joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d4e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5f11e4]
xor eax, ebp
mov dword [ebp - 4], eax
xor ecx, ecx
mov eax, 3
cmp byte [0x5c7930], cl
push edi
mov edi, dword [ebp + 8]
cmove eax, ecx
push eax
push 0x5c7930
mov ecx, edi
call fcn.00448910
xorps xmm0, xmm0
mov byte [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
movq qword [ebp - 0x1b], xmm0
movups xmmword [ebp - 0x2b], xmm0
mov dword [ebp - 0x13], 0
mov word [ebp - 0xf], 0
mov byte [ebp - 0xd], 0
call fcn.004593e0
cmp byte [ebp - 0x2c], 0
jne 0x47d544
xor ecx, ecx
jmp 0x47d559
lea ecx, [ebp - 0x2c]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47d550
sub ecx, edx
push ecx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [edi + 0x18]
call fcn.00448910
xor eax, eax
mov byte [ebp - 0xc], 0
push 8
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
lea eax, [ebp - 0xc]
push eax
push 0x59
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea ecx, [eax - 2]
cmp ecx, 5
ja 0x47d5aa
lea ecx, [ebp - 0xc]
push 8
add eax, ecx
push eax
push 0x5a
push 0x400
mov byte [eax - 1], 0x5f
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp byte [ebp - 0xc], 0
jne 0x47d5b4
xor ecx, ecx
jmp 0x47d5c9
lea ecx, [ebp - 0xc]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47d5c0
sub ecx, edx
push ecx
lea eax, [ebp - 0xc]
push eax
lea ecx, [edi + 0x30]
call fcn.00448910
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004feb45
mov esp, ebp
pop ebp
ret 4

Function at 0x47f3a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5f11e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x47f430
test esi, esi
je 0x47f430
push ebx
lea ecx, [ebp - 0x14]
xor bl, bl
push ecx
push 1
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47f413
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47f413
cmp dword [ebp - 0x10], 0
mov eax, 1
movzx ebx, bl
cmove ebx, eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004feb45
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.004feb45
mov esp, ebp
pop ebp
ret 8
Function at 0x482890
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58de3e
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x5f11e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00504ee0
add esp, 0xc
xor bl, bl
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4829dc
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x4829d5
cmp word [ebp - 0x218], 0
je 0x4829d5
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
lea edx, [ebp - 0x230]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x218]
call fcn.004591e0
test al, al
je 0x4829ca
mov dword [ebp - 0x234], 0xf
mov dword [ebp - 0x238], 0
mov byte [ebp - 0x248], bl
mov byte [ebp - 4], 2
lea eax, [ebp - 0x24c]
cmp dword [ebp - 0x21c], 8
lea esi, [ebp - 0x230]
push eax
cmovae esi, dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00452d80
lea ecx, [ebp - 0x248]
push dword [eax]
push esi
call fcn.004530f0
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x248]
call fcn.004485f0
lea ecx, [ebp - 0x248]
mov esi, eax
call fcn.00448360
test esi, esi
sete bl
lea ecx, [ebp - 0x230]
call fcn.0044bd20
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x20]
cmp ecx, 0x10
jb 0x4829f1
inc ecx
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00445e20
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004feb45
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x483cd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5f11e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x108]
mov esi, ecx
push 0
push eax
call fcn.00504ee0
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push SysReAllocString
push str.System32driversetchosts
call fcn.0051a1aa
push eax
push str.System32driversetchosts
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00519d15
lea eax, [ebp - 0x108]
push eax
call fcn.0045df40
