joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ba10
Capabilities:
Accept command line arguments
Check os version

Disassembly:
sub esp, 8
mov al, byte [0x662041]
mov cl, byte [0x66204b]
xor cl, al
push ebx
mov byte [0x66204b], cl
mov cl, byte [0x662042]
or cl, 0x10
shr cl, 3
and ecx, 0xff
mov dword [esp + 4], ecx
fild dword [esp + 4]
fdivr qword [0x665968]
fadd qword [0x662058]
fstp qword [0x6659d8]
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dl, byte [0x66204d]
mov ebx, eax
mov al, byte [0x662041]
or al, dl
mov byte [0x662041], al
mov al, byte [0x662045]
or al, 2
shr al, 1
and eax, 0xff
mov dword [esp + 4], eax
fild dword [esp + 4]
fdivr qword [0x662058]
fadd qword [0x65e710]
fstp qword [0x665978]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44bac9
mov edx, dword [0x665ac4]
push 0x6657dc
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [0x665ac4]
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov ecx, ebx
xor eax, eax
and ecx, 0xff
mov al, bh
cmp ecx, 5
pop ebx
jne 0x44baee
cmp eax, 1
jae 0x44bafe
mov dword [0x664fc8], 0x409
add esp, 8
ret
ja 0x44bafe
mov dword [0x664fc8], 0x409
add esp, 8
ret
mov dword [0x664fc8], 0x7f
add esp, 8
ret

Function at 0x4ed6a0
Capabilities:
Encode data using xor

Disassembly:
add byte [edx], 0x33
leave
adc byte [ebx + 0x75], ah
and ebp, esp
stosd dword es:[edi], eax
add eax, 0x94af3db1
movsd dword es:[edi], dword [esi]
aam 0xc7
fistp dword [edx - 0xf]
loope 0x4ed72f
fild word [edi - 0x75]
fild word [edi - 0x50f36930]
xchg ecx, eax
xchg edi, eax
mov ebx, 0x1114939b
push esi
bound edi, qword [edx + 0x31cf5543]
fist word [ecx]
add al, 0x40
xchg edx, ecx
fiadd word [esi]
or dword [edx], ecx
xor byte [edx], 0x97
scasd eax, dword es:[edi]
mov bl, 0xa0
and eax, 0x5387f19d
aas
or dh, byte [ecx - 0xb]
insd dword es:[edi], dx
add eax, 0x13161bd
mov cl, 0xc0
jno 0x4ed6cb
push ebp
iretd
mov bh, 0x62
mov dword [ebp - 9], ebx
cld
or dword [ebp + 0x148219dc], ebp
xchg dword [edi], ecx
retf 0x59d6
xchg ecx, eax
lea ecx, [ecx - 0xe63b5bd]
inc ebp
loop 0x4ed752
cmp ecx, dword [ebx - 0x3b6cb501]
pop ecx
lcall 0x510d, 0x65733ac6
and eax, 0x934e5b9a
inc ebp
inc ecx
jo 0x4ed765
inc ecx
inc edx
or eax, 0x79cd4a06
inc esp
xor eax, 0x7ab9d332
popfd
xchg ebp, eax
xor dword [ebp - 0xb], 0x4bf63265
dec ebx
cwde
lahf
std
cmp dword [ebp + 0xa8935b1], eax
xchg esp, eax
push 0xb98984d2
dec esp
fbstp tbyte [edi - 0x58d23b]
sti
mov ecx, 0xb14869e6
insd dword es:[edi], dx
inc ecx
bound eax, qword [ecx]
cmp ebp, dword [eax]
pushfd
mov word [ecx + ebp*8], fs
xor dword [ecx], 0x93d147d2
call 0xc6013c92
xchg edx, eax
inc dword [ebp - 0x1b28d26d]
xor byte [ecx], dl
mov dword [ebp - 0x2a394c59], ebx
not esi
adc dword [0x2130f40e], ebp
push ebx
invalid
Function at 0x5d5354
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
div dword [ecx*8 + 0x32d59560]
aad 0x7b
inc edi
xor dl, ch
jnp 0x5d53a7
salc
push 0x26
jne 0x5d535c
mov al, byte [0x5f67091c]
xchg ebx, eax
out 0x35, eax
xor al, 0x43
invalid
xchg ebp, eax
xchg ebx, eax
aad 0xde
ficomp word [eax - 0x16e619eb]
push ecx
cmpsb byte [esi], byte es:[edi]
in al, 0xc9
je 0x5d540e
dec ecx
invalid
sbb edx, ebp
and esi, 0x7b
pop esp
cmp al, 0x97
sub byte [0x974238d2], bh
ficomp dword [ebx - 0x27b50b36]
push cs
mov esp, 0xfcc77335
or esi, dword [edi + 0x4e]
cmp eax, 0x7bae15f5
ljmp 0xc4c7
mov dl, cl
test dword [edx], 0xe4f4b5a9
enter 0xffffffffffffb516, 0xfffffffffffffff3
into
mov eax, 0x934c212d
and ch, 0x65
and dword [ebx + edx*4 - 0x7e], ecx
in eax, 0x65
loop 0x5d5477
cmpsd dword [esi], dword es:[edi]
ja 0x5d5437
xor al, 0x94
cmc
cwde
ja 0x5d53d2
and al, 0x9a
xlatb
invalid
invalid
cmp al, byte [edi + 0x55]
push ebp
pop es
inc esi
pop ecx
ja 0x5d5445
aam 0xbb
add esi, dword [edi + 0x54]
cdq
jns 0x5d547c
mov edi, 0xd1e166f0
nop
stosd dword es:[edi], eax
movsb byte es:[edi], byte [esi]
jbe 0x5d5481
jbe 0x5d54d1
xchg esi, eax
sub esp, dword [ebx]
