joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440930
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4fbf8c], 0
jne 0x440b73
push 0x48
call fcn.0049d1bc
add esp, 4
mov dword [0x4fbf80], eax
test eax, eax
je 0x440984
push 0x1000
call fcn.0049d1bc
add esp, 4
mov dword [0x4fbf84], eax
test eax, eax
jne 0x44098c
push dword [0x4fbf80]
call fcn.0049675d
add esp, 4
mov dword [0x4fbf80], 0
xor al, al
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xc
mov dword [0x4fbf88], 0
sub eax, 0x4d6214
mov dword [ebp - 8], eax
mov eax, 0x10
push esi
sub eax, 0x4d6214
xor esi, esi
push edi
mov dword [ebp - 4], eax
mov edi, 8
mov eax, 0x14
sub edi, 0x4d6214
sub eax, 0x4d6214
mov dword [ebp - 0xc], eax
nop dword [eax]
mov eax, dword [0x4fbf80]
lea edx, [edi + 0x4d6214]
mov ecx, dword [esi + 0x4d6210]
add edx, esi
mov dword [esi + eax], ecx
mov eax, dword [0x4fbf80]
mov ecx, dword [esi + 0x4d6214]
mov dword [esi + eax + 4], ecx
mov eax, dword [0x4fbf80]
mov ecx, dword [esi + 0x4d6218]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [esi + 0x4d621c]
lea edx, [eax + 0x4d6214]
mov eax, dword [0x4fbf80]
add edx, esi
mov dword [edx + eax], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [esi + 0x4d6220]
lea edx, [eax + 0x4d6214]
mov eax, dword [0x4fbf80]
add edx, esi
mov dword [edx + eax], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [esi + 0x4d6224]
lea edx, [eax + 0x4d6214]
mov eax, dword [0x4fbf80]
add edx, esi
add esi, 0x18
mov dword [edx + eax], ecx
cmp esi, 0x48
jl 0x4409d0
xor eax, eax
nop dword [eax]
mov esi, 0x100
nop word [eax + eax]
mov ecx, dword [0x4fbf84]
mov edx, dword [eax + 0x4d6280]
mov dword [eax + ecx], edx
add eax, 4
sub esi, 1
jne 0x440a70
cmp eax, 0x1000
jl 0x440a60
xor edi, edi
lea ecx, [esi + 0x24]
movzx eax, byte [esi + str.a7b863b0_61b0_4825_a7d4_d93c6a2fad6e]
mov byte [ebp - 1], al
lea eax, [esi + 1]
cdq
idiv ecx
movzx eax, byte [edx + str.a7b863b0_61b0_4825_a7d4_d93c6a2fad6e]
mov byte [ebp - 2], al
lea eax, [esi + 2]
cdq
idiv ecx
movzx eax, byte [edx + str.a7b863b0_61b0_4825_a7d4_d93c6a2fad6e]
mov byte [ebp - 3], al
lea eax, [esi + 3]
cdq
idiv ecx
mov ecx, dword [0x4fbf80]
movzx eax, byte [edx + str.a7b863b0_61b0_4825_a7d4_d93c6a2fad6e]
mov byte [ebp - 4], al
mov eax, dword [ebp - 4]
xor dword [ecx + edi], eax
lea eax, [esi + 4]
cdq
mov ecx, 0x24
idiv ecx
add edi, 4
mov esi, edx
cmp edi, 0x48
jl 0x440a93
mov dword [ebp - 8], 0
xor esi, esi
mov dword [ebp - 4], 0
nop
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00440450
mov ecx, dword [0x4fbf80]
mov eax, dword [ebp - 4]
mov dword [esi + ecx], eax
mov eax, dword [0x4fbf80]
mov ecx, dword [ebp - 8]
mov dword [esi + eax + 4], ecx
add esi, 8
cmp esi, 0x48
jl 0x440b00
xor esi, esi
nop
mov edi, 0x80
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00440450
mov ecx, dword [0x4fbf84]
mov eax, dword [ebp - 4]
mov dword [esi + ecx], eax
mov eax, dword [0x4fbf84]
mov ecx, dword [ebp - 8]
mov dword [esi + eax + 4], ecx
add esi, 8
sub edi, 1
jne 0x440b35
cmp esi, 0x1000
jl 0x440b30
pop edi
mov byte [0x4fbf8c], 1
pop esi
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4411c0
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4f6108]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x100
lea eax, [ebp - 0x308]
mov dword [ebp - 0x41c], ecx
push 0
push eax
call fcn.00493690
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x100
push 0
push eax
call fcn.00493690
add esp, 0xc
mov dword [ebp - 0x40c], 0x100
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x100
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.00493690
add esp, 0xc
lea eax, [ebp - 0x408]
push 0x100
push 0
push eax
call fcn.00493690
add esp, 0xc
mov dword [ebp - 0x418], 0x100
lea eax, [ebp - 0x414]
mov dword [ebp - 0x410], 0x100
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x308]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
push 1
push str.S__lu_
mov esi, eax
lea eax, [ebp - 0x108]
push 0x100
push eax
call fcn.00441500
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x418], eax
