joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e470a
Capabilities:
Encode data using xor

Disassembly:
pop es
sti
sti
fild word [edx + eax*4 - 0x5ee3068e]
mov edi, 0x8f0afb7
mov word [ebp - 0x725e6561], gs
lock or byte [ebp + ebp*4 - 0x725e6561], cl
not cl
add eax, 0xd424299
sbb dword [edx + 0x5a83f972], eax
xor byte [edx - 7], 0x83
pop edx
jb 0x5e4727
sbb al, 0x1a
push 0xd201afb0
xor esp, dword [edx + ebx]
mov ebp, 0x1c01afb1
mov edi, 0xf9450e1f
sbb al, 0x82
sal dword [ebx], 1
and byte [edx + 0x1b264fa], dh
sal byte [edi - 0x68d7cb2], cl
test byte [ebx - 7], dl
pop es
scasd eax, dword es:[edi]
test eax, 0x12033d1
insb byte es:[edi], dx
sub dword [ebp - 0x1d868917], 0x19b83174
xor byte [edx - 7], 0x84
imul edi, ecx, 7
xor dword [eax - 0x68d7de7], edi
test byte [ebx - 7], ch
pop es
scasd eax, dword es:[edi]
mov eax, dword [0x821ebb87]
dec ebx
sbb byte [ecx + 4], bh
daa
pop ss
sbb al, 0x82
jb 0x5e4717
test byte [edx - 0x5ee3068e], al
mov edi, 0x1d9ffb7
mov word [eax + ebp*4 + 0x1af07fc], es
insb byte es:[edi], dx
add dword [ebp + 0xfaf05d9], 0x219895b3
jae 0x5e4797
btr dword [ebp - 0x68cde68], edx
sbb al, 0x39
pop esp
mov dl, 0x1d
xor byte [edx - 7], 0x99
rcl ebx, 2
in al, 0x74
jb 0x5e4744
cwde
test al, 0x72
stc
sbb al, 0xb2
dec ecx
or al, 0xd1
xchg bl, dl
add eax, 0xf8c59aaf
sbb al, 0x82
sub eax, 0xa011c23
jecxz 0x5e4764
mov esp, 0xd79fa670
cmpsd dword [esi], dword es:[edi]
mov esp, 0xba4001af
xchg esi, eax
xor eax, 0x90989634
jb 0x5e47d3
sbb al, 0xb5
daa
stosb byte es:[edi], al
scasd eax, dword es:[edi]
add edx, edx
cmp dword [esi*8 - 0x7c8b868e], edx
inc ecx
or eax, 0xf9728223
mov byte [0xdc841a7a], al
int 0x28
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
add edx, edx
dec esi
sbb al, byte [edx - 0x7de3a5d9]
jb 0x5e4804
push ss
out 0xf3, eax
sub ch, byte [edi + 0x2ddd201]
sub ch, byte [edi + 0x2ddd201]
sub byte [0x7284a121], 0xf9
or al, 1
or ah, byte [edi - 0x65]
mov esp, 0x4297a670
inc edx
or eax, 0xf972821a
lahf
xlatb
cmpsd dword [esi], dword es:[edi]
mov esp, 0xca4a01af
lodsd eax, dword [esi]
jmp 0x7540c242

Function at 0x5eec1a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5eec35
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124b3e5a]
pop edx
test eax, eax
je 0x5eed07
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5eecf6
test dword [ebp - 0x2a8], 1
jne 0x5eecf6
and dword [ebp - 0x2a8], 0x100
jne 0x5eecf6
push esi
push edx
push 4
push esi
call dword [edx + 0x122d3b82]
pop edx
pop esi
test eax, eax
je 0x5eec99
jmp 0x5eecf6
cmp word [esi], 0x5a4d
jne 0x5eecf6
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5eecf6
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d396a]
pop edx
test eax, eax
je 0x5eecf6
lea eax, [ebp - 0x28c]
push eax
call fcn.005eeb76
test eax, eax
jne 0x5eecef
jmp 0x5eecf6
mov eax, esi
jmp 0x5eed07
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5eec35
pop esi
leave
ret 4
Function at 0x403890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x482b66
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4ae070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4b29c8]
test eax, eax
jne 0x4038f9
push 0x84
call fcn.00459245
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
push 0x84
push 0
push esi
mov dword [ebp - 4], 0
call fcn.0045c4d0
add esp, 0xc
mov ecx, esi
call fcn.00407060
mov dword [ebp - 4], 0xffffffff
mov dword [0x4b29c8], eax
mov ecx, dword [eax + 4]
add eax, 4
push str.SvcInit:_Started_New
push eax
call dword [ecx + 0x14]
add esp, 8
call fcn.00410500
mov dword [0x4b29c0], eax
test eax, eax
jne 0x403941
push 1
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 1
call fcn.004035f0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor edx, edx
push 2
push 1
lea ecx, [edx + 4]
call fcn.004035f0
add esp, 8
push 0
push 0
push 0
push 0x403410
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x403977
call fcn.00407220
push str.SvcInit:_Creat_thread_failed
jmp 0x403981
call fcn.00407220
push str.SvcInit:_Create_thread_successful
mov ecx, dword [eax + 4]
add eax, 4
push eax
call dword [ecx + 0x14]
mov eax, dword [0x4b29c8]
add esp, 8
test eax, eax
jne 0x4039d3
push 0x84
call fcn.00459245
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
push 0x84
push 0
push esi
mov dword [ebp - 4], 1
call fcn.0045c4d0
add esp, 0xc
mov ecx, esi
call fcn.00407060
mov dword [ebp - 4], 0xffffffff
mov dword [0x4b29c8], eax
mov ecx, dword [eax + 4]
add eax, 4
push str.SvcInit:_Now_wating_for_the_close_signal
push eax
call dword [ecx + 0x14]
mov ecx, dword [0x4b29c0]
push 0
push 0xffffffffffffffff
call fcn.00410600
mov ecx, dword [0x4b29c0]
call fcn.004106b0
xor edx, edx
push 3
push 0
lea ecx, [edx + 1]
call fcn.004035f0
mov eax, dword [0x4b29c8]
add esp, 0x18
test eax, eax
jne 0x403a52
push 0x84
call fcn.00459245
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
push 0x84
push 0
push esi
mov dword [ebp - 4], 2
call fcn.0045c4d0
add esp, 0xc
mov ecx, esi
call fcn.00407060
mov dword [ebp - 4], 0xffffffff
mov dword [0x4b29c8], eax
mov ecx, dword [eax + 4]
add eax, 4
push str.SvcInit:_Finished
push eax
call dword [ecx + 0x14]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4048e0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4ae070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
mov esi, ecx
push eax
push 4
push esi
push 0x404990
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x404937
mov eax, dword [esi + 0x40]
push str.failed_to_create_a_new_thread_for_ipc_communications._Fatal_Error
push 0x49587c
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045922f
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x40497a
mov eax, dword [esi + 0x40]
push str.thread_failed_to_resumed._fatal_error
push 0x49587c
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045922f
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor ecx, ebp
mov al, 1
pop esi
call fcn.0045922f
mov esp, ebp
pop ebp
ret
Function at 0x40a240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4837ca
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4ae070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.00457c06
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x40a300
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.0045b5f7
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x4ac594
push eax
call fcn.0045bb00
push edi
push esi
call fcn.00457f4e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045922f
mov esp, ebp
pop ebp
ret 4

Function at 0x40c5c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483c37
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4ae070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ecx, ecx
mov dword [ebp - 0x14], esi
mov dword [esi + 8], 0
call fcn.0040f930
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 2
xor ecx, ecx
mov dword [esi + 0x14], 0
call fcn.0040f930
mov dword [esi + 0x18], 0
mov byte [ebp - 4], 3
xor ecx, ecx
mov dword [esi + 0x20], 0
call fcn.0040f930
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 4
xor ecx, ecx
mov dword [esi + 0x2c], 0
call fcn.0040f930
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 5
lea edi, [esi + 0x34]
cmp dword [0x4b29dc], 0
mov dword [ebp - 0x10], edi
jne 0x40c674
call fcn.0043a560
mov dword [0x4b29dc], 0x42fcb0
mov dword [edi], vtable.CryptoPP::Integer.0
mov ecx, 2
mov dword [edi + 8], 2
call fcn.00440a30
mov ecx, 8
call fcn.00448640
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov byte [ebp - 4], 6
lea edi, [esi + 0x48]
cmp dword [0x4b29dc], 0
mov dword [ebp - 0x10], edi
jne 0x40c6d1
call fcn.0043a560
mov dword [0x4b29dc], 0x42fcb0
mov dword [edi], vtable.CryptoPP::Integer.0
mov ecx, 2
mov dword [edi + 8], 2
call fcn.00440a30
mov ecx, 8
call fcn.00448640
mov dword [edi + 0xc], eax
mov ecx, eax
mov dword [edi + 0x10], 0
mov eax, esi
mov dword [ecx + 4], 0
mov ecx, dword [edi + 0xc]
mov dword [ecx], 0
mov byte [esi + 0x5c], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e110
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483f50
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4ae070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [edx + 0x51], 0
mov dword [edx + 0x58], 0x10
cmp byte [edx + 0x51], 0
jne 0x40e162
mov byte [edx + 0x51], 1
lea ecx, [edx + 0x10]
jmp 0x40e164
xor ecx, ecx
mov dword [edx + 0x5c], ecx
mov byte [edx + 0xa1], 0
mov dword [edx + 0xa8], 0x10
cmp byte [edx + 0xa1], 0
jne 0x40e18d
mov byte [edx + 0xa1], 1
lea ecx, [edx + 0x60]
jmp 0x40e18f
xor ecx, ecx
mov dword [edx + 0xac], ecx
mov eax, edx
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x415eb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4ae070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push ebx
mov edi, ecx
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 8]
mov eax, edx
push ecx
push esi
push eax
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x415f3b
nop word [eax + eax]
mov eax, dword [ebp - 8]
cmp eax, esi
ja 0x415f3b
jae 0x415fd5
call ecx
add ebx, dword [ebp - 8]
mov edx, eax
sub esi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, 0xbb8
jg 0x415f83
inc eax
push 0xa
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push esi
add eax, ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x415ef0
call ecx
mov ecx, dword [0x4b29d0]
mov edx, eax
test ecx, ecx
je 0x415fe8
push edx
push edi
push str.Write_failed_or_else__No_of_bytes_written___data_._Aborting_write_on_pipe__p___errno:__lu
push 0x49587c
push 0x49587c
push str.CommBridge
push str.OOBEUtils
push 0x28
call ecx
add esp, 0x20
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045922f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4b29d0]
test eax, eax
je 0x415fc2
push edi
push edx
push str.Number_of_retries_to_write_to_pipe_exhausted_with_last_error___lu._Aborting_write_on_pipe__p
push 0x49587c
push 0x49587c
push str.CommBridge
push str.OOBEUtils
push 0x28
call eax
add esp, 0x20
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045922f
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4b29d4]
test ecx, ecx
je 0x41600e
push edi
push edx
push str.Number_of_retries_to_write_to_pipe_exhausted_with_last_error___lu._Aborting_write_on_pipe__p
jmp 0x415ff9
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045922f
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4b29d4]
test ecx, ecx
je 0x41600e
push edx
push edi
push str.Write_failed_or_else__No_of_bytes_written___data_._Aborting_write_on_pipe__p___errno:__lu
mov eax, dword [ecx]
push str.CommBridge
push 0x49587c
push 0x28
push ecx
call dword [eax + 0x34]
add esp, 0x1c
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045922f
mov esp, ebp
pop ebp
ret
Function at 0x41c1c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4838a6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4ae070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00459245
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00457e4b
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41fb00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4ae070]
xor eax, ebp
mov dword [ebp - 4], eax
add ecx, 0x4c
mov word [ebp - 8], 0
mov dword [ebp - 0xc], 0
cmp dword [ecx + 0x14], 8
jb 0x41fb28
mov ecx, dword [ecx]
push 0x49e84c
push ecx
lea eax, [ebp - 0xc]
push eax
call fcn.0046c67f
mov eax, dword [ebp - 0xc]
add esp, 0xc
test eax, eax
je 0x41fb95
push eax
push 2
lea eax, [ebp - 8]
push 1
push eax
call fcn.0046dc26
push dword [ebp - 0xc]
call fcn.00466ff8
mov cl, byte [ebp - 8]
add esp, 0x14
mov al, byte [ebp - 7]
cmp cl, 0xff
jne 0x41fb69
cmp al, 0xfe
je 0x41fb72
cmp al, 0xff
jne 0x41fb85
cmp cl, 0xfe
jne 0x41fb85
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045922f
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045922f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.0045922f
mov esp, ebp
pop ebp
ret
Function at 0x41fcb0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485026
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x4ae070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41fdb5
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], eax
mov word [ebp - 0x248], ax
cmp word [ebp - 0x218], ax
jne 0x41fd2e
xor ecx, ecx
jmp 0x41fd46
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41fd37
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00401840
xor bl, bl
lea eax, [ebp - 0x248]
cmp dword [ebp - 0x234], 8
push 0
cmovae eax, dword [ebp - 0x248]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x41fd8a
cmp eax, 0xb7
je 0x41fd8a
cmp eax, 0x50
jne 0x41fd8c
mov bl, 1
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x41fdaa
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00401e70
test bl, bl
jne 0x41fdb5
xor al, al
jmp 0x41fed6
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
jne 0x41fddf
xor ecx, ecx
jmp 0x41fdff
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41fdf0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00401840
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x24c], 7
mov dword [ebp - 0x250], 0
mov word [ebp - 0x260], ax
cmp word [esi], ax
jne 0x41fe3f
xor ecx, ecx
jmp 0x41fe53
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41fe44
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x260]
call fcn.00401840
lea edx, [ebp - 0x260]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.00426700
mov byte [ebp - 4], 0
mov bl, al
