joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40671a
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x406765
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00406935
test al, al
jne 0x40675f
sub edx, 2
cmp edx, edi
jne 0x406745
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x406787
lea eax, [edi + 2]
cmp edx, eax
je 0x406787
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00406666
add esp, 0x10
jmp 0x40687f
push esi
lea ecx, [ebp - 0x255]
call fcn.00406935
sub edx, edi
xor ecx, ecx
sar edx, 1
inc edx
test al, al
lea eax, [ebp - 0x254]
cmovne ecx, edx
xor ebx, ebx
push ebx
push ebx
push ebx
push eax
push ebx
push edi
mov dword [ebp - 0x260], ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4067c8
push dword [ebp - 0x25c]
jmp 0x406777
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x406805
cmp word [ebp - 0x226], 0
je 0x406826
cmp word [ebp - 0x226], ax
jne 0x406805
cmp word [ebp - 0x224], 0
je 0x406826
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00406666
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x406872
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4067df
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x40685a
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x40687f
push 0x406496
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00409940
add esp, 0x10
jmp 0x40684f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401203
leave
ret
Function at 0x40d810
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40d83d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d83d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40d5f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d648
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x40d640
cmp ebp, ebx
jb 0x40d6c2
cmp ebp, dword [esp + 0x1c]
ja 0x40d6d3
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x40d642
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x40d630
jmp 0x40d69f
ja 0x40d648
cmp edx, edi
mov ebx, ebp
jne 0x40d605
mov edx, dword [esp + 0x24]
test edx, edx
je 0x40d6a3
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x40d680
mov esi, edi
sub ecx, ebx
jns 0x40d697
jmp 0x40d6a5
cmp edi, edx
je 0x40d6ac
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x40d6a5
xor al, 1
cmp esi, edx
jne 0x40d660
jmp 0x40d6a5
xor eax, eax
jmp 0x40d6a5
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x45e79c
push 0x2b
push 0x45dc5d
call fcn.004515c0
add esp, 0xc
ud2
push 0x45e78c
push ebp
push ebx
call fcn.00451980
add esp, 0xc
ud2
push 0x45e78c
push dword [esp + 0x20]
push ebp
call fcn.00451960
add esp, 0xc
ud2
Function at 0x4122b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41af60
mov edi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x2c], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x30], 0
cmp edi, 0x201
jae 0x412340
jmp 0x41232e
jbe 0x4123d3
cmp edi, 0x201
jae 0x412340
lea ebx, [ebp - 0x448]
mov dword [ebp - 0x28], 0x200
mov esi, edi
jmp 0x41237b
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
sub edi, esi
sub eax, esi
cmp eax, edi
jae 0x41236c
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x38]
mov edx, esi
push edi
call fcn.00451be0
add esp, 4
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x41239f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x412436
cmp edi, esi
jne 0x412320
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x412455
add esi, esi
mov eax, 0xffffffff
cmovb esi, eax
mov edi, esi
cmp edi, 0x201
jb 0x41232e
jmp 0x412340
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp edi, eax
ja 0x412472
lea eax, [ebp - 0x48]
push edi
push ebx
push eax
call fcn.004138d0
add esp, 0xc
movsd xmm0, qword [ebp - 0x48]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x40]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x412420
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00442950
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x43c
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi], 0
mov byte [esi + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x412410
jmp 0x412420
mov dword [ebp - 0x10], 0
push 0x460c6c
push 0x28
push 0x45f85f
call fcn.004515c0
add esp, 0xc
jmp 0x412481
push 0x460c7c
push eax
push edi
call fcn.00451960
add esp, 0xc
ud2
Function at 0x417c90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41b100
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x49f024]
test eax, eax
je 0x417ce4
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x417cfd