add esp, 0x1c
test eax, eax
je 0x483d7b
lea eax, [ebp - 0x108]
push 0x5c3460
push eax
call fcn.0045dd30
add esp, 8
mov dword [0x602b38], eax
test eax, eax
je 0x483d70
push str.Hostfile_opened_successfully
jmp 0x483d80
push str.Error_opening_host_file
push 0
push 5
jmp 0x483d84
push str.No_host_file_found
push 0
push 4
push str.AdobeGCHostfileValidation
push dword [esi]
call fcn.004a36b0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop esi
call fcn.004feb45
mov esp, ebp
pop ebp
ret
Function at 0x488ec0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58f1b8
mov eax, dword fs:[0]
push eax
sub esp, 0x314
mov eax, dword [0x5f11e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.Storing_XML_Started
push 0
push 4
mov dword [ebp - 4], 0
push str.AdobeGCUpdaterXMLWrapper
push dword [0x602b48]
call fcn.004a36b0
add esp, 0x14
cmp dword [ebp + 0x18], 0
je 0x48906b
lea eax, [ebp - 0x31c]
push eax
push 0
push 0
push 0x2e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x489064
push 0x104
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.0051dbad
push SysReAllocString
push 0x5c41ec
call fcn.0051a1aa
push eax
push 0x5c41ec
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00519d15
push 7
push str.AdobeGC
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00519d15
lea eax, [ebp - 0x114]
push eax
call fcn.0045df40
add esp, 0x38
test eax, eax
jne 0x488fc2
lea eax, [ebp - 0x114]
push eax
call fcn.0045e1b0
add esp, 4
test eax, eax
je 0x488fc2
push str.Could_not_retreive_path_to_folder
push 0
push 5
jmp 0x489090
push SysReAllocString
push 0x5c41ec
call fcn.0051a1aa
push eax
push 0x5c41ec
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00519d15
push 0xe
push str.adobegc_XXXXXX
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00519d15
lea eax, [ebp - 0x320]
mov dword [ebp - 0x320], 0
push eax
lea ecx, [ebp - 0x114]
call fcn.0045dfb0
add esp, 0x2c
test eax, eax
je 0x489087
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push 0x5c34b0
push dword [ebp - 0x320]
call fcn.00488a00
add esp, 0xc
test eax, eax
jle 0x489054
lea eax, [ebp - 0x114]
mov ecx, edi
push eax
call fcn.004488d0
push dword [ebp - 0x320]
call fcn.0050d76e
add esp, 4
jmp 0x489087
push str.Could_not_retreive_path_to_directory
jmp 0x489070
push str.No_data_to_write
push 0
push 5
push str.AdobeGCUpdaterXMLWrapper
push dword [0x602b48]
call fcn.004a36b0
add esp, 0x14
push str.Storing_XML_Ended
push 0
push 4
push str.AdobeGCUpdaterXMLWrapper
push dword [0x602b48]
call fcn.004a36b0
mov eax, dword [ebp + 0x1c]
add esp, 0x14
cmp eax, 0x10
jb 0x4890b8
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00445e20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004feb45
mov esp, ebp
pop ebp
ret
Function at 0x48a0b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
test esi, esi
je 0x48a13a
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x48a13a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x48a0e1
shr eax, 4
pop esi
and eax, 1
pop ebx
pop ebp
ret 4
push edi
push esi
call fcn.0052156d
mov edi, eax
push 0x5c
push edi
call fcn.00559148
add esp, 0xc
test eax, eax
je 0x48a131
xor ecx, ecx
mov word [eax], cx
mov ecx, ebx
push edi
call fcn.0048a0b0
push edi
test al, al
jne 0x48a11c
call fcn.00518a05
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
call fcn.00518a05
add esp, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x48a113
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
pop esi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x48a150
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
jne 0x48a180
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp eax, 1
sete bl
test bl, bl
je 0x48a1e7
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
setne bl
test bl, bl
je 0x48a1e7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
setne bl
test bl, bl
je 0x48a1e7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
