190
cmp dword [ebp - 0x428], 8
jb 0x40cbb2
mov ecx, dword [ebp - 0x43c]
push ecx
call fcn.00460bb0
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004840ae
mov esp, ebp
pop ebp
ret
Function at 0x4173a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x504898
push 0x4893f0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x510a50]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x20], edx
mov eax, 0x219
mov dword [ebp - 0x1c], eax
cmp ecx, edx
je 0x4174dc
test byte [ecx + 0x218], 1
je 0x41747e
mov dword [ebp - 0x1c], 0x221
mov dword [ebp - 0x1c], 0x222
movzx eax, byte [ecx + 0x221]
lea eax, [eax*4 + 0x222]
mov dword [ebp - 0x1c], eax
inc eax
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], eax
movzx edi, byte [ecx + 0x226]
cmp esi, edi
jge 0x417443
add eax, 2
mov dword [ebp - 0x1c], eax
lea edi, [esi + esi*2]
mov ebx, dword [ecx + 0x227]
movzx edi, word [ebx + edi*2]
add eax, edi
inc esi
jmp 0x41741a
inc eax
mov dword [ebp - 0x1c], eax
movzx esi, byte [ecx + 0x22b]
lea eax, [eax + esi*4]
mov dword [ebp - 0x1c], eax
inc eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
movzx esi, byte [ecx + 0x230]
cmp edx, esi
jge 0x41747e
add eax, 2
mov dword [ebp - 0x1c], eax
lea esi, [edx + edx*2]
mov edi, dword [ecx + 0x231]
movzx esi, word [edi + esi*2]
add eax, esi
inc edx
jmp 0x417455
mov dl, byte [ecx + 0x218]
test dl, 4
je 0x4174a2
add eax, 8
mov dword [ebp - 0x1c], eax
add eax, 2
mov dword [ebp - 0x1c], eax
movzx esi, word [ecx + 0x23d]
lea eax, [eax + esi*8]
mov dword [ebp - 0x1c], eax
test dl, 2
je 0x4174ba
add eax, 0xa
mov dword [ebp - 0x1c], eax
movzx ecx, word [ecx + 0x24b]
lea eax, [eax + ecx*4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x504818
push 0x4893f0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x510a50]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x218
cmp ecx, esi
je 0x417967
mov dword [ebp - 0x1c], 0x275
mov dword [ebp - 0x1c], 0x277
movzx eax, word [ecx + 0x275]
add eax, 0x277
mov dword [ebp - 0x1c], eax
add eax, 2
mov dword [ebp - 0x1c], eax
movzx edx, word [ecx + 0x27b]
add eax, edx
mov dword [ebp - 0x1c], eax
add eax, 2
mov dword [ebp - 0x1c], eax
movzx edx, word [ecx + 0x281]
add eax, edx
mov dword [ebp - 0x1c], eax
add eax, 2
mov dword [ebp - 0x1c], eax
movzx edx, word [ecx + 0x287]
add eax, edx
mov dword [ebp - 0x1c], eax
add eax, 2
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
movzx edi, word [ecx + 0x28d]
cmp edx, edi
jge 0x417850
add eax, 0x30
mov dword [ebp - 0x1c], eax
add eax, 0x50
mov dword [ebp - 0x1c], eax
add eax, 2
mov dword [ebp - 0x1c], eax
mov edi, edx
imul edi, edi, 0x86
mov ebx, dword [ecx + 0x28f]
movzx edi, word [ebx + edi + 0x80]
add eax, edi
inc edx
jmp 0x417812
add eax, 2
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
movzx edi, word [ecx + 0x293]
cmp edx, edi
jge 0x417893
add eax, 0x30
mov dword [ebp - 0x1c], eax
add eax, 0x50
mov dword [ebp - 0x1c], eax
add eax, 2
mov dword [ebp - 0x1c], eax
mov edi, edx
imul edi, edi, 0x86
mov ebx, dword [ecx + 0x295]
movzx edi, word [ebx + edi + 0x80]
add eax, edi
inc edx
jmp 0x417855
add eax, 2
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], eax
movzx edx, word [ecx + 0x299]
cmp esi, edx
jge 0x4178f7
sub eax, 0xffffff80
mov dword [ebp - 0x1c], eax
add eax, 2
mov dword [ebp - 0x1c], eax
add eax, 8
mov dword [ebp - 0x1c], eax
mov edx, esi
imul edx, edx, 0x9a
add edx, dword [ecx + 0x29b]
movzx edi, word [edx + 0x82]
add eax, edi
mov dword [ebp - 0x1c], eax
movzx edi, word [edx + 0x8e]
add eax, edi
mov dword [ebp - 0x1c], eax
movzx edi, word [edx + 0x94]
add eax, edi
mov dword [ebp - 0x1c], eax
movzx edx, word [edx + 0x88]
add eax, edx
inc esi
jmp 0x417896
add eax, 0x38
mov dword [ebp - 0x1c], eax
add eax, 2
