joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469770
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00510680
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.0045bd10
push 1
push 0x5b4a54
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00525485
push 3
push 0x5b60e8
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00525485
push 0x208
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.00510680
add esp, 0x40
lea eax, [ebp - 0x310]
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46982d
push 0
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
Function at 0x4739c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57a798
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x90], 0x67452301
mov dword [ebp - 0x8c], 0xefcdab89
cmp dword [edx + 0x14], 0x10
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x88], 0x98badcfe
mov dword [ebp - 0x84], 0x10325476
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
jb 0x473a36
mov edx, dword [edx]
push eax
lea ecx, [ebp - 0x90]
call fcn.00474e60
add esp, 4
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x90]
call fcn.00474f80
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x473a78
mov eax, dword [esi]
jmp 0x473a7a
mov eax, esi
lea edx, [ebp - 0x20]
cmp edx, eax
jb 0x473ab5
cmp ecx, 0x10
jb 0x473a8a
mov edx, dword [esi]
jmp 0x473a8c
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
lea edx, [ebp - 0x20]
cmp eax, edx
jbe 0x473ab5
cmp ecx, 0x10
jb 0x473aa1
mov ecx, dword [esi]
jmp 0x473aa3
mov ecx, esi
push 0x10
lea eax, [ebp - 0x20]
sub eax, ecx
mov ecx, esi
push eax
push esi
call fcn.0044d670
jmp 0x473af0
cmp ecx, 0x10
jae 0x473ac6
push dword [esi + 0x10]
mov ecx, esi
push 0x10
call fcn.0044ae00
cmp dword [esi + 0x14], 0x10
jb 0x473ad0
mov eax, dword [esi]
jmp 0x473ad2
mov eax, esi
movups xmm0, xmmword [ebp - 0x20]
movups xmmword [eax], xmm0
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0x10
jb 0x473aea
mov eax, dword [esi]
jmp 0x473aec
mov eax, esi
mov byte [eax + 0x10], 0
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
push esi
call fcn.00473f30
mov edi, eax
test edi, edi
je 0x473b09
push str.Failed_to_Encrypt_checksum.
jmp 0x473b31
cmp dword [ebp - 0x24], 0x10
lea ecx, [ebp - 0x38]
mov edx, dword [ebp - 0x28]
cmovae ecx, dword [ebp - 0x38]
push esi
call fcn.00475a30
add esp, 4
push esi
call fcn.00473900
mov edi, eax
test edi, edi
je 0x473b3b
push str.Failed_to_scramble_checksum.
push 4
call fcn.0046cc00
add esp, 8
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x473b50
inc eax
lea ecx, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
call fcn.0044ad40
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret 8
Function at 0x475a30
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, edx
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], esi
jb 0x475a4d
mov eax, dword [edi]
jmp 0x475a4f
mov eax, edi
mov byte [eax], 0
test ecx, ecx
je 0x475baa
test ebx, ebx
je 0x475baa
mov al, byte [ecx]
dec ebx
mov byte [ebp + esi - 8], al
inc ecx
mov ah, byte [ebp - 6]
inc esi
mov dl, byte [ebp - 7]
mov dh, byte [ebp - 8]
mov dword [ebp - 0x10], ecx
mov byte [ebp - 2], ah
mov byte [ebp + 0xb], dl
mov byte [ebp - 1], dh
cmp esi, 3
jne 0x475ae7
mov al, dh
mov cl, dh
shr al, 2
and cl, 3
mov byte [ebp - 0xc], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0xb], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ah
and al, 0x3f
mov byte [ebp - 0xa], cl
mov byte [ebp - 9], al
xor esi, esi
nop word [eax + eax]
movzx eax, byte [ebp + esi - 0xc]
mov ecx, edi
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push 1
call fcn.00454960
inc esi
cmp esi, 4
jl 0x475ac0
mov ecx, dword [ebp - 0x10]
xor esi, esi
mov dl, byte [ebp + 0xb]
mov dh, byte [ebp - 1]
test ebx, ebx
jne 0x475a62
mov dword [ebp + 8], esi
test esi, esi
je 0x475ba0
mov eax, esi
cmp esi, 3
jge 0x475b20
cmp eax, 3
jae 0x475bb3
mov byte [ebp + eax - 8], 0
inc eax
cmp eax, 3
jl 0x475b04
mov cl, byte [ebp - 6]
mov dl, byte [ebp - 7]
mov dh, byte [ebp - 8]
jmp 0x475b23
mov cl, byte [ebp - 2]
mov al, dh
xor ebx, ebx
shr al, 2
and dh, 3
mov byte [ebp - 0xc], al
mov al, dl
shr al, 4
and dl, 0xf
shl dh, 4
add dh, al
shl dl, 2
mov al, cl
mov byte [ebp - 0xb], dh
shr al, 6
and cl, 0x3f
add dl, al
mov byte [ebp - 9], cl
lea eax, [esi + 1]
