joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cb00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41eed0
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
cmp eax, 3
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x41cb3e
test eax, eax
jne 0x41ccba
mov ebx, dword [0x4a126c]
test ebx, ebx
je 0x41ccba
mov dword [ebp - 0x20], 0
jmp 0x41cb67
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41cb98
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41cd0b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x41cb60
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41cb60
test byte [ebp - 0x20], 1
je 0x41ccba
mov ebx, dword [0x4a126c]
test ebx, ebx
je 0x41ccba
mov dword [ebp - 0x20], 0
jmp 0x41cbc7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41cbf8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41cd0b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x41cbc0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41cbc0
test byte [ebp - 0x20], 1
je 0x41ccba
mov ebx, dword [0x4a126c]
test ebx, ebx
je 0x41ccba
mov dword [ebp - 0x20], 0
jmp 0x41cc27
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41cc58
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41cd0b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x41cc20
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41cc20
test byte [ebp - 0x20], 1
je 0x41ccba
mov ebx, dword [0x4a126c]
test ebx, ebx
je 0x41ccba
mov dword [ebp - 0x20], 0
jmp 0x41cc87
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41ccb4
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41cd0b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x41cc80
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41cc80
test byte [ebp - 0x20], 1
jne 0x41ccd4
movzx eax, byte [0x499054]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x4a126c]
jmp 0x41ccdf
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41ccba
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41cd0b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x41ccdc
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x41ccdc
mov dword [ebp - 0x10], 0
push 0x462d04
push 0x2b
push 0x4613a0
call fcn.0044dcd0
add esp, 0xc
ud2
Function at 0x41e650
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x4a1044]
mov esi, ecx
test eax, eax
je 0x41e676
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41e68f
cmp dword [eax + 4], 0
je 0x41e68f
add eax, 8
pop esi
pop edi
ret
push 0x4a1044
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x41e66a
mov eax, dword [0x4a1044]
test eax, eax
je 0x41e726
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x41e743
mov edi, eax
test eax, eax
jne 0x41e6ef
movzx eax, byte [0x4a16e5]
push 4
push 0x10
call fcn.004447d0
add esp, 8
test eax, eax
je 0x41e757
mov dword [eax], 0x4a1044
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x4a1044]
test eax, eax
je 0x41e748
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x41e70f
mov eax, dword [esi]
xor ecx, ecx
mov edx, 0
mov dword [esi], 0
cmp eax, 1
jne 0x41e713
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x41e713
xor ecx, ecx
xor edx, edx
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
lea eax, [edi + 8]
mov byte [edi + 0xc], dl
pop esi
pop edi
ret
push 0x4a1044
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x41e6ad
xor eax, eax
pop esi
pop edi
ret
push 0x4a1044
call fcn.0044d4c0
add esp, 4
jmp 0x41e6e7
push 0x10
push 4
call fcn.0044ea80
add esp, 8
ud2
Function at 0x41e770
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41ef60
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x4a1054]
test eax, eax
je 0x41e7c5
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41e7de
cmp dword [eax + 4], 0
mov ebx, eax
je 0x41e7de
add ebx, 8
jmp 0x41e8a8
push 0x4a1054
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x41e7b5
mov eax, dword [0x4a1054]
test eax, eax
je 0x41e889
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x41e8a6
mov edi, eax
test eax, eax
jne 0x41e842
movzx eax, byte [0x4a16e5]
push 4
push 0x10
call fcn.004447d0
add esp, 8
test eax, eax
je 0x41e8cd
mov dword [eax], 0x4a1054
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x4a1054]
test eax, eax
je 0x41e8bb
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x41e85c
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
mov edx, eax
je 0x41e860
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x41e860
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 0xc]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
je 0x41e8a8
test ecx, ecx
je 0x41e8a8
lock dec dword [ecx]
jne 0x41e8a8
call fcn.00414d40
jmp 0x41e8a8
push 0x4a1054
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x41e7fc
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4a1054
call fcn.0044d4c0
add esp, 4
jmp 0x41e83a
mov dword [ebp - 0x10], 0
push 0x10
push 4
call fcn.0044ea80
add esp, 8
ud2
Function at 0x41e910
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41ef70
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x4a1064]
test eax, eax
je 0x41e965
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41e97e
cmp dword [eax + 4], 0
mov ebx, eax
je 0x41e97e
add ebx, 8
jmp 0x41ea3a
push 0x4a1064
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x41e955
mov eax, dword [0x4a1064]
test eax, eax
je 0x41ea1b
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x41ea38
mov edi, eax
test eax, eax
jne 0x41e9de
movzx eax, byte [0x4a16e5]
push 4
push 0xc
call fcn.004447d0
add esp, 8
test eax, eax
je 0x41ea5f
mov dword [eax], 0x4a1064
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x4a1064]
test eax, eax
je 0x41ea4d
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x41e9f3
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x41e9f5
mov eax, dword [esi + 4]
jmp 0x41e9f5
xor eax, eax
mov ecx, dword [edi + 8]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x41ea3a
test ecx, ecx
je 0x41ea3a
lock dec dword [ecx]
jne 0x41ea3a
call fcn.00414da0
jmp 0x41ea3a
push 0x4a1064
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x41e99c
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4a1064
call fcn.0044d4c0
add esp, 4
jmp 0x41e9d6
mov dword [ebp - 0x10], 0
push 0xc
push 4
call fcn.0044ea80
add esp, 8
ud2
Function at 0x41eaa0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x4a1074]
test eax, eax
je 0x41eb9f
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41ead1
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x41eb9a
mov eax, dword [0x4a1074]
test eax, eax
je 0x41ebc1
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x41ebde
mov esi, eax
test eax, eax
jne 0x41eb3c
movzx eax, byte [0x4a16e5]
push 8
push 0x20
call fcn.004447d0
add esp, 8
test eax, eax
je 0x41ebfa
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x4a1074
mov esi, eax
mov eax, dword [0x4a1074]
test eax, eax
je 0x41ebe8
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [ebp + 8]
test eax, eax
je 0x41eb5b
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
cmp ecx, 1
je 0x41eb89
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x41eb7b
movaps xmm0, xmmword [esp]
jmp 0x41eb89
lea ecx, [esp + 0x10]
call fcn.0041c2e0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x41ebe0
push 0x4a1074
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x41eac4
jmp 0x41ead1
push 0x4a1074
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x41eaef
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x4a1074
call fcn.0044d4c0
add esp, 4
jmp 0x41eb34
push 0x20
push 8
call fcn.0044ea80
add esp, 8
ud2
Function at 0x42cbc0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, edx
mov edi, dword [ebp + 8]
mov eax, dword [0x4a1088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x104
push edi
push ecx
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x42cd2e
push str.MicrosoftWindowsStart_MenuPrograms_
push 0x104
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
test eax, eax
jne 0x42cd2e
mov ecx, dword [esi + 0x10]
lea eax, [ecx - 0x7ffffffb]
cmp eax, 3
jbe 0x42cd40
mov eax, dword [esi]
mov dword [ebp - 0x38], eax
mov edx, dword [esi + 0x14]
lea edi, [ebp - 0x28]
mov dword [edi], 0
lea eax, [ecx + 4]
mov ebx, 7
cmp eax, 8
jb 0x42cca4
mov dword [ebp - 0x30], edx
mov edx, eax
or edx, 7
cmp edx, 0xb
mov ebx, 0xa
cmovae ebx, edx
mov edx, SysReAllocString
cmp ebx, edx
cmovae ebx, edx
lea edi, [ebx + ebx]
cmp ebx, 0x7ff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], eax
jb 0x42cc8a
cmp ebx, 0x7fffffee
jae 0x42cd45
add edi, 0x25
push edi
call fcn.00448d63
add esp, 4
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x42cc98
add edi, 2
push edi
call fcn.00448d63
add esp, 4
mov edi, eax
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp edx, 8
cmovae esi, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
lea eax, [ecx + ecx]
push eax
push esi
push edi
mov esi, ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [edi + esi*2 + 4], 0x6b006e
mov dword [edi + esi*2], 0x6c002e
mov word [edi + esi*2 + 8], 0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
jb 0x42cce3
mov eax, dword [ebp - 0x28]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x42cd2e
mov ecx, dword [ebp - 0x28]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x42cd24
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42cd4a
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.00448d63
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448b70
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0044fcd0
call fcn.0044fce0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42cd9b
mov eax, dword [ebp + 0xc]
movdqu xmm0, xmmword [eax]
pcmpeqb xmm0, xmmword [0x463f90]
pmovmskb edx, xmm0
cmp edx, 0xffff
je 0x42cd92
movdqu xmm0, xmmword [eax]
pcmpeqb xmm0, xmmword [0x463fa0]
pmovmskb edx, xmm0
mov eax, 0x80004002
cmp edx, 0xffff
jne 0x42cda0
mov eax, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
jmp 0x42cda0
mov eax, 0x80004003
pop ebp
ret 0xc
Function at 0x42eaa0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x4a1088]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov esi, eax
call fcn.004011f0
mov ecx, dword [eax]
or ecx, 2
xor edx, edx
push esi
push edx
push dword [ebp + 0xc]
push edx
push edx
push dword [eax + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
xor ecx, ecx
dec ecx
test eax, eax
cmovs eax, ecx
lea edi, [eax + 1]
lea ebx, [eax + eax]
add ebx, 2
push ebx
call fcn.00448d63
add esp, 4
mov esi, eax
push ebx
xor eax, eax
push eax
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ebx, [ebp + 0x18]
mov dword [ebp - 0x18], ebx
call fcn.004011f0
push ebx
xor ecx, ecx
push ecx
push dword [ebp + 0xc]
push edi
push esi
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
mov eax, str.Error:__s___S:_d_
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push eax
call fcn.0044eb90
add esp, 0x10
lea ecx, [eax + 1]
mov dword [ebp - 0x1c], ecx
lea ebx, [eax + eax]
add ebx, 2
cmp eax, 0xffffffff
mov eax, 0xffffffff
cmovl ebx, eax
push ebx
call fcn.00448d63
add esp, 4
mov edi, eax
push ebx
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
mov eax, str.Error:__s___S:_d_
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push edi
call fcn.0044ebf0
add esp, 0x1c
push dword [ebp + 8]
push ebx
call dword [sym.imp.advapi32.dll_RegisterEventSourceW]
test eax, eax
je 0x42ebcf
mov ebx, eax
lea eax, [ebp - 0x14]
mov dword [eax], edi
sub esp, 0x24
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
movaps xmm0, xmmword [0x464450]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x14], 1
call dword [sym.imp.advapi32.dll_ReportEventW]
push ebx
call dword [sym.imp.advapi32.dll_DeregisterEventSource]
push edi
call fcn.004484c0
add esp, 4
push esi
call fcn.004484c0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448b70
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42fca0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov dword [ebp - 0x48], edx
mov ebx, ecx
mov eax, dword [0x4a1088]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0x28]
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], 0
sub esp, 0xc
mov al, byte [ebp - 0x40]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, edi
call fcn.0044fdb0
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
cmp eax, ecx
jae 0x42fe31
lea edx, [eax + 1]
mov dword [ebp - 0x18], edx
cmp ecx, 8
jb 0x42fd0c
mov ecx, dword [ebp - 0x28]
jmp 0x42fd0f
lea ecx, [ebp - 0x28]
mov word [ecx + eax*2], 0x5c
mov word [ecx + eax*2 + 2], 0
lea esi, [ebp - 0x40]
mov ecx, ebx
mov edx, esi
push dword [ebp + 8]
call fcn.0042f490
add esp, 4
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 8
jb 0x42fd3a
mov esi, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ebx, edx
sub ebx, ecx
cmp ebx, eax
jb 0x42fe3e
lea ebx, [ecx + eax]
mov dword [ebp - 0x18], ebx
cmp edx, 8
jb 0x42fd5a
mov edi, dword [ebp - 0x28]
lea ecx, [edi + ecx*2]
add eax, eax
push eax
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [edi + ebx*2], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
mov edi, dword [ebp - 0x48]
jb 0x42fdb0
mov ecx, dword [ebp - 0x40]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x42fda6
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42fe60
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.00448d63
add esp, 8
cmp dword [ebp - 0x14], 8
jb 0x42fdbb
mov eax, dword [ebp - 0x28]
jmp 0x42fdbe
lea eax, [ebp - 0x28]
push eax
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegDeleteTreeW]
mov ecx, eax
and ecx, 0xfffffffd
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test ecx, ecx
cmove edx, ecx
mov dword [edi], edx
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x42fe1d
mov ecx, dword [ebp - 0x28]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x42fe13
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42fe60
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.00448d63
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448b70
mov eax, edi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x28]
call fcn.00452430
jmp 0x42fd1c
sub esp, 0x10
mov cl, byte [ebp - 0x44]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp], eax
lea ecx, [ebp - 0x28]
call fcn.0044fec0
jmp 0x42fd70
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x43cf30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov al, 1
cmp byte [ecx + 4], 0
jne 0x43d000
mov esi, ecx
mov edi, dword [ecx]
test edi, edi
jne 0x43cf75
xor eax, eax
push str.MozillaFirefoxDefaultBrowserAgentRegistryMutex
push eax
push eax
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov edi, eax
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x43cf6b
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esi], edi
test edi, edi
je 0x43d004
push 0xbb8
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x43cfb9
cmp eax, 0x80
je 0x43cfd8
test eax, eax
je 0x43cff5
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0xbb
push str.Acquire
push str.Failed_to_wait_on_registry_mutex:__X
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042eaa0
add esp, 0x14
jmp 0x43cff9
push 0xae
push str.Acquire
push str.Timed_out_waiting_for_registry_mutex
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042eaa0
add esp, 0x10
jmp 0x43cff9
push 0xb5
push str.Acquire
push str.Found_abandoned_registry_mutex._Continuing...
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042eaa0
add esp, 0x10
mov byte [esi + 4], 1
cmp byte [esi + 4], 0
setne al
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0xa4
push str.Acquire
push str.Couldnt_open_registry_mutex:__X
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042eaa0
add esp, 0x14
xor eax, eax
jmp 0x43d000
Function at 0x43daf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, edx
mov eax, dword [0x4a1088]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
lea ebx, [ebp - 0x14]
mov dword [ebx], edi
push ebx
push 0x20019
push edi
push str.SOFTWAREPoliciesMozillaFirefox
push ecx
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov ebx, dword [ebx]
test ebx, ebx
je 0x43dbab
lea eax, [ebp - 0x18]
mov dword [eax], edi
lea ecx, [ebp - 0x1c]
mov dword [ecx], edi
sub esp, 0x30
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_RegQueryInfoKeyW]
mov edi, 2
test eax, eax
jne 0x43dba2
lea ecx, [ebp - 0x20]
mov dword [ecx], 0xffffffff
lea eax, [ebp - 0x24]
mov dword [eax], 4
xor edi, edi
push eax
push ecx
push edi
push 0x10
push esi
push edi
push ebx
call dword [sym.imp.advapi32.dll_RegGetValueW]
xor ecx, ecx
lea edx, [ebp - 0x20]
cmp dword [edx], edi
sete cl
test eax, eax
mov edi, 2
cmove edi, ecx
push ebx
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x43dbb0
mov edi, 2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448b70
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x448d63
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x448d72
pop dword [ebp - 0x34]
mov eax, 0x448d72
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x37f08
push 0
mov eax, 0x65ef5239
add eax, 0x9a5a8b23
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x4214
xor ebx, ebx
add ebx, eax
mov esi, 0x4240110c
sub esi, 0x41f5850c
add esi, dword [ebp - 0x34]
mov edi, 0xabc4f199
add edi, 0x141f9cf6
sub dword [ebp - 0x10], 0xf3180e05
mov edx, dword [esi]
add edx, edi
mov dword [ebp - 0x2c], 0x2d165745
mov dword [ebx], edx
xor dword [ebp - 0x2c], edi
add ebx, 0x8bbede48
sub ebx, 0x8bbede44
add esi, 0x41859a1e
add esi, 0xbe7a65e6
loop 0x448dc8
add eax, 0x2ae7af24
sub eax, 0x2ae6b401
mov ebx, eax
add eax, 0x74b8e585
sub eax, 0x74b8e580
mov ecx, 0xbe17d174
add ecx, 0x42282e8c
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x44d4c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x44d53a
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x44d575
cmp dword [esp + 4], 0
je 0x44d55c
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x44d598
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x4a126c]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x4a126c], edi
jne 0x44d520
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x44d56c
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x44d5df
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x44d560
mov esi, dword [esp]
jmp 0x44d56c
mov esi, dword [edi]
jmp 0x44d56b
mov esi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x462c80
push 0x462cb4
push eax
call fcn.0044e1a0
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
mov dword [esp + 8], 0x462cd8
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x4613d0
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push 0x462ce0
push eax
call fcn.0044dc10
add esp, 8
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x462cd8
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x4613d0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.0044e200
ud2