Function at 0x4130f2
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value
Write file on windows

Disassembly:
mov eax, 0x42b574
call sub.MSVCRT.dll__EH_prolog
push ecx
mov eax, 0x1038
call fcn.00428dc0
push ebx
push esi
xor ebx, ebx
push edi
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x10], esp
jne 0x413183
push ecx
mov dword [ebp - 0x20], esp
mov ecx, esp
push 0x440c60
call fcn.004015c5
push ecx
mov dword [ebp - 4], ebx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.IsFireFoxProviderInstalled
call fcn.00408881
mov ecx, dword [0x44df84]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + 8]
push eax
call fcn.0041ba11
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x413155
mov eax, dword [eax]
jmp 0x413157
xor eax, eax
cmp eax, ebx
je 0x41317b
push 0x441cf8
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
neg eax
sbb eax, eax
pop ecx
inc eax
pop ecx
mov dword [ebp - 0x20], eax
je 0x41317b
lea ecx, [ebp + 8]
jmp 0x41389d
lea ecx, [ebp + 8]
call fcn.0040180d
push str.C:Program_FilesMozilla_Firefox
lea ecx, [ebp - 0x24]
call fcn.004015c5
mov dword [ebp - 4], 1
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 3
push eax
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_firefox.exe
push 0x80000002
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x41323c
lea ecx, [ebp + 8]
call fcn.0040f258
mov edx, dword [ebp - 0x1c]
cmp eax, ebx
mov dword [ebp + 8], edx
jne 0x41323c
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1046]
mov word [ebp - 0x1048], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x7d0
push eax
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.Path
push edx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x1048]
lea ecx, [ebp - 0x1c]
push eax
call fcn.004015c5
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x24]
push eax
call fcn.00401619
lea ecx, [ebp - 0x1c]
call fcn.0040180d
jmp 0x41323c
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], 2
je 0x413254
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0040f258
push str._searchpluginsSiteVacuum.xml
lea ecx, [ebp + 8]
call fcn.004015c5
lea eax, [ebp + 8]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 5
call fcn.00409b90
push eax
lea ecx, [ebp - 0x3c]
call fcn.00410997
lea ecx, [ebp - 0x18]
call fcn.0040180d
lea ecx, [ebp + 8]
mov byte [ebp - 4], 7
call fcn.0040180d
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
je 0x4132a9
mov eax, dword [eax]
jmp 0x4132ab
xor eax, eax
push 0x442eac
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x413892
push ecx
mov dword [ebp - 0x20], esp
mov ecx, esp
push str.odt6fyyaaog
call fcn.004015c5
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SearchChannel
call fcn.00408881
mov ecx, dword [0x44df84]
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 7
call fcn.0041ba11
mov esi, 0x441598
lea ecx, [ebp - 0x44]
push esi
mov byte [ebp - 4], 9
call fcn.004015c5
push str._SearchPlugin_xmlns_http:__www.mozilla.org_2006_browser_search___
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xa
call fcn.004015c5
lea eax, [ebp + 0xb]
lea ecx, [ebp - 0x38]
push eax
mov byte [ebp - 4], 0xb
call fcn.0040845b
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xc
call fcn.0041ddd5
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0xd
call fcn.00408a5f
lea ecx, [ebp - 0x1c]
call fcn.0040180d
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp - 0x14]
call fcn.004015c5
push str._ShortName_Google_Search_Community__ShortName__Description_Google_Power__Community__Description_
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x11
call fcn.004015c5
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x12
call fcn.00408a8c
lea ecx, [ebp + 8]
call fcn.0040180d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp - 0x14]
call fcn.004015c5
mov byte [ebp - 4], 0x13
push str._InputEncoding_UTF_8__InputEncoding__Image_width_16__height_16__data:image_x_icon_base64_iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAMAAAAoLQ9TAAAABGdBTUEAALGPC_xhBQAAAwBQTFRFAAAAAUbWAUfbAUnfE1PZE1TeAU3jCk_gA1TlClPkCVjmD1zmE1bhEFjlE13lHmboKGrlMWvlP3jlVYLhVYLkVYPnWIXkWInobZHjapXrdpvpgKLq____AAAAAAAAAAAAAAAAAAA
lea ecx, [ebp + 8]
call fcn.004015c5
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x14
call fcn.00408a8c
lea ecx, [ebp + 8]
call fcn.0040180d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp - 0x14]
call fcn.004015c5
push str.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x15
call fcn.004015c5
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x16
call fcn.00408a8c
lea ecx, [ebp + 8]
call fcn.0040180d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp - 0x14]
call fcn.004015c5
push str.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x17
call fcn.004015c5
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x18
call fcn.00408a8c
lea ecx, [ebp + 8]
call fcn.0040180d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp - 0x14]
call fcn.004015c5
push str.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiJwJgAAAQB0Uk5T___________________________________________________________________________
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x19
call fcn.004015c5
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x1a
call fcn.00408a8c
lea ecx, [ebp + 8]
call fcn.0040180d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp - 0x14]
call fcn.004015c5
push str._________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________AFP3ByUAAAAJcEhZcwAADsAAAA7AAWrWiQkAAAAYdEVYdFNvZnR3YXJlAFBhaW
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x1b
call fcn.004015c5
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x1c