mov byte [ebp - 0xa], dl
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x475b7e
mov esi, eax
nop
movzx eax, byte [ebp + ebx - 0xc]
mov ecx, edi
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push 1
call fcn.00454960
inc ebx
cmp ebx, esi
jl 0x475b60
mov esi, dword [ebp + 8]
cmp esi, 3
jge 0x475ba0
mov ebx, 3
sub ebx, esi
nop word [eax + eax]
push 0x3d
push 1
mov ecx, edi
call fcn.00454960
sub ebx, 1
jne 0x475b90
mov eax, dword [edi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0050b4a4
int3
Function at 0x478bd0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b570
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
xor bl, bl
cmp dword [ebp + 0x18], 0
je 0x478d1e
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call fcn.00524175
add esp, 8
test eax, eax
jne 0x478c30
mov bl, 1
jmp 0x478d1e
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
push 2
sub esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0047f520
cmp eax, 0xffffffff
je 0x478d1e
push eax
push 0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp + 8]
call fcn.004649c0
push eax
lea ecx, [ebp - 0x28]
call fcn.00457330
lea ecx, [ebp - 0x44]
call fcn.0044d0b0
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.0044d8f0
mov ecx, esi
call fcn.00478bd0
cmp al, 1
jne 0x478d09
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call fcn.00525bf8
add esp, 4
test eax, eax
jne 0x478cee
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push str.Created__S
push 0
push 4
push str.AdobeGCUpdaterCFU
push dword [esi + 4]
call fcn.004a7700
add esp, 0x18
mov bl, 1
jmp 0x478d09
push str.Failed_to_Create__S
push 0
push 4
push str.AdobeGCUpdaterCFU
push dword [esi + 4]
call fcn.004a7700
add esp, 0x14
xor bl, bl
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x478d1e
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0044d810
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x478d33
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.0044d810
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret 0x18
Function at 0x478d60
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5cad78
push 0x510d10
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x5df3f4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x64], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], 0x7530
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 1
push esi
mov edi, dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
call edi
test eax, eax
jne 0x478efa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x478ebe
push dword [ebp - 0x48]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x54], eax
test eax, eax
je 0x478ebe
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp - 0x48]
push eax
push 1
push esi
call edi
test eax, eax
je 0x478eab
xor edi, edi
mov dword [ebp - 0x50], edi
cmp edi, dword [ebp - 0x20]
jae 0x478eee
lea eax, [edi + edi*8]
mov ecx, dword [ebp - 0x54]
movups xmm1, xmmword [ecx + eax*4]
movups xmm0, xmmword [ecx + eax*4 + 0x10]
movups xmmword [ebp - 0x78], xmm0
mov eax, dword [ecx + eax*4 + 0x20]
mov dword [ebp - 0x68], eax
push 0x24
movd eax, xmm1
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x60], esi
test esi, esi
je 0x478eab
mov dword [ebp - 4], 1
lea eax, [ebp - 0x44]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x478eab
cmp dword [ebp - 0x40], 1
je 0x478ec2
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x48]
push eax
push 0x24
lea eax, [ebp - 0x44]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x478eab
cmp dword [ebp - 0x40], 1
je 0x478ec2
call ebx
sub eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x5c]
jbe 0x478e75
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x5df3f4
call fcn.00512bc0
add esp, 0xc
xor eax, eax
jmp 0x478eff
mov dword [ebp - 4], 0
call fcn.00478ee6
inc edi
jmp 0x478e1e
mov dword [ebp - 4], 0xfffffffe
call fcn.00478f1b
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
Function at 0x47c080
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 4], eax
xor ecx, ecx
mov eax, 3
cmp byte [0x5b86ec], cl
push edi
mov edi, dword [ebp + 8]
cmove eax, ecx
push eax
push 0x5b86ec
mov ecx, edi
call fcn.0044d570
xorps xmm0, xmm0
mov byte [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
movq qword [ebp - 0x1b], xmm0
movups xmmword [ebp - 0x2b], xmm0
mov dword [ebp - 0x13], 0
mov word [ebp - 0xf], 0
mov byte [ebp - 0xd], 0
call fcn.00457120
cmp byte [ebp - 0x2c], 0
jne 0x47c0e4
xor ecx, ecx
jmp 0x47c0f9
lea ecx, [ebp - 0x2c]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47c0f0
sub ecx, edx
push ecx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [edi + 0x18]
call fcn.0044d570
xor eax, eax
mov byte [ebp - 0xc], 0
push 8
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
lea eax, [ebp - 0xc]
push eax
push 0x59
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea ecx, [eax - 2]
cmp ecx, 5
ja 0x47c14a
lea ecx, [ebp - 0xc]
push 8
add eax, ecx
push eax
push 0x5a
push 0x400
mov byte [eax - 1], 0x5f
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp byte [ebp - 0xc], 0
jne 0x47c154
xor ecx, ecx
jmp 0x47c169
lea ecx, [ebp - 0xc]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47c160
sub ecx, edx
push ecx
lea eax, [ebp - 0xc]
push eax
lea ecx, [edi + 0x30]
call fcn.0044d570
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0050ad85
mov esp, ebp
pop ebp
ret 4
Function at 0x481570
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c22e
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00510680
add esp, 0xc
xor bl, bl
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4816bc
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x4816b5
cmp word [ebp - 0x218], 0
je 0x4816b5
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
lea edx, [ebp - 0x230]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x218]
call fcn.00456f20
test al, al
je 0x4816aa
mov dword [ebp - 0x234], 0xf
mov dword [ebp - 0x238], 0
mov byte [ebp - 0x248], bl
mov byte [ebp - 4], 2
lea eax, [ebp - 0x24c]
cmp dword [ebp - 0x21c], 8
lea esi, [ebp - 0x230]
push eax
cmovae esi, dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00451540
lea ecx, [ebp - 0x248]
push dword [eax]
push esi
call fcn.00454a10
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x248]
call fcn.0044d150
lea ecx, [ebp - 0x248]
mov esi, eax
call fcn.0044d1a0
test esi, esi
sete bl
lea ecx, [ebp - 0x230]
call fcn.0044d0b0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x20]
cmp ecx, 0x10
jb 0x4816d1
inc ecx
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0044ad40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x484370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
test ecx, ecx
je 0x4843fa
test esi, esi
je 0x4843fa
push ebx
lea eax, [ebp - 0x14]
xor bl, bl
push eax
push 1
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4843df
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4843df
cmp dword [ebp - 0x10], 0
mov eax, 1
movzx ebx, bl
cmove ebx, eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0050ad85
mov esp, ebp
pop ebp
ret

Function at 0x484910
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x108]
mov esi, ecx
push 0
push eax
call fcn.00510680
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push SysReAllocString
push str.System32driversetchosts
call fcn.0052591a
push eax
push str.System32driversetchosts
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00525485
lea eax, [ebp - 0x108]
push eax
call fcn.0045b4a0
add esp, 0x1c
test eax, eax
je 0x4849bb
lea eax, [ebp - 0x108]
push 0x5b4038
push eax
call fcn.0045b290
add esp, 8
mov dword [0x5efb74], eax
test eax, eax
je 0x4849b0
push str.Hostfile_opened_successfully
jmp 0x4849c0
push str.Error_opening_host_file
push 0
push 5
jmp 0x4849c4
push str.No_host_file_found
push 0
push 4
push str.AdobeGCHostfileValidation
push dword [esi]
call fcn.004a7700
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop esi
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
Function at 0x48b5f0
Capabilities:
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e158
mov eax, dword fs:[0]
push eax
sub esp, 0x314
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push str.Storing_XML_Started
push 0
push 4
mov dword [ebp - 4], 0
push str.AdobeGCUpdaterXMLWrapper
push dword [0x5efb84]
call fcn.004a7700
add esp, 0x14
cmp dword [ebp + 0x18], 0
je 0x48b805
lea eax, [ebp - 0x31c]
push eax
push 0
push 0
push 0x2e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x48b7fe
push 0x104
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.005298eb
push SysReAllocString
push 0x5b4a54
call fcn.0052591a
push eax
push 0x5b4a54
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00525485
push 7
push 0x5bbf1c
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00525485
lea edi, [ebp - 0x31c]
add esp, 0x34
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x48b6d0
mov eax, dword [0x5b5b4c]
lea ecx, [ebp - 0x31c]
mov dword [edi], eax
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x48b6f0
mov eax, dword [str.AdobeGC]
mov dword [ecx], eax
mov eax, dword [0x5bc020]
mov dword [ecx + 4], eax
mov eax, dword [0x5bc024]
mov dword [ecx + 8], eax
mov eax, dword [0x5bc028]
mov dword [ecx + 0xc], eax
lea eax, [ebp - 0x114]
push eax
call fcn.0045b4a0
add esp, 4
test eax, eax
jne 0x48b760
lea eax, [ebp - 0x114]
push eax
call fcn.0045b710
add esp, 4
mov esi, eax
lea eax, [ebp - 0x31c]
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test esi, esi
je 0x48b760
push str.Could_not_retreive_path_to_folder
push 0
push 5
jmp 0x48b82a
push SysReAllocString
push 0x5b4a54
call fcn.0052591a
push eax
push 0x5b4a54
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00525485
push 0xe
push str.adobegc_XXXXXX
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00525485
lea eax, [ebp - 0x320]
mov dword [ebp - 0x320], 0
push eax
lea ecx, [ebp - 0x114]
call fcn.0045b510
add esp, 0x2c
test eax, eax
je 0x48b821
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov esi, dword [ebp - 0x320]
cmovae eax, dword [ebp + 8]
push eax
push 0x5b4088
push esi
call fcn.0048b130
add esp, 0xc
test eax, eax
jle 0x48b7f3
lea eax, [ebp - 0x114]
mov ecx, ebx
push eax
call fcn.0044d530
push esi
call fcn.00518f1e
add esp, 4
jmp 0x48b821
push str.Could_not_retreive_path_to_directory
jmp 0x48b80a
push str.No_data_to_write
push 0
push 5
push str.AdobeGCUpdaterXMLWrapper
push dword [0x5efb84]
call fcn.004a7700
add esp, 0x14
push str.Storing_XML_Ended
push 0
push 4
push str.AdobeGCUpdaterXMLWrapper
push dword [0x5efb84]
call fcn.004a7700
mov eax, dword [ebp + 0x1c]
add esp, 0x14
cmp eax, 0x10
jb 0x48b852
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.0044ad40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
Function at 0x48c840
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
test esi, esi
je 0x48c8ca
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x48c8ca
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x48c871
shr eax, 4
pop esi
and eax, 1
pop ebx
pop ebp
ret 4
push edi
push esi
call fcn.0052cda6
mov edi, eax
push 0x5c
push edi
call fcn.00548106
add esp, 0xc
test eax, eax
je 0x48c8c1
xor ecx, ecx
mov word [eax], cx
mov ecx, ebx
push edi
call fcn.0048c840
push edi
test al, al
jne 0x48c8ac
call fcn.00524165
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
call fcn.00524165
add esp, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x48c8a3
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
pop esi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x48c8e0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
jne 0x48c910
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp eax, 1
sete bl
test bl, bl
je 0x48c977
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
setne bl
test bl, bl
je 0x48c977
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
setne bl
test bl, bl
je 0x48c977
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
setne bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x48c990
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [edx], 0x12345678
mov dword [edx + 4], 0x23456789
mov dword [edx + 8], 0x34567890
mov dword [ebp - 4], edx
mov al, byte [ebx]
test al, al
je 0x48ca0a
push esi
push edi
mov edi, dword [edx + 4]
mov esi, 0x34567890
nop
mov ecx, dword [edx]
lea ebx, [ebx + 1]
movsx eax, al
xor eax, dword [edx]
mov edx, dword [ebp + 8]
movzx eax, al
shr ecx, 8
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov dword [edx], eax
movzx eax, al
add eax, edi
imul edi, eax, 0x8088405
inc edi
mov eax, edi
mov dword [edx + 4], edi
shr eax, 0x18
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [ecx + eax*4]
mov dword [edx + 8], esi
mov al, byte [ebx]
test al, al
jne 0x48c9c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f600
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x48f60b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0048f620