mov dword [ebp - 0x1c], eax
movzx edx, word [ecx + 0x2d7]
lea edx, [edx + edx*4]
shl edx, 6
add eax, edx
mov dword [ebp - 0x1c], eax
add eax, 2
mov dword [ebp - 0x1c], eax
movzx edx, word [ecx + 0x2dd]
lea edx, [edx + edx*4]
shl edx, 6
add eax, edx
mov dword [ebp - 0x1c], eax
add eax, 2
mov dword [ebp - 0x1c], eax
movzx ecx, word [ecx + 0x2e3]
lea ecx, [ecx + ecx*4]
shl ecx, 6
add eax, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41eb00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c95cb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x510a50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004a009a
push 4
mov dword [ebp - 4], 0
call fcn.00460b81
mov edi, eax
add esp, 4
test edi, edi
je 0x41eb7c
call fcn.0049f8b7
mov dword [edi], eax
call fcn.0049f732
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0049f667
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x41eb72
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0049f68f
jmp 0x41eb7e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4273e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ce5da
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x510a50]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push esi
mov eax, dword [0x510a50]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [edi]
mov edx, dword [eax + 0x16c]
mov ecx, edi
call edx
mov ecx, dword [edi + 0x20]
mov ebx, eax
lea eax, [esp + 0x10]
xor esi, esi
push eax
push ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x12c
call fcn.00460b81
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x30], esi
cmp eax, esi
je 0x42747d
mov ecx, dword [edi + 0x80]
lea edx, [edi + 0x84]
push edx
mov edx, dword [edi + 0x78]
push ebx
push ecx
mov ecx, dword [edi + 0x7c]
push ecx
push edx
push eax
call fcn.0042cd60
mov esi, eax
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x34], 0xffffffff
call fcn.0042d0c0
test eax, eax
je 0x4274c9
mov ecx, dword [edi + 0x74]
push ecx
mov ecx, esi
call fcn.0046dd0f
mov edx, dword [edi]
mov eax, dword [edx + 0x164]
push 1
push 0xffffffffffffffff
push 0x4f54c8
push esi
mov ecx, edi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0x160]
push ebx
mov ecx, edi
call eax
mov eax, dword [esi + 0x104]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004840ae
mov esp, ebp
pop ebp
ret
Function at 0x4299d0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ca006
mov eax, dword fs:[0]
push eax
mov eax, 0x20a8
call fcn.0048b160
mov eax, dword [0x510a50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x20b4]
call fcn.00470e1b
push edi
lea eax, [ebp - 0x1050]
mov dword [ebp - 4], 0
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push 0x4f6368
push eax
call ebx
add esp, 0xc
push 0
lea ecx, [ebp - 0x1050]
push ecx
lea ecx, [ebp - 0x20b4]
call fcn.00470ec2
test eax, eax
je 0x429b39
jmp 0x429a50
lea ecx, [ebp - 0x20b4]
call fcn.00470b34
lea ecx, [ebp - 0x20b4]
mov dword [ebp - 0x2098], eax
call fcn.00470ddd
test eax, eax
jne 0x429b2c
lea edx, [ebp - 0x2094]
push edx
lea ecx, [ebp - 0x20b4]
call fcn.0047119e
mov esi, eax
mov byte [ebp - 4], 1
mov eax, dword [esi]
cmp dword [eax - 4], 1
jle 0x429a9f
mov eax, dword [eax - 0xc]
push eax
mov ecx, esi
call fcn.00401620
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x830]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2094]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x429ad5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebp - 0x20b4]
mov eax, dword [edx + 0x38]
push 0x10
lea ecx, [ebp - 0x20b4]
call eax
lea ecx, [ebp - 0x830]
push ecx
push edi
push str._s_s
test eax, eax
je 0x429b13
lea edx, [ebp - 0x2090]
push edx
call ebx
lea eax, [ebp - 0x2090]
push eax
call fcn.004299d0
add esp, 0x14
jmp 0x429b2c
lea edx, [ebp - 0x1870]
