joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f020
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4133a0
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x4951d0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov dword [ebp - 0x24], 0x4951d0
mov esi, dword [edi]
test esi, esi
jne 0x40f0c5
mov ebx, dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40f0e1
mov esi, eax
test ebx, ebx
je 0x40f0bd
push 4
push 0xc
call fcn.00407d10
add esp, 8
test eax, eax
je 0x40f17e
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, eax
mov eax, dword [0x4951f0]
nop word cs:[eax + eax]
nop dword [eax]
mov dword [ecx + 8], eax
lock cmpxchg dword [0x4951f0], ecx
jne 0x40f0b0
mov eax, esi
test esi, esi
xchg dword [edi], eax
je 0x40f0fe
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x45e75c
push 0x2e
push 0x45e6fc
call fcn.004585e0
add esp, 0xc
ud2
lea eax, [ebp - 0x64]
mov dword [ebp - 0x4c], 0x45de14
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x64], 0x45de40
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x54], 0x45d160
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x30], fcn.00417bc0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x38], 1
push eax
push ecx
call fcn.0040c5b0
add esp, 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
call fcn.00409430
mov ecx, 7
int 0x29
ud2
push 4
push 0xc
call fcn.004580e0
add esp, 8
ud2
Function at 0x410e10
Capabilities:
Generate random numbers via rtlgenrandom
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x413430
lea eax, [esi + 0x50]
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
mov eax, dword [0x495014]
test eax, eax
je 0x410e5c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x410e75
jmp 0x410e85
push 0x495014
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x410e85
mov edi, eax
mov eax, dword [eax]
xor eax, 1
or eax, dword [edi + 4]
je 0x410f1c
mov eax, dword [0x495014]
test eax, eax
je 0x410f21
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x410f3e
mov edi, eax
test eax, eax
jne 0x410ef0
push 8
push 0x20
call fcn.00407d10
add esp, 8
test eax, eax
je 0x410fac
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x495014
mov edi, eax
mov eax, dword [0x495014]
test eax, eax
jne 0x410ee8
push 0x495014
call fcn.0040f020
add esp, 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xorps xmm0, xmm0
lea eax, [esi + 0x30]
movaps xmmword [esi + 0x30], xmm0
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x410f53
movaps xmm0, xmmword [esi + 0x30]
mov dword [edi + 4], 0
mov dword [edi], 1
movups xmmword [edi + 8], xmm0
add edi, 8
jmp 0x410f40
push 0x495014
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x410ea2
xor edi, edi
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
lea eax, [esi + 8]
mov dword [esi + 0x18], 0x45e6c0
mov dword [esi + 0x1c], 1
mov dword [esi + 8], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x10], eax
lea eax, [esi + 0x10]
mov dword [esi + 0x14], 0x40b6f0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 1
lea eax, [esi + 0x18]
push 0x45e6ec
push eax
call fcn.00459e60
add esp, 8
ud2
push 8
push 0x20
call fcn.004580e0
add esp, 8
ud2
Function at 0x411340
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x49501c]
test eax, eax
je 0x411359
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x411372
jmp 0x411381
push 0x49501c
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x411381
cmp dword [eax], 1
mov edi, eax
jne 0x411381
add edi, 4
mov eax, edi
pop esi
pop edi
ret
mov eax, dword [0x49501c]
test eax, eax
je 0x4113a0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4113b8
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x41137c
jmp 0x4113f5
push 0x49501c
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x411395
push 4
push 0xc
call fcn.00407d10
add esp, 8
test eax, eax
je 0x41142c
mov dword [eax], 0
mov dword [eax + 8], 0x49501c
mov esi, eax
mov eax, dword [0x49501c]
test eax, eax
jne 0x4113ed
push 0x49501c
call fcn.0040f020
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 4]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
je 0x41137c
test ecx, ecx
je 0x41137c
lock dec dword [ecx]
jne 0x41137c
call fcn.0040a590
mov eax, edi
pop esi
pop edi
ret
push 4
push 0xc
call fcn.004580e0
add esp, 8
ud2

Function at 0x411500
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x495024]
test eax, eax
je 0x411519
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x411532
jmp 0x411541
push 0x495024
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x411541
