joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409d00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x208
push eax
push 0x554272
push 0x554530
call fcn.00403e20
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x409d4f
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push esi
push 0x554554
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov edi, eax
jmp 0x409d93
lea eax, [ebp - 4]
push eax
push str.AcroDist_shellopencommand
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x409dcf
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push esi
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push 0x5545a4
push esi
mov edi, eax
call fcn.00528759
add esp, 8
test eax, eax
je 0x409d93
xor ecx, ecx
mov word [eax], cx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x409dcf
cmp word [esi], 0x22
jne 0x409dd9
lea ecx, [esi + 2]
mov edx, esi
sub edx, ecx
lea ecx, [ecx]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x409db0
push 0x22
push esi
call fcn.005286ab
add esp, 8
test eax, eax
jne 0x409deb
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
push str.___1_
push esi
call fcn.00528759
add esp, 8
test eax, eax
je 0x409df0
xor ecx, ecx
mov word [eax], cx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x409e00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x554d28
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409e6d
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
push 0
push str.iEntitlementLevel
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409e67
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jne 0x409e67
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x40a100
Capabilities:
Create thread
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540f8b
mov eax, dword fs:[0]
push eax
sub esp, 0x49c
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x48c]
mov edi, dword [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x40a19d
lea eax, [ebp - 0x490]
push eax
push 0x555124
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40a1a4
push 4
lea eax, [ebp - 0x494]
mov dword [ebp - 0x494], 1
push eax
push 4
push 0
push esi
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push 0x1388
push 0x9003
push edi
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x40a2b2
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x4a8]
call fcn.00411b08
mov dword [ebp - 4], 0
lea eax, [ebp - 0x23c]
push 0
xorps xmm0, xmm0
push eax
push esi
movlpd qword [ebp - 0x23c], xmm0
movlpd qword [ebp - 0x234], xmm0
movlpd qword [ebp - 0x22c], xmm0
call fcn.004153cb
mov eax, dword [ebp - 0x224]
or eax, dword [ebp - 0x220]
jne 0x40a24d
push eax
push esi
call fcn.004122fd
lea eax, [ebp - 0x494]
push eax
push 0x5551d4
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40a2a0
push 4
lea eax, [ebp - 0x490]
mov dword [ebp - 0x490], 1
push eax
push 4
push 0
push esi
push dword [ebp - 0x494]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push 0x1388
push 0x9003
push edi
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x40a2a0
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a252
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, eax
test edx, edx
je 0x40a2a0
mov ecx, edx
sub ecx, esi
jmp 0x40a280
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x40a280
push edx
push 0
push 0x40a2d0
call fcn.00528d95
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4a8]
call fcn.00411b7e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret

Function at 0x40a4b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x5a927c], 0
je 0x40a4d2
mov dword [0x5a9278], 1
mov dword [0x5a9274], 1
pop ebp
ret
pop ebp
jmp fcn.0040c190
Function at 0x40abb0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x41c]
push eax
push 0x5552cc
push 0x5552dc
mov esi, 2
call fcn.00403e20
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40adbb
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00525b40
add esp, 0xc
mov dword [ebp - 0x420], 0x208
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], 1
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push 0
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x40ac64
mov eax, dword [str.ADIST.dll]
mov dword [ecx], eax
mov eax, dword [0x555304]
mov dword [ecx + 4], eax
mov eax, dword [0x555308]
mov dword [ecx + 8], eax
mov eax, dword [0x55530c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x555310]
mov dword [ecx + 0x10], eax
mov ax, word [0x555314]
mov word [ecx + 0x14], ax
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00406b50
mov ebx, eax
test ebx, ebx
je 0x40ada8
push str.GetSaveFileName32
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ada1
push 1
push 1
push dword [edi + 0x418]
push edi
call eax
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x418]
push eax
push str.PrinterJobControl_
push str.SOFTWAREAdobeAcrobat_Distiller_
call fcn.00403f40
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40ad9c
push 0xa
lea eax, [ebp - 0x414]
push eax
push dword [edi + 0x410]
call fcn.00528aca
add esp, 0xc
test esi, esi
je 0x40ad6b
mov ecx, edi
lea edx, [ecx + 2]
jmp 0x40ad30
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ad30
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edi
push 1
push 0
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ada1
push 0x10
push str._ABORT_
push 1
push 0
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
mov esi, 0x3f
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ada1
mov esi, 5
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
Function at 0x40add0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
xor esi, esi
push eax
push 0x20019
push esi
push str.Installer
push 0x555150
call fcn.00403f40
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40af00
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00525b40
add esp, 0xc
mov dword [ebp - 0x214], 0x208
lea eax, [ebp - 0x214]
mov dword [ebp - 0x218], esi
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push str.ENU_GUID
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40aef4
lea eax, [ebp - 0x20c]
push str._7760_
push eax
call fcn.00528759
add esp, 8
test eax, eax
je 0x40ae93
mov esi, 0x76
jmp 0x40aef4
lea eax, [ebp - 0x20c]
push str._BA7E_
push eax
call fcn.00528759
add esp, 8
test eax, eax
je 0x40aeb2
mov esi, 0x10
jmp 0x40aef4
lea eax, [ebp - 0x20c]
push str._7761
push eax
call fcn.00528759
add esp, 8
test eax, eax
je 0x40aed1
mov esi, 0x17c
jmp 0x40aef4
lea eax, [ebp - 0x20c]
push str._3479_
push eax
call fcn.00528759
add esp, 8
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x134
add esi, 0x47
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
Function at 0x40c110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push ebx
push eax
push 0x20019
push 0
push str.SOFTWAREAdobeAdobe_AcrobatDCAVEntitlement
push SysReAllocString
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c17c
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
push 0
push str.bZHCNLocale
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c17c
mov ecx, 1
movzx eax, bl
cmp dword [ebp - 4], ecx
pop ebx
cmove eax, ecx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c7a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 2
je 0x40c7f0
sub eax, 0xc7
jne 0x40c7fb
cmp dword [ebp + 0x14], 1
jne 0x40c7fb
push eax
push eax
push 0x147
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push eax
push 0x150
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x40c7fb
test eax, eax
je 0x40c7fb
push eax
push dword [ebp + 8]
call fcn.0040bbe0
add esp, 8
pop ebp
ret
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret

Function at 0x40c850
Capabilities:
Create process on windows

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, 0x5a94a8
push 0
call fcn.0040f790
mov esi, dword [edi + 0xc]
test esi, esi
je 0x40c8cb
cmp word [esi], 0
je 0x40c8ab
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push 0
push esi
push str.notepad.exe
push 0
push 0
call ebx
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c890
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2]
add esi, 2
cmp word [esi], cx
jne 0x40c874
pop ebx
push dword [edi + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
pop edi
pop esi
ret
Function at 0x40cfb0
Capabilities:
Delete registry key

Disassembly:
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [0x5a9258]
cmp esi, eax
je 0x40cfe7
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.00408ac0
add esp, 4
mov dword [0x5a9258], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x5a9258]
jmp 0x40cff5
push eax
call fcn.00408ac0
add esp, 4
mov dword [0x5a9258], eax
cmp esi, eax
pop esi
je 0x40d04a
mov eax, dword [0x5a925c]
test eax, eax
je 0x40d04a
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40d04a
push dword [0x5a925c]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x40d04a
push eax
push eax
push 0x12
push dword [0x5a925c]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [0x5a925c]
call dword [sym.imp.USER32.dll_DestroyWindow]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x5a925c], 0
call fcn.0040dd20
call fcn.0040c8d0
jmp 0x40d150
push str.Folder_shellAdobeAcrobatMenuCommand
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.Folder_shellAdobeAcrobatMenu
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret

Function at 0x40d750
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54110b
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x5a928c], 0
jne 0x40d85c
push 0x20019
push 0x554f14
push 0x554f30
mov byte [0x5a928c], 1
call fcn.00403f40
add esp, 8
lea ecx, [ebp - 0x224]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00407cf0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 0x208
push eax
push 0
push 0
lea ecx, [ebp - 0x224]
call fcn.00408230
test eax, eax
je 0x40d84a
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d7f4
sub ecx, edx
sar ecx, 1
je 0x40d84a
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40d810
lea eax, [ebp - 0x218]
mov ecx, 0x14
mov esi, str.plug_insTest_ToolsFeatMonitorApp.exe
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
movzx ecx, byte [0x5a3128]
xor edx, edx
cmp eax, 0xffffffff
cmovne ecx, edx
mov byte [0x5a3128], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.00407da0
mov al, byte [0x5a3128]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
Function at 0x40d880
Capabilities:
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 1
push 0
push 0
push dword [ebp + 0xc]
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x40d8f5
add eax, 0xfffffffe
cmp eax, 1
ja 0x40d8f5
lea eax, [ebp - 8]
push eax
push 0x5550dc
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40d8f5
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 4
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push 0x1f4
push 0x9002
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetTimer]
mov esp, ebp
pop ebp
ret
Function at 0x40eac0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0040eab0
test al, al
jne 0x40ebf6
call fcn.00402f60
test al, al
jne 0x40ebf6
push ebx
push esi
lea ecx, [ebp - 0x20c]
mov esi, str.SOFTWAREPoliciesAdobeAdobe_Acrobat_
mov eax, ecx
xor bl, bl
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40eb23
movzx eax, word [esi + ecx]
test ax, ax
je 0x40eb23
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x40eb05
jmp 0x40eb27
test edx, edx
jne 0x40eb2a
sub ecx, 2
xor eax, eax
push 0x554ea8
mov word [ecx], ax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00402170
push str.FeatureLockDown
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00402170
lea eax, [ebp - 0x210]
mov dword [ebp - 0x218], 4
push eax
push 1
push 0
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x21c], 4
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ebe4
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push str.bAcroSuppressUpsell
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ebd8
cmp dword [ebp - 0x214], 0
mov eax, 1
movzx ebx, bl
cmovne ebx, eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
Function at 0x40ee20
Capabilities:
Check os version
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5411bb
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 1
call fcn.00401ee0
add esp, 4
test eax, eax
je 0x40ee65
xor eax, eax
jmp 0x40ef9a
mov esi, dword [ebp + 0x10]
push edi
mov dword [0x5a9254], esi
call fcn.00408ac0
mov dword [0x5a9258], eax
add esp, 4
mov eax, 0x554da8
mov cx, word [esi]
cmp cx, word [eax]
jne 0x40eea7
test cx, cx
je 0x40eea3
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x40eea7
add esi, 4
add eax, 4
test cx, cx
jne 0x40ee81
xor ecx, ecx
jmp 0x40eeac
sbb ecx, ecx
or ecx, 1
xor eax, eax
test ecx, ecx
push 0x110
sete al
mov dword [0x5a927c], eax
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00525b40
add esp, 0xc
mov dword [ebp - 0x124], 0x114
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 6
sbb eax, eax
inc eax
mov dword [0x5a9280], eax
je 0x40ef1b
push str.User32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40ef1b
push 0x554e24
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ef1b
push 1
push 0x4a
call eax
push 0x20019
push 0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x12c]
call fcn.00407cf0
mov dword [ebp - 4], 0
push 0
call fcn.0040a5f0
add esp, 4
mov dword [0x5a9268], eax
mov ecx, 0x5a9254
call fcn.0040bb50
test eax, eax
je 0x40ef84
push 0
push 0
push 0x408970
call fcn.00528d95
add esp, 0xc
cmp eax, 0xffffffff
je 0x40ef84
mov ecx, 0x5a9254
call fcn.0040d060
mov ecx, 0x5a9254
call fcn.0040a510
mov esi, eax
jmp 0x40ef86
xor esi, esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.00407da0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40f0d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
push 0x10
mov ebx, ecx
mov ecx, 0x5a9254
push 0x68
call fcn.0040c760
push 0x10
push 0x67
mov ecx, 0x5a9254
mov dword [ebx + 0x3d0], eax
mov dword [ebx + 0x28], eax
call fcn.0040c760
mov dword [ebx + 0x3d4], eax
lea edi, [ebx + 0x3dc]
mov eax, dword [ebx + 0x3d0]
mov esi, 2
mov dword [ebx + 0x3d8], eax
lea ecx, [ecx]
push 0x10
lea eax, [esi + 0x67]
mov ecx, 0x5a9254
push eax
call fcn.0040c760
inc esi
mov dword [edi], eax
lea edi, [edi + 4]
cmp esi, 6
jl 0x40f120
push 0x30
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.00525b40
mov eax, dword [0x5a9258]
add esp, 0xc
mov ecx, 0x5a9254
mov dword [ebp - 0x3c], 0x30
mov dword [ebp - 0x34], 0x410230
mov dword [ebp - 0x28], eax
push 0x20
push 0x68
mov dword [ebp - 0x14], 0x555444
call fcn.0040c760
push 0x10
push 0x68
mov ecx, 0x5a9254
mov dword [ebp - 0x24], eax
call fcn.0040c760
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0040ed40
test ax, ax
jne 0x40f1a3
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push dword [ebp - 0x28]
push 0
push 0
push 0
push 0
push 0
push 0
push SysReAllocString
push 0x555464
push str.AcrobatTrayIcon
push 0
call fcn.00410480
mov ecx, eax
mov dword [ebx], ecx
test ecx, ecx
je 0x40f198
mov eax, dword [ebp + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x3d0]
mov dword [ebx + 0x28], eax
lea eax, [ebx + 0x2c]
push 0x100
push eax
mov dword [ebx + 0x18], ecx
mov ecx, 0x5a9254
push 0x8f
call fcn.0040c780
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x5554a4
push 0x5554a8
call fcn.00403e20
add esp, 8
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40f2ca
cmp dword [0x5a927c], eax
je 0x40f2ad
mov dword [ebp + 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
push 0
push 0x5554cc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40f27c
call fcn.0040f2e0
test eax, eax
jne 0x40f27c
push eax
push 0xf
call fcn.0040c490
add esp, 8
jmp 0x40f2c1
push 0
push 0xf
mov dword [ebp + 8], 1
call fcn.0040c490
add esp, 8
test eax, eax
je 0x40f2c1
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push 0x5554e8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x40f2c1
push 0
push 0x927c0
push 0x900a
push dword [ebx]
call dword [sym.imp.USER32.dll_SetTimer]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40f630
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x40f661
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret
push 0
push str.TrayNotifyWnd
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x40f651
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x40f651
push edi
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
mov edi, eax
push 1
sar edi, 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
mov ecx, 2
sub eax, edx
xor edx, edx
sar eax, 1
cmp dword [ebp - 8], eax
cmovl edx, ecx
xor ecx, ecx
cmp dword [ebp - 0x14], edi
pop edi
setl cl
or edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, edx
call fcn.00525b2c
mov esp, ebp
pop ebp
ret