joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
lea eax, [ebp - 4]
mov dword [ebp - 8], 1
push eax
push 0
push 2
push 0
push 0
push 0
push 0x5511e0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4030d5
xor al, al
mov esp, ebp
pop ebp
ret
push esi
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.Launched
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop esi
sete al
mov esp, ebp
pop ebp
ret

Function at 0x4039d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004039e0

Function at 0x4039e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
mov edi, dword [ebp + 8]
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
mov dword [ebp - 0xdc], 4
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd8], 4
call esi
push eax
lea eax, [ebp - 0xcc]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0xd0]
push eax
push 0x20019
push 0
push 0x551580
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403a9e
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xdc]
push eax
push 0
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xd0]
test eax, eax
cmove esi, dword [ebp - 0xd4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00525b2c
mov esp, ebp
pop ebp
ret

Function at 0x403ab0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
mov edi, dword [ebp + 8]
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call esi
push eax
lea eax, [ebp - 0xcc]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call esi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0xd0]
push eax
push 0x20019
push 0
push 0x5515e0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403b5f
push 0x12c
mov dword [ebp - 0xd4], 0x12c
call fcn.00527345
add esp, 4
mov esi, eax
lea eax, [ebp - 0xd4]
push eax
push esi
lea eax, [ebp - 0xd8]
push eax
push 0
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xd0]
test eax, eax
cmove edi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
Function at 0x403ba0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
mov dword [ebp - 0xd4], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
lea eax, [ebp - 0xcc]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0xd0]
push eax
push 0x20006
push 0
push 0x551648
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop edi
test eax, eax
je 0x403c33
push 0
lea eax, [ebp - 0xd0]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x5516a8
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x403c5f
push 4
lea eax, [ebp - 0xd4]
push eax
push 4
push 0
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret

Function at 0x403c70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
mov edi, dword [ebp + 8]
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call esi
push eax
lea eax, [ebp - 0xcc]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call esi
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x403cb5
lea eax, [ebp - 0xd0]
sub esi, ecx
push eax
push 0x20006
push 0
push 0x5514c0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x403d0a
push 0
lea eax, [ebp - 0xd0]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x551520
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x403d32
lea eax, [esi + 1]
push eax
push ebx
push 3
push 0
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
Function at 0x403d50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
movzx eax, al
push 0
mov dword [ebp - 0xd4], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
lea eax, [ebp - 0xcc]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0xd0]
push eax
push 0x20006
push 0
push 0x551708
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop edi
test eax, eax
je 0x403de6
push 0
lea eax, [ebp - 0xd0]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x551768
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x403e12
push 4
lea eax, [ebp - 0xd4]
push eax
push 4
push 0
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
Function at 0x4040f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push 0x5518bc
push 0x5518e0
call fcn.00403f40
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
add esp, 8
push eax
push SysReAllocString
call esi
test eax, eax
je 0x4041cf
lea eax, [ebp - 0x108]
push eax
push 0x55191c
push 0x551940
call fcn.00403f40
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x4041cf
lea eax, [ebp - 0x108]
push eax
push 0x55197c
push 0x5519a0
call fcn.00403f40
add esp, 8
push eax
push SysReAllocString
call esi
test eax, eax
je 0x4041cf
lea eax, [ebp - 0x108]
push eax
push 0x5519e0
push 0x551a04
call fcn.00403f40
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x4041cf
lea eax, [ebp - 0x108]
push eax
push 0x551a44
push 0x551a64
call fcn.00403f40
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x40434b
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x100
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x108]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40434b
cmp dword [ebp - 0x110], 1
jne 0x40434b
mov eax, dword [ebp - 0x10c]
cmp eax, 4
jb 0x40434b
lea eax, [ebp + eax - 0x108]
push 0x551aa4
push eax
call fcn.00527597
add esp, 8
test eax, eax
je 0x404324
mov eax, dword [ebp - 0x10c]
push 0x551aa8
lea eax, [ebp + eax - 0x108]
push eax
call fcn.00527597
add esp, 8
test eax, eax
je 0x404324
movzx eax, byte [ebp - 0xfc]
mov cl, byte [ebp - 0xfd]
mov byte [edi + 1], al
movzx eax, byte [ebp - 0xfb]
mov byte [edi + 2], al
movzx eax, byte [ebp - 0xfa]
mov byte [edi + 3], al
movzx eax, byte [ebp - 0xf9]
mov byte [edi + 4], al
movsx eax, cl
push eax
mov byte [edi], cl
call fcn.005274d9
add esp, 4
test eax, eax
je 0x40434b
movsx eax, byte [edi + 1]
push eax
call fcn.005274d9
add esp, 4
test eax, eax
je 0x40434b
cmp byte [edi + 2], 0x5f
jne 0x40434b
movsx eax, byte [edi + 3]
push eax
call fcn.005274d9
add esp, 4
test eax, eax
je 0x40434b
movsx eax, byte [edi + 4]
push eax
call fcn.005274d9
add esp, 4
test eax, eax
je 0x40434b
movsx eax, byte [edi + 3]
push eax
call fcn.00527162
mov byte [edi + 3], al
movsx eax, byte [edi + 4]
push eax
call fcn.00527162
add esp, 8
mov byte [edi + 4], al
mov byte [edi + 5], 0
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
push 0x551aac
push dword [ebp + 0xc]
push edi
call fcn.00525d32
add esp, 0xc
mov byte [edi + 5], 0
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
Function at 0x404360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x107]
push edi
mov edi, dword [ebp + 8]
push 0x103
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.00525b40
push 0x551894
push 0x551898
mov dword [ebp - 0x10c], 0
call fcn.00403e20
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00525d32
lea ecx, [ebp - 0x108]
add esp, 0x20
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4043d0
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push edi
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00525d87
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp - 0x10c]
test ecx, ecx
je 0x404476
mov eax, dword [ebp + 0x10]
movzx eax, al
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x114], 4
push eax
lea eax, [ebp - 0x118]
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x110], 0
pop edi
seta al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp + 0x10]
xor ecx, ebp
pop edi
pop esi
call fcn.00525b2c
mov esp, ebp
pop ebp
ret