cmp dword [eax], 1
mov edi, eax
jne 0x411541
add edi, 4
mov eax, edi
pop esi
pop edi
ret
mov eax, dword [0x495024]
test eax, eax
je 0x411560
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x411578
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x41153c
jmp 0x4115b5
push 0x495024
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x411555
push 4
push 0x10
call fcn.00407d10
add esp, 8
test eax, eax
je 0x4115f3
mov dword [eax], 0
mov dword [eax + 0xc], 0x495024
mov esi, eax
mov eax, dword [0x495024]
test eax, eax
jne 0x4115ad
push 0x495024
call fcn.0040f020
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
je 0x41153c
test ecx, ecx
je 0x41153c
lock dec dword [ecx]
jne 0x41153c
call fcn.0040a550
mov eax, edi
pop esi
pop edi
ret
push 4
push 0x10
call fcn.004580e0
add esp, 8
ud2
Function at 0x4127a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x495030]
test eax, eax
je 0x4127b8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x4127d1
jmp 0x4127dc
push 0x495030
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4127dc
cmp dword [eax], 1
mov esi, eax
je 0x41285d
mov eax, dword [0x495030]
test eax, eax
je 0x4127fb
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x412813
xor esi, esi
cmp eax, 1
je 0x412860
mov esi, eax
jmp 0x412850
push 0x495030
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4127f0
push 4
push 0xc
call fcn.00407d10
add esp, 8
test eax, eax
je 0x412864
mov dword [eax], 0
mov dword [eax + 8], 0x495030
mov esi, eax
mov eax, dword [0x495030]
test eax, eax
jne 0x412848
push 0x495030
call fcn.0040f020
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 1
mov dword [esi + 4], 0
add esi, 4
mov eax, esi
pop esi
ret
push 4
push 0xc
call fcn.004580e0
add esp, 8
ud2
Function at 0x429d90
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x49503c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov esi, eax
call fcn.004030b0
mov ecx, dword [eax]
or ecx, 2
xor edx, edx
push esi
push edx
push dword [ebp + 8]
push edx
push edx
push dword [eax + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
mov ebx, eax
xor eax, eax
dec eax
test ebx, ebx
cmovs ebx, eax
inc ebx
mov edi, ebx
add edi, ebx
cmovb edi, eax
push edi
call fcn.0044fc05
add esp, 4
mov esi, eax
push edi
xor eax, eax
push eax
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edi, [ebp + 0x14]
mov dword [ebp - 0x18], edi
call fcn.004030b0
push edi
xor ecx, ecx
push ecx
push dword [ebp + 8]
push ebx
mov dword [ebp - 0x1c], esi
push esi
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
mov eax, str.Error:__s___S:_d_
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push eax
call fcn.00451240
add esp, 0x10
mov esi, eax
inc esi
mov ebx, esi
add ebx, esi
mov eax, 0xffffffff
cmovb ebx, eax
push ebx
call fcn.0044fc05
add esp, 4
mov edi, eax
push ebx
xor eax, eax
push eax
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
mov eax, str.Error:__s___S:_d_
push eax
push 0xffffffffffffffff
push esi
xor esi, esi
push edi
call fcn.004512a0
add esp, 0x1c
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x429ebe
mov ebx, eax
lea eax, [ebp - 0x14]
mov dword [eax], edi
sub esp, 0x24
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], esi
movaps xmm0, xmmword [0x461850]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push edi
call fcn.0044fc0e
add esp, 4
push dword [ebp - 0x1c]
call fcn.0044fc0e
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004503b0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42acf0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, edx
mov ebx, ecx
mov eax, dword [0x49503c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x28]
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], 0
sub esp, 0xc
mov al, byte [ebp - 0x40]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, edi
call fcn.00452270
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
cmp eax, ecx
mov dword [ebp - 0x48], esi
jae 0x42ae72
lea edx, [eax + 1]
mov dword [ebp - 0x18], edx
cmp ecx, 7
jbe 0x42ad5e
mov ecx, dword [ebp - 0x28]
jmp 0x42ad61
lea ecx, [ebp - 0x28]
mov word [ecx + eax*2], 0x5c
mov word [ecx + eax*2 + 2], 0
lea esi, [ebp - 0x40]
mov ecx, ebx
mov edx, esi
push dword [ebp + 8]
call fcn.0042a7c0
add esp, 4
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 7
jbe 0x42ad8c
mov esi, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ebx, edx
sub ebx, ecx
cmp ebx, eax
jb 0x42adc0
lea ebx, [ecx + eax]
mov dword [ebp - 0x18], ebx
cmp edx, 7
jbe 0x42ada8
mov edi, dword [ebp - 0x28]
lea ecx, [edi + ecx*2]
add eax, eax
push eax
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [edi + ebx*2], 0
jmp 0x42addd
sub esp, 0x10
mov cl, byte [ebp - 0x44]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp], eax
lea ecx, [ebp - 0x28]
call fcn.004520d0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
mov esi, dword [ebp - 0x48]
jb 0x42ae07
mov eax, dword [ebp - 0x40]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42ae7f
push edx
push eax
call fcn.0044fbc2
add esp, 8
cmp dword [ebp - 0x14], 7
jbe 0x42ae12
mov eax, dword [ebp - 0x28]
jmp 0x42ae15
lea eax, [ebp - 0x28]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ecx, eax
and ecx, 0xfffffffd
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test ecx, ecx
cmove edx, ecx
mov dword [esi], edx
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x42ae5e
mov eax, dword [ebp - 0x28]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42ae9a
push edx
push eax
call fcn.0044fbc2
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004503b0
mov eax, esi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x28]
call fcn.00453660
jmp 0x42ad6e
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42aeb2
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42adfd
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42aeb2
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42ae54
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x42b6a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x74
mov eax, dword [0x49503c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x80], ecx
jmp dword [edx*4 + 0x4619bc]

Function at 0x42bb00
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x49503c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
lea edi, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.0042d960
add esp, 4
mov eax, dword [edi + 0x18]
test eax, eax
je 0x42bb44
mov dword [esi], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004503b0
mov eax, esi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebp - 0x34], xmm0
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [ebp - 0x44], xmm0
xor edi, edi
mov dword [ebp - 0x1c], edi
mov eax, 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x2c], di
lea ebx, [ebp - 0x5c]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], edi
mov word [ebx], di
sub esp, 0xc
mov al, byte [ebp - 0x60]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, ebx
call fcn.00452270
mov ecx, 7
cmp dword [ebp - 0x30], ecx
jbe 0x42bba2
mov eax, dword [ebp - 0x44]
jmp 0x42bba5
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], ecx
jbe 0x42bbad
mov ebx, dword [ebp - 0x5c]
push eax
push ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
je 0x42bbe0
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
mov edx, str.RegistryDeleteValue
push 0x158
call fcn.0042bc70
add esp, 4
mov dword [esi], edi
mov ecx, dword [ebp - 0x48]
cmp ecx, 8
jb 0x42bc05
mov eax, dword [ebp - 0x5c]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42bc31
push edx
push eax
call fcn.0044fbc2
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x42bb30
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42bc49
push edx
push eax
call fcn.0044fbc2
add esp, 8
jmp 0x42bb30
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42bc61
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42bbfb
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42bc61
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42bc22
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x42bc70
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ecx
mov eax, dword [0x49503c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, str.0x_X_in__S:_d
push dword [ebp + 8]
push edx
push ecx
push eax
call fcn.00451240
add esp, 0x10
mov ebx, eax
inc ebx
xor eax, eax
dec eax
mov esi, ebx
add esi, ebx
cmovb esi, eax
push esi
call fcn.0044fc05
add esp, 4
mov edi, eax
xor eax, eax
push esi
mov esi, dword [ebp - 0x18]
push eax
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 8]
push dword [ebp - 0x1c]
push esi
mov eax, str.0x_X_in__S:_d
push eax
push 0xffffffffffffffff
push ebx
push edi
call fcn.004512a0
add esp, 0x1c
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
xor eax, eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x42bd12
mov ebx, eax
lea eax, [ebp - 0x14]
mov dword [eax], edi
xor ecx, ecx
inc ecx
xor edx, edx
push edx
push eax
push edx
push ecx
push edx
push esi
push edx
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push edi
call fcn.0044fc0e
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004503b0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42d3c0
Capabilities:
Check os version
Get common file path
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov esi, ecx
mov eax, dword [0x49503c]
xor eax, ebp
mov dword [ebp - 8], eax
jmp dword [edx*4 + 0x4619dc]

Function at 0x42dbc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x49503c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
lea edi, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.0042d960
add esp, 4
mov eax, dword [edi + 0x18]
test eax, eax
je 0x42dc0a
mov word [esi], 0
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004503b0
mov eax, esi
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebp - 0x34], xmm0
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [ebp - 0x44], xmm0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov ebx, 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x2c], ax
lea edi, [ebp - 0x5c]
mov dword [edi + 0x14], ebx
mov dword [edi + 0x10], eax
mov word [edi], ax
sub esp, 0xc
mov al, byte [ebp - 0x60]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, edi
call fcn.00452270
mov dword [ebp - 0x64], 4
cmp dword [ebp - 0x30], ebx
jbe 0x42dc6a
mov eax, dword [ebp - 0x44]
jmp 0x42dc6d
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], ebx
jbe 0x42dc75
mov edi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x64]
lea edx, [ebp - 0x60]
push ecx
push edx
xor ecx, ecx
push ecx
push 0x10
push eax
push edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x42dc9f
cmp eax, 2
jne 0x42dcb4
mov word [esi], 0
jmp 0x42dcb0
xor eax, eax
cmp dword [ebp - 0x60], 0
setne al
or eax, 0x100
mov word [esi], ax
xor edi, edi
jmp 0x42dcdb
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
mov edx, str.RegistryGetValueBool
push 0xb1
call fcn.0042bc70
add esp, 4
mov word [esi], 0
mov dword [esi + 4], edi
mov ecx, dword [ebp - 0x48]
cmp ecx, 8
jb 0x42dd01
mov eax, dword [ebp - 0x5c]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42dd2d
push edx
push eax
call fcn.0044fbc2
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x42dbf6
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42dd45
push edx
push eax
call fcn.0044fbc2
add esp, 8
jmp 0x42dbf6
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42dd5d
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42dcf7
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42dd5d
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42dd1e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x42dd70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x49503c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
lea edi, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.0042d960
add esp, 4
mov eax, dword [edi + 0x18]
test eax, eax
je 0x42ddb4
mov dword [esi], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004503b0
mov eax, esi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebp - 0x34], xmm0
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [ebp - 0x44], xmm0
xor edi, edi
mov dword [ebp - 0x1c], edi
mov eax, 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x2c], di
lea ebx, [ebp - 0x5c]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], edi
mov word [ebx], di
sub esp, 0xc
mov al, byte [ebp - 0x60]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, ebx
call fcn.00452270
mov ecx, 7
movzx eax, byte [ebp + 0xc]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x30], ecx
jbe 0x42de19
mov eax, dword [ebp - 0x44]
jmp 0x42de1c
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], ecx
jbe 0x42de24
mov ebx, dword [ebp - 0x5c]
mov ecx, 4
lea edx, [ebp - 0x60]
push ecx
push edx
push ecx
push eax
push ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
je 0x42de62
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
mov edx, str.RegistrySetValueBool
push 0xcc
call fcn.0042bc70
add esp, 4
mov dword [esi], edi
mov ecx, dword [ebp - 0x48]
cmp ecx, 8
jb 0x42de87
mov eax, dword [ebp - 0x5c]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42deb3
push edx
push eax
call fcn.0044fbc2
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x42dda0
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42decb
push edx
push eax
call fcn.0044fbc2
add esp, 8
jmp 0x42dda0
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42dee3
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42de7d
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42dee3
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42dea4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3