cmp dword [eax], 0
mov ebx, eax
je 0x417cfd
add ebx, 4
jmp 0x417ddb
push 0x49f024
call fcn.00451e70
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x417cd5
mov eax, dword [0x49f024]
test eax, eax
je 0x417dbc
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x417dd9
mov edi, eax
test eax, eax
jne 0x417d6a
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x49f024
push 4
push 0xc
call fcn.00442940
add esp, 8
test eax, eax
je 0x417e00
mov edi, eax
mov eax, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [edi + 8], eax
movsd qword [edi], xmm0
mov eax, dword [0x49f024]
test eax, eax
je 0x417dee
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor edx, edx
test esi, esi
je 0x417d98
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esi], 0
test eax, eax
je 0x417d98
cmp eax, 1
jne 0x417d88
mov edx, ecx
jmp 0x417d98
test ecx, ecx
je 0x417d98
lock dec dword [ecx]
jne 0x417d98
call fcn.00411300
xor edx, edx
mov ecx, dword [edi + 4]
cmp dword [edi], 0
lea ebx, [edi + 4]
mov dword [edi], 1
mov dword [edi + 4], edx
je 0x417ddb
test ecx, ecx
je 0x417ddb
lock dec dword [ecx]
jne 0x417ddb
call fcn.00411300
jmp 0x417ddb
push 0x49f024
call fcn.00451e70
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x417d1b
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x49f024
call fcn.00451e70
add esp, 4
jmp 0x417d62
mov dword [ebp - 0x10], 0
push 4
push 0xc
call fcn.00451aa0
add esp, 8
ud2
Function at 0x41a200
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41b1b0
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x49f04c]
test eax, eax
je 0x41a254
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41a26d
cmp dword [eax], 0
mov ebx, eax
je 0x41a26d
add ebx, 4
jmp 0x41a35c
push 0x49f04c
call fcn.00451e70
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x41a245
mov eax, dword [0x49f04c]
test eax, eax
je 0x41a33d
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41a35a
mov edi, eax
test eax, eax
jne 0x41a2de
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0x49f04c
push 4
push 0x10
call fcn.00442940
add esp, 8
test eax, eax
je 0x41a381
movsd xmm0, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
mov edi, eax
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [0x49f04c]
test eax, eax
je 0x41a36f
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x41a312
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [esi], 0
test edx, edx
je 0x41a312
cmp edx, 1
jne 0x41a2fd
mov edx, ecx
jmp 0x41a316
test ecx, ecx
je 0x41a312
xor eax, eax
lock dec dword [ecx]
mov edx, 0
jne 0x41a316
call fcn.004112c0
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 8]
cmp dword [edi], 0
lea ebx, [edi + 4]
mov dword [edi], 1
mov dword [edi + 4], eax
mov dword [edi + 8], edx
je 0x41a35c
test ecx, ecx
je 0x41a35c
lock dec dword [ecx]
jne 0x41a35c
call fcn.004112c0
jmp 0x41a35c
push 0x49f04c
call fcn.00451e70
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41a28b
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x49f04c
call fcn.00451e70
add esp, 4
jmp 0x41a2d6
mov dword [ebp - 0x10], 0
push 4
push 0x10
call fcn.00451aa0
add esp, 8
ud2
Function at 0x41a410
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x49f05c]
mov esi, ecx
test eax, eax
je 0x41a435
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41a44e
cmp dword [eax], 0
je 0x41a44e
add eax, 4
pop esi
pop edi
ret
push 0x49f05c
call fcn.00451e70
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x41a42a
mov eax, dword [0x49f05c]
test eax, eax
je 0x41a4c4
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41a4dd
mov edi, eax
test eax, eax
jne 0x41a49b
push 4
push 0xc
call fcn.00442940
add esp, 8
test eax, eax
je 0x41a4f1
mov dword [eax], 0
mov dword [eax + 8], 0x49f05c
mov edi, eax
mov eax, dword [0x49f05c]
test eax, eax
je 0x41a4e2
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x41a4b3
mov eax, dword [esi]
xor ecx, ecx
mov dword [esi], 0
cmp eax, 1
jne 0x41a4b5
mov ecx, dword [esi + 4]
jmp 0x41a4b5
xor ecx, ecx
mov dword [edi], 1
lea eax, [edi + 4]
mov dword [edi + 4], ecx
pop esi
pop edi
ret
push 0x49f05c
call fcn.00451e70
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41a464
xor eax, eax
pop esi
pop edi
ret
push 0x49f05c
call fcn.00451e70
add esp, 4
jmp 0x41a493
push 4
push 0xc
call fcn.00451aa0
add esp, 8
ud2
Function at 0x4285b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, edx
mov edi, dword [ebp + 8]