Function at 0x404490
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x10c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x110], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4044f8
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
mov dword [ebp - 0x110], esi
jmp 0x4044fe
mov esi, dword [ebp - 0x110]
test esi, esi
je 0x40456f
push 1
push esi
call fcn.00527a05
mov edi, eax
add esp, 8
test edi, edi
je 0x404569
push edi
push esi
push dword [ebp - 0x114]
lea eax, [ebp - 0x108]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x404560
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x118]
push eax
push 0x5518b8
push edi
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x118]
test ecx, ecx
je 0x404560
movzx eax, word [ecx + 0xa]
mov dword [ebx], eax
movzx eax, word [ecx + 0xc]
mov ecx, dword [ebp - 0x10c]
mov dword [ecx], eax
push edi
call fcn.00527a45
add esp, 4
mov edi, dword [ebp - 0x10c]
cmp dword [ebx], 8
mov eax, 1
jg 0x404585
mov dword [ebx], 9
mov dword [edi], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
Function at 0x407250
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push str.SoftwareAdobeDesigner8.2
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407295
push str.MasterKey
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.MasterApp
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x407860
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4078a6
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4078c5
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x4085a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4085b5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4085f4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4085f0
lea ebx, [ebx]
cmp esi, edx
jae 0x4085f4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4085e0
cmp esi, edx
jb 0x4085f9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x408610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00525b40
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x553834
push 0x553850
call fcn.00403f40
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4086b8
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x208
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], 0
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push dword [ebp - 0x210]
call ebx
push dword [ebp - 0x210]
call esi
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4086c1
sub ecx, edx
sar ecx, 1
jne 0x408730
lea eax, [ebp - 0x210]
push eax
push 0x55388c
push 0x5538a8
call fcn.00403f40
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x408730
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push dword [ebp - 0x210]
call ebx
push dword [ebp - 0x210]
call esi
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408740
sub ecx, edx
sar ecx, 1
je 0x40887a
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.00527dcc
mov edx, eax
add esp, 8
test edx, edx
je 0x40887a
mov ecx, str.EslAiod.dll
sub edx, ecx
jmp 0x408780
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x408780
lea eax, [ebp - 0x20c]
push eax
call fcn.00406b50
mov esi, eax
test esi, esi
je 0x40887a
push str.MigrateUserRegistry
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 2
call edi
add esp, 4
lea eax, [ebp - 0x210]
push eax
push 0x55391c
push str.SOFTWAREAdobeAcrobat_Elements_
call fcn.00403f40
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40885d
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x214]
push eax
push 0
lea eax, [ebp - 0x218]
push eax
push 0
push str.InstallDate
push dword [ebp - 0x210]
call ebx
cmp dword [ebp - 0x214], 1
jbe 0x408851
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0
push eax
push 0
lea eax, [ebp - 0x218]
push eax
push 0
push str.InstallTime
push dword [ebp - 0x210]
call ebx
cmp dword [ebp - 0x214], 1
jbe 0x408851
push 3
call edi
add esp, 4
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
Function at 0x409000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x208]
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
push 0x553b38
push 0x553b5c
call fcn.00403f40
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
add esp, 8
push eax
push SysReAllocString
call esi
test eax, eax
je 0x4090e3
lea eax, [ebp - 0x208]
push eax
push str.Languagecurrent
push 0x553bbc
call fcn.00403f40
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x4090e3
lea eax, [ebp - 0x208]
push eax
push 0x553bf8
push 0x553c1c
call fcn.00403f40
add esp, 8
push eax
push SysReAllocString
call esi
test eax, eax
je 0x4090e3
lea eax, [ebp - 0x208]
push eax
push str.LanguageCurrent
push 0x553c80
call fcn.00403f40
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x4090e3
lea eax, [ebp - 0x208]
push eax
push str.LanguageNext
push str.SoftwareAdobeAcrobat_Reader_
call fcn.00403f40
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x409204
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x20c], 0x200
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x208]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x409204
cmp dword [ebp - 0x210], 1
jne 0x409204
mov eax, dword [ebp - 0x20c]
cmp eax, 4
jb 0x409204
shr eax, 1
push 0x553d20
lea eax, [ebp + eax*2 - 0x20c]
push eax
call fcn.005280c6
add esp, 8
test eax, eax
je 0x4091f1
mov eax, dword [ebp - 0x20c]
shr eax, 1
push 0x553d28
lea eax, [ebp + eax*2 - 0x20c]
push eax
call fcn.005280c6
add esp, 8
test eax, eax
je 0x4091f1
mov esi, dword [ebp - 0x20c]
mov ecx, 4
mov eax, esi
shr eax, 1
sub ecx, eax
add ecx, ecx
lea edx, [ebp + eax*2 - 0x20c]
lea eax, [ebp - 0x204]
sub ecx, eax
add ecx, ebx
jmp 0x4091b0
movzx eax, word [edx]
lea edx, [edx + 2]
mov word [ecx + edx - 2], ax
test ax, ax
jne 0x4091b0
test edi, edi
je 0x4091db
cmp esi, 0xd
jb 0x4091db
push 0xd
lea eax, [ebp - 0x204]
push eax
push edi
call fcn.00528086
add esp, 0xc
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
Function at 0x409220
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push 0x5539ac
push 0x5539d0
call fcn.00403f40
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
add esp, 8
push eax
push SysReAllocString
call esi
test eax, eax
je 0x4092d6
lea eax, [ebp - 0x108]
push eax
push 0x553a0c
push 0x553a30
call fcn.00403f40
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x4092d6
lea eax, [ebp - 0x108]
push eax
push 0x553a6c
push 0x553a8c
call fcn.00403f40
add esp, 8
push eax
push SysReAllocString
call esi
test eax, eax
je 0x4092d6
lea eax, [ebp - 0x108]
push eax
push 0x553acc
push 0x553aec
call fcn.00403f40
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4093b4
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x100
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x108]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4093b4
cmp dword [ebp - 0x110], 1
jne 0x4093b4
mov ecx, dword [ebp - 0x10c]
lea eax, [ecx - 4]
cmp eax, 0xfb
ja 0x4093b4
cmp byte [ebp + ecx - 0x105], 0
je 0x40935a
mov eax, ecx
inc ecx
mov dword [ebp - 0x10c], ecx
cmp eax, 0x100
jae 0x4093c6
mov byte [ebp + eax - 0x104], 0
mov esi, dword [ebp + 0xc]
lea eax, [ebp + ecx - 0x108]
push eax
push esi
push edi
call fcn.00525d32
push 0x553b2c
push edi
call fcn.00527597
add esp, 0x14
test eax, eax
je 0x409390
push 0x553b30
push edi
call fcn.00527597
add esp, 8
test eax, eax
jne 0x40939f
push 0x553b34
push esi
push edi
call fcn.00525d32
add esp, 0xc
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
call fcn.00527faa
int3