joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440b40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
cmp esi, 1
mov eax, ebx
sbb eax, 0
jl 0x440c03
mov edx, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 0x38], 0
mov dword [ebp - 0x10], ecx
je 0x440c0c
mov ecx, esi
mov esi, ebx
mov ebx, edi
jmp 0x440bc2
mov edx, dword [ebp - 0x14]
cmp edx, ecx
mov edi, ecx
cmovb edi, edx
test esi, esi
cmovne edi, ecx
push edi
push eax
push ebx
call fcn.00507e70
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add esp, 0xc
add ebx, edi
sub ecx, edi
sbb esi, 0
mov eax, dword [edx + 0x2c]
sub dword [eax], edi
mov eax, dword [edx + 0x1c]
add dword [eax], edi
mov eax, ecx
neg eax
mov eax, 0
sbb eax, esi
jge 0x440cae
mov dword [ebp - 0x14], ecx
mov eax, dword [edx + 0x1c]
mov eax, dword [eax]
test eax, eax
je 0x440bd7
mov ecx, dword [edx + 0x2c]
mov ecx, dword [ecx]
test ecx, ecx
jg 0x440b80
mov eax, dword [edx]
mov edi, dword [eax + 0x1c]
mov ecx, edi
call dword [0x57244c]
mov ecx, dword [ebp - 0x10]
call edi
cmp eax, 0xffffffff
je 0x440cab
mov byte [ebx], al
inc ebx
mov ecx, dword [ebp - 0x14]
add ecx, 0xffffffff
adc esi, 0xffffffff
mov edx, dword [ebp - 0x10]
jmp 0x440bb1
xor eax, eax
xor edx, edx
jmp 0x440ce0
mov eax, dword [edx + 0x1c]
mov eax, dword [eax]
test eax, eax
je 0x440c3f
mov ecx, dword [edx + 0x2c]
mov ebx, dword [ecx]
test ebx, ebx
je 0x440c3f
cmp ebx, esi
cmovae ebx, esi
push ebx
push eax
push edi
call fcn.00507e70
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov eax, dword [edx + 0x2c]
sub dword [eax], ebx
mov eax, dword [edx + 0x1c]
add dword [eax], ebx
add edi, ebx
sub esi, ebx
cmp dword [edx + 0x4c], 0
je 0x440cd3
mov eax, dword [edx + 0xc]
lea ecx, [edx + 0x3c]
cmp dword [eax], ecx
jne 0x440c80
mov ecx, dword [edx + 0x50]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c]
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x2c]
mov dword [eax], edx
mov edx, dword [ebp - 0x10]
nop word cs:[eax + eax]
cmp esi, 0x1000
jb 0x440cba
push dword [edx + 0x4c]
push 0xfff
push 1
push edi
call fcn.00513b9f
mov edx, dword [ebp - 0x10]
add esp, 0x10
add edi, eax
sub esi, eax
cmp eax, 0xfff
je 0x440c80
jmp 0x440cd3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
sub eax, ecx
mov edx, dword [ebp + 0x10]
sbb edx, esi
jmp 0x440ce0
test esi, esi
je 0x440cd1
push dword [edx + 0x4c]
push esi
push 1
push edi
call fcn.00513b9f
add esp, 0x10
sub esi, eax
jmp 0x440cd3
xor esi, esi
mov ebx, dword [ebp + 0xc]
sub ebx, esi
mov eax, ebx
mov edx, dword [ebp + 0x10]
sbb edx, 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x440cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, ecx
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [edx + 0x38], 0
mov dword [ebp - 0x10], edx
je 0x440dc1
cmp ecx, 1
mov eax, edi
sbb eax, 0
mov eax, edi
mov edi, ecx
mov ecx, eax
jl 0x440e58
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
jmp 0x440d79
cmp edi, ecx
mov esi, ecx
cmovb esi, edi
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x18]
test ebx, ebx
cmovne esi, ecx
push esi
push dword [ebp - 0x14]
push eax
call fcn.00507e70
mov ecx, ebx
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add esp, 0xc
add ebx, esi
sub edi, esi
sbb ecx, 0
mov eax, dword [edx + 0x30]
sub dword [eax], esi
mov eax, dword [edx + 0x20]
add dword [eax], esi
mov eax, edi
neg eax
mov eax, 0
sbb eax, ecx
jge 0x440e58
mov dword [ebp - 0x18], ecx
mov eax, dword [edx + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x440d8e
mov ecx, dword [edx + 0x30]
mov ecx, dword [ecx]
test ecx, ecx
jg 0x440d30
movzx eax, byte [ebx]
mov dword [ebp - 0x14], eax
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x57244c]
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x14]
call esi
cmp eax, 0xffffffff
je 0x440e55
inc ebx
add edi, 0xffffffff