lodsd eax, dword [esi]
mov dword [0x93482ea1], eax
int1
mov dword cs:[0x21a83f60], eax
scasb al, byte es:[edi]
aam 0x8e
mov byte [esi - 0x69], bl
mov bl, 0xe5
jge 0x5d541e
in eax, 0x7d
movsb byte es:[edi], byte [esi]
adc ebx, 0xc67168b1
sal dword [ecx + 0x50c67168], cl
push eax
test dword [edx - 0x2c], ebx
ffree st(3)
push ebp
js 0x5d5501
push cs
sub ch, dh
rcr byte [edi], cl
ficomp word [esi + 0x70210506]
inc eax
and eax, 0x454c17e4
adc eax, 0xa22445ca
xlatb
mov ebp, es
daa
add eax, dword [edi + 0x46]
xor eax, 0xe5371486
pop ss
and al, 0xd9
ja 0x5d5443
ficomp word [ecx + 0x14]
invalid
adc al, 0xf
out 0xf7, eax
xchg edi, eax
dec edx
inc ecx
invalid
push ecx
sbb dh, byte [ebx + 0x17c833d1]
dec edx
mov word [esi + 0x21753b2], cs
inc edi
and eax, 0x1105587
xchg edx, eax
and ch, byte [ebx]
pop ds
xchg ebp, ebx
xor al, 0x1d
jne 0x5d54ea
xlatb
push 0xffffffffffffffc0
into
idiv dword [esi + edi - 0x3c2a14e0]
call 0x7d797a22
xchg edi, eax
mov ch, 0x47
loopne 0x5d5510
xchg ebp, eax
int1
scasb al, byte es:[edi]
lcall 0xf82c, 0x3aa2b913
in eax, dx
add eax, 0xe655456c
jp 0x5d54b5
inc edi
push 0x8114df3d
retf 0xd0db
Function at 0x6006bf
Capabilities:
Check for vm using instruction vpcext

Disassembly:
cwde
xchg edx, eax
and edx, dword [esi + 0x42]
and byte [edi + ecx*8], dl
xchg esi, eax
xchg edx, eax
invalid
or eax, 0x9730e681
mov eax, dword [0xdbb40b5d]
xchg edi, eax
jo 0x600617
fist dword [edi + 0xbb0d770]
xlatb
mov al, 0xb
sub ch, al
push ebp
xchg edi, eax
bound esp, qword [ebx + esi*8 - 0x50]
jno 0x600684
dec ecx
test byte [0xeb4ff5fb], bh
mov bh, 3
jmp 0x600633
pop ebp
add eax, 0x17060b6f
pop ss
mov dl, byte cs:[edi - 0x2009a2f9]
jecxz 0x6006c5
xor al, 0x37
cmpsd dword [esi], dword es:[edi]
test eax, 0xdb85866b
jne 0x60063f
pop ebx
stc
mov ebx, 0x3bb456c7
add eax, 0xa3bbbdeb
ret 0x882a
mov dword [edi], 0x41d897a1
salc
inc ebp
in al, dx
outsb dx, byte [esi]
out 0x22, al
xchg dword [edx - 0x2b], eax
and ecx, esi
cwde
add al, 0xa6
jmp 0x60063c
mov eax, 0xf989ff5a
scasb al, byte es:[edi]
jbe 0x60073e
dec esi
loopne 0x600668
mov dword [ebp + 0x2bad05e6], ecx
pop eax
fiadd word [ebx - 0x41]
pop ds
jns 0x6006f0
and edx, dword [0x2bb68bb0]
jl 0x6006c4
scasb al, byte es:[edi]
push 0x25
mov eax, 0x23718948
cmp al, dh
xchg ebp, eax
fcomi st(4)
mul dword [edx + 0x7c]
sbb esi, dword [ebx - 0x58]
jae 0x60069a
inc ebp
invalid
xchg edi, eax
mov ch, 0xba
add eax, 0x766317f5
or ecx, dword [ecx + 0x52]
sbb bh, bh
mov edx, 0x8e638d25
jge 0x60074f
invalid
xchg esp, eax
pop ds
movsb byte es:[edi], byte [esi]
and dword [ecx + 0x22b90673], ebx
lodsd eax, dword [esi]
cmc
bound ecx, qword [edi + 0x307798c8]
and ebp, esi
invalid

Function at 0x659a0d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6623a8
cmp edx, dword [eax]
je 0x659a2f
add eax, 8
inc ecx
cmp eax, 0x662438
jl 0x659a20
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6623a8]
jne 0x659b5d
mov eax, dword [0xa5cd0c]
cmp eax, 1
je 0x659b37
test eax, eax
jne 0x659a60
cmp dword [0x6622d4], 1
je 0x659b37
cmp edx, 0xfc
je 0x659b5d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659a97
lea eax, [ebp - 0x1a4]
push 0x65eaa8
push eax
call fcn.0065a3f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a880
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659ada
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a880
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65eaa4
push edi
call fcn.0065c750
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65ea88
push eax
call fcn.0065a3f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a400
lea eax, [ebp - 0xa0]
push 0x65ea84
push eax
call fcn.0065a400
push dword [esi + 0x6623ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a400
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65ea5c
push eax
call fcn.0065c6c4
add esp, 0x2c
pop edi
jmp 0x659b5d
lea eax, [ebp + 8]
lea esi, [esi + 0x6623ac]
push 0
push eax
push dword [esi]
call fcn.0065a880
