joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408d7e
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor esi, esi
push str.ntdll.dll
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
call dword [0x40c0d8]
cmp eax, esi
jne 0x408da8
xor eax, eax
jmp 0x408ed5
push 0x40c810
push eax
call dword [0x40c03c]
mov ebx, eax
cmp ebx, esi
je 0x408da1
push dword [ebp + 8]
call fcn.004064d0
pop ecx
push 0x50
pop esi
lea ecx, [ebp - 1]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], esi
mov byte [ebp - 1], 0
call fcn.0040887b
add esp, 0x10
test al, al
je 0x408ec0
xor eax, eax
cmp dword [ebp - 8], esi
sete al
test byte [ebp - 1], al
je 0x408e04
mov dword [ebp - 8], 0x1bb
push 0xa28
call fcn.00404c49
mov esi, dword [0x40c128]
pop ecx
push dword [ebp + 0xc]
mov edi, eax
call esi
pop ecx
shl eax, 2
push eax
call fcn.00404c49
pop ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
call esi
pop ecx
push eax
push dword [ebp + 0xc]
call fcn.0040655c
mov esi, eax
push esi
push str._wv_ls
push dword [ebp - 0x14]
call ebx
add esp, 0x14
test eax, eax
jle 0x408ea9
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00402c68
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push 0x413880
push edi
call ebx
add esp, 0x18
cmp byte [ebp - 1], 0
jne 0x408e80
push 0
push edi
push dword [ebp - 8]
xor ebx, ebx
push dword [ebp - 0xc]
call fcn.00407388
jmp 0x408e96
mov ecx, edi
call fcn.00402c68
push eax
push edi
push dword [ebp - 8]
xor ebx, ebx
push dword [ebp - 0xc]
call fcn.00403ad5
add esp, 0x10
cmp byte [ebp + 0x10], 0
mov dword [ebp - 0x10], eax
je 0x408ea9
push eax
call fcn.00404c38
pop ecx
push edi
call fcn.00404c38
pop ecx
push dword [ebp - 0x14]
call fcn.00404c38
pop ecx
push esi
call fcn.00404c38
pop ecx
push dword [ebp - 0xc]
call fcn.00404c38
pop ecx
push dword [ebp - 0x1c]
call fcn.00404c38
mov eax, dword [ebp - 0x10]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409ba4
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push str.ntdll.dll
call dword [0x40c0d8]
xor ebx, ebx
cmp eax, ebx
je 0x409da9
push 0x40c810
push eax
call dword [0x40c03c]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x409da9
mov esi, 0x104
push esi
call fcn.00404c49
mov edi, eax
pop ecx
push edi
mov dword [ebp - 0x2c], edi
call fcn.00408812
pop ecx
test al, al
jne 0x409bfb
push edi
jmp 0x409da3
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
mov dword [ebp - 0x1c], ebx
call fcn.00402c68
push eax
push edi
call fcn.004063b6
add esp, 0xc
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x1c], ebx
jbe 0x409bf5
push 0x50
pop edi
lea ecx, [ebp - 1]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 8], edi
mov byte [ebp - 1], bl
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x24], ebx
call fcn.0040887b
add esp, 0x10
test al, al
je 0x409d8e
xor eax, eax
cmp dword [ebp - 8], edi
sete al
test byte [ebp - 1], al
je 0x409c5e
mov dword [ebp - 8], 0x1bb
push esi
call fcn.00404c49
pop ecx
push eax
mov dword [ebp - 0x1c], eax
call fcn.004079b2
pop ecx
push esi
call fcn.00404c49
pop ecx
push eax
mov dword [ebp - 0x18], eax
call fcn.00407d09
pop ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402c68
shl eax, 2
push eax
call fcn.00404c49
pop ecx
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
mov dword [ebp - 0x28], esi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0x412170
push esi
call dword [ebp - 0x10]
add esp, 0x18
test eax, eax
jle 0x409d73
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
mov dword [ebp - 0x20], ebx
call fcn.00402c68
push eax
push esi
call fcn.0040632b
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x20], ebx
jbe 0x409d6a
mov ecx, eax
call fcn.00402c68
add eax, eax
push eax
call fcn.00404c49
pop ecx
push dword [ebp - 0x14]
mov edi, eax
push str._wv_s
push edi
call dword [ebp - 0x10]
add esp, 0xc
test eax, eax
jle 0x409d63
mov ecx, edi
call fcn.00402c68
add eax, eax
push eax
call fcn.00404c49
pop ecx
push edi
mov ecx, edi
mov esi, eax
call fcn.00402c68
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x24]
push 0x412188
push esi
call dword [ebp - 0x10]
add esp, 0x18
cmp byte [ebp - 1], bl
jne 0x409d43
push ebx
push esi
push dword [ebp - 8]
xor ebx, ebx
push dword [ebp - 0xc]
call fcn.00407388
jmp 0x409d59
mov ecx, esi
call fcn.00402c68
push eax
push esi
push dword [ebp - 8]
xor ebx, ebx
push dword [ebp - 0xc]
call fcn.00403ad5
add esp, 0x10
push eax
call fcn.00404c38
pop ecx
push edi
call fcn.00404c38
pop ecx
push dword [ebp - 0x14]
call fcn.00404c38
pop ecx
push dword [ebp - 0x28]
call fcn.00404c38
pop ecx
push dword [ebp - 0x18]
call fcn.00404c38
pop ecx
push dword [ebp - 0x1c]
call fcn.00404c38
pop ecx
push dword [ebp - 0xc]
call fcn.00404c38
pop ecx
push dword [ebp - 0x2c]
call fcn.00404c38
pop ecx
push dword [ebp - 0x30]
call fcn.00404c38
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409eca
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push str.ntdll.dll
call dword [0x40c0d8]
xor ebx, ebx
cmp eax, ebx
je 0x40a0f4
push 0x40c810
push eax
call dword [0x40c03c]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x40a0f4
mov eax, dword [ebp + 8]
call fcn.00402c47
test al, al
jne 0x40a0f4
mov eax, dword [ebp + 0xc]
call fcn.00402c47
test al, al
jne 0x40a0f4
push esi
push edi
mov esi, 0x104
push esi
call fcn.00404c49
mov edi, eax
push edi
mov dword [ebp - 0x2c], edi
call fcn.00408812
pop ecx
pop ecx
test al, al
je 0x409f5b
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
mov dword [ebp - 0x1c], ebx
call fcn.00402c68
push eax
push edi
call fcn.004063b6
add esp, 0xc
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x1c], ebx
ja 0x409f67
push edi
call fcn.00404c38
pop ecx
jmp 0x40a0f2
push 0x50
pop edi
lea ecx, [ebp - 1]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 8], edi
mov byte [ebp - 1], bl
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x24], ebx
call fcn.0040887b
add esp, 0x10
test al, al
je 0x40a0d7
xor eax, eax
cmp dword [ebp - 8], edi
sete al
test byte [ebp - 1], al
je 0x409faa
mov dword [ebp - 8], 0x1bb
push esi
call fcn.00404c49
push eax
mov dword [ebp - 0x1c], eax
call fcn.004079b2
push esi
call fcn.00404c49
push eax
mov dword [ebp - 0x18], eax
call fcn.00407d09
mov ecx, dword [ebp + 0xc]
call fcn.00402c68
shl eax, 2
push eax
call fcn.00404c49
push dword [ebp + 0x10]
mov esi, eax
push dword [ebp + 0xc]
mov dword [ebp - 0x28], esi
push dword [ebp + 8]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0x4167a4
push esi
call dword [ebp - 0x10]
add esp, 0x30
test eax, eax
jle 0x40a0bc
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
mov dword [ebp - 0x20], ebx
call fcn.00402c68
push eax
push esi
call fcn.0040632b
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x20], ebx
jbe 0x40a0b3
mov ecx, eax
call fcn.00402c68
add eax, eax
push eax
call fcn.00404c49
push dword [ebp - 0x14]
mov edi, eax
push str._wv_s
push edi
call dword [ebp - 0x10]
add esp, 0x10
test eax, eax
jle 0x40a0ac
mov ecx, edi
call fcn.00402c68
add eax, eax
push eax
call fcn.00404c49
pop ecx
push edi
mov ecx, edi
mov esi, eax
call fcn.00402c68
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x24]
push 0x416b50
push esi
call dword [ebp - 0x10]
add esp, 0x18
cmp byte [ebp - 1], bl
jne 0x40a08c
push ebx
push esi
push dword [ebp - 8]
xor ebx, ebx
push dword [ebp - 0xc]
call fcn.00407388
jmp 0x40a0a2
mov ecx, esi
call fcn.00402c68
push eax
push esi
push dword [ebp - 8]
xor ebx, ebx
push dword [ebp - 0xc]
call fcn.00403ad5
add esp, 0x10
push eax
call fcn.00404c38
pop ecx
push edi
call fcn.00404c38
pop ecx
push dword [ebp - 0x14]
call fcn.00404c38
pop ecx
push dword [ebp - 0x28]
call fcn.00404c38
push dword [ebp - 0x18]
call fcn.00404c38
push dword [ebp - 0x1c]
call fcn.00404c38
add esp, 0xc
push dword [ebp - 0xc]
call fcn.00404c38
push dword [ebp - 0x2c]
call fcn.00404c38
push dword [ebp - 0x30]
call fcn.00404c38
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a1d2
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor ebx, ebx
push str.ntdll.dll
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call dword [0x40c0d8]
cmp eax, ebx
jne 0x40a1fc
xor eax, eax
jmp 0x40a2bc
push 0x40c810
push eax
call dword [0x40c03c]
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x40a1f5
push 0x50
pop esi
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], esi
mov byte [ebp - 1], bl
call fcn.0040887b
add esp, 0x10
test al, al
je 0x40a2b0
mov edi, dword [ebp - 0xc]
xor eax, eax
cmp edi, esi
sete al
test byte [ebp - 1], al
je 0x40a24b
mov edi, 0x1bb
push 0xa28
call fcn.00404c49
pop ecx
push dword [ebp - 8]
mov esi, eax
push dword [ebp - 0x14]
push str.GET__s_HTTP_1.0_r_nAccept:____r_nUser_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__rv:35.0__Gecko_20100101_Firefox_35.0_r_nHost:__s_r_nConnection:_Close_r_n_r_n_r_n
push esi
call dword [ebp - 0x18]
add esp, 0x10
test eax, eax
jle 0x40a2a9
mov dword [ebp - 0xc], ebx
cmp byte [ebp - 1], bl
jne 0x40a286
push ebx
push esi
push edi
push dword [ebp - 8]
lea ebx, [ebp - 0xc]
call fcn.00407388
jmp 0x40a29b
mov ecx, esi
call fcn.00402c68
push eax
push esi
push edi
push dword [ebp - 8]
lea ebx, [ebp - 0xc]
call fcn.00403ad5
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
add esp, 0x10
mov dword [ecx], eax
push esi
call fcn.00404c38
pop ecx
push dword [ebp - 8]
call fcn.00404c38
mov eax, dword [ebp - 0x10]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a2c1
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 8], 0
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
push str.ntdll.dll
call dword [0x40c0d8]
test eax, eax
jne 0x40a2e8
xor al, al
jmp 0x40a3e1
push 0x40c810
push eax
call dword [0x40c03c]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40a2e1
push dword [ebp + 8]
call fcn.004064d0
pop ecx
push 0x50
pop esi
lea ecx, [ebp - 1]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], esi
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
call fcn.0040887b
mov edi, dword [ebp - 8]
add esp, 0x10
test al, al
je 0x40a3ca
mov ebx, dword [ebp - 0xc]
xor eax, eax
cmp ebx, esi
sete al
test byte [ebp - 1], al
je 0x40a34c
mov ebx, 0x1bb
push 0xa28
call fcn.00404c49
pop ecx
push edi
push dword [ebp - 0x10]
mov esi, eax
push str.GET__s_HTTP_1.0_r_nAccept:____r_nUser_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__rv:35.0__Gecko_20100101_Firefox_35.0_r_nHost:__s_r_nConnection:_Close_r_n_r_n_r_n
push esi
call dword [ebp - 0x14]
add esp, 0x10
test eax, eax
jle 0x40a3c3
and dword [ebp - 8], 0
cmp byte [ebp - 1], 0
jne 0x40a386
push 0
push esi
push ebx
push edi
lea ebx, [ebp - 8]
call fcn.00407388
jmp 0x40a399
mov ecx, esi
call fcn.00402c68
push eax
push esi
push ebx
push edi
lea ebx, [ebp - 8]
call fcn.00403ad5
add esp, 0x10
cmp dword [ebp - 8], 0
mov ebx, eax
jbe 0x40a3bc
push dword [ebp - 8]
push ebx
push dword [ebp + 0xc]
call fcn.004053cb
add esp, 0xc
cmp eax, dword [ebp - 8]
jne 0x40a3bc
mov byte [ebp - 2], 1
push ebx
call fcn.00404c38
pop ecx
push esi
call fcn.00404c38
pop ecx
push edi
call fcn.00404c38
pop ecx
push dword [ebp - 0x18]
call fcn.00404c38
cmp byte [ebp - 2], 0
pop ecx
setne al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x3312b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x3350a0
push edi
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
dec dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.003311ad
test eax, eax
jne 0x331323
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x331340
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0x331323
cmp dword [ebp - 0x10], 4
jne 0x331323
cmp dword [ebp - 8], 1
jne 0x331323
cmp dword [esi + 0xc], ebx
je 0x33136e
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x33133b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
leave
ret 4
lea eax, [ebp + 8]
push eax
mov eax, dword [esi + 4]
mov dword [ebp + 8], ebx
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
je 0x331323
mov eax, dword [esi + 4]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 4]
mov dword [eax + 8], ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
jmp 0x331323
Function at 0x3325d1
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
cmp eax, edi
jne 0x332d32
mov eax, dword [esi + 0x30]
cmp eax, edi
jne 0x33303e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp eax, edi
je 0x332616
push dword [eax + 0x64]
call dword [sym.imp.RPCRT4.dll_RpcMgmtSetServerStackSize]
cmp dword [esi + 0x34], edi
jne 0x3332d7
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
test byte [esi + 0x38], bl
jne 0x3332c4
push ebx
lea ecx, [esi + 0x20]
push ecx
push dword [esi + 0x1c]
push dword [esi + 0x18]
push dword [esi + 0x14]
push eax
call fcn.00332d61
test eax, eax
jne 0x3325ec
jmp 0x3332bd
shl eax, 0xa
push eax
jmp 0x332610
xor eax, eax
jmp 0x33262b
push 4
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x3325ec
jmp 0x3332bd
push ebx
push edi
push ebx
call dword [sym.imp.ntdll.dll_RtlSetProcessIsCritical]
add esp, 0xc
jmp 0x33261f
Function at 0x401630
Capabilities:
Check os version
Create process on windows

Disassembly:
sub esp, 0x328
mov eax, dword [0x448e90]
xor eax, esp
mov dword [esp + 0x324], eax
call fcn.004013c0
test eax, eax
jne 0x401712
push 0x206
push eax
lea ecx, [esp + 0x126]
push ecx
mov word [esp + 0x128], ax
call fcn.00421cd0
add esp, 0xc
push 0x104
lea edx, [esp + 0x120]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401712
lea eax, [esp + 0x11c]
push 0x5c
push eax
call fcn.004210de
push str.ICBCEBankAssist.exe
lea edx, [esp + 0x128]
xor ecx, ecx
push 0x104
push edx
mov word [eax + 2], cx
call fcn.00421192
push 0x11c
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00421cd0
add esp, 0x20
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
push 0
push 0
push str.start101
jb 0x4016fd
lea edx, [esp + 0x128]
push edx
push str.runas
jmp 0x40170a
lea eax, [esp + 0x128]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x324]
xor ecx, esp
xor eax, eax
call fcn.004210cf
add esp, 0x328
ret 0x10
Function at 0x402370
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x43a84d
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x448e90]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov eax, dword [0x448e90]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
mov edi, dword [esp + 0x244]
xor ebx, ebx
push ebx
push 0x23
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x402598
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x14]
call entry0
mov esi, eax
cmp edi, esi
je 0x4023f7
mov ecx, edi
call fcn.00401270
mov eax, dword [esi]
mov dword [edi], eax
cmp eax, ebx
je 0x4023f7
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0x10]
call fcn.00401270
mov dword [esp + 0x14], ebx
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x240], ebx
call fcn.004021b0
add esp, 4
test eax, eax
je 0x402588
mov eax, 0x16
mov word [esp + 0x18], ax
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x240], 1
call fcn.004020a0
lea edx, [esp + 0x14]
push edx
mov ecx, eax
call fcn.00401920
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.00401270
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x240], 0
call esi
test bl, bl
je 0x40249b
push str.icbc_data_
lea ecx, [esp + 0x14]
call entry0
lea ecx, [esp + 0x10]
mov byte [esp + 0x23c], 2
push ecx
jmp 0x402578
mov edx, 0x16
mov word [esp + 0x18], dx
mov dword [esp + 0x20], 2
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x240], 3
call fcn.004020a0
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.00401920
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.00401270
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x240], 0
call esi
test bl, bl
je 0x402508
push str.icbc_data_firefox_
lea ecx, [esp + 0x14]
call entry0
mov byte [esp + 0x23c], 4
jmp 0x402573
mov ecx, 0x16
mov word [esp + 0x18], cx
mov dword [esp + 0x20], 3
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
mov byte [esp + 0x240], 5
call fcn.004020a0
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.00401920
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.00401270
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x240], 0
call esi
test bl, bl
je 0x402588
push str.icbc_data_chrome_
lea ecx, [esp + 0x14]
call entry0
mov byte [esp + 0x23c], 6
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.00401120
lea ecx, [esp + 0x10]
call fcn.00401270
lea ecx, [esp + 0x14]
call fcn.00401270
mov eax, 1
jmp 0x40259a
xor eax, eax
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.004210cf
add esp, 0x230
ret
Function at 0x402c10
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43a961
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x448e90]
xor eax, esp
mov dword [esp + 0x42c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x448e90]
xor eax, esp
push eax
lea eax, [esp + 0x444]
mov dword fs:[0], eax
mov esi, dword [esp + 0x454]
mov edi, dword [esp + 0x458]
mov ebx, dword [esp + 0x45c]
mov ebp, dword [esp + 0x460]
push str.HKEY_CLASSES_ROOT
lea ecx, [esp + 0x20]
call entry0
push 0x43d29c
lea ecx, [esp + 0x18]
mov dword [esp + 0x450], 0
call entry0
push str.HKEY_CURRENT_USER
lea ecx, [esp + 0x1c]
mov byte [esp + 0x450], 1
call entry0
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov byte [esp + 0x450], 2
call fcn.00401920
test eax, eax
jne 0x402cc3
mov ecx, SysReAllocString
jmp 0x402cf3
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.00401920
test eax, eax
jne 0x402cda
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x402cf3
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.00401920
test eax, eax
jne 0x402de1
mov ecx, SysReAllocString
mov eax, dword [edi]
test eax, eax
je 0x402cfd
mov eax, dword [eax]
jmp 0x402cff
xor eax, eax
lea edx, [esp + 0x20]
push edx
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402e03
push 0x40e
push eax
lea ecx, [esp + 0x3a]
push ecx
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], 0x208
mov word [esp + 0x3c], ax
call fcn.00421cd0
mov eax, dword [ebx]
add esp, 0xc
test eax, eax
je 0x402d4a
mov eax, dword [eax]
jmp 0x402d4c
xor eax, eax
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push eax
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x402d7d
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402e03
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x2c]
call entry0
mov esi, eax
cmp ebp, esi
je 0x402db6
mov ecx, ebp
call fcn.00401270
mov eax, dword [esi]
mov dword [ebp], eax
test eax, eax
je 0x402db6
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0x28]
call fcn.00401270
lea ecx, [esp + 0x18]
call fcn.00401270
lea ecx, [esp + 0x14]
call fcn.00401270
lea ecx, [esp + 0x1c]
call fcn.00401270
mov eax, 1
jmp 0x402e20
push str.FALSE
push str.ASSERT_FAIL:__s_n
push str.util_register::CRegisterHelper::GetRegValue
push 0x21
push str..RegisterHelper.cpp
push 0
push 3
call fcn.00408730
add esp, 0x1c
lea ecx, [esp + 0x18]
call fcn.00401270
lea ecx, [esp + 0x14]
call fcn.00401270
lea ecx, [esp + 0x1c]
call fcn.00401270
xor eax, eax
mov ecx, dword [esp + 0x444]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.004210cf
add esp, 0x43c
ret
Function at 0x405cc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43abb3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x448e90]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.std::locale::_Locimp.0
push esi
mov dword [esp + 0x18], 1
call fcn.0040e971
add esp, 4
cmp dword [esi + 0x30], 0x10
jb 0x405d11
mov eax, dword [esi + 0x1c]
push eax
call fcn.004210c4
add esp, 4
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov dword [esi], vtable.std::locale::facet.0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x408730
Capabilities:
Print debug messages

Disassembly:
sub esp, 0xc04
mov eax, dword [0x448e90]
xor eax, esp
mov dword [esp + 0xc00], eax
mov eax, dword [0x44a1e0]
push ebx
push ebp
mov ebp, dword [esp + 0xc14]
push esi
mov esi, dword [esp + 0xc1c]
push edi
mov edi, dword [esp + 0xc28]
test eax, eax
je 0x4088f7
mov ebx, dword [esp + 0xc18]
cmp ebx, dword [eax]
jl 0x4088f7
push 0x5c
push esi
call fcn.00421d50
mov ecx, eax
add esp, 8
test ecx, ecx
jne 0x40878e
mov ecx, esi
jmp 0x40878f
inc ecx
push ebx
call fcn.00403180
push eax
mov eax, dword [esp + 0xc2c]
push edi
push eax
push ecx
mov ecx, dword [0x44a1e0]
add ecx, 0x428
push ecx
push str._s__s___d__s____S:
lea edx, [esp + 0x2c]
push 0x400
push edx
call fcn.004237a4
lea eax, [esp + 0x34]
add esp, 0x24
lea edx, [eax + 1]
jmp 0x4087d0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4087d0
sub eax, edx
mov edx, eax
lea eax, [esp + 0x10]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4087e2
lea ecx, [esp + 0xc30]
push ecx
mov ecx, dword [esp + 0xc30]
push ecx
mov ecx, 0x400
sub ecx, edx
sub eax, esi
push ecx
lea edx, [esp + eax + 0x1c]
push edx
call fcn.0042203e
add esp, 0x10
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, dword [esp + 0xc18]
xor esi, esi
lea ebx, [esi + 4]
test ebp, ebp
je 0x408897
cmp edi, ebx
jne 0x408897
mov ecx, dword [0x44a1e0]
cmp dword [ecx + 4], ebx
jg 0x408897
mov eax, ebp
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408840
sub eax, edx
lea edi, [eax + 1]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040e5f6
push ebp
push 0x43d7f0
mov esi, eax
push edi
push esi
call fcn.00423786
mov ecx, dword [esp + 0xc40]
lea eax, [esp + 0xc44]
push eax
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00403390
mov edi, dword [esp + 0xc38]
add esp, 0x20
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x414]
push 0x43d7f0
push ecx
call fcn.004033b0
mov ecx, dword [0x44a1e0]
add esp, 0xc
cmp edi, ebx
jne 0x4088d0
cmp dword [ecx + 4], ebx
jg 0x4088d0
lea edx, [esp + 0x410]
push edx
push esi
call fcn.00407ba0
jmp 0x4088e3
cmp edi, dword [ecx + 4]
jl 0x4088e3
lea eax, [esp + 0x410]
push eax
push edi
call fcn.004084b0
test esi, esi
je 0x4088f0
push esi
call fcn.0042110a
add esp, 4
mov eax, 1
jmp 0x4088f9
xor eax, eax
mov ecx, dword [esp + 0xc10]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004210cf
add esp, 0xc04
ret