mov eax, dword [0x49f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x104
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x42871e
push str.MicrosoftWindowsStart_MenuPrograms_
push 0x104
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
test eax, eax
jne 0x42871e
mov ecx, dword [esi + 0x10]
lea eax, [ecx - 0x7ffffffb]
cmp eax, 3
jbe 0x428730
mov eax, dword [esi]
mov dword [ebp - 0x38], eax
mov edx, dword [esi + 0x14]
lea edi, [ebp - 0x28]
mov dword [edi], 0
lea eax, [ecx + 4]
mov ebx, 7
cmp eax, 8
jb 0x428694
mov dword [ebp - 0x30], edx
mov edx, eax
or edx, 7
cmp edx, 0xb
mov ebx, 0xa
cmovae ebx, edx
mov edx, SysReAllocString
cmp ebx, edx
cmovae ebx, edx
lea edi, [ebx + ebx]
cmp ebx, 0x7ff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], eax
jb 0x42867a
cmp ebx, 0x7fffffee
jae 0x428735
add edi, 0x25
push edi
call fcn.0044fa55
add esp, 4
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x428688
add edi, 2
push edi
call fcn.0044fa55
add esp, 4
mov edi, eax
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp edx, 8
cmovae esi, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
lea eax, [ecx + ecx]
push eax
push esi
push edi
mov esi, ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [edi + esi*2 + 4], 0x6b006e
mov dword [edi + esi*2], 0x6c002e
mov word [edi + esi*2 + 8], 0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
jb 0x4286d3
mov eax, dword [ebp - 0x28]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x42871e
mov ecx, dword [ebp - 0x28]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x428714
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42873a
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0044fa85
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00450100
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00453360
call fcn.00453370
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42878b
mov eax, dword [ebp + 0xc]
movdqu xmm0, xmmword [eax]
pcmpeqb xmm0, xmmword [0x461b70]
pmovmskb edx, xmm0
cmp edx, 0xffff
je 0x428782
movdqu xmm0, xmmword [eax]
pcmpeqb xmm0, xmmword [0x461b80]
pmovmskb edx, xmm0
mov eax, 0x80004002
cmp edx, 0xffff
jne 0x428790
mov eax, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
jmp 0x428790
mov eax, 0x80004003
pop ebp
ret 0xc
Function at 0x42a490
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x49f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov esi, eax
call fcn.00401160
mov ecx, dword [eax]
or ecx, 2
xor edx, edx
push esi
push edx
push dword [ebp + 0xc]
push edx
push edx
push dword [eax + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
xor ecx, ecx
dec ecx
test eax, eax
cmovs eax, ecx
lea edi, [eax + 1]
lea ebx, [eax + eax]
add ebx, 2
push ebx
call fcn.0044fa47
add esp, 4
mov esi, eax
push ebx
xor eax, eax
push eax
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ebx, [ebp + 0x18]
mov dword [ebp - 0x18], ebx
call fcn.00401160
push ebx
xor ecx, ecx
push ecx
push dword [ebp + 0xc]
push edi
push esi
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
mov eax, str.Error:__s___S:_d_
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push eax
call fcn.00452540
add esp, 0x10
lea ecx, [eax + 1]
mov dword [ebp - 0x1c], ecx
lea ebx, [eax + eax]
add ebx, 2
cmp eax, 0xffffffff
mov eax, 0xffffffff
cmovl ebx, eax
push ebx
call fcn.0044fa47
add esp, 4
mov edi, eax
push ebx
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
mov eax, str.Error:__s___S:_d_
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push edi
call fcn.004525a0
add esp, 0x1c
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x42a5bf
mov ebx, eax
lea eax, [ebp - 0x14]
mov dword [eax], edi
sub esp, 0x24
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
movaps xmm0, xmmword [0x45f470]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push edi
call fcn.0044fa50
add esp, 4
push esi
call fcn.0044fa50
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00450100
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42b680
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov dword [ebp - 0x48], edx
mov ebx, ecx
mov eax, dword [0x49f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0x28]
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], 0
sub esp, 0xc
mov al, byte [ebp - 0x40]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, edi
call fcn.00453440
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
cmp eax, ecx
jae 0x42b811
lea edx, [eax + 1]
mov dword [ebp - 0x18], edx
cmp ecx, 8
jb 0x42b6ec