call fcn.00408a8c
lea ecx, [ebp + 8]
call fcn.0040180d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp - 0x14]
call fcn.004015c5
push str.50Lk5FVCB2My4zNTDus58AAABrSURBVChTdY9JEoAgDARR3HBF3HX_00NagStcm7pdMFE7JIPzDb2OVtjBuAdXyAWQAJTIYNTXsC0AxqSBvUDlzGA7LmBEXOhkoq2quEfylla59IuUccDq4vFYuC3usvaO78e8h4zXyLcw4at7Hur4NtIQAAAABJRU5ErkJggg__Image_
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x1d
call fcn.004015c5
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x1e
call fcn.00408a8c
lea ecx, [ebp + 8]
call fcn.0040180d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp - 0x14]
call fcn.004015c5
push str._Url_type_application_x_suggestionsjson__method_GET__template_http:__suggestqueries.google.com_complete_search_outputfirefoxamp_clientfirefoxamp_qusearchTerms___
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x1f
call fcn.004015c5
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x20
call fcn.00408a8c
lea ecx, [ebp + 8]
call fcn.0040180d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp - 0x14]
call fcn.004015c5
push str._Url_type_text_html__method_GET__template_http:__www.sitevacuum.com_Results.aspx___Param_name_cx__value_partner_pub_8885210189291163:
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x21
call fcn.004015c5
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x22
call fcn.00408a8c
lea ecx, [ebp + 8]
call fcn.0040180d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp - 0x18]
call fcn.004015c5
push 0x44533c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x23
call fcn.004015c5
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x48]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x24
call fcn.00409b90
push eax
lea ecx, [ebp + 8]
call fcn.00410997
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x26
call fcn.00408a8c
lea ecx, [ebp + 8]
call fcn.0040180d
lea ecx, [ebp - 0x20]
call fcn.0040180d
lea ecx, [ebp - 0x14]
call fcn.0040180d
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp - 0x18]
call fcn.004015c5
push str._Param_name_ie__value_utf_8____Param_name_oe__value_utf_8____Param_name_SV_SRC__value_FFSearchBox____Param_name_UDSideSiteVacuumID__value_
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x27
call fcn.004015c5
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x28
call fcn.00408a8c
lea ecx, [ebp + 8]
call fcn.0040180d
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp + 8]
call fcn.004015c5
lea eax, [ebp + 8]
mov byte [ebp - 4], 0x29
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x44deb4
call fcn.00408881
mov byte [ebp - 4], 0x2a
call fcn.004083ea
push ecx
add eax, 0x68
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.00410997
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x20]
mov ecx, dword [0x44df84]
push eax
call fcn.0041ba11
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x2b
call fcn.00408a8c
lea ecx, [ebp - 0x20]
call fcn.0040180d
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp - 0x18]
call fcn.004015c5
push str.____Param_name_WSHostingSiteURL__value_
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x2c
call fcn.004015c5
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x2d
call fcn.00408a8c
lea ecx, [ebp + 8]
call fcn.0040180d
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp + 8]
call fcn.004015c5
lea eax, [ebp + 8]
mov byte [ebp - 4], 0x2e
push eax
call fcn.004083ea
add eax, 0x1c
lea ecx, [ebp - 0x38]
push eax
call fcn.00408a8c
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp - 0x18]
call fcn.004015c5
push str.____Param_name_cof__value_FORID_3A10___
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x2f
call fcn.004015c5
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x30
call fcn.00408a8c
lea ecx, [ebp + 8]
call fcn.0040180d
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp - 0x18]
call fcn.004015c5
push str._Param_name_sa__value_Search____Param_name_q__value_searchTerms________Dynamic_parameters_____MozParam_name_client__condition_defaultEngine__trueValue_firefox_a__falseValue_firefox_____Url_
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x31
call fcn.00408881
mov byte [ebp - 4], 0x32
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x38]
call fcn.00408a8c
lea ecx, [ebp + 8]
call fcn.0040180d
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push esi
lea ecx, [ebp - 0x14]
call fcn.00408881
push str._SearchForm_http:__www.sitevacuum.com_Results.aspx__SearchForm___SearchPlugin_
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x33
call fcn.00408881
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x34
call fcn.00408a8c
lea ecx, [ebp - 0x18]
call fcn.0040180d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xf
call fcn.0040180d
push ebx
lea eax, [ebp - 0x40]
push ebx
push eax
lea ecx, [ebp - 0x38]
call fcn.0041e138
mov ecx, dword [ebp - 0x40]
mov byte [ebp - 4], 0x35
cmp ecx, ebx
je 0x413827
call fcn.0040175a
mov ebx, eax
push edi
lea ecx, [ebp - 0x40]
call fcn.0040164a
push eax
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x10
mov ecx, esp
mov dword [ebp + 8], esp
push 0x441cf8
call fcn.00408881
push ecx
mov byte [ebp - 4], 0x36
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.IsFireFoxProviderInstalled
call fcn.00408881
mov ecx, dword [0x44df84]
mov byte [ebp - 4], 0x35
call fcn.0041bccc
lea ecx, [ebp - 0x40]
call fcn.0040180d
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 9
call fcn.00408a43
lea ecx, [ebp - 0x48]
call fcn.0040180d
lea ecx, [ebp - 0x3c]
call fcn.0040180d
lea ecx, [ebp - 0x24]
call fcn.0040180d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4