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4412d1
movzx eax, byte [esi + 5]
sub ecx, edx
push eax
mov eax, 0x100
sub eax, ecx
push 0x4e0784
push eax
lea eax, [ebp - 0x108]
add eax, ecx
push eax
call fcn.00441500
add dword [ebp - 0x418], eax
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
xor esi, esi
movzx ebx, byte [eax]
test ebx, ebx
je 0x44135b
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
nop
push esi
lea eax, [ebp - 0x208]
push eax
call edi
mov ecx, dword [ebp - 0x418]
push dword [eax]
mov eax, 0x100
sub eax, ecx
push str.__lu
push eax
lea eax, [ebp - 0x108]
add eax, ecx
push eax
call fcn.00441500
add dword [ebp - 0x418], eax
inc esi
add esp, 0x10
cmp esi, ebx
jl 0x441320
push ecx
lea eax, [ebp - 0x108]
push eax
push ecx
mov ecx, dword [ebp - 0x41c]
call fcn.004403f0
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047ac53
mov esp, ebp
pop ebp
ret
Function at 0x4466b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be9e6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4f6108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0047a764
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0047939b
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x449930
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2d93
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4f6108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x4fba58
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x4fba58
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x4dc102
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00448860
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x449bb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
jne 0x449c0a
cmp byte [esi + 0x2c], bl
jne 0x449c01
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x449be0
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x34]
call fcn.00448860
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov edi, dword [esi + 0x18]
test edi, edi
je 0x449c20
mov ecx, edi
mov edi, dword [edi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test edi, edi
jne 0x449c11
push 2
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push 0
push ebx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
call fcn.004a5ecc
push ebx
call fcn.004a643e
push 0
mov edi, eax
push 0
push ebx
mov dword [ebp + 8], edi
call fcn.004a5ecc
add esp, 0x1c
test edi, edi
jg 0x449c8c
cmp byte [esi + 0x2c], 0
jne 0x449c01
mov edx, dword [str.Error_document_empty.]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 0xc
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x449c80
jmp 0x449be7
lea eax, [edi + 1]
push eax
call fcn.0047b1ad
push ebx
mov ebx, dword [ebp + 8]
mov edi, eax
push 1
push ebx
push edi
mov byte [edi], 0
call fcn.004a6615
add esp, 0x14
cmp eax, 1
je 0x449ce4
push edi
call fcn.0047ad4b
add esp, 4
cmp byte [esi + 0x2c], 0
jne 0x449c01
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x449cd8
jmp 0x449be7
mov byte [edi + ebx], 0
mov eax, edi
cmp byte [edi], 0
mov ecx, edi
je 0x449d0f
mov dl, byte [eax]
mov ebx, eax
cmp dl, 0xd
jne 0x449d06
inc eax
mov byte [ecx], 0xa
cmp byte [eax], 0xa
cmovne eax, ebx
jmp 0x449d08
mov byte [ecx], dl
inc eax
inc ecx
cmp byte [eax], 0
jne 0x449cf1
mov byte [ecx], 0
mov ecx, esi
mov eax, dword [esi]
push 0
push 0
push edi
call dword [eax + 8]
push edi
call fcn.0047ad4b
add esp, 4
cmp byte [esi + 0x2c], 0
sete al
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x44f300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
je 0x44f35f
mov dword [edi], 0
mov edx, 0x400000
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
cmp esi, 0x400000
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x44f368
test ecx, ecx
je 0x44f35f
mov ecx, dword [ebp - 4]
mov edx, 0x400000
test esi, esi
jne 0x44f320
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44f5b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
push ebx
push esi
push edi
nop dword [eax + eax]
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x4fca80], ecx