mov ecx, dword [ebp - 0x18]
adc ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
jmp 0x440d68
mov eax, dword [edx + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x440e20
cmp dword [ebp + 0xc], 1
mov ecx, edi
sbb ecx, 0
jl 0x440e20
mov ecx, edx
mov edx, ebx
mov ecx, dword [ecx + 0x30]
mov esi, dword [ecx]
test esi, esi
jle 0x440e22
mov ebx, dword [ebp + 0xc]
cmp esi, ebx
mov ecx, ebx
cmovb ecx, esi
test edi, edi
cmove esi, ebx
cmove esi, ecx
push esi
mov ebx, edx
push edx
push eax
call fcn.00507e70
add esp, 0xc
add ebx, esi
mov edx, ebx
mov eax, edi
mov edi, dword [ebp + 0xc]
sub edi, esi
mov ecx, eax
sbb ecx, 0
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x30]
sub dword [eax], esi
mov eax, dword [ebx + 0x20]
add dword [eax], esi
jmp 0x440e29
mov edx, ebx
mov eax, edi
mov edi, dword [ebp + 0xc]
mov ecx, eax
cmp edi, 1
mov eax, ecx
sbb eax, 0
jl 0x440e58
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x4c]
test eax, eax
je 0x440e58
push eax
push edi
push 1
push edx
mov esi, ecx
call fcn.00514839
mov ecx, esi
add esp, 0x10
sub edi, eax
sbb ecx, 0
jmp 0x440e58
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
sub eax, edi
mov edx, dword [ebp + 0x10]
sbb edx, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x441230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x5ce440]
xor eax, ebp
mov dword [esp + 0x38], eax
mov bl, 1
cmp dword [ecx + 0x38], 0
je 0x4412f7
mov esi, ecx
cmp byte [ecx + 0x3d], 0
je 0x4412f7
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x57244c]
mov ecx, esi
push 0xffffffffffffffff
call edi
cmp eax, 0xffffffff
je 0x4412f5
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], 0xffffffff
mov ebx, dword [esi + 0x38]
lea eax, [esi + 0x40]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [0x57244c]
lea eax, [esp + 0xc]
lea edx, [esp + 0x10]
mov ecx, ebx
mov ebx, edx
push eax
lea eax, [esp + 0x34]
push eax
push edx
push dword [esp + 0x14]
call edi
cmp eax, 3
je 0x44130c
cmp eax, 1
je 0x4412d1
test eax, eax
jne 0x4412f5
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 0xc]
sub edi, ebx
je 0x4412ec
push dword [esi + 0x4c]
push edi
push 1
push ebx
call fcn.00514839
add esp, 0x10
cmp edi, eax
jne 0x4412f5
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x4412f7
xor ebx, ebx
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.005051b5
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x3d], 0
mov bl, 1
jmp 0x4412f7

Function at 0x444150
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5daca0]
mov ecx, dword [0x5dc534]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x44417b
mov ecx, 0x5dac98
pop ebp
jmp fcn.00431120
push 0x5daca0
call fcn.00505151
add esp, 4
cmp dword [0x5daca0], 0xffffffff
jne 0x444170
mov dword [0x5dac9c], 0
mov dword [0x5dac98], 0
mov ecx, 0x5dac98
push 0
call fcn.00431190
push 0x5daca0
call fcn.00505100
add esp, 4
jmp 0x444170

Function at 0x446fbe
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x20]
mov ebx, dword [ebp + 8]
movups xmm0, xmmword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
xor edx, edx
mov dword [edi], edx
mov ecx, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], eax
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edx
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x44701d
mov esi, eax
mov ebx, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 3
xor ecx, ecx
push ecx
push ecx
push edi
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [ecx + ecx*4]
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x448bb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x448c29
mov ecx, dword [ebp + 0xc]
cmp ebx, 1
jne 0x448bcc
xor esi, esi
jmp 0x448c0e
and ebx, 0xfffffffe
xor esi, esi
nop word cs:[eax + eax]
movzx edi, al
movzx edx, byte [ecx + esi]
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x57ba74]
movzx edx, al
movzx edi, byte [ecx + esi + 1]
xor edi, edx
shr eax, 8
xor eax, dword [edi*4 + 0x57ba74]
add esi, 2
cmp ebx, esi
jne 0x448be0
mov edx, dword [ebp + 0x10]
test dl, 1
je 0x448c29
movzx edx, al
movzx ecx, byte [ecx + esi]
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x57ba74]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x45534c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesAdobeAcrobat_ReaderDCFeatureLockDown
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4553b8
lea eax, [ebp - 0x10]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
push esi
push str.bEnableATL7Compat
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4553af
cmp dword [ebp - 8], 4
jne 0x4553af
inc eax
cmp dword [ebp - 0xc], eax
cmove esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x4553bd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push esi
push edi
push eax
push 0x20019
xor edi, edi
xor esi, esi
push edi
push str.SoftwareAdobeAdobe_AcrobatDCSecurity
push 0x80000002
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x455423
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push edi
push 0x5765ac
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45541a
cmp dword [ebp - 4], eax
cmove esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x455dc6
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor edi, edi
push edi
push edi
push 4
push 4
push 1
push 0xe
push 0x80003
push str..pipeAIPC_SRCcom.adobe.acrobat.rna.libCEFLoad
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
cmp esi, 0xffffffff
je 0x455e61
push edi
push edi
xorps xmm0, xmm0
push 1
push edi
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x455e13
push esi
jmp 0x455e5b
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x455e3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x455e51
push 0x3e8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x455e51
push edi
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret

Function at 0x458666
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
movzx eax, ax
mov edx, ecx
push edi
mov edi, eax
mov dword [ebp - 8], eax
shr edi, 8
mov ebx, ecx
cmp dword [ebp + 0x10], ecx
jbe 0x4586c5
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + ebx*2]
mov esi, eax
movzx eax, al
shr esi, 8
add esi, edx
cmp edi, eax
jb 0x4586c5
jne 0x4586bd
cmp edx, esi
jge 0x4586bd
mov eax, dword [ebp + 8]
movzx eax, al
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
movzx eax, byte [edx + eax]
cmp ax, word [ebp - 4]
je 0x4586e9
inc edx
cmp edx, esi
jl 0x4586ab
inc ebx
mov edx, esi
cmp ebx, dword [ebp + 0x10]
jb 0x458687
mov bl, 1
cmp dword [ebp + 0x1c], ecx
jbe 0x4586fc
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp - 8]
movzx eax, byte [ecx + esi]
test al, al
jns 0x4586ed
inc ecx
and eax, 0x7f
shl eax, 8
movzx edx, byte [ecx + esi]
or edx, eax
jmp 0x4586ef
xor al, al
jmp 0x4586fe
mov edx, eax
sub edi, edx
js 0x4586fc
xor bl, 1
inc ecx
cmp ecx, dword [ebp + 0x1c]
jb 0x4586d2
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x458aa0
Capabilities:
Create thread

Disassembly:
push 0x24
mov eax, 0x5584f1
call fcn.00505228
mov esi, ecx
call fcn.00455886
add esi, 0xfffffffc
cmp dword [eax + 4], 0
mov edi, dword [esi]
ja 0x458b05
mov ecx, dword [edi + 8]
call dword [0x57244c]
mov ecx, esi
call dword [edi + 8]
call fcn.00472900
call fcn.004aa7b1
test al, al
jne 0x458b72
cmp dword [0x5db818], 0
je 0x458b72
xor ecx, ecx
lea eax, [ebp - 0x30]
push eax
push ecx
push esi
push 0x455d60
push ecx
push ecx
mov dword [ebp - 0x30], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x458b72
mov ebx, 0x576489
lea ecx, [ebp - 0x28]
push ebx
call fcn.00452f2e
mov ecx, dword [edi + 0x28]
lea eax, [ebp - 0x28]
and dword [ebp - 4], 0
push 1
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [0x57244c]