push edx
call ebx
add esp, 0x10
lea eax, [ebp - 0x1870]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp dword [ebp - 0x2098], 0
jne 0x429a50
lea ecx, [ebp - 0x20b4]
call fcn.00470a4e
push edi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20b4]
test eax, eax
jne 0x429b65
call fcn.00470e4d
xor eax, eax
jmp 0x429b6f
call fcn.00470e4d
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004840ae
mov esp, ebp
pop ebp
ret

Function at 0x429ba0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.0046b82f
mov eax, dword [esi + 0xbc]
push 0x3c0000
push 0
push 0x401
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x20]
push 0
push 0x12c
push 1
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
push esi
push 0x429c00
push 0
push 0
call fcn.004851bb
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 1
pop esi
ret
Function at 0x429dc0
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
mov ebx, 0x1000
xor edi, edi
mov eax, 0x7a
test eax, eax
je 0x429e19
push esi
cmp eax, 0x7a
jne 0x429e82
call fcn.00460bb0
push ebx
call fcn.00460bbb
mov esi, eax
add esp, 8
mov dword [esi], ebx
mov dword [ebp - 4], ebx
test edi, edi
jne 0x429e13
lea eax, [ebp - 4]
push eax
push esi
push edi
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
mov edi, eax
xor eax, eax
test edi, edi
setne al
jmp 0x429e58
lea ecx, [ebp - 4]
push ecx
jmp 0x429e50
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x429e26
mov edx, dword [esi + 4]
push edx
jmp 0x429e43
test dword [esi + 0xc], 0x100000
je 0x429e3a
cmp eax, 2
jne 0x429e49
mov eax, dword [esi + 4]
push eax
jmp 0x429e43
cmp eax, 1
jne 0x429e49
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea edx, [ebp - 4]
mov dword [ebp - 4], ebx
push edx
push esi
push edi
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
test eax, eax
je 0x429e60
xor eax, eax
jmp 0x429e69
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x98], 0
je 0x429dd5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00460bb0
add esp, 4
test edi, edi
je 0x429e95
push edi
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x429ea0
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
mov ebx, 0x1000
xor edi, edi
mov eax, 0x7a
test eax, eax
je 0x429ef5
push esi
cmp eax, 0x7a
jne 0x429f21
call fcn.00460bb0
push ebx
call fcn.00460bbb
mov esi, eax
add esp, 8
mov dword [esi], ebx
mov dword [ebp - 4], ebx
test edi, edi
jne 0x429eef
lea eax, [ebp - 4]
push eax
push esi
push edi
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
mov edi, eax
xor eax, eax
test edi, edi
setne al
jmp 0x429f0e
lea ecx, [ebp - 4]
push ecx
jmp 0x429f06
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push esi
push edi
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
test eax, eax
je 0x429f16
xor eax, eax
jmp 0x429eb5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, dword [ebp - 4]
jmp 0x429eb5
call fcn.00460bb0
add esp, 4
test edi, edi
je 0x429f34
push edi
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b5e0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9fc8
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x510a50]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1a4]
push eax
push 0x202
mov dword [ebp - 4], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x42b69b
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
jle 0x42b641
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [ebp + 8]
call fcn.00412f20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x42b695
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42b691
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
jmp 0x42b6c4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b6c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004840ae
mov esp, ebp
pop ebp
ret