joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4066d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
test edi, edi
je 0x4066e2
cmp dword [esi], 2
jae 0x4066e2
push 0x7a
pop eax
jmp 0x406743
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406743
cmp dword [ebp + 0xc], 7
je 0x406713
push 0xd
jmp 0x4066df
mov ecx, dword [ebp - 4]
test edi, edi
je 0x40673d
test cl, 1
jne 0x40670f
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x40670f
cmp word [edi + eax*2 - 2], 0
jne 0x40670f
cmp eax, 1
jbe 0x40673d
cmp word [edi + eax*2 - 4], 0
jne 0x40670f
shr ecx, 1
mov dword [esi], ecx
xor eax, eax
leave
ret 8

Function at 0x40677e
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x40678f
push 0xd
pop eax
jmp 0x4067bc
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x406792
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x4067c1
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call fcn.0040151a
mov ebx, eax
cmp ebx, esi
je 0x40682c
lea ecx, [ebp - 0x214]
call fcn.004014a5
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049f533
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x40684a
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.004067c1
cmp eax, esi
jne 0x406891
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x406834
lea ecx, [ebp - 0x214]
call fcn.004014a5
push dword [ebp - 0x21c]
mov ecx, edi
call fcn.00406643
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.004014a5
mov eax, esi
jmp 0x40681b
Function at 0x406f83
Capabilities:
Delete registry value

Disassembly:
push 0x24
mov eax, 0x4c1065
call fcn.0049f542
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call fcn.00406b3e
mov edi, eax
cmp edi, ebx
jne 0x406fbc
mov esi, 0x3e81
lea ecx, [ebp - 0x14]
call fcn.004014a5
mov eax, esi
call fcn.0049f61a
ret 4
mov esi, dword [ebp + 8]
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], ebx
jb 0x406fd0
mov eax, dword [esi + 4]
jmp 0x406fd3
lea eax, [esi + 4]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp + 8], eax
cmp eax, ebx
jne 0x406feb
push edi
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
jmp 0x407040
push str.CRegistry::removeValue_...___for_key
lea ecx, [ebp - 0x30]
call fcn.00404bd0
lea eax, [ebp - 0x30]
push esi
push eax
mov byte [ebp - 4], 1
call fcn.00401985
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.004058b3
push str.CRegistry::removeValue_...___DeleteValue_error
lea ecx, [ebp - 0x30]
call fcn.00404bd0
push dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 2
call fcn.004018c5
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.004058b3
mov esi, dword [ebp + 8]
jmp 0x406faa

Function at 0x4075eb
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
xor ecx, ecx
cmp dword [esi + 0x14], ecx
jne 0x4075ff
push 0xd
pop eax
jmp 0x407658
push edi
xor edi, edi
cmp dword [eax + 0x1c], 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
jb 0x407613
mov ecx, dword [eax + 8]
jmp 0x407616
lea ecx, [eax + 8]
push 0xf003f
push ecx
push dword [eax + 0x20]
lea ecx, [ebp - 8]
call fcn.0040151a
test eax, eax
jne 0x40764d
cmp dword [esi + 0x18], 8
jb 0x407636
mov esi, dword [esi + 4]
jmp 0x407639
add esi, 4
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 8]
mov edi, eax
call fcn.004014a5
lea ecx, [ebp - 8]
call fcn.004014a5
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x40765b
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0
jne 0x40766d
push 0xd
pop eax
jmp 0x4076c6
and dword [ebp + 8], 0
cmp dword [ecx + 0x1c], 8
jb 0x40767c
mov eax, dword [ecx + 8]
jmp 0x40767f
lea eax, [ecx + 8]
push edi
lea edx, [ebp + 8]
push edx
push 0xf003f
push 0
push eax
push dword [ecx + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x4076c3
cmp dword [ebp + 8], eax
je 0x4076c3
cmp dword [esi + 0x18], 8
jb 0x4076ab
mov eax, dword [esi + 4]
jmp 0x4076ae
lea eax, [esi + 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x4078e8
Capabilities:
Encrypt data using dpapi
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 8]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SoftwareMicrosoftInternet_ExplorerUser_Preferences
push SysReAllocString
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x40798b
mov eax, edi
mov dword [ebp - 0x14], edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x407921
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x40795e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40798b
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push 3
push esi
push str.88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x408345
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x210], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jbe 0x4083f1
cmp word [ebp + eax*2 - 0x20e], 0x5c
push esi
push edi
je 0x4083a6
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x408395
mov esi, 0x4d5480
movsd dword es:[edi], dword [esi]
mov eax, ebx
mov edx, ebx
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4083aa
sub eax, edx
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x4083be
push dword [ebp - 0x210]
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x20c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.004a1ace
pop ecx
pop ecx
pop edi
pop esi
jmp 0x4083f3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0049f533
leave
ret
Function at 0x40b640
Capabilities:
Get file version info