mov ecx, dword [ebp - 0x24c]
cmp ecx, 8
jb 0x41fe99
inc ecx
push ecx
push dword [ebp - 0x260]
lea ecx, [ebp - 0x260]
call fcn.00401e70
test bl, bl
je 0x41feb6
lea ecx, [edi + 0x4c]
lea eax, [ebp - 0x230]
cmp ecx, eax
je 0x41feb4
push 0xffffffffffffffff
push 0
push eax
call fcn.00401fb0
mov bl, 1
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x41fed4
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00401e70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045922f
mov esp, ebp
pop ebp
ret 4
Function at 0x420110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4ae070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov esi, edi
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x420130
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
sar esi, 1
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
add esi, esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push dword [ebx + 0x68]
call esi
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 4
push 0x49e868
push dword [ebx + 0x68]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045922f
mov esp, ebp
pop ebp
ret 4

Function at 0x4201a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4ae070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov esi, edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4201c0
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push dword [ebx + 0x68]
call esi
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 2
push 0x49e870
push dword [ebx + 0x68]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045922f
mov esp, ebp
pop ebp
ret 4
Function at 0x424bf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0
push 0
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
test edi, edi
jne 0x424c0f
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
push esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046469a
mov esi, eax
add esp, 4
test esi, esi
je 0x424c47
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
test eax, eax
jne 0x424c4f
call fcn.0046446b
add esp, 4
pop esi
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
call fcn.00401590
push esi
call fcn.0046446b
add esp, 4
mov al, 1
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x424d10
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4ae070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x26
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x424d4e
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045922f
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0x20c], 0
jne 0x424d5c
xor ecx, ecx
jmp 0x424d74
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424d65
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401840
push 0x1b
push str.AdobeAdobe_Creative_Cloud
mov ecx, esi
call fcn.00401940
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0045922f
mov esp, ebp
pop ebp
ret

Function at 0x424db0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4ae070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x2b
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x424dee
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045922f
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0x20c], 0
jne 0x424dfc
xor ecx, ecx
jmp 0x424e14
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424e05
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401840
push 0x1b
push str.AdobeAdobe_Desktop_Common
mov ecx, esi
call fcn.00401940
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0045922f
mov esp, ebp
pop ebp
ret
Function at 0x425080
Capabilities:
Check if file exists
Create directory

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x42508d
mov eax, dword [esi]
jmp 0x42508f
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4250b0
cmp dword [esi + 0x14], 8
jb 0x4250a2
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
pop esi
setne al
ret
cmp dword [esi + 0x14], 8
jb 0x4250b8
mov esi, dword [esi]
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov esi, eax
test esi, esi
je 0x425121
mov eax, dword [0x4b29d0]
test eax, eax
je 0x4250fc
push esi
push 0x49eb50
push 0x49587c
push 0x49587c
push 0x49eab4
push str.OOBEUtils
push 0x32
call eax
add esp, 0x1c
xor eax, eax
test esi, esi
sete al
pop esi
ret
mov ecx, dword [0x4b29d4]
test ecx, ecx
je 0x425121
mov eax, dword [ecx]
push esi
push 0x49eb50
push 0x49eab4
push 0x49587c
push 0x32
push ecx
call dword [eax + 0x34]
add esp, 0x18
xor eax, eax
test esi, esi
pop esi
sete al
ret