joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd2a0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d2a200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd2a0d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd2a0c2
add dl, dl
jne 0xd2a0e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd2a134
xor eax, eax
add dl, dl
jne 0xd2a0ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd2a1d5
add dl, dl
jne 0xd2a0fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2a108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2a113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2a11e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd2a12a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd2a0cd
mov eax, 1
add dl, dl
jne 0xd2a142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2a14d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd2a139
sub eax, ebx
mov ebx, 1
jne 0xd2a180
mov ecx, 1
add dl, dl
jne 0xd2a166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd2a171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd2a15d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd2a0cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd2a197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd2a1a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd2a18e
cmp eax, 0x7d00
jae 0xd2a1c5
cmp eax, 0x500
jb 0xd2a1c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd2a0cd
cmp eax, 0x7f
ja 0xd2a1c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd2a0cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd2a1f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd2a0cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403f60
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408028]
jne 0x403f6a
repz ret
jmp fcn.00404494
Function at 0x402c72
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x402c81
pop dword [ebp - 0x38]
mov eax, 0x4079843e
sub eax, 0x403957bd
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x9b428466
add dword [ebp - 0x48], 0xb30fc0e5
mov dword [ebp - 0x44], 0x9708bd73
sub dword [ebp - 0x44], 0x64d5712e
mov dword [ebp - 0x40], 0x49281cfd
sub dword [ebp - 0x40], 0xfcdbd8cf
mov dword [ebp - 0x3c], 0x65380c1c
add dword [ebp - 0x3c], 0x9ac7f3e4
lea eax, [ebp - 0x48]
push eax
mov eax, 0xff7131f0
sub eax, 0xff30c0e4
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xe7daf67e
add dword [ebp - 0x48], 0x8c9772d8
mov dword [ebp - 0x44], 0xc7e3851c
sub dword [ebp - 0x44], 0x867723a7
mov dword [ebp - 0x40], 0x24859eee
add dword [ebp - 0x40], 0x3ee9cd7e
mov dword [ebp - 0x3c], 0xfce2e1d9
add dword [ebp - 0x3c], 0x31d1e27
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x397c7
push 0
call eax
mov ecx, 0x61024392
sub ecx, 0x6101f16b
xor edx, edx
add edx, eax
mov edi, 0xaad6017b
sub edi, 0xaa92db7b
add edi, dword [ebp - 0x38]
mov esi, 0xfc3263ef
add esi, 0x6135a22c
sub dword [ebp - 0xc], ebx
mov ebx, dword [edi]
mov dword [ebp - 0x34], 0xd82c5023
xor ebx, esi
mov dword [edx], ebx
add dword [ebp - 0x1c], edx
add edx, 0xda25fd9e
add edx, 0x25da0266
add edi, 0x7b754f02
sub edi, 0x7b754efe
loop 0x402da0
add eax, 0x445ce028
add eax, 0xbba45b47
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x48a3aa4c
add ecx, 0xb79c55b4
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401fc0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
mov ecx, 0x41
xor eax, eax
push ebx
push esi
push edi
mov edi, 0x43a0a0
rep stosd dword es:[edi], eax
mov ecx, 0x41
mov edi, 0x439f9c
rep stosd dword es:[edi], eax
lea eax, [esp + 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0x110]
push str.SN_Setup.ini
push ecx
lea edx, [esp + 0x14]
push 0x430ec8
push edx
call ebx
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x402032
pop edi
pop esi
pop ebx
add esp, 0x208
ret
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
mov eax, ecx
mov edi, 0x43a0a0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str.SN_AutoGen.ini
and ecx, 3
lea edx, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x114]
push ecx
push 0x430ec8
push edx
call ebx
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40208c
pop edi
pop esi
pop ebx
add esp, 0x208
ret
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
mov eax, ecx
mov edi, 0x439e94
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str.SNDATA
and ecx, 3
lea edx, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x114]
push ecx
push 0x430ec8
push edx
call ebx
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x4020e6
pop edi
pop esi
pop ebx
add esp, 0x208
ret
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
mov eax, ecx
mov edi, 0x439f9c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x411900
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes

Disassembly:
push 0xffffffffffffffff
push 0x424ae0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreatePipe]
lea eax, [esp + 0x14]
push ebp
lea ecx, [esi + 0x1058]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 1
call edi
test eax, eax
jne 0x4119b2
push 0x43b2bc
push ebp
push 0x10ac
push str.Z:develSN_Writer_devExecuteSPexc.cpp
lea ecx, [esp + 0x98]
call sub.MTRACE.dll_public:_void___thiscall_MetaTrace::constructor_char_const___int__unsigned_char__char_const__
mov ecx, dword [0x43b2d8]
push str.SmartPhoneSN::Adb_Manager_Init___:_CreatePipe___write_fail...
push ecx
push eax
mov dword [esp + 0xb0], ebp
call sub.MTRACE.dll_public:_void___cdecl_MetaTrace::operator___struct_MetaTraceHandle___char_const__
add esp, 0xc
lea ecx, [esp + 0x88]
mov dword [esp + 0xa4], 0xffffffff
call sub.MTRACE.dll_public_virtual:_void___thiscall_MetaTrace::destructor_void_
xor al, al
jmp 0x411aba
lea edx, [esp + 0x14]
push ebp
lea eax, [esp + 0x10]
push edx
add esi, 0x105c
push eax
push esi
call edi
test eax, eax
jne 0x411a21
push 0x43b2bc
push ebp
push 0x10b2
push str.Z:develSN_Writer_devExecuteSPexc.cpp
lea ecx, [esp + 0x84]
call sub.MTRACE.dll_public:_void___thiscall_MetaTrace::constructor_char_const___int__unsigned_char__char_const__
mov ecx, dword [0x43b2d8]
push str.SmartPhoneSN::Adb_Manager_Init___:_CreatePipe___read_fail...
push ecx
push eax
mov dword [esp + 0xb0], 1
call sub.MTRACE.dll_public:_void___cdecl_MetaTrace::operator___struct_MetaTraceHandle___char_const__
add esp, 0xc
lea ecx, [esp + 0x74]
mov dword [esp + 0xa4], 0xffffffff
call sub.MTRACE.dll_public_virtual:_void___thiscall_MetaTrace::destructor_void_
xor al, al
jmp 0x411aba
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x30]
lea edx, [esp + 0x30]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x34], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x30]
push ecx
push edx
push ebp
push ebp
push ebp
push 1
push ebp
mov dword [esp + 0x8c], eax
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x2c]
push ebp
push ebp
push str.c:windows_system32cmd.exe
mov dword [esp + 0x90], eax
mov word [esp + 0x88], bp
mov dword [esp + 0x84], 0x101
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x411a96
xor al, al
jmp 0x411aba
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov edx, dword [esp + 0x24]
push edx
call esi
mov eax, dword [esp + 0x20]
push eax
call esi
mov al, 1
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x9c
ret
Function at 0x411ae0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x64
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0xc]
mov esi, dword [esp + 0x74]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x78]
lea edi, [esp + 0xc]
mov ecx, eax
push 0
mov ebx, ecx
add eax, 2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov dword [esp + 0x7c], 0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + eax + 0xe], 0xd
mov byte [esp + eax + 0xf], 0xa
lea ecx, [esp + 0x7c]
push ecx
mov ecx, dword [edx + 0x1058]
push eax
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x78]
pop edi
neg eax
sbb eax, eax
pop esi
and eax, ecx
pop ebx
add esp, 0x64
ret 8

Function at 0x411b60
Capabilities:
Read file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push 0
push eax
mov eax, dword [ecx + 0x105c]
push edx
push esi
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x411b91
pop esi
pop ecx
ret 8
mov ecx, dword [esp + 4]
mov byte [ecx + esi], 0
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x402c00
pop dword [ebp - 0x40]
mov eax, 0x402c00
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xa288c8b3
sub dword [ebp - 0x50], 0x54368368
mov dword [ebp - 0x4c], 0xa62753a5
sub dword [ebp - 0x4c], 0x73f40760
mov dword [ebp - 0x48], 0xc0b45c32
sub dword [ebp - 0x48], 0x74681804
mov dword [ebp - 0x44], 0x47fbe60c
add dword [ebp - 0x44], 0xb80419f4
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xa621ff47
sub dword [ebp - 0x50], 0x31af95f1
mov dword [ebp - 0x4c], 0x113a9f4
add dword [ebp - 0x4c], 0x4058b781
mov dword [ebp - 0x48], 0x44ddf53
sub dword [ebp - 0x48], 0xa0de72e7
mov dword [ebp - 0x44], 0xde1a64c6
add dword [ebp - 0x44], 0x21e59b3a
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x34392
push 0
call eax
mov ecx, 0x822bc5bc
add ecx, 0x7dd47867
xor ebx, ebx
add ebx, eax
mov esi, 0x410000
add esi, dword [ebp - 0x40]
mov edi, 0xd10fe864
sub edi, 0xa9409b38
sub dword [ebp - 0x18], 0xad47c17a
mov edx, dword [esi]
sub dword [ebp - 0xc], 0x346ff52b
xor edx, edi
sub dword [ebp - 0x24], 0x90a42104
mov dword [ebx], edx
mov dword [ebp - 0x34], 0x73e9ac4c
add ebx, 0x5fc96188
add ebx, 0xa0369e7c
add esi, 0xf28ecb1a
add esi, 0xd7134ea
loop 0x402d0f
add eax, 0x8c77177e
sub eax, 0x8c762c1f
mov ebx, eax
add eax, 0xcaa605c0
add eax, 0x3559fa45
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401359
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push 0x104
push ebx
lea esi, [edi + 4]
mov dword [edi], vtable.CArmReport.0
push esi
call fcn.0041bfd0
add esp, 0xc
push esi
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4013a5
push 0x436f88
mov ebx, 0x104
push ebx
push esi
call fcn.00401c85
push str.ArmReport.ini
push ebx
push esi
call fcn.00401c85
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x4015df
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x401610
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
add eax, 4
push eax
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x401610
cmp dword [ebp - 4], 0
setne al
mov byte [esi], al
mov al, 1
jmp 0x401612
xor al, al
pop esi
leave
ret 8