Disassembly:
push 0x244
mov eax, 0x4c206e
call fcn.0049f5ab
xor ebx, ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
push 0x20019
push str.SoftwareMicrosoftInternet_Explorer
mov dword [ebp - 4], ebx
xor eax, eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x23c], 0x104
mov word [ebp - 0x21c], ax
call fcn.0040151a
cmp eax, ebx
jne 0x40b6b9
push str.Version
lea eax, [ebp - 0x248]
push eax
lea esi, [ebp - 0x23c]
lea edi, [ebp - 0x21c]
call fcn.00401596
lea ecx, [ebp - 0x248]
call fcn.004014a5
lea eax, [ebp - 0x21c]
push eax
call fcn.004a15e9
pop ecx
mov dword [ebp - 0x23c], eax
cmp eax, 9
jne 0x40b7c3
lea eax, [ebp - 0x238]
push str.ProgramFiles
push eax
call fcn.0040479d
pop ecx
pop ecx
push str.Internet_Exploreriexplore.exe
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 1
call fcn.004052dd
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x250], ebx
jae 0x40b717
lea eax, [ebp - 0x234]
lea ecx, [ebp - 0x250]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jbe 0x40b7b5
push esi
call fcn.0049e091
mov edi, eax
pop ecx
cmp edi, ebx
je 0x40b7b5
push esi
push ebx
push edi
call fcn.0049f650
mov eax, dword [ebp - 0x234]
add esp, 0xc
cmp dword [ebp - 0x220], 8
jae 0x40b75b
lea eax, [ebp - 0x234]
push edi
push esi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40b7ae
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x240]
push eax
push 0x4d5480
push edi
mov dword [ebp - 0x24c], 0x104
mov dword [ebp - 0x240], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40b7ae
mov eax, dword [ebp - 0x240]
cmp eax, ebx
je 0x40b7ae
movzx eax, word [eax + 0xa]
cmp eax, 9
jle 0x40b7ae
mov dword [ebp - 0x23c], eax
push edi
call fcn.0049eec0
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x238]
call fcn.004058b3
lea ecx, [ebp - 0x248]
call fcn.004014a5
mov eax, dword [ebp - 0x23c]
call fcn.0049f62e
ret

Function at 0x40be56
Capabilities:
Create process on windows

Disassembly:
push 0x58
mov eax, 0x4c1f24
call fcn.0049f5ab
mov esi, dword [ebp + 8]
push 0x4d53a4
lea ecx, [ebp - 0x2c]
call fcn.00404bd0
lea eax, [ebp - 0x64]
push str.ProgramFiles
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0040479d
pop ecx
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00405c92
push ebx
push 1
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.004058b3
push str.internet_exploreriexplore.exe_
lea ecx, [ebp - 0x2c]
call fcn.004052dd
push str._new
lea ecx, [ebp - 0x48]
call fcn.00404bd0
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00405c92
cmp dword [ebp - 0x30], 8
mov ecx, dword [ebp - 0x44]
jae 0x40bedb
lea ecx, [ebp - 0x44]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40bee7
lea eax, [ebp - 0x28]
push 1
push ebx
push ecx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.004058b3
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004058b3
call fcn.0049f62e
ret
Function at 0x40cadb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
call fcn.0040cefb
pop ecx
push 0
push 0x20
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40cb27
push 0
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0040cc89
add esp, 0xc
test eax, eax
setne al
jmp 0x40cb29
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049f533
leave
ret

Function at 0x40cb35
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp - 4], eax
push 2
call fcn.0040cefb
pop ecx
push 0
push 0x21
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40cb81
push 0
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0040cc89
add esp, 0xc
test eax, eax
setne al
jmp 0x40cb83
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049f533
leave
ret