mov ecx, dword [ebp - 0x28]
jmp 0x42b6ef
lea ecx, [ebp - 0x28]
mov word [ecx + eax*2], 0x5c
mov word [ecx + eax*2 + 2], 0
lea esi, [ebp - 0x40]
mov ecx, ebx
mov edx, esi
push dword [ebp + 8]
call fcn.0042ae80
add esp, 4
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 8
jb 0x42b71a
mov esi, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ebx, edx
sub ebx, ecx
cmp ebx, eax
jb 0x42b81e
lea ebx, [ecx + eax]
mov dword [ebp - 0x18], ebx
cmp edx, 8
jb 0x42b73a
mov edi, dword [ebp - 0x28]
lea ecx, [edi + ecx*2]
add eax, eax
push eax
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [edi + ebx*2], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
mov edi, dword [ebp - 0x48]
jb 0x42b790
mov ecx, dword [ebp - 0x40]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x42b786
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42b840
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0044fa85
add esp, 8
cmp dword [ebp - 0x14], 8
jb 0x42b79b
mov eax, dword [ebp - 0x28]
jmp 0x42b79e
lea eax, [ebp - 0x28]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ecx, eax
and ecx, 0xfffffffd
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test ecx, ecx
cmove edx, ecx
mov dword [edi], edx
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x42b7fd
mov ecx, dword [ebp - 0x28]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x42b7f3
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42b840
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0044fa85
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00450100
mov eax, edi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x28]
call fcn.00455ac0
jmp 0x42b6fc
sub esp, 0x10
mov cl, byte [ebp - 0x44]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp], eax
lea ecx, [ebp - 0x28]
call fcn.00453550
jmp 0x42b750
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x439520
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, edx
mov eax, dword [0x49f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
lea ebx, [ebp - 0x14]
mov dword [ebx], edi
push ebx
push 0x20019
push edi
push str.SOFTWAREPoliciesMozillaFirefox
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4395db
lea eax, [ebp - 0x18]
mov dword [eax], edi
lea ecx, [ebp - 0x1c]
mov dword [ecx], edi
sub esp, 0x30
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, 2
test eax, eax
jne 0x4395d2
lea ecx, [ebp - 0x20]
mov dword [ecx], 0xffffffff
lea eax, [ebp - 0x24]
mov dword [eax], 4
xor edi, edi
push eax
push ecx
push edi
push 0x10
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
xor ecx, ecx
lea edx, [ebp - 0x20]
cmp dword [edx], edi
sete cl
test eax, eax
mov edi, 2
cmove edi, ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4395e0
mov edi, 2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00450100
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44f290
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x49f148]
test eax, eax
je 0x44f39e
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x44f2be
cmp dword [eax + 4], 0
mov esi, eax
jne 0x44f395
mov eax, dword [0x49f148]
test eax, eax
je 0x44f3b0
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x44f393
mov esi, eax
test eax, eax
jne 0x44f31c
push 4
push 0x20
call fcn.00416260
add esp, 8
test eax, eax
je 0x44f3d4
mov dword [eax + 4], 0
mov dword [eax + 0x1c], 0x49f148
mov esi, eax
mov eax, dword [0x49f148]
test eax, eax
je 0x44f3c2
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp + 8]
test eax, eax
je 0x44f355
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [eax + 4], 0
test edx, edx
je 0x44f355
mov edi, dword [eax + 0x18]
movsd xmm0, qword [eax + 8]
movsd xmm1, qword [eax + 0x10]
mov dword [ebp - 0xc], edi
movsd qword [ebp - 0x14], xmm1
movsd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
jmp 0x44f361
lea eax, [ebp - 0x24]
push eax
call fcn.0044f060
add esp, 4
movsd xmm1, qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x24]
movsd qword [esi + 8], xmm1
movsd xmm1, qword [ebp - 0x14]
movsd qword [esi + 0x10], xmm1
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
cmp dword [esi + 4], 0
movsd qword [esi], xmm0
je 0x44f395
lock dec dword [0x49f700]
jmp 0x44f395
xor esi, esi
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebp
ret
push 0x49f148
call fcn.00451e70
add esp, 4
jmp 0x44f2a6
push 0x49f148
call fcn.00451e70
add esp, 4
jmp 0x44f2cc
push 0x49f148
call fcn.00451e70
add esp, 4
jmp 0x44f314
push 4
push 0x20
call fcn.00451aa0
int3