joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442020
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463185
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x494680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x20], eax
push 0x643
mov ecx, 0x498b90
call fcn.004010a0
movzx eax, al
test eax, eax
jne 0x442077
cmp dword [ebp - 0x20], 0
jne 0x4420bb
push 0x46e208
lea ecx, [ebp - 0x48]
call fcn.00401a60
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x48]
push ecx
push 0x643
mov ecx, 0x498b90
call fcn.004010c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00405030
xor eax, eax
jmp 0x4421d1
push 4
push str.MSIServer
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x10], eax
push 0x644
mov ecx, 0x498b90
call fcn.004010a0
movzx eax, al
test eax, eax
jne 0x4420eb
cmp dword [ebp - 0x10], 0
jne 0x442139
push str.OpenSCManager_failed:
lea ecx, [ebp - 0x4c]
call fcn.00401a60
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x4c]
push ecx
push 0x644
mov ecx, 0x498b90
call fcn.004010c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00405030
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4421d1
lea eax, [ebp - 0x18]
push eax
push 0x24
lea ecx, [ebp - 0x44]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov dword [ebp - 0x14], eax
push 0x641
mov ecx, 0x498b90
call fcn.004010a0
movzx eax, al
test eax, eax
jne 0x44216e
cmp dword [ebp - 0x14], 0
jne 0x4421ad
push str.QueryServiceStatusEx_failed
lea ecx, [ebp - 0x50]
call fcn.00401a60
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0x641
mov ecx, 0x498b90
call fcn.004010c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.00405030
jmp 0x4421ba
cmp dword [ebp - 0x3c], 4
jne 0x4421ba
mov dword [ebp - 0x1c], 1
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x443460
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4633ee
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x494680]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x498b90
call fcn.004031e0
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0xc], 0
je 0x443500
mov ecx, 0x498b90
call fcn.00408670
push eax
mov ecx, dword [ebp + 8]
call fcn.004024f0
push 0x46ccfc
mov ecx, dword [ebp + 8]
call fcn.00401110
mov ecx, dword [ebp - 0x10]
call fcn.004029a0
test eax, eax
je 0x4434d6
mov dword [ebp - 0x234], 0x498b4c
jmp 0x4434e0
mov dword [ebp - 0x234], 0x498b50
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004010f0
jmp 0x4435ed
xor edx, edx
mov word [ebp - 0x21c], dx
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00427990
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x44359e
lea edx, [ebp - 0x21c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401a40
push str.AdobeARM1.0_
mov ecx, dword [ebp + 8]
call fcn.00401110
mov ecx, dword [ebp - 0x10]
call fcn.004029a0
test eax, eax
je 0x443577
mov dword [ebp - 0x238], 0x498b4c
jmp 0x443581
mov dword [ebp - 0x238], 0x498b50
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x228]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004010f0
jmp 0x4435ed
push str.SHGetFolderPath_in_GetLauncherPath_failed:
lea ecx, [ebp - 0x230]
call fcn.00401a60
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x220]
push edx
lea eax, [ebp - 0x230]
push eax
push 1
call fcn.0045c8c0
add esp, 0xc
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00405030
mov eax, dword [ebp - 0x22c]
jmp 0x4435f2
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00427284
mov esp, ebp
pop ebp
ret
Function at 0x443610
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463426
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x494680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call fcn.00404f90
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x10]
call fcn.004021a0
push eax
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004016e0
cmp dword [ebp - 0x14], 0
jne 0x44368e
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.004024f0
push 0x46ce78
mov ecx, dword [ebp + 8]
call fcn.00401110
jmp 0x4436d4
push str.SHGetFolderPath_in_GetExtractDllPath_failed:
lea ecx, [ebp - 0x1c]
call fcn.00401a60
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 1
call fcn.0045c8c0
add esp, 0xc
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00405030
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405030
mov eax, dword [ebp - 0x18]
jmp 0x4436ed
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405030
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x443700
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463451
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x494680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call fcn.00404f90
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x10]
call fcn.004021a0
push eax
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004016e0
cmp dword [ebp - 0x14], 0
jne 0x44377e
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.004024f0
push str.AdobeARM1.0AdobeARM.exe
mov ecx, dword [ebp + 8]
call fcn.00401110
jmp 0x4437c4
push str.SHGetFolderPath_in_GetCurrentExePath_failed:
lea ecx, [ebp - 0x1c]
call fcn.00401a60
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 1
call fcn.0045c8c0
add esp, 0xc
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00405030
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405030
mov eax, dword [ebp - 0x18]
jmp 0x4437dd
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405030
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x443900
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4634a7
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x494680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x443999