inc eax
cmp eax, 0x100
jb 0x44f5c0
cmp eax, 0x800
jae 0x44f693
nop dword [eax]
mov edx, dword [eax*4 + 0x4fc680]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x4fca80]
mov dword [eax*4 + 0x4fca80], edx
inc eax
cmp eax, 0x800
jb 0x44f670
lea ecx, [ebp - 0x20]
mov dword [0x4fbfa8], 0x4502c0
call fcn.004503c0
test eax, eax
je 0x44f74c
mov edi, dword [ebp - 0x10]
xor ecx, ecx
mov esi, edi
mov eax, 0x4f6c48
shr esi, 8
shr edi, 4
and esi, 0xff00f
and edi, 0xf00f
xor edx, edx
nop dword [eax]
mov ebx, dword [ebp - 0x1c]
cmp dword [eax - 8], ebx
jne 0x44f6e7
mov ebx, dword [ebp - 0x18]
cmp dword [eax - 4], ebx
mov ebx, dword [ebp - 0x14]
jne 0x44f6e7
cmp dword [eax], ebx
je 0x44f6f6
add edx, 0xc
inc ecx
add eax, 0xc
cmp edx, 0x24
jb 0x44f6d0
or ecx, 0xffffffff
sub ecx, 0
je 0x44f733
sub ecx, 1
je 0x44f722
sub ecx, 1
jne 0x44f74c
cmp esi, 6
jb 0x44f74c
jne 0x44f742
cmp edi, 0xf
jb 0x44f74c
mov dword [0x4fbfa8], 0x450360
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 5
jb 0x44f74c
jne 0x44f742
cmp edi, 6
jb 0x44f74c
cmp edi, 0xa
jmp 0x44f740
cmp esi, 6
jb 0x44f74c
jne 0x44f742
cmp edi, 0x100c
je 0x44f74c
mov dword [0x4fbfa8], 0x450360
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4520a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov eax, dword [eax]
and eax, 7
cmp edx, 5
jae 0x4520c0
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
add edx, 0xfffffffc
or ebx, 0xffffffff
add edx, ecx
push esi
mov dword [ebp - 8], edx
nop dword [eax]
lea esi, [edi + ecx]
cmp esi, edx
jae 0x4520e9
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x4520e6
inc esi
cmp esi, edx
jb 0x4520d7
mov ecx, dword [ebp - 4]
mov edi, esi
sub edi, ecx
mov ecx, edi
sub ecx, ebx
cmp esi, edx
jae 0x4521f9
cmp ecx, 3
jbe 0x452128
xor eax, eax
mov cl, byte [esi + 4]
mov ebx, edi
mov dword [ebp - 0x10], ebx
test cl, cl
je 0x452166
cmp cl, 0xff
je 0x452166
mov edx, dword [ebp - 8]
and eax, 3
add eax, eax
mov ecx, 1
or eax, 1
add edi, ecx
mov ecx, dword [ebp - 4]
jmp 0x4520d0
dec ecx
shl eax, cl
and eax, 7
je 0x452100
movzx ecx, byte [eax + 0x4d9a18]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x4d9a10], 0
mov cl, byte [edx + 4]
je 0x452150
test cl, cl
je 0x452150
cmp cl, 0xff
jne 0x452100
mov edx, dword [ebp - 8]
and eax, 3
mov ecx, dword [ebp - 4]
add eax, eax
mov ebx, edi
or eax, 1
inc edi
jmp 0x4520d0
movzx edx, cl
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
sub edx, edi
lea ebx, [edx - 5]
test eax, eax
je 0x4521c2
movzx edx, byte [eax + 0x4d9a18]
mov ecx, 0x18
shl edx, 3
sub ecx, edx
mov dword [ebp - 0xc], edx
mov edx, ebx
shr edx, cl
test dl, dl
je 0x4521ae
cmp dl, 0xff
jne 0x4521c2
mov ecx, 0x20
mov edx, 1
sub ecx, dword [ebp - 0xc]
shl edx, cl
dec edx
xor edx, ebx
jmp 0x452184
mov edx, dword [ebp - 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
mov byte [esi + 1], bl
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
mov ebx, dword [ebp - 0x10]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
add edi, ecx
mov ecx, dword [ebp - 4]
jmp 0x4520d0
pop esi
pop ebx
cmp ecx, 3
jbe 0x45220e
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 7
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x452ff0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
cmp dword [eax - 0xc], 0
jne 0x453001
xor ebx, ebx
jmp 0x45301d
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
cmp eax, 0x20
mov eax, dword [ebp + 8]
setg bl
add eax, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x453035
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x453500
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c3100
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4f6108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x18], esi
mov edx, str.MasterPDFData
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x10]
call fcn.0045d3b0
mov dword [ebp - 4], 0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x45356c
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebp - 0x10]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test edi, edi
je 0x4535c6
push edi
lea ecx, [ebp - 0x14]
call fcn.00404260
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.0045ca20
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov edx, dword [ebp - 0x14]
add esp, 4
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4535af
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jmp 0x4535f2
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.004043f0
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add esp, 4
mov dword [esi], eax
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4535fc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x453610
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c3100
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4f6108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x18], esi
mov edx, str.UserData
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x10]
call fcn.00453500
mov dword [ebp - 4], 0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x45367c
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebp - 0x10]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test edi, edi
je 0x4536d6
push edi
lea ecx, [ebp - 0x14]
call fcn.00404260
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.0045ca20
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov edx, dword [ebp - 0x14]
add esp, 4
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4536bf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jmp 0x453702
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.004043f0
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add esp, 4
mov dword [esi], eax
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45370c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x453750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4f6108]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], esi
mov eax, dword [0x4fc62c]
test al, 1
jne 0x4537b0
or eax, 1
mov dword [0x4fc62c], eax
call fcn.004047a0
mov ecx, eax
test ecx, ecx
je 0x4538af
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0x4c76c0
mov dword [0x4fc630], eax
call fcn.0047aa06
add esp, 4
mov eax, dword [0x4fc630]
cmp dword [eax - 0xc], 0
jne 0x453887
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallMasterPDF
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x453887
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00493690
add esp, 0xc
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push str.DisplayVersion
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x210], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x453866
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, 0x4fc630
call fcn.00404160
mov ecx, dword [0x4fc630]
add ecx, 0xfffffff0
push ecx
call fcn.004043f0
mov ecx, dword [ebp - 4]
add esp, 4
add eax, 0x10
xor ecx, ebp
mov dword [esi], eax
mov eax, esi
pop esi
call fcn.0047ac53
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404500
int3
Function at 0x455530
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, ecx
mov ebx, 0x20019
push edi
mov dword [ebp - 0xc], eax
xor edi, edi
lea ecx, [ebp - 4]
push ecx
push ebx
push 0
push str.SoftwareClasses.pdf
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4555b3
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x4555aa
mov eax, dword [ebp - 8]
shr eax, 1
inc eax
push 2
push eax
call fcn.004a6c8a
add esp, 8
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x4555aa
push edi
call fcn.0049675d
add esp, 4
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x4555d4
mov eax, dword [ebp - 0xc]
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
jne 0x4555d4
cmp ebx, 0x20019
jne 0x4555d4
mov ebx, 0x20119
jmp 0x455545
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x455640
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
call fcn.004555e0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdfUserChoice
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
pop esi
test eax, eax
je 0x455661
cmp eax, 2
je 0x455661
xor al, al
ret
mov al, 1
ret