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x409b70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x408015
lea edi, [esi - 0x7015]
push edi
or ebp, 0xffffffff
jmp 0x409b92
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x409b99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x409b88
mov eax, 1
add ebx, ebx
jne 0x409bab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x409ba0
jne 0x409bbc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x409ba0
xor ecx, ecx
sub eax, 3
jb 0x409bd0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x409c42
mov ebp, eax
add ebx, ebx
jne 0x409bdb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x409be8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x409c0c
inc ecx
add ebx, ebx
jne 0x409bf8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x409bed
jne 0x409c09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x409bed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x409c2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x409c1d
jmp 0x409b8e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x409c2c
add edi, ecx
jmp 0x409b8e
pop esi
mov edi, esi
mov ecx, 0x1f4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x409c4a
cmp byte [edi], 4
jne 0x409c4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x409c4f
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x409cbe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9080]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x409c7c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9088]
or eax, eax
je 0x409cb8
mov dword [ebx], eax
add ebx, 4
jmp 0x409c99
call dword [esi + 0x9084]
mov ebp, dword [esi + 0x908c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x409cf2
sub esp, 0xffffff80
jmp 0x404cec
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x30db63cc
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x308b79cc
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401d50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.004031f0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret

Function at 0x402450
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jne 0x402463
xor al, al
jmp 0x402495
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402210
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x402493
xor eax, eax
cmp dword [ebp - 4], 0
setne al
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov al, 1
jmp 0x402495
xor al, al
mov esp, ebp
pop ebp
ret 8

Function at 0x41480e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44eca0]
jne 0x414818
repz ret
jmp fcn.0041a6bb

Function at 0x424c90
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041ba7f
and dword [ebp - 4], 0
cmp dword [0x452c28], 0
mov ebx, eax
jne 0x424d41
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x424df2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x424df2
push eax
call fcn.0041ba0d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x452c28], eax
call esi
push eax
call fcn.0041ba0d
mov dword [esp], 0x43fb18
push edi
mov dword [0x452c2c], eax
call esi
push eax
call fcn.0041ba0d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x452c30], eax
call esi
push eax
call fcn.0041ba0d
pop ecx
mov dword [0x452c38], eax
test eax, eax
je 0x424d41
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041ba0d
pop ecx
mov dword [0x452c34], eax
mov eax, dword [0x452c34]
cmp eax, ebx
je 0x424d99
cmp dword [0x452c38], ebx
je 0x424d99
push eax
call fcn.0041ba88
push dword [0x452c38]
mov esi, eax
call fcn.0041ba88
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x424d99
test edi, edi
je 0x424d99
call esi
test eax, eax
je 0x424d90
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x424d90
test byte [ebp - 0xc], 1
jne 0x424d99
or dword [ebp + 0x10], 0x200000
jmp 0x424dd2
mov eax, dword [0x452c2c]
cmp eax, ebx
je 0x424dd2
push eax
call fcn.0041ba88
pop ecx
test eax, eax
