joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x30cd5a97
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x79c35baa
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
inc eax
mov eax, 0x2bf099d1
cmp eax, 0x14
mov eax, ecx
mov eax, ebx
inc eax
mov eax, 0x1d195fdf
nop
cmp eax, 0xffffffb8
mov eax, ebx
cmp eax, 0x78
mov eax, ecx
mov eax, ebx
mov eax, 0xce81b43d
nop
cmp eax, 0xfffffff4
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
nop
inc eax
cmp eax, 0xcbbdb5b6
mov eax, ecx
nop
cmp eax, 0x1041cefc
nop
mov eax, ebx
mov eax, ebx
cmp eax, 0x1d
nop
cmp eax, 0x40
inc eax
mov eax, ebx
cmp eax, 0xfffffffb
mov eax, ebx
inc eax
mov eax, ebx
nop
mov eax, ebx
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, ecx
mov eax, ebx
nop
mov eax, ecx
mov eax, ecx
cmp eax, 0x6a
mov eax, ecx
cmp eax, 0x68d87b49
mov eax, ebx
mov eax, ebx
mov eax, 0x5d5d4517
mov eax, ebx
inc eax
mov eax, 0x220cec69
nop
inc eax
mov eax, ebx
mov eax, ecx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
inc eax
mov eax, ebx
mov eax, 0x7b2fe84d
cmp eax, 0x6a
mov eax, ebx
cmp eax, 0xffffff85
cmp eax, 0xffffffde
nop
mov eax, ecx
cmp eax, 0x22
cmp eax, 0xc48347a2
mov eax, 0xdf090b9a
inc eax
mov eax, ebx
mov eax, ebx
inc eax
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
mov eax, 0xf5d944c1
inc eax
cmp eax, 0x2d
inc eax
mov eax, ecx
mov eax, 0xcffb2e4a
mov eax, ecx
inc eax
nop
nop
nop
mov eax, ebx
mov eax, ebx
mov eax, ecx
cmp eax, 0x456560d7
mov eax, ebx
mov eax, ecx
mov eax, ebx
mov eax, ecx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, ecx
inc eax
cmp eax, 0x26
cmp eax, 0x5e28ed94
mov eax, 0x8b5d2648
nop
cmp eax, 0x7c
mov eax, ebx
mov eax, ecx
mov eax, 0xdbea80a3
mov eax, ebx
cmp eax, 0xc13dcc2b
inc eax
cmp eax, 0x1d
mov eax, ecx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4019f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x4019ff
push esp
mov dword [ebp - 0x24], 0x40171b
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a9e
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a7f
pop ebp
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5b0d3651
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6bcb209f
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x408313
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x408322
pop dword [ebp - 0x2c]
mov eax, 0xb928e31a
add eax, 0x4717a008
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xeee0b150
add dword [ebp - 0x3c], 0x5f7193fb
mov dword [ebp - 0x38], 0x72c1bfeb
sub dword [ebp - 0x38], 0x408e73a6
mov dword [ebp - 0x34], 0x76e3204a
add dword [ebp - 0x34], 0xd56923e4
mov dword [ebp - 0x30], 0xde7792ca
add dword [ebp - 0x30], 0x21886d36
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x44343440
add eax, 0xbc0c9c0c
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x6e4d43db
add dword [ebp - 0x3c], 0x625257b
mov dword [ebp - 0x38], 0xf941af9e
add dword [ebp - 0x38], 0x482ab1d7
mov dword [ebp - 0x34], 0xb17c3b74
sub dword [ebp - 0x34], 0x4e0ccf08
mov dword [ebp - 0x30], 0xc05813a1
add dword [ebp - 0x30], 0x3fa7ec5f
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x8137a4a9
sub eax, 0x80f6d461
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x38c7b
push 0
call eax
mov ecx, 0xa6a5cde7
add ecx, 0x595a776f
mov ebx, eax
mov esi, 0x4b4bf97a
add esi, 0xb4f5b686
add esi, dword [ebp - 0x2c]
mov edi, 0x96a28eed
add dword [ebp - 0x14], 0x4c1a7c59
mov edx, dword [esi]
xor dword [ebp - 0xc], esi
sub edx, edi
xor dword [ebp - 4], 0xa9374f0e
mov dword [ebx], edx
sub dword [ebp - 8], esi
add ebx, 4
add esi, 0x53e58fc7
add esi, 0xac1a703d
loop 0x40843e
add eax, 0x1082b
mov ebx, eax
add eax, 0x142baf92
sub eax, 0x142baf8d
mov ecx, 0xcb4438e3
sub ecx, 0xcb0438e3
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x23e16d8c
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x1ace3ec8
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x43b2f0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x43b308
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x43b3ac
mov edx, dword [ebp - 4]
sub edx, 0x231d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 + 0x463a]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shr eax, 0xc
cmp eax, 3
jne 0x43b3a7
mov ecx, dword [ebp - 8]
push ecx
call fcn.0043b2d0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x43b366
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x43b366
xor eax, eax
jmp 0x43b3ac
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax - 0x4c3f8]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
add ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov edx, dword [ebp + 0x10]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x4c3f8
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jmp 0x43b2ff
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x4a7c4d0f
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x6aaa0e38
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x401ae0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40406c], eax
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.mifedount
push str.Deltapo
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401b33
xor eax, eax
jmp 0x401b4e
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x45a340
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], ecx
mov eax, dword [ebp + 8]
push eax
push str.C:WindowsPrefetch_s
lea ecx, [ebp - 0x108]
push ecx
call fcn.0045b2d0
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret 4