mov ecx, esi
call dword [edi + 0x28]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00456855
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x458b60
call fcn.00455563
sub esp, 0x18
mov esi, eax
mov ecx, esp
push ebx
call fcn.00452f2e
push 1
mov ecx, esi
call fcn.004b5fb1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], 3
test eax, eax
je 0x458b72
push eax
call fcn.00455b31
pop ecx
call fcn.005051d7
ret
Function at 0x4a6230
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5ce440]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x4a6303
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
call fcn.00505b80
movsd xmm1, qword [0x580338]
divsd xmm1, xmm0
xorps xmm0, xmm0
comisd xmm0, xmm1
movsd qword [ebp - 0xc], xmm1
jae 0x4a6303
push esi
lea eax, [ebp - 0x14]
xor esi, esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x4a62a4
inc esi
cmp esi, 3
ja 0x4a62d0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4a6290
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.00505b80
mulsd xmm0, qword [ebp - 0xc]
call fcn.00505a80
mov dword [edi], eax
mov eax, edi
pop esi
mov dword [edi + 4], edx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005051b5
mov esp, ebp
pop ebp
ret
push 0x34
push 0x5801b0
push str.0___Boost::Chrono___QueryPerformanceCounter_Internal_Error_
call fcn.0051592e
add esp, 0xc
mov dword [edi], 0
mov dword [edi + 4], 0
mov eax, edi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005051b5
mov esp, ebp
pop ebp
ret
push 0x2c
push 0x5801b0
push str.0___Boost::Chrono___get_nanosecs_per_tic_Internal_Error_
call fcn.0051592e
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [edi], 0
mov eax, edi
mov dword [edi + 4], 0
xor ecx, ebp
pop edi
call fcn.005051b5
mov esp, ebp
pop ebp
ret
Function at 0x4a9df3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov bl, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x4a9e66
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push 0x20019
push edi
push 0x5806f0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9e66
cmp dword [esi + 0x14], 0xf
movzx eax, bl
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
jbe 0x4a9e3f
mov esi, dword [esi]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a9e5d
cmp dword [ebp - 8], edi
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x4a9e6d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov bl, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x4a9ee0
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push 0x20019
push edi
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9ee0
cmp dword [esi + 0x14], 0xf
movzx eax, bl
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
jbe 0x4a9eb9
mov esi, dword [esi]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a9ed7
cmp dword [ebp - 8], edi
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x4aa109
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push ebx
push eax
push 1
xor ebx, ebx
push ebx
push dword [0x5ce248]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4aa16a
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [0x5ce24c]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4aa161
cmp dword [ebp - 0xc], 4
jne 0x4aa161
cmp dword [ebp - 0x10], ebx
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret
Function at 0x4aa16f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5ce440]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
call fcn.004aa24c
mov esi, eax
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.004a8e04
cmp eax, dword [esi]
jne 0x4aa1a4
xor al, al
jmp 0x4aa23e
mov esi, dword [eax + 0x14]
push ebx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.004ce122
pop ecx
test al, al
je 0x4aa201
cmp dword [ebp + 8], 1
jne 0x4aa201
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], ebx
push eax
push ebx
push ebx
push 0x57c43c
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x4aa23b
cmp dword [ebp - 0x210], ebx
je 0x4aa23b
push dword [ebp - 0x210]
mov ecx, edi
call fcn.004ab2ee
push dword [ebp - 0x210]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x4aa239
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.005083f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4aa23b
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004ab2ee
mov bl, 1
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005051b5
leave
ret

Function at 0x4aa348
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push esi
push eax
push 1
push 0
push dword [0x5ce250]
or esi, 0xffffffff
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4aa3a8
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [0x5ce254]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4aa39f
cmp dword [ebp - 0xc], 4
cmove esi, dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x4aa3ad
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24c
mov eax, 0x55f31c
call fcn.00505228
mov ecx, dword [0x5dc534]
xor ebx, ebx
mov eax, dword fs:[0x2c]
mov edi, 0x5db61c
mov esi, dword [ebp + 8]
mov eax, dword [eax + ecx*4]
lea ecx, [eax + 0xc]
mov eax, dword [0x5db634]
cmp eax, dword [ecx]
jg 0x4aa5d0
cmp dword [0x5db62c], 0
jbe 0x4aa3ff
push esi
push edi
call fcn.004a99cf
pop ecx
pop ecx
jmp 0x4aa5ca
push edi
call fcn.004aa08b
cmp dword [0x5db62c], 0
pop ecx
mov byte [ebp - 0x249], bl
je 0x4aa5b9
push 0x5804ac
mov ecx, edi
call fcn.00456be3
push 0x580460
mov ecx, edi
call fcn.00456be3
push str.WebResources
mov ecx, edi
call fcn.00456be3
push edi
lea ecx, [ebp - 0x230]
call fcn.004a93c4
xor ecx, ecx
lea eax, [ebp - 0x254]
push eax
inc ecx
push ecx
push ebx
push dword [0x5ce240]
mov dword [ebp - 4], ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4aa514
mov edi, 0x208
lea eax, [ebp - 0x218]
push edi
push ebx
push eax
call fcn.005083f0
add esp, 0xc
mov dword [ebp - 0x258], edi
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push dword [0x5ce244]
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, 0x5db61c
test eax, eax
jne 0x4aa4e8
cmp dword [ebp - 0x250], 1
jne 0x4aa4e8
push 0x580460
mov ecx, edi
mov byte [ebp - 0x249], 1
call fcn.00456be3
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.00456be3
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x249], 0
je 0x4aa514
sub esp, 0x18
mov ecx, esp
push edi
call fcn.004a93c4
call fcn.004aaa52
add esp, 0x18
test al, al
jne 0x4aa581
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.004a9718
push 0x580460
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.004a8b27
sub esp, 0xc
mov byte [ebp - 4], 2
mov ecx, esp
push str.Resource0
push eax
push ecx
call fcn.004a8b0a
add esp, 0xc
call fcn.004aaa52
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
mov bl, al
call fcn.0045687b
test bl, bl
je 0x4aa59b
push 0x580460
mov ecx, edi
call fcn.00456be3
push str.Resource0
mov ecx, edi
call fcn.00456be3
push esi
push edi
call fcn.004a99cf
pop ecx
pop ecx
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.0045687b
mov al, bl
jmp 0x4aa5ca
push edi
call fcn.004a9acb
pop ecx
test al, al
jne 0x4aa581
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x4aa5b0
mov eax, dword [esi]
xor ebx, ebx
mov dword [esi + 0x10], ebx
mov byte [eax], bl
jmp 0x4aa58c
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x4aa5c3
mov eax, dword [esi]
mov dword [esi + 0x10], ebx
mov byte [eax], bl
xor al, al
call fcn.005051d7
ret
push 0x5db634
call fcn.00505151
cmp dword [0x5db634], 0xffffffff
pop ecx
jne 0x4aa3e8
push 0x5764fc
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.00452fe1
push 0x571300
call fcn.005050c0
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x5db634
call fcn.00505100
pop ecx
jmp 0x4aa3e8