je 0x424dd2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x424dd2
mov eax, dword [0x452c30]
cmp eax, ebx
je 0x424dd2
push eax
call fcn.0041ba88
pop ecx
test eax, eax
je 0x424dd2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x452c28]
call fcn.0041ba88
pop ecx
test eax, eax
je 0x424df2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x424df4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b070
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439388
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x44eca0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], 8
lea ecx, [ebp - 0x30]
call fcn.00405120
mov dword [ebp - 4], 0
push 0
mov eax, dword [ebp - 0x38]
push eax
lea ecx, [ebp - 0x30]
call fcn.004051e0
mov ecx, dword [ebp - 0x38]
shl ecx, 2
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 1
mov byte [ebp - 0xd], 1
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x42b144
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
push 0
lea ecx, [ebp - 0x30]
call fcn.004052c0
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x42b130
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x34]
jb 0x42b121
mov eax, dword [ebp - 0x38]
shl eax, 1
mov dword [ebp - 0x38], eax
push 0
mov ecx, dword [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x30]
call fcn.004051e0
mov edx, dword [ebp - 0x38]
shl edx, 2
mov dword [ebp - 0x34], edx
jmp 0x42b12e
mov eax, dword [ebp - 0x18]
shr eax, 2
mov dword [ebp - 0x38], eax
mov byte [ebp - 0xd], 0
jmp 0x42b142
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x14], 0
jmp 0x42b0d4
cmp dword [ebp - 0x14], 0
je 0x42b183
mov ecx, dword [ebp + 8]
call fcn.00405370
mov dword [ebp - 0x3c], 0
jmp 0x42b164
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x38]
jae 0x42b183
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x30]
call fcn.004052c0
push eax
mov ecx, dword [ebp + 8]
call fcn.004052f0
jmp 0x42b15b
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00405190
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42b1b0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43942c
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x44eca0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 1
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
lea ecx, [ebp - 0x14]
call fcn.0042b000
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401da0
movzx ecx, al
test ecx, ecx
je 0x42b32c
lea ecx, [ebp - 0x38]
call fcn.00404fa0
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x3c]
push edx
push 4
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.0042afe0
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x42b2f8
movzx ecx, byte [ebp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 0xe4
add ecx, 0x20
mov dword [ebp - 0x40], ecx
push 0
mov edx, dword [ebp - 0x40]
push edx
lea ecx, [ebp - 0x38]
call fcn.00405030
cmp dword [ebp - 0x18], 0
je 0x42b2f8
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x42b29d
mov ecx, dword [ebp - 0x40]
push ecx
push 0
lea ecx, [ebp - 0x38]
call fcn.004050f0
push eax
mov edx, dword [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x14]
call fcn.0042afe0
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
mov dword [ebp - 0x20], eax
jmp 0x42b2c1
mov eax, dword [ebp - 0x40]
push eax
push 0
lea ecx, [ebp - 0x38]
call fcn.004050f0
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0042afe0
push eax
call sub.PSAPI.DLL_GetModuleBaseNameW
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x40]
jb 0x42b2f1
mov eax, dword [ebp - 0x40]
shl eax, 1
mov dword [ebp - 0x40], eax
push 0
mov ecx, dword [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x38]
call fcn.00405030
cmp dword [ebp - 0x20], 0x104
jbe 0x42b2ef
mov dword [ebp - 0x18], 0
jmp 0x42b2f3
jmp 0x42b2f8
jmp 0x42b265
cmp dword [ebp - 0x20], 0
ja 0x42b305
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 1
jne 0x42b31e
push 0
lea ecx, [ebp - 0x38]
call fcn.004050f0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004027b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00405010
jmp 0x42b333
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0
jne 0x42b341
mov ecx, dword [ebp + 0xc]
call fcn.00403100
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x44], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0042b030
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42b560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43990b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x44eca0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call fcn.00402670
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x10]
call fcn.004031b0
push eax
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00403220
cmp dword [ebp - 0x14], 0
jne 0x42b5de
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402790
push str.AdobeARM1.0AdobeARM.exe
mov ecx, dword [ebp + 8]
call fcn.004027f0
jmp 0x42b628
push str.SHGetFolderPath_in_GetARMExePath_failed:
lea ecx, [ebp - 0x18]
call fcn.00402690
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
push 1
call fcn.00437fa0
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00407a70
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407a70
mov eax, dword [ebp - 0x1c]
jmp 0x42b641
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407a70
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x42b810
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0x452d50], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x452d58], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x452d54], edx
mov dword [0x452d68], 0
push 0
push 0
push 0
push 0x42b760
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x42b970
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x44eca0]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov ecx, 0x20
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea edi, [ebp - 0x90]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], 0
mov dword [ebp - 0x94], 0
cmp dword [ebp - 0x94], 8
jae 0x42bb0d
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x94]
movzx ecx, byte [eax]
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x94]
add edx, 1
mov dword [ebp - 0x94], edx
cmp dword [ebp - 0x94], 8
jae 0x42ba04
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x94]
movzx ecx, byte [eax]
mov dword [ebp - 0xa4], ecx
mov edx, dword [ebp - 0x94]
add edx, 1
mov dword [ebp - 0x94], edx
jmp 0x42ba0e
mov dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0x94], 8
jae 0x42ba46
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x94]
movzx edx, byte [ecx]
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0x94]
add eax, 1
mov dword [ebp - 0x94], eax
jmp 0x42ba50
mov dword [ebp - 0xa8], 0
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0x98]
shr edx, 2
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dx, word [ebp + edx*2 - 0x90]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xa0]
shr ecx, 4
mov edx, dword [ebp - 0x98]
and edx, 3
shl edx, 4
or ecx, edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov cx, word [ebp + ecx*2 - 0x90]
mov word [edx + eax*2], cx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x9c]
shr eax, 6
mov ecx, dword [ebp - 0xa0]
and ecx, 0xf
shl ecx, 2
or eax, ecx
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov ax, word [ebp + eax*2 - 0x90]
mov word [ecx + edx*2], ax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x9c]
and edx, 0x3f
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dx, word [ebp + edx*2 - 0x90]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x42b9aa
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, 0x3d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov word [ecx + eax*2], dx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov word [edx + ecx*2], ax
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041480e
mov esp, ebp
pop ebp
ret