Function at 0x4016fd
Capabilities:
Write file on windows

Disassembly:
push 0x9c
mov eax, 0x4341fe
call fcn.0041aab0
mov esi, ecx
mov eax, 0xfeff
xor ebx, ebx
mov word [ebp - 0x78], ax
mov eax, vtable.ATL::CAccessToken.0
mov byte [ebp - 0x71], bl
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 1
push eax
call fcn.00401572
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 2
mov dword [esp], 0x2000a
call fcn.0040187b
push 2
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x9c]
call fcn.004016b9
lea eax, [ebp - 0x71]
push eax
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x8c]
call fcn.004015df
push ebx
cmp byte [ebp - 0x71], bl
je 0x4017d9
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa8], 0xc
push eax
push 1
push str.D:_D_OICI_GA___BG__D_OICI_GA___AN__A_OICI_GA___AU_
mov dword [ebp - 0xa0], ebx
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x401833
push ebx
push 0x80
push 1
lea eax, [ebp - 0xa8]
push eax
jmp 0x4017e1
push 0x80
push 1
push ebx
push ebx
push 0x40000000
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401833
push ebx
lea eax, [ebp - 0x7c]
push eax
push 2
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401833
push ebx
lea eax, [ebp - 0x7c]
mov edi, str._SESSION_
push eax
push edi
call fcn.0041fc6e
pop ecx
lea eax, [eax*2 + 2]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40183d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x401844
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x70]
call fcn.004014b7
mov esi, vtable.ATL::CAccessToken.0
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x8c], esi
call fcn.00401620
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], esi
call fcn.00401620
mov eax, ebx
call fcn.0041aa5a
ret
Function at 0x40198c
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea ebx, [ecx + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x4019a7
push 3
pop eax
jmp 0x401a4f
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4019b7
push 2
jmp 0x4019a1
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x82
push 2
pop edx
add esi, esi
cmp esi, 0x821
jae 0x401a4a
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040b742
lea ecx, [esi + esi]
mov dword [edi], eax
push ecx
push 0
push eax
call fcn.0041bfd0
add esp, 0x10
push ebx
push esi
push dword [edi]
push 0
push dword [ebp + 8]
push str.SESSION
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 4], eax
test eax, eax
je 0x401a14
lea ecx, [esi - 1]
cmp eax, ecx
jne 0x401a26
push dword [edi]
call fcn.0040b73d
and dword [edi], 0
mov eax, dword [ebp - 4]
pop ecx
test eax, eax
je 0x401a43
inc eax
push 2
pop edx
cmp esi, eax
jbe 0x4019c4
cmp dword [edi], 0
je 0x401a4a
push dword [edi]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x401a4a
xor eax, eax
jmp 0x401a4d
mov eax, 0xe8
jmp 0x401a4d
push 0xd
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401a7a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 8], edi
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x401a9f
push 3
pop eax
jmp 0x401bc5
push esi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401ac6
and dword [ebp - 4], ebx
mov ecx, edi
call fcn.004016fd
mov ebx, eax
test ebx, ebx
jne 0x401bc5
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x401ba3
cmp dword [ebp - 4], 0
je 0x401ba3
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.0040198c
test eax, eax
jne 0x401ba3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test edi, edi
je 0x401ba3
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0041c12a
pop ecx
pop ecx
test eax, eax
je 0x401b2d
push 2
push dword [ebp - 4]
call fcn.0041aa26
pop ecx
pop ecx
xor eax, eax
jmp 0x401bc5
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, edi
xor ecx, ecx
push 2
pop edx
lea esi, [eax*2 + 2]
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040b742
pop ecx
push dword [ebp - 4]
mov edi, eax
push esi
push edi
call fcn.00401c54
push dword [ebp + 0x10]
push esi
push edi
call fcn.00401c85
push dword [ebp + 0xc]
push esi
push edi
call fcn.00401c85
mov eax, dword [ebp - 8]
add eax, 4
push eax
push edi
push dword [ebp + 8]
push str.SESSION
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 2
push dword [ebp - 4]
mov esi, eax
call fcn.0041aa26
push edi
call fcn.0040b73d
add esp, 0xc
jmp 0x401bb7
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.SESSION
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esi, eax
test esi, esi
jne 0x401bc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x402992
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor esi, esi
push eax
push 0x20019
push esi
push dword [0x44983c]
xor ebx, ebx
mov dword [ebp - 0xc], esi
inc ebx
mov dword [ebp - 0x14], esi
mov edi, 0x80000002
mov byte [0x4497c9], bl
push edi
mov dword [0x4497cc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402a7b
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x449848]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402a04
cmp dword [ebp - 0xc], ebx
je 0x402a2f
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x437098
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402a39
cmp dword [ebp - 0x14], ebx
jne 0x402a39
mov dword [0x4497cc], 2
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], esi
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], esi
push eax
push str.iLogLevelDebug
push dword [0x44983c]
push edi
call fcn.00405dca
add esp, 0x14
test eax, eax
jne 0x402a72
movzx eax, byte [0x4497ca]
cmp dword [ebp - 0x18], 0x64
cmovae eax, ebx
mov byte [0x4497ca], al
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4032ba
Capabilities:
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x4497c9], 0
jne 0x4032cb
call fcn.00402992
cmp byte [0x4497ca], 0
je 0x4032da
pop ebp
jmp fcn.00402b31
xor eax, eax
pop ebp
ret

Function at 0x40414d
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00405689
pop ecx
test eax, eax
je 0x404188
push 0x80
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x404188
push 0x186a0
push esi
push 2
call fcn.00403273
add esp, 0xc
pop esi
pop ebp
ret

Function at 0x4042b9
Capabilities:
Copy file
Create directory
Get common file path

Disassembly:
push 0x218
mov eax, 0x434535
call fcn.0041aab0
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x220]
mov edi, dword [ebp + 0xc]
push str.BackupArmExe...
call fcn.004020dd
xor esi, esi
lea eax, [ebp - 0x220]
push esi
push eax
push 2
mov dword [ebp - 4], esi
call fcn.00403273
mov ecx, dword [ebp - 0x220]
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00401a54
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push 0x2b
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x40433a
push eax
push str.Self_Update_Init_Error
push 0x436f68
push str.SHGetFolderPath_failed
call fcn.00407ae6
add esp, 0x10
jmp 0x4043f3
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004020dd
push str.AdobeARM1.0Backup
mov dword [ebp - 4], 1
call fcn.0041fc6e
pop ecx
push eax
push str.AdobeARM1.0Backup
lea ecx, [ebp - 0x21c]
call fcn.00402366
push esi
push dword [ebp - 0x21c]
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp eax, 0xa1
je 0x4043c8
cmp eax, 3
je 0x4043c8
push str.AdobeARM.exe
call fcn.0041fc6e
pop ecx
push eax
push str.AdobeARM.exe
lea ecx, [ebp - 0x21c]
call fcn.00402366
lea eax, [ebp - 0x21c]
mov ecx, edi
push eax
call fcn.004021f9
push esi
push dword [edi]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4043f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Self_Update_Init_Error
push dword [ebp - 0x21c]
push str.Failed_arm_backup_folder:
call fcn.00407ae6
mov esi, eax
add esp, 0x10
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.00401a54
mov eax, esi
call fcn.0041aa5a
ret
push str.success_backup
lea ecx, [ebp - 0x224]
call fcn.004020dd
push esi
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 2
push eax
push 2
call fcn.00403273
mov ecx, dword [ebp - 0x224]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.00401a54
jmp 0x4043e3