Function at 0x45a390
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0x10
jne 0x45a3df
mov edx, dword [ebp + 8]
add edx, 0x2c
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x532980
lea ecx, [ebp - 0x108]
push ecx
call fcn.0045b2d0
add esp, 0x10
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret 8

Function at 0x45a400
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x11c], ecx
mov eax, dword [0x815908]
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp - 0x110]
mov al, byte [edx]
mov byte [ebp - 0x109], al
add dword [ebp - 0x110], 1
cmp byte [ebp - 0x109], 0
jne 0x45a433
mov ecx, dword [ebp - 0x110]
sub ecx, dword [ebp - 0x114]
mov dword [ebp - 0x118], ecx
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [0x815908]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005076d0
add esp, 0xc
test eax, eax
jne 0x45a4a5
mov edx, dword [ebp + 8]
push edx
push str.C:WindowsPrefetch_s
lea eax, [ebp - 0x108]
push eax
call fcn.0045b2d0
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret 4
Function at 0x45ab30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52fbe0
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x6c]
call fcn.0045a050
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
push 0x532840
call fcn.00507af6
add esp, 4
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
push edx
mov ecx, dword [ebp - 0x38]
call fcn.0045aa30
mov dword [ebp - 0x3c], eax
push 0x53263c
mov ecx, dword [ebp - 0x3c]
call fcn.0045aa30
push eax
lea ecx, [ebp - 0x28]
call fcn.00459d80
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6c]
call fcn.0045a230
mov eax, dword [str.chrome.log]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x84]
push edx
call fcn.00459680
add esp, 0xc
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
call fcn.0045ab10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x84]
call fcn.0045a230
push 0x532848
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x9c]
push ecx
call fcn.00459680
add esp, 0xc
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
call fcn.0045ab10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x9c]
call fcn.0045a230
push 0x815b98
lea ecx, [ebp - 0xb4]
call fcn.00459e30
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
call fcn.004ff760
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x54]
call fcn.0045aa30
mov ecx, eax
call fcn.0045ab10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb4]
call fcn.0045a230
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0045a230
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret

Function at 0x45acb0
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 4], eax
push str.Application
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x45ad11
push 0
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
push 0x40
push 0x532614
push 0x532640
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x45ad43
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5326a0
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x10
push 0x532784
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret
Function at 0x45ae40
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x144]
push eax
push str.C:WindowsPrefetch.
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xffffffff
je 0x45aebd
mov ecx, dword [ebp - 0x144]
and ecx, 0x10
jne 0x45ae98
mov edx, dword [ebp + 8]
mov dword [ebp - 0x14c], edx
lea eax, [ebp - 0x118]
push eax
call dword [ebp - 0x14c]
add esp, 4
lea ecx, [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x148]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x45ae74
mov eax, dword [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret

Function at 0x45aed0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x254], eax
movzx ecx, byte [ebp + 0x14]
test ecx, ecx
je 0x45af00
mov dword [ebp - 0x250], 0x5325c0
jmp 0x45af0a
mov dword [ebp - 0x250], 0x5325c4
mov edx, dword [ebp - 0x254]
push edx
mov eax, dword [ebp - 0x250]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.0045b2d0
add esp, 0xc
lea edx, [ebp - 0x248]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0xffffffff
je 0x45af95
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x258], ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x248]
push eax
call dword [ebp - 0x258]
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x45af70
jmp 0x45af88
lea edx, [ebp - 0x248]
push edx
mov eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x45af4a
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret