joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4072d0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44171b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x452284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push ebx
push ecx
mov dword [ebp - 0x238], ebx
mov word [ebp - 0x218], ax
call fcn.0042b460
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], dx
push ebx
push 0x1a
lea eax, [ebp - 0x218]
push eax
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x407389
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push 0xffffffffffffffff
mov word [esi + 4], cx
push ebx
lea eax, [ebp - 0x234]
mov ecx, esi
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x407400
mov edx, dword [ebp - 0x230]
push edx
jmp 0x4073f8
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x407392
sub eax, edx
lea ecx, [ebp - 0x218]
sar eax, 1
push ecx
lea edx, [ebp - 0x234]
call fcn.0040ea60
push str.BaiduBaiduBrowseruser_datadefaultchrome_profilepref
mov eax, 0x39
lea edx, [ebp - 0x234]
call fcn.0040ea60
push 0xffffffffffffffff
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push ebx
lea eax, [ebp - 0x234]
mov ecx, esi
mov word [esi + 4], dx
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x407400
mov eax, dword [ebp - 0x230]
push eax
call fcn.00438d27
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425608
mov esp, ebp
pop ebp
ret 4
Function at 0x407420
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44171b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x452284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0x238], edi
mov word [ebp - 0x218], ax
call fcn.0042b460
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], dx
push edi
push 0x1a
lea eax, [ebp - 0x218]
push eax
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4074d9
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x407550
mov edx, dword [ebp - 0x230]
push edx
jmp 0x407548
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4074e2
sub eax, edx
lea ecx, [ebp - 0x218]
sar eax, 1
push ecx
lea edx, [ebp - 0x234]
call fcn.0040ea60
push str.SogouExplorerExtension3.db
mov eax, 0x1c
lea edx, [ebp - 0x234]
call fcn.0040ea60
push 0xffffffffffffffff
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
mov word [esi + 4], dx
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x407550
mov eax, dword [ebp - 0x230]
push eax
call fcn.00438d27
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425608
mov esp, ebp
pop ebp
ret
Function at 0x407830
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44171b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x452284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0x238], edi
mov word [ebp - 0x218], ax
call fcn.0042b460
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], dx
push edi
push 0x1c
lea eax, [ebp - 0x218]
push eax
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4078e9
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x407960
mov edx, dword [ebp - 0x230]
push edx
jmp 0x407958
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4078f2
sub eax, edx
lea ecx, [ebp - 0x218]
sar eax, 1
push ecx
lea edx, [ebp - 0x234]
call fcn.0040ea60
push str.GoogleChromeUser_DataLocal_State
mov eax, 0x24
lea edx, [ebp - 0x234]
call fcn.0040ea60
push 0xffffffffffffffff
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
mov word [esi + 4], dx
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x407960
mov eax, dword [ebp - 0x230]
push eax
call fcn.00438d27
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425608
mov esp, ebp
pop ebp
ret
Function at 0x407980
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44171b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x452284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0x238], edi
mov word [ebp - 0x218], ax
call fcn.0042b460
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], dx
push edi
push 0x1c
lea eax, [ebp - 0x218]
push eax
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x407a39
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x407ab0
mov edx, dword [ebp - 0x230]
push edx
jmp 0x407aa8
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x407a42
sub eax, edx
lea ecx, [ebp - 0x218]
sar eax, 1
push ecx
lea edx, [ebp - 0x234]
call fcn.0040ea60
push str.2345ExplorerUser_DataLocal_State
mov eax, 0x23
lea edx, [ebp - 0x234]
call fcn.0040ea60
push 0xffffffffffffffff
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
mov word [esi + 4], dx
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x407ab0
mov eax, dword [ebp - 0x230]
push eax
call fcn.00438d27
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425608
mov esp, ebp
pop ebp
ret
Function at 0x407ad0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44171b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x452284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0x238], edi
mov word [ebp - 0x218], ax
call fcn.0042b460
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], dx
push edi
push 0x1a
lea eax, [ebp - 0x218]
push eax
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x407b89
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x407c00
mov edx, dword [ebp - 0x230]
push edx
jmp 0x407bf8
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x407b92
sub eax, edx
lea ecx, [ebp - 0x218]
sar eax, 1
push ecx
lea edx, [ebp - 0x234]
call fcn.0040ea60
push str.BaiduBaiduBrowseruser_datadefaultchrome_profileLocal_State
mov eax, 0x40
lea edx, [ebp - 0x234]
call fcn.0040ea60
push 0xffffffffffffffff
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
mov word [esi + 4], dx
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x407c00
mov eax, dword [ebp - 0x230]
push eax
call fcn.00438d27
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425608
mov esp, ebp
pop ebp
ret
Function at 0x408040
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44171b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x452284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0x238], edi
mov word [ebp - 0x218], ax
call fcn.0042b460
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], dx
push edi
push 0x1c
lea eax, [ebp - 0x218]
push eax
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4080f9
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x408170
mov edx, dword [ebp - 0x230]
push edx
jmp 0x408168
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x408102
sub eax, edx
lea ecx, [ebp - 0x218]
sar eax, 1
push ecx
lea edx, [ebp - 0x234]
call fcn.0040ea60
push str.GoogleChromeUser_DataDefaultExtensions
mov eax, 0x2b
lea edx, [ebp - 0x234]
call fcn.0040ea60
push 0xffffffffffffffff
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
mov word [esi + 4], dx
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x408170
mov eax, dword [ebp - 0x230]
push eax
call fcn.00438d27
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425608
mov esp, ebp
pop ebp
ret
Function at 0x408190
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44171b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x452284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0x238], edi
mov word [ebp - 0x218], ax
call fcn.0042b460
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], dx
push edi
push 0x1c
lea eax, [ebp - 0x218]
push eax
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x408249
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x4082c0
mov edx, dword [ebp - 0x230]
push edx
jmp 0x4082b8
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x408252
sub eax, edx
lea ecx, [ebp - 0x218]
sar eax, 1
push ecx
lea edx, [ebp - 0x234]
call fcn.0040ea60
push str.2345ExplorerUser_DataDefaultExtensions
mov eax, 0x2a
lea edx, [ebp - 0x234]
call fcn.0040ea60
push 0xffffffffffffffff
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
mov word [esi + 4], dx
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x4082c0
mov eax, dword [ebp - 0x230]
push eax
call fcn.00438d27
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425608
mov esp, ebp
pop ebp
ret
Function at 0x4082e0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44171b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x452284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0x238], edi
mov word [ebp - 0x218], ax
call fcn.0042b460
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], dx
push edi
push 0x1a
lea eax, [ebp - 0x218]
push eax
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x408399
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x408410
mov edx, dword [ebp - 0x230]
push edx
jmp 0x408408
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4083a2
sub eax, edx
lea ecx, [ebp - 0x218]
sar eax, 1
push ecx
lea edx, [ebp - 0x234]
call fcn.0040ea60
push str.BaiduBaiduBrowseruser_datadefaultchrome_profileExtensions
mov eax, 0x3f
lea edx, [ebp - 0x234]
call fcn.0040ea60
push 0xffffffffffffffff
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
mov word [esi + 4], dx
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x408410
mov eax, dword [ebp - 0x230]
push eax
call fcn.00438d27
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425608
mov esp, ebp
pop ebp
ret
Function at 0x408430
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44171b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x452284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0x238], edi
mov word [ebp - 0x218], ax
call fcn.0042b460
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], dx
push edi
push 0x1a
lea eax, [ebp - 0x218]
push eax
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4084e9
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x408560
mov edx, dword [ebp - 0x230]
push edx
jmp 0x408558
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4084f2
sub eax, edx
lea ecx, [ebp - 0x218]
sar eax, 1
push ecx
lea edx, [ebp - 0x234]
call fcn.0040ea60
push str.SogouExplorerExtension
mov eax, 0x18
lea edx, [ebp - 0x234]
call fcn.0040ea60
push 0xffffffffffffffff
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
mov word [esi + 4], dx
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x408560
mov eax, dword [ebp - 0x230]
push eax
call fcn.00438d27
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425608
mov esp, ebp
pop ebp
ret
Function at 0x408580
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44171b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x452284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0x238], edi
mov word [ebp - 0x218], ax
call fcn.0042b460
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], dx
push edi
push 0x1c
lea eax, [ebp - 0x218]
push eax
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x408639
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x4086b0
mov edx, dword [ebp - 0x230]
push edx
jmp 0x4086a8
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x408642
sub eax, edx
lea ecx, [ebp - 0x218]
sar eax, 1
push ecx
lea edx, [ebp - 0x234]
call fcn.0040ea60
push str.UCBrowserUser_DataDefaultExtensions
mov eax, 0x27
lea edx, [ebp - 0x234]
call fcn.0040ea60
push 0xffffffffffffffff
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
lea eax, [ebp - 0x234]
mov ecx, esi
mov word [esi + 4], dx
call fcn.00402780
cmp dword [ebp - 0x21c], 8
jb 0x4086b0
mov eax, dword [ebp - 0x230]
push eax
call fcn.00438d27
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425608
mov esp, ebp
pop ebp
ret
Function at 0x409170
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4091e6
lea ecx, [ebp - 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4091e6
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
push 0
push 0
push 0x10
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 4]
push 0
push edx
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4091e6
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4091f0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441b1b
mov eax, dword fs:[0]
push eax
mov eax, 0x4234
call fcn.004306e0
mov eax, dword [0x452284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push 0x3ffc
lea eax, [ebp - 0x423c]
push esi
push eax
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x4240], esi
call fcn.0042b460
add esp, 0xc
lea ecx, [ebp - 0x23c]
push ecx
push 0x4000
lea edx, [ebp - 0x4240]
push edx
call sub.PSAPI.DLL_EnumProcesses
mov edi, dword [ebp - 0x23c]
shr edi, 2
mov dword [ebp - 0x240], edi
cmp eax, esi
je 0x409399
call fcn.00409170
test al, al
je 0x409399
push 0x208
lea ecx, [ebp - 0x21a]
xor eax, eax
push esi
push ecx
mov word [ebp - 0x21c], ax
call fcn.0042b460
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], esi
mov word [ebp - 0x234], dx
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], esi
call fcn.004065b0
xor ebx, ebx
cmp edi, esi
ja 0x409304
cmp dword [ebp - 0x220], 8
jb 0x4092e4
mov edx, dword [ebp - 0x234]
push edx
call fcn.00438d27
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425608
mov esp, ebp
pop ebp
ret
xor esi, esi
mov eax, dword [ebp + ebx*4 - 0x4240]
cmp eax, esi
je 0x40937d
push eax
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40937d
push 0x105
lea eax, [ebp - 0x21c]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x409376
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409343
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x21c]
push ecx
mov edi, eax
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x238]
call fcn.0040ec00
test eax, eax
je 0x409387
mov edi, dword [ebp - 0x240]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, edi
jb 0x409302
jmp 0x4092cc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [ebp - 0x238]
call fcn.004025e0
mov al, 1
jmp 0x4092e6
Function at 0x4093a0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441b1b
mov eax, dword fs:[0]
push eax
mov eax, 0x4234
call fcn.004306e0
mov eax, dword [0x452284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push 0x3ffc
lea eax, [ebp - 0x423c]
push esi
push eax
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x4240], esi
call fcn.0042b460
add esp, 0xc
lea ecx, [ebp - 0x23c]
push ecx
push 0x4000
lea edx, [ebp - 0x4240]
push edx
call sub.PSAPI.DLL_EnumProcesses
mov edi, dword [ebp - 0x23c]
shr edi, 2
mov dword [ebp - 0x240], edi
cmp eax, esi
je 0x409549
call fcn.00409170
test al, al
je 0x409549
push 0x208
lea ecx, [ebp - 0x21a]
xor eax, eax
push esi
push ecx
mov word [ebp - 0x21c], ax
call fcn.0042b460
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], esi
mov word [ebp - 0x234], dx
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], esi
call fcn.004066c0
xor ebx, ebx
cmp edi, esi
ja 0x4094b4
cmp dword [ebp - 0x220], 8
jb 0x409494
mov edx, dword [ebp - 0x234]
push edx
call fcn.00438d27
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425608
mov esp, ebp
pop ebp
ret
xor esi, esi
mov eax, dword [ebp + ebx*4 - 0x4240]
cmp eax, esi
je 0x40952d
push eax
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40952d
push 0x105
lea eax, [ebp - 0x21c]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x409526
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4094f3
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x21c]
push ecx
mov edi, eax
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x238]
call fcn.0040ec00
test eax, eax
je 0x409537
mov edi, dword [ebp - 0x240]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, edi
jb 0x4094b2
jmp 0x40947c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [ebp - 0x238]
call fcn.004025e0
mov al, 1
jmp 0x409496