push str.module_handle_is_NULL:_kernel32.dll
lea ecx, [ebp - 0x40]
call fcn.00401a60
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x40]
push ecx
push 1
call fcn.0045c8c0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00405030
mov eax, dword [ebp - 0x14]
jmp 0x4439e0
push str.GetNativeSystemInfo
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4439ba
lea eax, [ebp - 0x3c]
push eax
call dword [ebp - 0x10]
jmp 0x4439c4
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx edx, word [ebp - 0x3c]
cmp edx, 9
je 0x4439d6
movzx eax, word [ebp - 0x3c]
cmp eax, 6
jne 0x4439dd
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4439f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4634cd
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x494680]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x11c
push 0
lea eax, [ebp - 0x134]
push eax
call fcn.00427990
add esp, 0xc
mov dword [ebp - 0x134], 0x11c
lea ecx, [ebp - 0x134]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x443a6b
mov dword [ebp - 0x134], 0x114
lea edx, [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x443abd
cmp dword [ebp - 0x130], 5
jne 0x443abd
push str.IsXP_returns_1
lea ecx, [ebp - 0x138]
call fcn.00401a60
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x138]
push eax
push 2
call fcn.0045c8c0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.00405030
mov eax, 1
jmp 0x443abf
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00427284
mov esp, ebp
pop ebp
ret
Function at 0x443ae0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46350b
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x494680]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
push 0x11c
push 0
lea eax, [ebp - 0x13c]
push eax
call fcn.00427990
add esp, 0xc
mov dword [ebp - 0x13c], 0x11c
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x443b62
mov dword [ebp - 0x13c], 0x114
lea edx, [ebp - 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x443b78
cmp dword [ebp - 0x138], 6
jb 0x443b78
mov dword [ebp - 0x14], 1
movzx eax, byte [0x4991f0]
test eax, eax
jne 0x443c0e
cmp dword [ebp - 0x14], 0
je 0x443bcb
push str.IsVistaOrW7_returns_1
lea ecx, [ebp - 0x140]
call fcn.00401a60
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x140]
push ecx
push 2
call fcn.0045c8c0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call fcn.00405030
jmp 0x443c07
push str.IsVistaOrW7_returns_0
lea ecx, [ebp - 0x144]
call fcn.00401a60
mov dword [ebp - 4], 1
push 0
lea edx, [ebp - 0x144]
push edx
push 2
call fcn.0045c8c0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.00405030
mov byte [0x4991f0], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00427284
mov esp, ebp
pop ebp
ret
Function at 0x4469d0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x30], ecx
push 0
push 0x46f930
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x446a22
push 0
push str.TrayNotifyWnd
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x446a22
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x446b46
mov dword [ebp - 0x28], 0x24
lea eax, [ebp - 0x28]
push eax
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x446aa8
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 3
ja case.default.0x446a48
mov edx, dword [ebp - 0x34]
jmp dword [edx*4 + 0x446b4c]
mov eax, dword [ebp - 0xc]
sub eax, 0x64
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0xc]
sub edx, 0x10
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 8], ecx
jmp case.default.0x446a48
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [edx + 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x64
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
sub edx, 0x10
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
jmp 0x446b46
push 0
push str.Shell_TrayWnd
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x446b16
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
sub edx, dword [ecx]
cmp edx, 0x96
jle 0x446af4
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
sub ecx, 0x96
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0xc]
sub edx, dword [ecx + 4]
cmp edx, 0x1e
jle 0x446b14
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
sub ecx, 0x1e
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
jmp 0x446b46
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
sub edx, 0x96
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
sub edx, 0x1e
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov esp, ebp
pop ebp
ret 4
Function at 0x447ff0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x494680]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x448010
xor eax, eax
jmp 0x4480a7
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4480a5
mov dword [ebp - 0x258], 0
push 0x24c
push 0
lea ecx, [ebp - 0x254]
push ecx
call fcn.00427990
add esp, 0xc
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4480a5
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0xc], 0xffffffff
je 0x44807e
mov edx, dword [ebp - 0x238]
cmp edx, dword [ebp + 0xc]
je 0x44807e
xor eax, eax
jmp 0x4480a7
mov eax, dword [ebp + 8]
push eax
call fcn.00447b80
add esp, 4
test eax, eax
je 0x4480a5
cmp dword [ebp + 0xc], 0xffffffff
jne 0x44809e
mov eax, dword [ebp - 0x238]
jmp 0x4480a7
mov eax, 1
jmp 0x4480a7
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00427284
mov esp, ebp
pop ebp
ret
Function at 0x44bf90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4623ac
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x494680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x234], ecx
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x44bfe4
xor eax, eax
jmp 0x44c0dd
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x22c]
call fcn.00401a60
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.00404f90
mov byte [ebp - 4], 1
mov ecx, 0x498b90
call fcn.004031e0
mov dword [ebp - 0x228], eax
lea edx, [ebp - 0x224]
push edx
mov ecx, dword [ebp - 0x228]
call fcn.00445170
lea ecx, [ebp - 0x224]
call fcn.00404b10
push eax
call fcn.00427a20
add esp, 4
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0xa
jge 0x44c08a
mov ecx, dword [ebp - 0x228]
call fcn.004029a0
test eax, eax
je 0x44c06c
mov dword [ebp - 0x238], str.AdobeReader
jmp 0x44c076
mov dword [ebp - 0x238], str.AdobeAcrobat
mov eax, dword [ebp - 0x238]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00401110
jmp 0x44c09a
push str.AdobeARM
lea ecx, [ebp - 0x22c]
call fcn.00401110
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x22c]
push edx
mov ecx, dword [ebp - 0x234]
call fcn.0044bd30
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.00405030
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.00405030
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00427284
mov esp, ebp
pop ebp
ret 4
Function at 0x44c100
Capabilities:
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4629a2
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x494680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
push 0
mov ecx, dword [ebp + 8]
call fcn.004061a0
mov eax, dword [ebp + 8]
push eax
call fcn.00401020
add esp, 4
test eax, eax
je 0x44c2aa
mov ecx, dword [ebp + 8]
call fcn.00404b10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44c2aa
mov ecx, dword [ebp + 8]
call fcn.00404b10
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
and ecx, 0xfffffffe
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404b10
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp - 0x10]
and eax, 0x10
je 0x44c254
mov ecx, dword [ebp + 8]
call fcn.00404b10
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x44c252
mov dword [ebp - 0x38], 0
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov word [ebp - 0x1c], cx
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp + 8]
call fcn.00404b10
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 3
mov edx, 0x414
mov word [ebp - 0x28], dx
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x44c24b
push str.SHFileOperation_FO_DELETE__failed:
lea ecx, [ebp - 0x3c]
call fcn.00401a60
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x3c]
push eax
push 1
call fcn.0045c270
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00405030
jmp 0x44c252
mov dword [ebp - 0x14], 1
jmp 0x44c266
mov ecx, dword [ebp + 8]
call fcn.00404b10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x44c2aa
push str.RemoveDirectory___DeleteFile___failed:
lea ecx, [ebp - 0x40]
call fcn.00401a60
mov dword [ebp - 4], 1
push 0x3e8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x40]
push edx
push 1
call fcn.0045c270
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00405030
xor eax, eax
jmp 0x44c2af
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x44f5d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461bd3
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x494680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
push 0x473044
mov ecx, 0x498b90
call fcn.004031e0
mov ecx, eax
call fcn.00404db0
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00401260
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x30]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00401260
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00405030
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
lea ecx, [ebp - 0x14]
call fcn.00404b10
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x10], 0
je 0x44f6c2
movzx eax, byte [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 4
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], 0
seta cl
mov byte [ebp - 0x25], cl
lea ecx, [ebp - 0x14]
call fcn.00405030
mov al, byte [ebp - 0x25]
jmp 0x44f6d3
mov dl, byte [ebp + 0x10]
mov byte [ebp - 0x26], dl
lea ecx, [ebp - 0x14]
call fcn.00405030
mov al, byte [ebp - 0x26]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x44f800
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4620c7
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x494680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x473048
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x10], 0
je 0x44f94d
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
push ecx
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push 0x4730ac
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x18], 0
je 0x44f943
lea ecx, [ebp - 0x20]
call fcn.00404f90
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004021a0
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push str.PendingFileRenameOperations
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x18], 0
je 0x44f91e
cmp dword [ebp - 0x1c], 0
je 0x44f91e
push 0x5c
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00406970
add esp, 8
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 2
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x20]
call fcn.00401110
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0042736d
add esp, 4
mov ecx, dword [ebp - 0x1c]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax]
test ecx, ecx
je 0x44f914
push 0x2c
lea ecx, [ebp - 0x20]
call fcn.00404f00
mov edx, dword [ebp - 0x1c]
movzx eax, word [edx]
test eax, eax
jne 0x44f8c4
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call fcn.004016e0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004024f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00405030
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret