joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d5a0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x280
mov eax, dword [0x49803c]
lea esi, [esp + 0x6e]
xor eax, ebp
mov dword [esp + 0x278], eax
push 0x20a
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41d5f5
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
add eax, 0xb
cmp eax, 0x103
jbe 0x41d60f
xor ebx, ebx
mov ecx, dword [esp + 0x278]
xor ecx, ebp
call fcn.0045fb40
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push str.control.exe
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor ebx, ebx
test eax, eax
je 0x41d5f7
lea edi, [esp + 0x68]
mov ecx, edi
mov dword [edi], ebx
call fcn.0041d400
mov ecx, dword [edi]
mov eax, str.control.exe__name_Microsoft.DefaultPrograms__page_pageDefaultProgrampageAdvancedSettings_pszAppName_s
mov dword [esp + 8], ecx
push ecx
push eax
call fcn.0041d4e0
add esp, 8
mov edi, eax
inc edi
xor ecx, ecx
mov dword [esp + 0xc], edi
dec ecx
add edi, edi
cmovb edi, ecx
push edi
call fcn.0045f403
add esp, 4
push edi
push ebx
push eax
mov edi, eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [esp + 8]
mov eax, str.control.exe__name_Microsoft.DefaultPrograms__page_pageDefaultProgrampageAdvancedSettings_pszAppName_s
push eax
push 0xffffffffffffffff
push dword [esp + 0x18]
push edi
call fcn.0041d540
add esp, 0x14
lea eax, [esp + 0x24]
lea ecx, [esp + 0x10]
xorps xmm0, xmm0
mov dword [eax + 0x30], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x20], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x28], ebx
mov dword [eax + 0x24], ebx
mov dword [eax + 0x38], ebx
mov dword [eax + 0x34], ebx
mov dword [eax + 0x40], ebx
mov dword [eax + 0x3c], ebx
mov dword [eax], 0x44
mov dword [eax + 0x2c], 1
mov word [eax + 0x30], 0xa
movaps xmmword [ecx], xmm0
push ecx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41d6f7
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x10]
call esi
push dword [esp + 0x14]
call esi
mov bl, 1
push edi
call fcn.0045f40c
add esp, 4
cmp dword [esp + 8], 0
mov dword [esp + 0x68], 0
je 0x41d5f7
push dword [esp + 8]
call fcn.0045f40c
add esp, 4
jmp 0x41d5f7
Function at 0x41d730
Capabilities:
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x210
mov eax, dword [0x49803c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4985b8]
cmp eax, 0x3a74
ja 0x41d7b6
mov eax, dword [0x498068]
cmp eax, 0x3a76
jb 0x41d85e
mov esi, 4
lea edi, [ebp - 0x214]
xor ebx, ebx
lea eax, [edi + esi]
push 0x118
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [edi], 0x11c
mov dword [edi + 0xc], 0x3a75
push 3
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x41d853
mov eax, 0x3a75
xchg dword [0x4985b8], eax
lea eax, [ebp - 0x214]
push eax
push 0x46106c
push 3
push 0
push 0x46109c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x41d84f
mov edi, dword [ebp - 0x214]
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
call dword [section..00cfg]
lea esi, [ebp - 0x218]
push esi
push 0
push str.pageSettingsPageAppsDefaults
push str.windows.immersivecontrolpanel_cw5n1h2txyewy_microsoft.windows.immersivecontrolpanel
push edi
call ecx
test eax, eax
setns bl
js 0x41d824
mov edi, dword [ebp - 0x214]
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
call dword [section..00cfg]
push esi
push 0
push str.pageSettingsPageAppsDefaultstargetSystemSettings_DefaultApps_Browser
push str.windows.immersivecontrolpanel_cw5n1h2txyewy_microsoft.windows.immersivecontrolpanel
push edi
call ecx
mov esi, dword [ebp - 0x214]
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push esi
call ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
mov eax, ebx
add esp, 0x210
pop esi
pop edi
pop ebx
pop ebp
ret
mov bl, 1
jmp 0x41d838
mov eax, 0x3a75
xchg dword [0x498068], eax
lea esi, [ebp - 0x218]
lea edi, [ebp - 0x214]
mov dword [esi], 0x101
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x41d891
lea eax, [ebp - 0x21c]
push eax
push 0x18
push edi
push 0
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
je 0x41d8e1
xor eax, eax
mov dword [ebp - 0x218], 4
mov dword [ebp - 0x214], eax
push esi
push edi
push eax
push 0xffff
push str.IsConnectedAtLogon
push str.SOFTWAREMicrosoftWindowsShellAssociations
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x41d7b6
cmp dword [ebp - 0x214], 0
je 0x41d7b6
call fcn.0041d5a0
mov ebx, eax
jmp 0x41d838
mov eax, dword [ebp - 0x21c]
mov ebx, dword [eax]
push eax
call sub.NETAPI32.dll_NetApiBufferFree
test ebx, ebx
jne 0x41d7b6
jmp 0x41d891
Function at 0x423be0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x49803c]
mov edi, dword [ebp + 8]
mov esi, edx
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x104
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x423d44
push str.MicrosoftWindowsStart_MenuPrograms_
push 0x104
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
test eax, eax
jne 0x423d44
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], 0
mov eax, 7
mov ebx, dword [esi + 0x10]
lea ecx, [ebx + 4]
cmp ecx, 7
je 0x423dcb
cmp ecx, 8
jb 0x423cac
cmp ecx, 0x7fffffff
jae 0x423dd5
or ecx, 7
mov ebx, 0xa
mov eax, SysReAllocString
cmp ecx, 0xa
cmova ebx, ecx
cmp ebx, eax
cmovae ebx, eax
lea eax, [ebx + ebx + 2]
cmp eax, 0x1000
jae 0x423da3
push eax
call fcn.0045f34c
add esp, 4
mov dword [ebp - 0x14], ebx
movzx ecx, word [ebp - 0x28]
mov word [eax], cx
mov dword [ebp - 0x28], eax
mov ebx, dword [esi + 0x10]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
cmp dword [esi + 0x14], 7
jbe 0x423cb4
mov esi, dword [esi]
cmp eax, ebx
jb 0x423d56
cmp eax, 7
mov dword [ebp - 0x18], ebx
jbe 0x423cc9
mov edi, dword [ebp - 0x28]
jmp 0x423ccc
lea edi, [ebp - 0x28]
lea eax, [ebx + ebx]
push eax
push esi
push edi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [edi + ebx*2], 0
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov edx, ecx
sub edx, eax
cmp edx, 4
jb 0x423d78
lea edx, [eax + 4]
cmp ecx, 7
mov dword [ebp - 0x18], edx
jbe 0x423d06
mov ecx, dword [ebp - 0x28]
jmp 0x423d09
lea ecx, [ebp - 0x28]
mov dword [ecx + eax*2 + 4], 0x6b006e
mov dword [ecx + eax*2], 0x6c002e
mov word [ecx + eax*2 + 8], 0
lea esi, [ebp - 0x28]
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x423d2d
mov eax, dword [ebp - 0x28]
push eax
push 0x104
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov ecx, esi
call fcn.004244c0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
mov al, byte [ebp - 0x2c]
lea ecx, [ebp - 0x28]
mov byte [esp + 4], al
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp], ebx
call fcn.00423e40
jmp 0x423ce3
sub esp, 0x10
mov al, byte [ebp - 0x2c]
lea ecx, [ebp - 0x28]
mov byte [esp + 4], al
mov eax, 4
mov dword [esp + 8], str..lnk
mov dword [esp + 0xc], eax
mov dword [esp], eax
call fcn.00423e40
jmp 0x423d1f
lea ecx, [ebx + ebx]
add ecx, 0x25
xor edx, edx
dec edx
cmp eax, 0xffffffdd
cmovb edx, ecx
push edx
call fcn.0045f34c
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x423c92
mov ebx, 3
jmp 0x423cac
call fcn.00423de0
int3
Function at 0x426ce0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x49803c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov esi, eax
call fcn.0041d9f0
mov ecx, dword [eax]
xor edx, edx
or ecx, 2
push esi
push edx
push dword [ebp + 8]
push edx
push edx
push dword [eax + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
mov ebx, eax
xor eax, eax
dec eax
cmp ebx, 0xfffffffe
cmovle ebx, eax
inc ebx
mov edi, ebx
add edi, ebx
cmovb edi, eax
push edi
call fcn.0045f403
add esp, 4
mov esi, eax
push edi
xor eax, eax
push eax
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edi, [ebp + 0x14]
mov dword [ebp - 0x18], edi
call fcn.0041d9f0
push edi
xor ecx, ecx
push ecx
push dword [ebp + 8]
push ebx
mov dword [ebp - 0x1c], esi
push esi
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
mov eax, str.Error:__s___S:_d_
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push eax
call fcn.0041d4e0
add esp, 0x10
mov esi, eax
mov eax, 0xffffffff
inc esi
mov ebx, esi
add ebx, esi
cmovb ebx, eax
push ebx
call fcn.0045f403
add esp, 4
mov edi, eax
push ebx
xor eax, eax
push eax
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
mov eax, str.Error:__s___S:_d_
push eax
push 0xffffffffffffffff
push esi
xor esi, esi
push edi
call fcn.0041d540
add esp, 0x1c
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x426df5
xor ecx, ecx
mov ebx, eax
lea eax, [ebp - 0x14]
mov dword [eax], edi
inc ecx
push esi
push eax
push esi
push ecx
push esi
push esi
push esi
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push edi
call fcn.0045f40c
add esp, 4
push dword [ebp - 0x1c]
call fcn.0045f40c
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x427ce0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov dword [ebp - 0x48], edx
mov ebx, ecx
lea edi, [ebp - 0x28]
mov eax, dword [0x49803c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], 0
sub esp, 0xc
mov al, byte [ebp - 0x40]
mov ecx, edi
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
call fcn.00424520
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
cmp eax, ecx
jae 0x427e64
lea edx, [eax + 1]
cmp ecx, 7
mov dword [ebp - 0x18], edx
jbe 0x427d4c
mov ecx, dword [ebp - 0x28]
jmp 0x427d4f
lea ecx, [ebp - 0x28]
mov word [ecx + eax*2], 0x5c
mov word [ecx + eax*2 + 2], 0
lea esi, [ebp - 0x40]
mov ecx, ebx
mov edx, esi
push dword [ebp + 8]
call fcn.00427750
add esp, 4
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 7
jbe 0x427d7a
mov esi, dword [ebp - 0x40]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ebx, edx
sub ebx, ecx
cmp ebx, eax
jb 0x427e42
lea ebx, [ecx + eax]
cmp edx, 7
mov dword [ebp - 0x18], ebx
jbe 0x427d9a
mov edi, dword [ebp - 0x28]
add eax, eax
lea ecx, [edi + ecx*2]
push eax
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [edi + ebx*2], 0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x427dd5
mov eax, dword [ebp - 0x40]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x427e71
push edx
push eax
call fcn.0045f3d1
add esp, 8
cmp dword [ebp - 0x14], 7
jbe 0x427de0
mov eax, dword [ebp - 0x28]
jmp 0x427de3
lea eax, [ebp - 0x28]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ecx, eax
movzx edx, ax
and ecx, 0xfffffffd
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test ecx, ecx
mov eax, dword [ebp - 0x48]
cmove edx, ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax], edx
cmp ecx, 8
jb 0x427e2d
mov eax, dword [ebp - 0x28]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x427e8c
push edx
push eax
call fcn.0045f3d1
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
mov eax, dword [ebp - 0x48]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
mov cl, byte [ebp - 0x44]
mov byte [esp + 4], cl
lea ecx, [ebp - 0x28]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp], eax
call fcn.00423e40
jmp 0x427db0
lea ecx, [ebp - 0x28]
call fcn.00437ef0
jmp 0x427d5c
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x427ea7
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x427dcb
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x427ea7
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x427e23
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x428840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x7c
mov dword [ebp - 0x88], ecx
mov eax, dword [0x49803c]
xor eax, ebp
mov dword [ebp - 0x10], eax
jmp dword [edx*4 + 0x4656cc]

Function at 0x428d30
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov esi, ecx
mov ecx, dword [0x49803c]
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x2c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, edi
push eax
call fcn.0042abb0
add esp, 4
mov eax, dword [edi + 0x18]
test eax, eax
je 0x428d74
mov dword [esi], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
mov eax, esi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x1c]
movsd xmm2, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
xor edi, edi
lea ebx, [ebp - 0x5c]
mov eax, 7
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
mov word [ebp - 0x2c], di
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], edi
mov word [ebx], di
movsd qword [ebp - 0x34], xmm0
movsd qword [ebp - 0x3c], xmm1
movsd qword [ebp - 0x44], xmm2
sub esp, 0xc
mov al, byte [ebp - 0x60]
mov ecx, ebx
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
call fcn.00424520
mov ecx, 7
cmp dword [ebp - 0x30], ecx
jbe 0x428dde
mov eax, dword [ebp - 0x44]
jmp 0x428de1
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], ecx
jbe 0x428de9
mov ebx, dword [ebp - 0x5c]
push eax
push ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
je 0x428e1c
movzx edi, ax
mov edx, str.RegistryDeleteValue
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
push 0x158
call fcn.00428eb0
add esp, 4
mov ecx, dword [ebp - 0x48]
mov dword [esi], edi
cmp ecx, 8
jb 0x428e3f
mov eax, dword [ebp - 0x5c]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x428e79
push edx
push eax
call fcn.0045f3d1
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x428e60
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x428e91
push edx
push eax
call fcn.0045f3d1
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], 0
jmp 0x428d60
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x428ea9
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x428e35
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x428ea9
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x428e56
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x428eb0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ecx
mov eax, dword [0x49803c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, str.0x_X_in__S:_d
push dword [ebp + 8]
push edx
push ecx
push eax
call fcn.0041d4e0
add esp, 0x10
mov ebx, eax
inc ebx
xor eax, eax
mov esi, ebx
dec eax
add esi, ebx
cmovb esi, eax
push esi
call fcn.0045f403
add esp, 4
mov edi, eax
xor eax, eax
push esi
mov esi, dword [ebp - 0x18]
push eax
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 8]
push dword [ebp - 0x1c]
push esi
mov eax, str.0x_X_in__S:_d
push eax
push 0xffffffffffffffff
push ebx
push edi
call fcn.0041d540
add esp, 0x1c
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
xor eax, eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x428f52
xor ecx, ecx
mov ebx, eax
lea eax, [ebp - 0x14]
xor edx, edx
mov dword [eax], edi
inc ecx
push edx
push eax
push edx
push ecx
push edx
push esi
push edx
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push edi
call fcn.0045f40c
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42a620
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov eax, dword [0x49803c]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 8], eax
jmp dword [edx*4 + 0x4656ec]

Function at 0x42ae50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
mov esi, ecx
mov ecx, dword [0x49803c]
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x2c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, edi
push eax
call fcn.0042abb0
add esp, 4
mov eax, dword [edi + 0x18]
test eax, eax
je 0x42ae9a
mov word [esi], 0
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
mov eax, esi
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x1c]
movsd xmm2, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
xor eax, eax
lea edi, [ebp - 0x5c]
mov ebx, 7
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x2c], ax
mov dword [edi + 0x14], ebx
mov dword [edi + 0x10], eax
mov word [edi], ax
movsd qword [ebp - 0x34], xmm0
movsd qword [ebp - 0x3c], xmm1
movsd qword [ebp - 0x44], xmm2
sub esp, 0xc
mov al, byte [ebp - 0x60]
mov ecx, edi
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
call fcn.00424520
cmp dword [ebp - 0x30], ebx
mov dword [ebp - 0x64], 4
jbe 0x42af06
mov eax, dword [ebp - 0x44]
jmp 0x42af09
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], ebx
jbe 0x42af11
mov edi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x64]
lea edx, [ebp - 0x60]
push ecx
push edx
mov ecx, 0
push ecx
push 0x10
push eax
push edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x42af45
cmp eax, 2
jne 0x42af5f
mov dword [esi + 4], 0
mov word [esi], 0
jmp 0x42af89
xor eax, eax
cmp dword [ebp - 0x60], 0
mov dword [esi + 4], 0
setne al
or eax, 0x100
mov word [esi], ax
jmp 0x42af89
movzx edi, ax
mov edx, str.RegistryGetValueBool
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
push 0xb1
call fcn.00428eb0
add esp, 4
mov word [esi], 0
mov dword [esi + 4], edi
mov ecx, dword [ebp - 0x48]
cmp ecx, 8
jb 0x42afaa
mov eax, dword [ebp - 0x5c]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x42afe4
push edx
push eax
call fcn.0045f3d1
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x42afcb
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x42affc
push edx
push eax
call fcn.0045f3d1
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], 0
jmp 0x42ae86
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x42b014
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42afa0
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x42b014
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42afc1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x42b020
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov esi, ecx
mov ecx, dword [0x49803c]
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x2c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, edi
push eax
call fcn.0042abb0
add esp, 4
mov eax, dword [edi + 0x18]
test eax, eax
je 0x42b064
mov dword [esi], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
mov eax, esi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x1c]
movsd xmm2, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
xor edi, edi
lea ebx, [ebp - 0x5c]
mov eax, 7
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
mov word [ebp - 0x2c], di
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], edi
mov word [ebx], di
movsd qword [ebp - 0x34], xmm0
movsd qword [ebp - 0x3c], xmm1
movsd qword [ebp - 0x44], xmm2
sub esp, 0xc
mov al, byte [ebp - 0x60]
mov ecx, ebx
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
call fcn.00424520
mov ecx, 7
movzx eax, byte [ebp + 0xc]
cmp dword [ebp - 0x30], ecx
mov dword [ebp - 0x60], eax
jbe 0x42b0d5
mov eax, dword [ebp - 0x44]
jmp 0x42b0d8
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], ecx
jbe 0x42b0e0
mov ebx, dword [ebp - 0x5c]
mov ecx, 4
lea edx, [ebp - 0x60]
push ecx
push edx
push ecx
push eax
push ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
je 0x42b11e
movzx edi, ax
mov edx, str.RegistrySetValueBool
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
push 0xcc
call fcn.00428eb0
add esp, 4
mov ecx, dword [ebp - 0x48]
mov dword [esi], edi
cmp ecx, 8
jb 0x42b141
mov eax, dword [ebp - 0x5c]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x42b17b
push edx
push eax
call fcn.0045f3d1
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x42b162
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x42b193
push edx
push eax
call fcn.0045f3d1
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], 0
jmp 0x42b050
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x42b1ab
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42b137
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x42b1ab
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42b158
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3