joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4366f0
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 8
mov dword [esp + 0x30], 0
mov eax, dword [0xea317c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [eax + 0x1b0], 8
lea ecx, [esp + 0x10]
mov dword [eax + 0x1b4], ecx
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.004363d0
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
add esp, 8
ret
Function at 0x458350
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0xea317c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45844c
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x10], eax
test byte [eax], al
nop
nop
mov dword [esp], eax
call fcn.0040a860
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x458393
call fcn.004581f0
mov eax, dword [esp + 0x10]
inc dword [eax + 8]
movzx ecx, byte [eax + 5]
test cl, 1
je 0x4583e7
test cl, 4
je 0x4583e7
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
test ebx, ebx
setg bl
xchg ebp, ebx
sete bl
xchg ebp, ebx
test edx, edx
seta dl
and ebp, edx
or ebp, ebx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x4583e7
and ecx, 0xfffffffb
mov byte [eax + 5], cl
mov ecx, dword [eax + 0x2c]
test byte [ecx], al
add ecx, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0xffffffff
call fcn.00478f70
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 5]
nop
test cl, 1
jne 0x458425
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
test edx, edx
setg dl
sete bl
test ecx, ecx
seta cl
and ebx, ecx
or ebx, edx
test bl, bl
je 0x458425
movzx ecx, byte [eax + 6]
test cl, cl
je 0x45841e
mov ecx, dword [eax + 8]
test ecx, ecx
seta cl
jmp 0x458427
mov ecx, 1
jmp 0x458427
xor ecx, ecx
mov byte [esp + 0xf], cl
mov dword [esp], eax
call fcn.00455fe0
movzx eax, byte [esp + 0xf]
test al, al
je 0x458448
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00456b20
add esp, 0x14
ret
call fcn.00472e50
jmp fcn.00458350
Function at 0x461c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0xea317c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x461e9a
sub esp, 0x68
movzx eax, byte [esp + 0x88]
test al, al
je 0x461e4a
mov ecx, dword [esp + 0x8c]
test ecx, ecx
sete dl
mov ebx, dword [esp + 0x90]
test ebx, ebx
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x461d5a
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x34], ebx
movzx eax, al
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x19
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call fcn.0045e550
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x461ddc
mov edx, dword [esp + 0x78]
mov dword [esp + 0x48], edx
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x4c], ebp
mov esi, dword [esp + 0x80]
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x84]
mov dword [esp + 0x54], esi
movzx eax, al
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ebx
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x30
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 4
call fcn.0045e550
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx ebx, byte [esp + 0x89]
test bl, bl
je 0x461e31
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x44], ebx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov byte [esp + 0xc], 0x22
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call fcn.0045e550
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x68
ret
call fcn.0043a3b0
lea eax, [0x92c95f]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043ac10
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 4], eax
call fcn.0043a900
call fcn.0043a5b0
call fcn.0043a410
lea eax, [0x95c2b4]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.0046da30
nop
call fcn.00472e50
jmp fcn.00461c90
Function at 0x470730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0xea317c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4708aa
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x4708a0
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x47078a
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x47078a
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x47079d
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x470877
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x47086b
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x470862
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x4707f0
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x470833
mov eax, 1
cmp eax, ecx
ja 0x470827
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00474340
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x47085d
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x47082c
mov ecx, dword [esp + 0xc]
jmp 0x4707f5
call fcn.004742e0
xor eax, eax
mov ecx, eax
call fcn.004742d0
call fcn.00474340
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x47089b
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x470870
mov ecx, dword [esp + 0x18]
jmp 0x4707a2
call fcn.004742e0
xor eax, eax
mov ecx, eax
call fcn.004742d0
nop
call fcn.00472e50
jmp fcn.00470730
Function at 0x472100
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0xea317c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47219b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0xea317c]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.004744e7
lea ecx, [0x45bff0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00472d60
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00472e50
jmp fcn.00472100
Function at 0x474100
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0xea3720]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x47288b
je 0x4728de
cmp ebx, 0x20
jbe 0x4728e4
cmp ebx, 0x40
jbe 0x47292a
jmp 0x4729cb
test ebx, ebx
je 0x4728d4
add eax, 0x10
test ax, 0xff0
je 0x4728c0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0xb54240]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0xb54340]
jmp 0x4728a8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x4728a8
pxor xmm1, xmmword [0xea3730]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xea3730]
pxor xmm2, xmmword [0xea3740]
pxor xmm3, xmmword [0xea3750]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xea3730]
pxor xmm2, xmmword [0xea3740]
pxor xmm3, xmmword [0xea3750]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x472a2a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0xea2fa8], 0
je 0x47411a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x472850
jmp fcn.00409360
Function at 0x40b7d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x40b7f5
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x40b868
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x40b82a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x40b85d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x40b85b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x40b821
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x40b7ec
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x401d30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.004016d0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret

Function at 0x4023e0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jne 0x4023f3
xor al, al
jmp 0x402425
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.004021d0
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x402423
xor eax, eax
cmp dword [ebp - 4], 0
setne al
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov al, 1
jmp 0x402425
xor al, al
mov esp, ebp
pop ebp
ret 8

Function at 0x410c05
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43fc54]
jne 0x410c0f
repz ret
jmp fcn.004165db

Function at 0x4210c5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041821f
and dword [ebp - 4], 0
cmp dword [0x443b84], 0
mov ebx, eax
jne 0x421176
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x421227
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x421227
push eax
call fcn.004181ad
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x443b84], eax
call esi
push eax
call fcn.004181ad
mov dword [esp], 0x434330
push edi
mov dword [0x443b88], eax
call esi
push eax
call fcn.004181ad
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x443b8c], eax
call esi
push eax
call fcn.004181ad
pop ecx
mov dword [0x443b94], eax
test eax, eax
je 0x421176
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004181ad
pop ecx
mov dword [0x443b90], eax
mov eax, dword [0x443b90]
cmp eax, ebx
je 0x4211ce
cmp dword [0x443b94], ebx
je 0x4211ce
push eax
call fcn.00418228
push dword [0x443b94]
mov esi, eax
call fcn.00418228
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4211ce
test edi, edi
je 0x4211ce
call esi
test eax, eax
je 0x4211c5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4211c5
test byte [ebp - 0xc], 1
jne 0x4211ce
or dword [ebp + 0x10], 0x200000
jmp 0x421207
mov eax, dword [0x443b88]
cmp eax, ebx
je 0x421207
push eax
call fcn.00418228
pop ecx
test eax, eax
je 0x421207
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x421207
mov eax, dword [0x443b8c]
cmp eax, ebx
je 0x421207
push eax
call fcn.00418228
pop ecx
test eax, eax
je 0x421207
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x443b84]
call fcn.00418228
pop ecx
test eax, eax
je 0x421227
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x421229
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x426990
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x43fc54]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x4269b0
xor eax, eax
jmp 0x426a47
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x426a45
mov dword [ebp - 0x258], 0
push 0x24c
push 0
lea ecx, [ebp - 0x254]
push ecx
call fcn.00411600
add esp, 0xc
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x426a45
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0xc], 0xffffffff
je 0x426a1e
mov edx, dword [ebp - 0x238]
cmp edx, dword [ebp + 0xc]
je 0x426a1e
xor eax, eax
jmp 0x426a47
mov eax, dword [ebp + 8]
push eax
call fcn.00426550
add esp, 4
test eax, eax
je 0x426a45
cmp dword [ebp + 0xc], 0xffffffff
jne 0x426a3e
mov eax, dword [ebp - 0x238]
jmp 0x426a47
mov eax, 1
jmp 0x426a47
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00410c05
mov esp, ebp
pop ebp
ret
Function at 0x426de0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fcfb
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x43fc54]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], 1
lea ecx, [ebp - 0x2c]
call fcn.00402600
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00402600
mov byte [ebp - 4], 1
push 0x104
lea ecx, [ebp - 0x2c]
call fcn.00402fa0
push eax
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x30], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403000
cmp dword [ebp - 0x30], 0
jne 0x426e71
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402760
push str.AdobeARM1.0
lea ecx, [ebp - 0x28]
call fcn.004027c0
jmp 0x426ec7
push str.SHGetFolderPath_in_UpdateArmFiles_failed
lea ecx, [ebp - 0x44]
call fcn.00402640
mov byte [ebp - 4], 2
push 0
lea ecx, [ebp - 0x44]
push ecx
push 1
call fcn.0042e9d0
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.00402740
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x48], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00402740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402740
mov eax, dword [ebp - 0x48]
jmp 0x426ff8
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x24]
call fcn.004059bb
mov byte [ebp - 4], 3
push 0x43528c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00402d50
add esp, 0xc
mov byte [ebp - 4], 4
push 0
lea ecx, [ebp - 0x3c]
call fcn.004016d0
push eax
lea ecx, [ebp - 0x24]
call fcn.00405a53
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x426fb4
cmp dword [ebp - 0x38], 0
jne 0x426fb4
lea ecx, [ebp - 0x24]
call fcn.0040569d
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x24]
call fcn.0040597c
test eax, eax
je 0x426f36
jmp 0x426f09
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x24]
call fcn.00405d11
mov byte [ebp - 4], 5
push 0x443c58
lea eax, [ebp - 0x40]
push eax
call fcn.00402eb0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x426f76
push 0x443c5c
lea edx, [ebp - 0x40]
push edx
call fcn.00402eb0
add esp, 8
movzx eax, al
test eax, eax
je 0x426f84
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00402740
jmp 0x426f09
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00426af0
add esp, 0xc
test eax, eax
jne 0x426fa3
mov dword [ebp - 0x38], 1
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00402740
jmp 0x426f09
lea ecx, [ebp - 0x24]
call fcn.004055b7
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3c]
call fcn.00402740
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.004059e4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00402740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402740
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x427010
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fd26
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x43fc54]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call fcn.00402600
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00402fa0
push eax
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00403000
cmp dword [ebp - 0x14], 0
jne 0x42708e
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402760
push str.AdobeARM1.0AdobeARM.exe
mov ecx, dword [ebp + 8]
call fcn.004027c0
jmp 0x4270d8
push str.SHGetFolderPath_in_GetARMExePath_failed:
lea ecx, [ebp - 0x18]
call fcn.00402640
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
push 1
call fcn.0042e9d0
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402740
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402740
mov eax, dword [ebp - 0x1c]
jmp 0x4270f1
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402740
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4272c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0x443cac], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x443cb4], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x443cb0], edx
mov dword [0x443cc4], 0
push 0
push 0
push 0
push 0x427210
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x427340
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x43fc54]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov ecx, 0x20
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea edi, [ebp - 0x90]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], 0
mov dword [ebp - 0x94], 0
cmp dword [ebp - 0x94], 8
jae 0x4274dd
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x94]
movzx ecx, byte [eax]
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x94]
add edx, 1
mov dword [ebp - 0x94], edx
cmp dword [ebp - 0x94], 8
jae 0x4273d4
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x94]
movzx ecx, byte [eax]
mov dword [ebp - 0xa4], ecx
mov edx, dword [ebp - 0x94]
add edx, 1
mov dword [ebp - 0x94], edx
jmp 0x4273de
mov dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0x94], 8
jae 0x427416
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x94]
movzx edx, byte [ecx]
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0x94]
add eax, 1
mov dword [ebp - 0x94], eax
jmp 0x427420
mov dword [ebp - 0xa8], 0
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0x98]
shr edx, 2
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dx, word [ebp + edx*2 - 0x90]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xa0]
shr ecx, 4
mov edx, dword [ebp - 0x98]
and edx, 3
shl edx, 4
or ecx, edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov cx, word [ebp + ecx*2 - 0x90]
mov word [edx + eax*2], cx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x9c]
shr eax, 6
mov ecx, dword [ebp - 0xa0]
and ecx, 0xf
shl ecx, 2
or eax, ecx
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov ax, word [ebp + eax*2 - 0x90]
mov word [ecx + edx*2], ax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x9c]
and edx, 0x3f
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dx, word [ebp + edx*2 - 0x90]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x42737a
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, 0x3d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov word [ecx + eax*2], dx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov word [edx + ecx*2], ax
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00410c05
mov esp, ebp
pop ebp
ret