Function at 0x40cb8f
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x24
mov eax, 0x4c0f93
call fcn.0049f542
push 0x4daeb8
lea ecx, [ebp - 0x30]
call fcn.00404bd0
lea eax, [ebp - 0x30]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004017f5
or dword [ebp - 4], 0xffffffff
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.004058b3
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x14]
push eax
push 0x4d2b38
push 3
push ebx
push str._J7_
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x40cc18
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x104
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edi, [ebp]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x40cc2c
mov esi, str.History
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
push 0x22
movsd dword es:[edi], dword [esi]
lea eax, [ebp]
push eax
push ebx
movsw word es:[edi], word [esi]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40cc63
push 1
lea eax, [ebp]
push ebx
push eax
call fcn.0040cc89
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0049f533
add ebp, 0x20c
leave
ret
Function at 0x40cefb
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
push edi
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push ebx
push ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call esi
push dword [ebp - 4]
call fcn.0049e091
pop ecx
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
push ebx
call esi
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x40cfad
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
mov dword [ebp - 8], eax
and dword [ebp - 8], 1
mov dword [ebp - 0xc], eax
and dword [ebp - 0xc], 2
cmp dword [ebp - 8], ebx
je 0x40cf62
test dword [edi + 0xc], 0x100000
jne 0x40cf62
push dword [edi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
cmp dword [ebp - 0xc], ebx
je 0x40cf79
test dword [edi + 0xc], 0x100000
je 0x40cf79
push dword [edi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
call esi
push edi
call fcn.0049eec0
push dword [ebp - 4]
call fcn.0049e091
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x40cf4b
mov dword [ebp - 0xc], 1
cmp edi, ebx
je 0x40cfb8
push edi
call fcn.0049eec0
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cfc0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x2714]
mov eax, 0x2714
call fcn.0049fdd0
push 0xffffffffffffffff
push 0x4c0f14
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp + 0x2710], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x271c]
mov edi, ecx
push 0x511110
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
call fcn.00404f19
mov esi, 0x2710
xor ebx, ebx
push esi
lea eax, [ebp]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0049f650
add esp, 0xc
push edi
lea ecx, [ebp - 0x14]
call fcn.0040608f
lea edi, [ebp - 0x14]
call fcn.0040ffae
push dword [ebp - 0x10]
mov ecx, edi
call fcn.00410081
push ebx
push 0x80
push 3
push ebx
push 3
push 0x40000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x40d099
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401713
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2710]
xor ecx, ebp
call fcn.0049f533
add ebp, 0x2714
leave
ret
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push 0x40
push dword [ebp - 0x10]
mov edi, eax
sub edi, 0x40
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp edi, ebx
jbe 0x40d0df
lea eax, [ebp - 0x18]
push ebx
push eax
lea eax, [ebp]
cmp edi, esi
jbe 0x40d0d4
push esi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub edi, esi
jne 0x40d0b7
jmp 0x40d0df
push edi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
jmp 0x40d069
Function at 0x40d1e7
Capabilities:
Initialize iwebbrowser2

Disassembly:
push 0x58
mov eax, 0x4c6194
call fcn.0049f575
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
push str.CInternetExplorer_ShowToolBandEx
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], ebx
call fcn.00404bd0
push esi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.00404bd0
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 2
call fcn.00401985
pop ecx
pop ecx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x64]
call fcn.004058b3
push ebx
push edi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], bl
call fcn.004058b3
lea eax, [ebp - 0x14]
push eax
push 0x4d2ab8
push 4
push ebx
push 0x4d2ad8
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jl 0x40d341
cmp dword [ebp - 0x14], ebx
je 0x40d341
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x48]
push eax
call esi
lea eax, [ebp - 0x2c]
push eax
call esi
lea eax, [ebp - 0x58]
push eax
call esi
push 8
pop eax
push dword [ebp - 0x1c]
mov byte [ebp - 4], 6
mov word [ebp - 0x48], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0xb
mov dword [ebp - 0x40], eax
pop eax
mov word [ebp - 0x2c], ax
xor eax, eax
cmp byte [ebp + 0x24], bl
push 0x16
sete al
lea edx, [ebp - 0x58]
mov dword [ebp - 0x50], edi
dec eax
mov word [ebp - 0x24], ax
pop eax
push edx
lea edx, [ebp - 0x2c]
push edx
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
lea edx, [ebp - 0x48]
push edx
push eax
call dword [ecx + 0xdc]
push dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x58]
push eax
call esi
lea eax, [ebp - 0x2c]
push eax
call esi
lea eax, [ebp - 0x48]
push eax
call esi
mov dword [ebp - 4], ebx
jmp 0x40d341
cmp byte [ebp + 0x28], bl
je 0x40d34b
call fcn.00403765
push str.CInternetExplorer_ShowToolBandEx_S_TRUE
lea ecx, [ebp - 0x38]
call fcn.00404bd0
push dword [ebp - 0x18]
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 9
call fcn.004018c5
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x38]
call fcn.004058b3
push ebx
push edi
lea ecx, [ebp + 8]
call fcn.004058b3
mov eax, dword [ebp - 0x18]
call fcn.0049f61a
ret 0x24
Function at 0x40d509
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x48
mov eax, 0x4bfbc4
call fcn.0049f542
mov edi, ecx
push str.CInternetExplorer::CryptGUID
lea ecx, [ebp - 0x38]
call fcn.00404bd0
lea eax, [ebp - 0x38]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.004017f5
or dword [ebp - 4], 0xffffffff
pop ecx
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.004058b3
mov eax, edi
push 2
mov dword [ebp - 0x18], edi
lea ecx, [eax + 2]
pop edi
mov dx, word [eax]
add eax, edi
cmp dx, si
jne 0x40d54d
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x40d5a2
push str.CInternetExplorer::CryptGUID:_FAIL
lea ecx, [ebp - 0x38]
call fcn.00404bd0
xor edi, edi
lea eax, [ebp - 0x38]
inc edi
push eax
mov dword [ebp - 4], edi
call fcn.004017f5
pop ecx
push esi
push edi
lea ecx, [ebp - 0x38]
call fcn.004058b3
jmp 0x40d5f3
mov eax, dword [ebp - 0x14]
push eax
mov dword [ebx], eax
call fcn.0049e091
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp eax, esi
je 0x40d5ea
push dword [ebx]
push dword [ebp - 0x10]
push eax
call fcn.004a44f0
add esp, 0xc
push str.CInternetExplorer::CryptGUID:_copy_guid
lea ecx, [ebp - 0x54]
call fcn.00404bd0
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 4], edi
call fcn.004017f5
pop ecx
push esi
push 1
lea ecx, [ebp - 0x54]
call fcn.004058b3
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.0049f61a
ret 4
Function at 0x410ab3
Capabilities:
Check if file exists

Disassembly:
push 0x5c
mov eax, 0x4c5fbc
call fcn.0049f5ab
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], ecx
push str.CFirefoxBrowser::CreateSearchProvider___start
lea ecx, [ebp - 0x4c]
call fcn.00404bd0
lea eax, [ebp - 0x4c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004017f5
or dword [ebp - 4], 0xffffffff
pop ecx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x4c]
call fcn.004058b3
cmp byte [ebp + 0xc], bl
je 0x410b35
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx]
call dword [eax + 0x84]
test eax, eax
jne 0x410b35
push str.CFirefoxBrowser::CreateSearchProvider___NOT_host_Browser___Exit
lea ecx, [ebp - 0x4c]
call fcn.00404bd0
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 4], edi
call fcn.004017f5
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x4c]
call fcn.004058b3
push 5
pop eax
call fcn.0049f62e
ret 8
push ebx
push 0x51085c
push 0x5107c0
push ebx
push esi
call fcn.004bcaba
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x410b7c
push str.CFirefoxBrowser::CreateSearchProvider___ERROR_INVALID_HANDLE
lea ecx, [ebp - 0x4c]
call fcn.00404bd0
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 4], 2
call fcn.004017f5
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x4c]
call fcn.004058b3
push 6
jmp 0x410b2c
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404bf2
push str.FireFoxSearchXml.tmp
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 3
call fcn.004052dd
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x410ba8
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x410be9
push str.CFirefoxBrowser::CreateSearchProvider___failed_to_find_xml_to_temp
lea ecx, [ebp - 0x4c]
call fcn.00404bd0
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 4
call fcn.004017f5
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x4c]
call fcn.004058b3
push ebx
push edi
lea ecx, [ebp - 0x2c]
call fcn.004058b3
push 2
jmp 0x410b2c
push dword [ebp - 0x30]
mov ecx, esi
call fcn.00411081
test al, al
jne 0x410c30
push str.CFirefoxBrowser::CreateSearchProvider___failed_to_replace_common_values
lea ecx, [ebp - 0x4c]
call fcn.00404bd0
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 5
call fcn.004017f5
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x4c]
call fcn.004058b3
push 2
pop esi
push ebx
push edi
lea ecx, [ebp - 0x2c]
call fcn.004058b3
mov eax, esi
jmp 0x410b2d
mov ecx, esi
call fcn.00411489
test al, al
jne 0x410c60
push str.CFirefoxBrowser::CreateSearchProvider___copy_XML_to_program_files_failed.
lea ecx, [ebp - 0x68]
call fcn.00404bd0
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 4], 6
call fcn.004017f5
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x68]
call fcn.004058b3
xor esi, esi
jmp 0x410c1f