setne bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x48a200
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [edx], 0x12345678
mov dword [edx + 4], 0x23456789
mov dword [edx + 8], 0x34567890
mov dword [ebp - 4], edx
mov al, byte [ebx]
test al, al
je 0x48a27a
push esi
push edi
mov edi, dword [edx + 4]
mov esi, 0x34567890
nop
mov ecx, dword [edx]
lea ebx, [ebx + 1]
movsx eax, al
xor eax, dword [edx]
mov edx, dword [ebp + 8]
movzx eax, al
shr ecx, 8
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov dword [edx], eax
movzx eax, al
add eax, edi
imul edi, eax, 0x8088405
inc edi
mov eax, edi
mov dword [edx + 4], edi
shr eax, 0x18
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [ecx + eax*4]
mov dword [edx + 8], esi
mov al, byte [ebx]
test al, al
jne 0x48a230
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48ce70
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x48ce7b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0048ce90
Function at 0x48df70
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], esi
jb 0x48df8b
mov eax, dword [edi]
jmp 0x48df8d
mov eax, edi
mov ecx, dword [ebp + 8]
mov byte [eax], 0
test ecx, ecx
je 0x48e0ea
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x48e0ea
mov al, byte [ecx]
dec ebx
mov byte [ebp + esi - 8], al
inc ecx
mov ah, byte [ebp - 6]
inc esi
mov dl, byte [ebp - 7]
mov dh, byte [ebp - 8]
mov dword [ebp + 8], ecx
mov byte [ebp - 2], ah
mov byte [ebp + 0x13], dl
mov byte [ebp - 1], dh
cmp esi, 3
jne 0x48e027
mov al, dh
mov cl, dh
shr al, 2
and cl, 3
mov byte [ebp - 0xc], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0xb], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ah
and al, 0x3f
mov byte [ebp - 0xa], cl
mov byte [ebp - 9], al
xor esi, esi
nop
movzx eax, byte [ebp + esi - 0xc]
mov ecx, edi
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push 1
call fcn.00453040
inc esi
cmp esi, 4
jl 0x48e000
mov ecx, dword [ebp + 8]
xor esi, esi
mov dl, byte [ebp + 0x13]
mov dh, byte [ebp - 1]
test ebx, ebx
jne 0x48dfa6
mov dword [ebp + 8], esi
test esi, esi
je 0x48e0e0
mov eax, esi
cmp esi, 3
jge 0x48e060
cmp eax, 3
jae 0x48e0f3
mov byte [ebp + eax - 8], 0
inc eax
cmp eax, 3
jl 0x48e044
mov cl, byte [ebp - 6]
mov dl, byte [ebp - 7]
mov dh, byte [ebp - 8]
jmp 0x48e063
mov cl, byte [ebp - 2]
mov al, dh
xor ebx, ebx
shr al, 2
and dh, 3
mov byte [ebp - 0xc], al
mov al, dl
shr al, 4
and dl, 0xf
shl dh, 4
add dh, al
shl dl, 2
mov al, cl
mov byte [ebp - 0xb], dh
shr al, 6
and cl, 0x3f
add dl, al
mov byte [ebp - 9], cl
lea eax, [esi + 1]
mov byte [ebp - 0xa], dl
mov dword [ebp + 0x10], eax
test eax, eax
jle 0x48e0be
mov esi, eax
nop
movzx eax, byte [ebp + ebx - 0xc]
mov ecx, edi
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push 1
call fcn.00453040
inc ebx
cmp ebx, esi
jl 0x48e0a0
mov esi, dword [ebp + 8]
cmp esi, 3
jge 0x48e0e0
mov ebx, 3
sub ebx, esi
nop word [eax + eax]
push 0x3d
push 1
mov ecx, edi
call fcn.00453040
sub ebx, 1
jne 0x48e0d0
mov eax, dword [edi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004ff02c
int3
Function at 0x48e450
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x48e46d
lea eax, [edi + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 4], edi
je 0x48e47e
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
call fcn.0048f1f0
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x48e508
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x48e508
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x48e508
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.004ffa60
mulsd xmm0, qword [0x5cdb60]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.004ffa60
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x48e50b
xorps xmm0, xmm0
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push ebx
push str.Get_AdobeGC_client_download_path_status_____d__took_____.2f_ms.
push 4
call fcn.00494940
add esp, 0x14
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48e530
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x48e54d
lea eax, [edi + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 4], edi
je 0x48e55e
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
call fcn.0048fa00
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x48e5e8
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x48e5e8
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x48e5e8
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.004ffa60
mulsd xmm0, qword [0x5cdb60]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.004ffa60
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x48e5eb
xorps xmm0, xmm0
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push ebx
push str.AdobeGC_client_download_status_____d__took_____.2f_ms.
push 4
call fcn.00494940
add esp, 0x14
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48e610
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x48e62d
lea eax, [edi + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 4], edi
je 0x48e63e
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
call fcn.00490080
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x48e6c8
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x48e6c8
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x48e6c8
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.004ffa60
mulsd xmm0, qword [0x5cdb60]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.004ffa60
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x48e6cb
xorps xmm0, xmm0
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push ebx
push str.AdobeGC_Fetching_rules_status_____d__took_____.2f_ms.
push 4
call fcn.00494940
add esp, 0x14
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48e6f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x48e70d
lea eax, [edi + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 4], edi
je 0x48e71e
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
call fcn.00492840
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x48e7a8
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x48e7a8
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x48e7a8
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.004ffa60
mulsd xmm0, qword [0x5cdb60]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.004ffa60
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x48e7ab
xorps xmm0, xmm0
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push ebx
push str.AdobeGC_Posting_rules_data_status_____d__took_____.2f_ms.
push 4
call fcn.00494940
add esp, 0x14
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48e7d0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x48e7eb
lea eax, [edi + 2]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [edi + 4], edi
je 0x48e7fb
mov eax, 3
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00494560
mov edi, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x48e882
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x48e882
mov esi, dword [esp + 0x20]
mov eax, esi
or eax, dword [esp + 0x24]
je 0x48e882
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.004ffa60
mulsd xmm0, qword [0x5cdb60]
mov ecx, esi
mov edx, dword [esp + 0x24]
movsd qword [esp + 0x38], xmm0
call fcn.004ffa60
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x48e885
xorps xmm0, xmm0
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push edi
push str.AdobeGC_Send_AGS_Status_status_____d__took_____.2f_ms.
push 4
call fcn.00494940
add esp, 0x14
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48e980
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x48e99b
lea eax, [edi + 2]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [edi + 4], edi
je 0x48e9ab
mov eax, 3
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00494fe0
mov edi, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x48ea32
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x48ea32
mov esi, dword [esp + 0x20]
mov eax, esi
or eax, dword [esp + 0x24]
je 0x48ea32
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.004ffa60
mulsd xmm0, qword [0x5cdb60]
mov ecx, esi
mov edx, dword [esp + 0x24]
movsd qword [esp + 0x38], xmm0
call fcn.004ffa60
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x48ea35
xorps xmm0, xmm0
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push edi
push str.AdobeGC_sending_ETS_event___Hostfile_modified_____d__took_____.2f_ms.
push 4
call fcn.00494940
add esp, 0x14
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x497b80
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x497bab
push 8
call fcn.004feb64
mov dword [esp + 0x24], eax
add esp, 4
mov dword [eax], vtable.adobe_ial::HTTPCommunicationAgent.0
mov dword [edi + 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
mov ecx, dword [edi + 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ecx]
push dword [ebp + 8]
call dword [eax + 4]
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x497c39
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x497c39
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x497c39
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.004ffa60
mulsd xmm0, qword [0x5cdb60]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.004ffa60
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x497c3c
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [eax + 0x10]
push ebx
push str.HTTPCommunicationAgent__Return_Code:__d__response_size___d__time_taken___.2f_ms.
push 4
call fcn.00494940
add esp, 0x18
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc