joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411970
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
je 0x411985
test eax, eax
jne 0x411a9d
mov ebp, dword [0x4951f0]
test ebp, ebp
je 0x411a9d
mov edi, dword [sym.imp.kernel32.dll_TlsGetValue]
xor ebx, ebx
jmp 0x4119a7
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x4119c8
push dword [ebp + 4]
call edi
test eax, eax
je 0x4119a0
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x4119a0
test bl, 1
je 0x411a9d
mov ebp, dword [0x4951f0]
test ebp, ebp
je 0x411a9d
xor ebx, ebx
jmp 0x4119f7
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x411a18
push dword [ebp + 4]
call edi
test eax, eax
je 0x4119f0
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x4119f0
test bl, 1
je 0x411a9d
mov ebp, dword [0x4951f0]
test ebp, ebp
je 0x411a9d
xor ebx, ebx
jmp 0x411a37
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x411a58
push dword [ebp + 4]
call edi
test eax, eax
je 0x411a30
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x411a30
test bl, 1
je 0x411a9d
mov ebp, dword [0x4951f0]
test ebp, ebp
je 0x411a9d
xor ebx, ebx
jmp 0x411a77
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x411a98
push dword [ebp + 4]
call edi
test eax, eax
je 0x411a70
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x411a70
test bl, 1
jne 0x411aa9
mov al, byte [0x48d510]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebp, dword [0x4951f0]
jmp 0x411ab4
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x411a9d
push dword [ebp + 4]
call edi
test eax, eax
je 0x411ab1
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
jmp 0x411ab1
Function at 0x4127a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x495030]
test eax, eax
je 0x4127b8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x4127d1
jmp 0x4127dc
push 0x495030
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4127dc
cmp dword [eax], 1
mov esi, eax
je 0x41285d
mov eax, dword [0x495030]
test eax, eax
je 0x4127fb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x412813
xor esi, esi
cmp eax, 1
je 0x412860
mov esi, eax
jmp 0x412850
push 0x495030
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x4127f0
push 4
push 0xc
call fcn.00407d10
add esp, 8
test eax, eax
je 0x412864
mov dword [eax], 0
mov dword [eax + 8], 0x495030
mov esi, eax
mov eax, dword [0x495030]
test eax, eax
jne 0x412848
push 0x495030
call fcn.0040f020
add esp, 4
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi], 1
mov dword [esi + 4], 0
add esi, 4
mov eax, esi
pop esi
ret
push 4
push 0xc
call fcn.004580e0
add esp, 8
ud2
Function at 0x429d90
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x49503c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov esi, eax
call fcn.004030b0
mov ecx, dword [eax]
or ecx, 2
xor edx, edx
push esi
push edx
push dword [ebp + 8]
push edx
push edx
push dword [eax + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
mov ebx, eax
xor eax, eax
dec eax
test ebx, ebx
cmovs ebx, eax
inc ebx
mov edi, ebx
add edi, ebx
cmovb edi, eax
push edi
call fcn.00450591
add esp, 4
mov esi, eax
push edi
xor eax, eax
push eax
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edi, [ebp + 0x14]
mov dword [ebp - 0x18], edi
call fcn.004030b0
push edi
xor ecx, ecx
push ecx
push dword [ebp + 8]
push ebx
mov dword [ebp - 0x1c], esi
push esi
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
mov eax, str.Error:__s___S:_d_
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push eax
call fcn.00451240
add esp, 0x10
mov esi, eax
inc esi
mov ebx, esi
add ebx, esi
mov eax, 0xffffffff
cmovb ebx, eax
push ebx
call fcn.00450591
add esp, 4
mov edi, eax
push ebx
xor eax, eax
push eax
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
mov eax, str.Error:__s___S:_d_
push eax
push 0xffffffffffffffff
push esi
xor esi, esi
push edi
call fcn.004512a0
add esp, 0x1c
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
push esi
call dword [sym.imp.advapi32.dll_RegisterEventSourceW]
test eax, eax
je 0x429ebe
mov ebx, eax
lea eax, [ebp - 0x14]
mov dword [eax], edi
sub esp, 0x24
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], esi
movaps xmm0, xmmword [0x461850]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x14], 1
call dword [sym.imp.advapi32.dll_ReportEventW]
push ebx
call dword [sym.imp.advapi32.dll_DeregisterEventSource]
push edi
call fcn.0044fc0e
add esp, 4
push dword [ebp - 0x1c]
call fcn.0044fc0e
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004503b0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42acf0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, edx
mov ebx, ecx
mov eax, dword [0x49503c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x28]
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], 0
sub esp, 0xc
mov al, byte [ebp - 0x40]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, edi
call fcn.00452270
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
cmp eax, ecx
mov dword [ebp - 0x48], esi
jae 0x42ae72
lea edx, [eax + 1]
mov dword [ebp - 0x18], edx
cmp ecx, 7
jbe 0x42ad5e
mov ecx, dword [ebp - 0x28]
jmp 0x42ad61
lea ecx, [ebp - 0x28]
mov word [ecx + eax*2], 0x5c
mov word [ecx + eax*2 + 2], 0
lea esi, [ebp - 0x40]
mov ecx, ebx
mov edx, esi
push dword [ebp + 8]
call fcn.0042a7c0
add esp, 4
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 7
jbe 0x42ad8c
mov esi, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ebx, edx
sub ebx, ecx
cmp ebx, eax
jb 0x42adc0
lea ebx, [ecx + eax]
mov dword [ebp - 0x18], ebx
cmp edx, 7
jbe 0x42ada8
mov edi, dword [ebp - 0x28]
lea ecx, [edi + ecx*2]
add eax, eax
push eax
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [edi + ebx*2], 0
jmp 0x42addd
sub esp, 0x10
mov cl, byte [ebp - 0x44]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp], eax
lea ecx, [ebp - 0x28]
call fcn.004520d0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
mov esi, dword [ebp - 0x48]
jb 0x42ae07
mov eax, dword [ebp - 0x40]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42ae7f
push edx
push eax
call fcn.00450591
add esp, 8
cmp dword [ebp - 0x14], 7
jbe 0x42ae12
mov eax, dword [ebp - 0x28]
jmp 0x42ae15
lea eax, [ebp - 0x28]
push eax
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegDeleteTreeW]
mov ecx, eax
and ecx, 0xfffffffd
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test ecx, ecx
cmove edx, ecx
mov dword [esi], edx
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x42ae5e
mov eax, dword [ebp - 0x28]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42ae9a
push edx
push eax
call fcn.00450591
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004503b0
mov eax, esi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x28]
call fcn.00453660
jmp 0x42ad6e
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42aeb2
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42adfd
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42aeb2
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42ae54
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x42b6a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x74
mov eax, dword [0x49503c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x80], ecx
jmp dword [edx*4 + 0x4619bc]

Function at 0x42bb00
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x49503c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
lea edi, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.0042d960
add esp, 4
mov eax, dword [edi + 0x18]
test eax, eax
je 0x42bb44
mov dword [esi], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004503b0
mov eax, esi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebp - 0x34], xmm0
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [ebp - 0x44], xmm0
xor edi, edi
mov dword [ebp - 0x1c], edi
mov eax, 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x2c], di
lea ebx, [ebp - 0x5c]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], edi
mov word [ebx], di
sub esp, 0xc
mov al, byte [ebp - 0x60]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, ebx
call fcn.00452270
mov ecx, 7
cmp dword [ebp - 0x30], ecx
jbe 0x42bba2
mov eax, dword [ebp - 0x44]
jmp 0x42bba5
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], ecx
jbe 0x42bbad
mov ebx, dword [ebp - 0x5c]
push eax
push ebx
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegDeleteKeyValueW]
test eax, eax
je 0x42bbe0
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
mov edx, str.RegistryDeleteValue
push 0x158
call fcn.0042bc70
add esp, 4
mov dword [esi], edi
mov ecx, dword [ebp - 0x48]
cmp ecx, 8
jb 0x42bc05
mov eax, dword [ebp - 0x5c]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42bc31
push edx
push eax
call fcn.00450591
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x42bb30
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42bc49
push edx
push eax
call fcn.00450591
add esp, 8
jmp 0x42bb30
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42bc61
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42bbfb
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42bc61
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42bc22
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x42bc70
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ecx
mov eax, dword [0x49503c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, str.0x_X_in__S:_d
push dword [ebp + 8]
push edx
push ecx
push eax
call fcn.00451240
add esp, 0x10
mov ebx, eax
inc ebx
xor eax, eax
dec eax
mov esi, ebx
add esi, ebx
cmovb esi, eax
push esi
call fcn.00450591
add esp, 4
mov edi, eax
xor eax, eax
push esi
mov esi, dword [ebp - 0x18]
push eax
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 8]
push dword [ebp - 0x1c]
push esi
mov eax, str.0x_X_in__S:_d
push eax
push 0xffffffffffffffff
push ebx
push edi
call fcn.004512a0
add esp, 0x1c
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
xor eax, eax
push eax
call dword [sym.imp.advapi32.dll_RegisterEventSourceW]
test eax, eax
je 0x42bd12
mov ebx, eax
lea eax, [ebp - 0x14]
mov dword [eax], edi
xor ecx, ecx
inc ecx
xor edx, edx
push edx
push eax
push edx
push ecx
push edx
push esi
push edx
push ecx
push ebx
call dword [sym.imp.advapi32.dll_ReportEventW]
push ebx
call dword [sym.imp.advapi32.dll_DeregisterEventSource]
push edi
call fcn.0044fc0e
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004503b0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42d3c0
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov esi, ecx
mov eax, dword [0x49503c]
xor eax, ebp
mov dword [ebp - 8], eax
jmp dword [edx*4 + 0x4619dc]

Function at 0x42dbc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x49503c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
lea edi, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.0042d960
add esp, 4
mov eax, dword [edi + 0x18]
test eax, eax
je 0x42dc0a
mov word [esi], 0
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004503b0
mov eax, esi
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebp - 0x34], xmm0
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [ebp - 0x44], xmm0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov ebx, 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x2c], ax
lea edi, [ebp - 0x5c]
mov dword [edi + 0x14], ebx
mov dword [edi + 0x10], eax
mov word [edi], ax
sub esp, 0xc
mov al, byte [ebp - 0x60]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, edi
call fcn.00452270
mov dword [ebp - 0x64], 4
cmp dword [ebp - 0x30], ebx
jbe 0x42dc6a
mov eax, dword [ebp - 0x44]
jmp 0x42dc6d
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], ebx
jbe 0x42dc75
mov edi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x64]
lea edx, [ebp - 0x60]
push ecx
push edx
xor ecx, ecx
push ecx
push 0x10
push eax
push edi
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegGetValueW]
test eax, eax
je 0x42dc9f
cmp eax, 2
jne 0x42dcb4
mov word [esi], 0
jmp 0x42dcb0
xor eax, eax
cmp dword [ebp - 0x60], 0
setne al
or eax, 0x100
mov word [esi], ax
xor edi, edi
jmp 0x42dcdb
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
mov edx, str.RegistryGetValueBool
push 0xb1
call fcn.0042bc70
add esp, 4
mov word [esi], 0
mov dword [esi + 4], edi
mov ecx, dword [ebp - 0x48]
cmp ecx, 8
jb 0x42dd01
mov eax, dword [ebp - 0x5c]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42dd2d
push edx
push eax
call fcn.00450591
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x42dbf6
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42dd45
push edx
push eax
call fcn.00450591
add esp, 8
jmp 0x42dbf6
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42dd5d
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42dcf7
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42dd5d
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42dd1e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x42dd70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x49503c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
lea edi, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.0042d960
add esp, 4
mov eax, dword [edi + 0x18]
test eax, eax
je 0x42ddb4
mov dword [esi], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004503b0
mov eax, esi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebp - 0x34], xmm0
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [ebp - 0x44], xmm0
xor edi, edi
mov dword [ebp - 0x1c], edi
mov eax, 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x2c], di
lea ebx, [ebp - 0x5c]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], edi
mov word [ebx], di
sub esp, 0xc
mov al, byte [ebp - 0x60]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, ebx
call fcn.00452270
mov ecx, 7
movzx eax, byte [ebp + 0xc]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x30], ecx
jbe 0x42de19
mov eax, dword [ebp - 0x44]
jmp 0x42de1c
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], ecx
jbe 0x42de24
mov ebx, dword [ebp - 0x5c]
mov ecx, 4
lea edx, [ebp - 0x60]
push ecx
push edx
push ecx
push eax
push ebx
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegSetKeyValueW]
test eax, eax
je 0x42de62
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
mov edx, str.RegistrySetValueBool
push 0xcc
call fcn.0042bc70
add esp, 4
mov dword [esi], edi
mov ecx, dword [ebp - 0x48]
cmp ecx, 8
jb 0x42de87
mov eax, dword [ebp - 0x5c]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42deb3
push edx
push eax
call fcn.00450591
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x42dda0
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42decb
push edx
push eax
call fcn.00450591
add esp, 8
jmp 0x42dda0
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42dee3
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42de7d
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42dee3
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42dea4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x42def0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x49503c]
xor ecx, ebp
mov dword [esp + 0x68], ecx
lea edi, [esp + 0x4c]
mov ecx, edi
push eax
call fcn.0042d960
add esp, 4
mov eax, dword [edi + 0x18]
test eax, eax
je 0x42df41
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], eax
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004503b0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [esp + 0x5c]
movsd qword [esp + 0x40], xmm0
movups xmm0, xmmword [esp + 0x4c]
movaps xmmword [esp + 0x30], xmm0
xor eax, eax
mov dword [esp + 0x5c], eax
mov ebx, 7
mov dword [esp + 0x60], ebx
mov word [esp + 0x4c], ax
lea edi, [esp + 0x18]
mov dword [edi + 0x14], ebx
mov dword [edi + 0x10], eax
mov word [edi], ax
sub esp, 0xc
mov al, byte [esp + 0x1c]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, edi
call fcn.00452270
mov dword [esp + 0xc], 8
cmp dword [esp + 0x44], ebx
jbe 0x42dfad
mov eax, dword [esp + 0x30]
jmp 0x42dfb1
lea eax, [esp + 0x30]
cmp dword [esp + 0x2c], ebx
jbe 0x42dfbb
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
xor ecx, ecx
push ecx
push 0x40
push eax
push edi
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegGetValueW]
test eax, eax
je 0x42dfe8
cmp eax, 2
jne 0x42e002
xorps xmm0, xmm0
movups xmmword [esi], xmm0
jmp 0x42dff9
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov byte [esi + 8], 1
mov dword [esi + 0x10], 0
jmp 0x42e02d
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
mov edx, str.RegistryGetValueQword
push 0xeb
call fcn.0042bc70
add esp, 4
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], edi
mov ecx, dword [esp + 0x2c]
cmp ecx, 8
jb 0x42e052
mov eax, dword [esp + 0x18]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42e080
push edx
push eax
call fcn.00450591
add esp, 8
mov ecx, dword [esp + 0x44]
cmp ecx, 8
jb 0x42df2c
mov eax, dword [esp + 0x30]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42e098
push edx
push eax
call fcn.00450591
add esp, 8
jmp 0x42df2c
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42e0b0
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42e048
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42e0b0
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42e071
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x42e0c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov edi, edx
mov dword [esp + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x49503c]
xor edx, ebp
mov dword [esp + 0x58], edx
mov esi, 7
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], 0
mov word [esp + 0x40], 0
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
mov ebx, eax
cmp eax, 7
ja 0x42e137
lea eax, [esp + 0x40]
mov dword [eax + 0x10], ebx
mov ecx, ebx
add ecx, ebx
push ecx
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov word [esp + ebx*2 + 0x40], 0
jmp 0x42e152
sub esp, 0xc
mov al, byte [esp + 0x24]
mov byte [esp + 4], al
mov dword [esp + 8], edi
mov dword [esp], ebx
lea ecx, [esp + 0x4c]
call fcn.00452270
movzx eax, word [esp + 0x40]
movsd xmm0, qword [esp + 0x42]
movsd qword [esp + 0x30], xmm0
movsd xmm0, qword [esp + 0x48]
movsd qword [esp + 0x36], xmm0
mov ecx, dword [esp + 0x50]
mov ebx, dword [esp + 0x54]
mov word [esp + 0x40], ax
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x36]
movsd qword [esp + 0x42], xmm0
movsd qword [esp + 0x48], xmm1
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ebx
lea edi, [esp + 0x18]
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], 0
mov word [edi], 0
sub esp, 0xc
mov al, byte [esp + 0x20]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, edi
call fcn.00452270
cmp ebx, 7
jbe 0x42e1db
mov eax, dword [esp + 0x40]
jmp 0x42e1df
lea eax, [esp + 0x40]
mov esi, dword [esp + 4]
cmp dword [esp + 0x2c], 7
jbe 0x42e1ee
mov edi, dword [esp + 0x18]
lea ecx, [esp + 8]
push 8
push ecx
push 0xb
push eax
push edi
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegSetKeyValueW]
test eax, eax
je 0x42e22c
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
mov edx, str.RegistrySetValueQword
push 0x106
call fcn.0042bc70
add esp, 4
jmp 0x42e22e
xor edi, edi
mov dword [esi], edi
mov ecx, dword [esp + 0x2c]
cmp ecx, 8
jb 0x42e255
mov eax, dword [esp + 0x18]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42e28f
push edx
push eax
call fcn.00450591
add esp, 8
mov ecx, dword [esp + 0x54]
cmp ecx, 8
jb 0x42e27a
mov eax, dword [esp + 0x40]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42e2ab
push edx
push eax
call fcn.00450591
add esp, 8
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004503b0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42e2c7
add ecx, ecx
add ecx, 0x25
mov edx, ecx
mov esi, dword [esp + 4]
jmp 0x42e24b
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42e2c7
add ecx, ecx
add ecx, 0x25
mov edx, ecx
mov esi, dword [esp + 4]
jmp 0x42e270
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3