joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b300
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x5cc440]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov edi, dword [eax]
mov dword [ebp - 0x28], 0
movsd xmm0, qword [0x574ae0]
movsd qword [ebp - 0x18], xmm0
mov byte [ebp - 0x28], 0
push edi
call fcn.0050a930
add esp, 4
mov esi, eax
cmp eax, 0xf
jbe 0x43b35c
sub esp, 0xc
mov al, byte [ebp - 0x2c]
mov byte [esp + 4], al
mov dword [esp + 8], edi
mov dword [esp], esi
lea ecx, [ebp - 0x28]
call fcn.00407350
jmp 0x43b372
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x28]
push esi
push edi
push eax
call fcn.00504b50
add esp, 0xc
mov byte [ebp + esi - 0x28], 0
mov eax, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea esi, [ebp - 0x28]
mov dword [ebp - 0x30], eax
cmovae esi, eax
test ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ecx
je 0x43b3a7
lea edx, [ebx - 1]
mov ecx, ebx
and ecx, 3
cmp edx, 3
jae 0x43b3ae
mov edx, 0x811c9dc5
xor edi, edi
jmp 0x43b3fa
mov edx, 0x811c9dc5
jmp 0x43b421
and ebx, 0xfffffffc
mov edx, 0x811c9dc5
xor edi, edi
nop dword [eax + eax]
movzx eax, byte [esi + edi]
xor eax, edx
imul eax, eax, 0x1000193
movzx edx, byte [esi + edi + 1]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + edi + 2]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + edi + 3]
xor edx, eax
imul edx, edx, 0x1000193
add edi, 4
cmp ebx, edi
jne 0x43b3c0
test ecx, ecx
je 0x43b421
add edi, esi
xor ebx, ebx
nop word cs:[eax + eax]
movzx eax, byte [edi + ebx]
xor eax, edx
imul edx, eax, 0x1000193
inc ebx
cmp ecx, ebx
jne 0x43b410
mov eax, dword [ebp + 8]
and edx, dword [eax + 0x18]
mov ecx, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edx*8 + 4]
mov dword [ebp - 0x34], ecx
cmp edi, ecx
mov ecx, dword [ebp - 0x38]
je 0x43b487
add edx, edx
mov ebx, dword [eax + edx*4]
cmp ecx, dword [edi + 0x18]
jne 0x43b475
nop word cs:[eax + eax]
cmp dword [edi + 0x1c], 0x10
jb 0x43b460
mov eax, dword [edi + 8]
jmp 0x43b463
lea eax, [edi + 8]
push ecx
push eax
push esi
call fcn.005056c7
mov ecx, dword [ebp - 0x38]
add esp, 0xc
test eax, eax
je 0x43b483
cmp edi, ebx
je 0x43b487
mov edi, dword [edi + 4]
cmp ecx, dword [edi + 0x18]
je 0x43b450
jmp 0x43b475
test edi, edi
jne 0x43b48a
mov edi, dword [ebp - 0x34]
mov edx, dword [ebp - 0x3c]
cmp edx, 0x10
jb 0x43b4c1
lea ecx, [edx + 1]
cmp ecx, 0x1000
jb 0x43b4b4
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, eax
cmp ecx, 0x20
jae 0x43b4db
add edx, 0x24
mov ecx, edx
jmp 0x43b4b7
mov eax, dword [ebp - 0x30]
push ecx
push eax
call fcn.00503276
add esp, 8
cmp edi, dword [ebp - 0x34]
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005035b5
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005099a6
Function at 0x440b50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, dword [0x5cc440]
xor eax, ebp
mov dword [esp + 0x48], eax
cmp ebx, 0xffffffff
je 0x440c72
mov esi, ecx
mov eax, dword [ecx + 0x20]
cmp dword [eax], 0
je 0x440b9a
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
test ecx, ecx
jle 0x440b9a
dec ecx
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
lea edx, [ecx + 1]
mov dword [eax], edx
mov byte [ecx], bl
jmp 0x440cb4
cmp dword [esi + 0x4c], 0
je 0x440c76
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0x3c]
cmp dword [eax], ecx
jne 0x440bc2
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov edi, dword [esi + 0x38]
test edi, edi
je 0x440c7d
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov byte [esp + 0x1f], bl
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
lea eax, [esi + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [edi]
mov ecx, dword [eax + 0x1c]
mov dword [esp + 0xc], ecx
call dword [0x57044c]
lea eax, [esp + 0x20]
lea edx, [esp + 0x1f]
mov ecx, edi
mov edi, edx
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x44]
push edx
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x30]
push eax
push edi
push dword [esp + 0x28]
call dword [esp + 0x28]
mov ecx, 0xffffffff
cmp eax, 2
jae 0x440c94
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x20]
sub edi, eax
je 0x440c5f
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00512c29
mov ecx, 0xffffffff
add esp, 0x10
cmp edi, eax
jne 0x440cb2
mov byte [esi + 0x3d], 1
lea eax, [esp + 0x1f]
cmp dword [esp + 0x18], eax
mov eax, 0xffffffff
jmp 0x440cad
xor ebx, ebx
jmp 0x440cb4
mov ebx, 0xffffffff
jmp 0x440cb4
movsx eax, bl
push dword [esi + 0x4c]
push eax
call fcn.00512cb5
add esp, 8
cmp eax, 0xffffffff
cmove ebx, eax
jmp 0x440cb4
cmp eax, 3
jne 0x440cb2
movsx eax, byte [esp + 0x1f]
push dword [esi + 0x4c]
push eax
call fcn.00512cb5
add esp, 8
cmp eax, 0xffffffff
cmove ebx, eax
mov ecx, ebx
mov ebx, ecx
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005035b5
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x441080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
cmp esi, 1
mov eax, ebx
sbb eax, 0
jl 0x441143
mov edx, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 0x38], 0
mov dword [ebp - 0x10], ecx
je 0x44114c
mov ecx, esi
mov esi, ebx
mov ebx, edi
jmp 0x441102
mov edx, dword [ebp - 0x14]
cmp edx, ecx
mov edi, ecx
cmovb edi, edx
test esi, esi
cmovne edi, ecx
push edi
push eax
push ebx
call fcn.00504b50
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add esp, 0xc
add ebx, edi
sub ecx, edi
sbb esi, 0
mov eax, dword [edx + 0x2c]
sub dword [eax], edi
mov eax, dword [edx + 0x1c]
add dword [eax], edi
mov eax, ecx
neg eax
mov eax, 0
sbb eax, esi
jge 0x4411ee
mov dword [ebp - 0x14], ecx
mov eax, dword [edx + 0x1c]
mov eax, dword [eax]
test eax, eax
je 0x441117
mov ecx, dword [edx + 0x2c]
mov ecx, dword [ecx]
test ecx, ecx
jg 0x4410c0
mov eax, dword [edx]
mov edi, dword [eax + 0x1c]
mov ecx, edi
call dword [0x57044c]
mov ecx, dword [ebp - 0x10]
call edi
cmp eax, 0xffffffff
je 0x4411eb
mov byte [ebx], al
inc ebx
mov ecx, dword [ebp - 0x14]
add ecx, 0xffffffff
adc esi, 0xffffffff
mov edx, dword [ebp - 0x10]
jmp 0x4410f1
xor eax, eax
xor edx, edx
jmp 0x441220
mov eax, dword [edx + 0x1c]
mov eax, dword [eax]
test eax, eax
je 0x44117f
mov ecx, dword [edx + 0x2c]
mov ebx, dword [ecx]
test ebx, ebx
je 0x44117f
cmp ebx, esi
cmovae ebx, esi
push ebx
push eax
push edi
call fcn.00504b50
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov eax, dword [edx + 0x2c]
sub dword [eax], ebx
mov eax, dword [edx + 0x1c]
add dword [eax], ebx
add edi, ebx
sub esi, ebx
cmp dword [edx + 0x4c], 0
je 0x441213
mov eax, dword [edx + 0xc]
lea ecx, [edx + 0x3c]
cmp dword [eax], ecx
jne 0x4411c0
mov ecx, dword [edx + 0x50]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c]
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x2c]
mov dword [eax], edx
mov edx, dword [ebp - 0x10]
nop word cs:[eax + eax]
cmp esi, 0x1000
jb 0x4411fa
push dword [edx + 0x4c]
push 0xfff
push 1
push edi
call fcn.00511f8f
mov edx, dword [ebp - 0x10]
add esp, 0x10
add edi, eax
sub esi, eax
cmp eax, 0xfff
je 0x4411c0
jmp 0x441213
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
sub eax, ecx
mov edx, dword [ebp + 0x10]
sbb edx, esi
jmp 0x441220
test esi, esi
je 0x441211
push dword [edx + 0x4c]
push esi
push 1
push edi
call fcn.00511f8f
add esp, 0x10
sub esi, eax
jmp 0x441213
xor esi, esi
mov ebx, dword [ebp + 0xc]
sub ebx, esi
mov eax, ebx
mov edx, dword [ebp + 0x10]
sbb edx, 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x441230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, ecx
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [edx + 0x38], 0
mov dword [ebp - 0x10], edx
je 0x441301
cmp ecx, 1
mov eax, edi
sbb eax, 0
mov eax, edi
mov edi, ecx
mov ecx, eax
jl 0x441398
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
jmp 0x4412b9
cmp edi, ecx
mov esi, ecx
cmovb esi, edi
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x18]
test ebx, ebx
cmovne esi, ecx
push esi
push dword [ebp - 0x14]
push eax
call fcn.00504b50
mov ecx, ebx
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add esp, 0xc
add ebx, esi
sub edi, esi
sbb ecx, 0
mov eax, dword [edx + 0x30]
sub dword [eax], esi
mov eax, dword [edx + 0x20]
add dword [eax], esi
mov eax, edi
neg eax
mov eax, 0
sbb eax, ecx
jge 0x441398
mov dword [ebp - 0x18], ecx
mov eax, dword [edx + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x4412ce
mov ecx, dword [edx + 0x30]
mov ecx, dword [ecx]
test ecx, ecx
jg 0x441270
movzx eax, byte [ebx]
mov dword [ebp - 0x14], eax
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x57044c]
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x14]
call esi
cmp eax, 0xffffffff
je 0x441395
inc ebx
add edi, 0xffffffff
mov ecx, dword [ebp - 0x18]
adc ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
jmp 0x4412a8
mov eax, dword [edx + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x441360
cmp dword [ebp + 0xc], 1
mov ecx, edi
sbb ecx, 0
jl 0x441360
mov ecx, edx
mov edx, ebx
mov ecx, dword [ecx + 0x30]
mov esi, dword [ecx]
test esi, esi
jle 0x441362
mov ebx, dword [ebp + 0xc]
cmp esi, ebx
mov ecx, ebx
cmovb ecx, esi
test edi, edi
cmove esi, ebx
cmove esi, ecx
push esi
mov ebx, edx
push edx
push eax
call fcn.00504b50
add esp, 0xc
add ebx, esi
mov edx, ebx
mov eax, edi
mov edi, dword [ebp + 0xc]
sub edi, esi
mov ecx, eax
sbb ecx, 0
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x30]
sub dword [eax], esi
mov eax, dword [ebx + 0x20]
add dword [eax], esi
jmp 0x441369
mov edx, ebx
mov eax, edi
mov edi, dword [ebp + 0xc]
mov ecx, eax
cmp edi, 1
mov eax, ecx
sbb eax, 0
jl 0x441398
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x4c]
test eax, eax
je 0x441398
push eax
push edi
push 1
push edx
mov esi, ecx
call fcn.00512c29
mov ecx, esi
add esp, 0x10
sub edi, eax
sbb ecx, 0
jmp 0x441398
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
sub eax, edi
mov edx, dword [ebp + 0x10]
sbb edx, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x441770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x5cc440]
xor eax, ebp
mov dword [esp + 0x38], eax
mov bl, 1
cmp dword [ecx + 0x38], 0
je 0x441837
mov esi, ecx
cmp byte [ecx + 0x3d], 0
je 0x441837
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x57044c]
mov ecx, esi
push 0xffffffffffffffff
call edi
cmp eax, 0xffffffff
je 0x441835
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], 0xffffffff
mov ebx, dword [esi + 0x38]
lea eax, [esi + 0x40]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [0x57044c]
lea eax, [esp + 0xc]
lea edx, [esp + 0x10]
mov ecx, ebx
mov ebx, edx
push eax
lea eax, [esp + 0x34]
push eax
push edx
push dword [esp + 0x14]
call edi
cmp eax, 3
je 0x44184c
cmp eax, 1
je 0x441811
test eax, eax
jne 0x441835
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 0xc]
sub edi, ebx
je 0x44182c
push dword [esi + 0x4c]
push edi
push 1
push ebx
call fcn.00512c29
add esp, 0x10
cmp edi, eax
jne 0x441835
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x441837
xor ebx, ebx
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.005035b5
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x3d], 0
mov bl, 1
jmp 0x441837

Function at 0x444690
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5d8bf8]
mov ecx, dword [0x5da474]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x4446bb
mov ecx, 0x5d8bf0
pop ebp
jmp fcn.00431680
push 0x5d8bf8
call fcn.00503551
add esp, 4
cmp dword [0x5d8bf8], 0xffffffff
jne 0x4446b0
mov dword [0x5d8bf4], 0
mov dword [0x5d8bf0], 0
mov ecx, 0x5d8bf0
push 0
call fcn.004316f0
push 0x5d8bf8
call fcn.00503500
add esp, 4
jmp 0x4446b0

Function at 0x4474fe
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x20]
mov ebx, dword [ebp + 8]
movups xmm0, xmmword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
xor edx, edx
mov dword [edi], edx
mov ecx, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], eax
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edx
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x44755d
mov esi, eax
mov ebx, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 3
xor ecx, ecx
push ecx
push ecx
push edi
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [ecx + ecx*4]
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x4490f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x449169
mov ecx, dword [ebp + 0xc]
cmp ebx, 1
jne 0x44910c
xor esi, esi
jmp 0x44914e
and ebx, 0xfffffffe
xor esi, esi
nop word cs:[eax + eax]
movzx edi, al
movzx edx, byte [ecx + esi]
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x578114]
movzx edx, al
movzx edi, byte [ecx + esi + 1]
xor edi, edx
shr eax, 8
xor eax, dword [edi*4 + 0x578114]
add esi, 2
cmp ebx, esi
jne 0x449120
mov edx, dword [ebp + 0x10]
test dl, 1
je 0x449169
movzx edx, al
movzx ecx, byte [ecx + esi]
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x578114]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x44c71c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesAdobeAcrobat_ReaderDCFeatureLockDown
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44c788
lea eax, [ebp - 0x10]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
push esi
push str.bEnableATL7Compat
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44c77f
cmp dword [ebp - 8], 4
jne 0x44c77f
inc eax
cmp dword [ebp - 0xc], eax
cmove esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x44c78d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push esi
push edi
push eax
push 0x20019
xor edi, edi
xor esi, esi
push edi
push str.SoftwareAdobeAdobe_AcrobatDCSecurity
push 0x80000002
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44c7f3
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push edi
push 0x57445c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44c7ea
cmp dword [ebp - 4], eax
cmove esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x44e1b0
Capabilities:
Create thread

Disassembly:
push 0x24
mov eax, 0x556376
call fcn.00503628
mov esi, ecx
call fcn.0044cc56
add esi, 0xfffffffc
cmp dword [eax + 4], 0
mov edi, dword [esi]
ja 0x44e215
mov ecx, dword [edi + 8]
call dword [0x57044c]
mov ecx, esi
call dword [edi + 8]
call fcn.004670b0
call fcn.0049ed3e
test al, al
jne 0x44e282
cmp dword [0x5d9774], 0
je 0x44e282
xor ecx, ecx
lea eax, [ebp - 0x30]
push eax
push ecx
push esi
push 0x44d0b0
push ecx
push ecx
mov dword [ebp - 0x30], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x44e282
mov ebx, 0x57433a
lea ecx, [ebp - 0x28]
push ebx
call fcn.0044b88b
mov ecx, dword [edi + 0x28]
lea eax, [ebp - 0x28]
and dword [ebp - 4], 0
push 1
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [0x57044c]
mov ecx, esi
call dword [edi + 0x28]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0044d7bd
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x44e270
call fcn.0044c933
sub esp, 0x18
mov esi, eax
mov ecx, esp
push ebx
call fcn.0044b88b
push 1
mov ecx, esi
call fcn.004b3a8c
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], 3
test eax, eax
je 0x44e282
push eax
call fcn.0044ced0
pop ecx
call fcn.005035d7
ret
Function at 0x49a9d0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5cc440]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x49aaa3
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
call fcn.00503dc0
movsd xmm1, qword [0x57ca48]
divsd xmm1, xmm0
xorps xmm0, xmm0
comisd xmm0, xmm1
movsd qword [ebp - 0xc], xmm1
jae 0x49aaa3
push esi
lea eax, [ebp - 0x14]
xor esi, esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x49aa44
inc esi
cmp esi, 3
ja 0x49aa70
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x49aa30
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.00503dc0
mulsd xmm0, qword [ebp - 0xc]
call fcn.00503cc0
mov dword [edi], eax
mov eax, edi
pop esi
mov dword [edi + 4], edx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005035b5
mov esp, ebp
pop ebp
ret
push 0x34
push 0x57c8c8
push str.0___Boost::Chrono___QueryPerformanceCounter_Internal_Error_
call fcn.00513d3d
add esp, 0xc
mov dword [edi], 0
mov dword [edi + 4], 0
mov eax, edi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005035b5
mov esp, ebp
pop ebp
ret
push 0x2c
push 0x57c8c8
push str.0___Boost::Chrono___get_nanosecs_per_tic_Internal_Error_
call fcn.00513d3d
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [edi], 0
mov eax, edi
mov dword [edi + 4], 0
xor ecx, ebp
pop edi
call fcn.005035b5
mov esp, ebp
pop ebp
ret
Function at 0x49e3e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov bl, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x49e457
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push 0x20019
push edi
push 0x57ce00
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e457
cmp dword [esi + 0x14], 0xf
movzx eax, bl
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
jbe 0x49e430
mov esi, dword [esi]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x49e44e
cmp dword [ebp - 8], edi
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x49e45e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov bl, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x49e4d1
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push 0x20019
push edi
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e4d1
cmp dword [esi + 0x14], 0xf
movzx eax, bl
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
jbe 0x49e4aa
mov esi, dword [esi]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x49e4c8
cmp dword [ebp - 8], edi
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x49e6fa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push ebx
push eax
push 1
xor ebx, ebx
push ebx
push dword [0x5cc248]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e75b
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [0x5cc24c]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49e752
cmp dword [ebp - 0xc], 4
jne 0x49e752
cmp dword [ebp - 0x10], ebx
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret
Function at 0x49e760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5cc440]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
call fcn.0049e83d
mov esi, eax
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.0049d4e8
cmp eax, dword [esi]
jne 0x49e795
xor al, al
jmp 0x49e82f
mov esi, dword [eax + 0x14]
push ebx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.004bd23c
pop ecx
test al, al
je 0x49e7f2
cmp dword [ebp + 8], 1
jne 0x49e7f2
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], ebx
push eax
push ebx
push ebx
push 0x578aec
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x49e82c
cmp dword [ebp - 0x210], ebx
je 0x49e82c
push dword [ebp - 0x210]
mov ecx, edi
call fcn.0049f731
push dword [ebp - 0x210]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x49e82a
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.005050d0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x49e82c
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.0049f731
mov bl, 1
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005035b5
leave
ret

Function at 0x49e939
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push esi
push eax
push 1
push 0
push dword [0x5cc250]
or esi, 0xffffffff
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e999
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [0x5cc254]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49e990
cmp dword [ebp - 0xc], 4
cmove esi, dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret