joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4250ae
Capabilities:
Check os version
Get token membership

Disassembly:
push ebp
lea ebp, [esp - 0xf4]
sub esp, 0x174
mov eax, dword [0x486d50]
xor eax, ebp
mov dword [ebp + 0xf0], eax
push esi
push edi
lea eax, [ebp - 0x6c]
push eax
xor edi, edi
push 1
push 0xa
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x42510a
lea eax, [ebp - 0x6c]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4251ae
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x68], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4251ae
cmp dword [ebp - 0x64], 6
jb 0x42515f
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x7c]
push eax
push 4
lea eax, [ebp - 0x78]
push eax
push 0x12
push dword [ebp - 0x6c]
call esi
test eax, eax
je 0x4251ae
cmp dword [ebp - 0x78], 3
jne 0x42515f
lea eax, [ebp - 0x7c]
push eax
push 4
lea eax, [ebp - 0x70]
push eax
push 0x13
push dword [ebp - 0x6c]
call esi
test eax, eax
je 0x4251ae
cmp dword [ebp - 0x70], edi
jne 0x425177
lea eax, [ebp - 0x70]
push eax
push 1
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x4251ae
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xac]
push eax
push edi
push 0x1a
mov dword [ebp - 0x80], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x4251ae
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0xac]
push eax
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4251b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x6c], edi
je 0x4251c7
push dword [ebp - 0x6c]
call esi
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x70], edi
je 0x4251d1
push dword [ebp - 0x70]
call esi
mov ecx, dword [ebp + 0xf0]
mov eax, dword [ebp - 0x74]
pop edi
xor ecx, ebp
pop esi
call fcn.0043a688
add ebp, 0xf4
leave
ret
Function at 0x4252ad
Capabilities:
Get common file path

Disassembly:
push 8
mov eax, 0x454394
call fcn.0043cf0a
call fcn.00429b48
push eax
lea ecx, [ebp - 0x10]
call fcn.0040fc71
xor esi, esi
push 0x104
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00402467
push eax
push esi
push esi
push 0x2b
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.00408a9c
cmp edi, esi
jne 0x42531e
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00408b86
mov ecx, dword [ebp + 8]
push str.AdobeARM1.0AdobeARM.exe
call fcn.004089c0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004025e7
xor eax, eax
inc eax
jmp 0x425358
push str.SHGetFolderPath_in_GetCurrentExePath_failed:
lea ecx, [ebp - 0x14]
call fcn.0040215a
push edi
lea eax, [ebp - 0x14]
push eax
push 1
mov byte [ebp - 4], 1
call fcn.0040e50d
mov ecx, dword [ebp - 0x14]
add esp, 0xc
add ecx, 0xfffffff0
mov esi, eax
call fcn.004025e7
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004025e7
mov eax, esi
call fcn.0043cfe2
ret
Function at 0x42535e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x454356
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x486d50]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push esi
mov eax, dword [0x486d50]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4253b7
push 0x48b534
mov ecx, edi
call fcn.00408b86
push 0x45ed08
jmp 0x4253fc
xor eax, eax
push 0x206
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push esi
push eax
call fcn.0043b400
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push esi
push esi
push 0x2b
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
cmp ebx, esi
jne 0x425518
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.00402123
push str.AdobeARM1.0_
mov ecx, edi
call fcn.004089c0
push 0x48b40c
mov ecx, edi
call fcn.00401f30
mov esi, dword [edi]
or ebx, 0xffffffff
call fcn.00417c21
test eax, eax
jne 0x425513
push str.Will_attempt_to_use_legacy_launcher___not_found_or_not_valid:
lea ecx, [esp + 0x10]
call fcn.0040215a
push 0
xor eax, eax
push edi
lea ecx, [esp + 0x14]
inc eax
push ecx
push eax
mov dword [esp + 0x240], eax
call fcn.0040e087
mov dword [esp + 0x240], ebx
mov ecx, dword [esp + 0x1c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004025e7
push str._ArmPrefs
xor ecx, ecx
mov esi, 0x48bae0
call fcn.0040884e
cmp eax, ebx
jne 0x42548e
push str._FixPDF
xor ecx, ecx
call fcn.0040884e
cmp eax, ebx
jne 0x42548e
mov eax, 0x48b904
call fcn.004051e1
jmp 0x4254a3
push str._PRODUCT:Reader
xor ecx, ecx
call fcn.0040884e
xor ecx, ecx
cmp eax, ebx
setne cl
mov eax, ecx
test eax, eax
mov eax, 0x48b410
jne 0x4254b1
mov eax, 0x48b414
push dword [eax]
push dword [0x48b40c]
push edi
call fcn.004086d4
mov esi, dword [edi]
call fcn.00417c21
test eax, eax
jne 0x425513
push edi
lea eax, [esp + 0x14]
push str.Not_found_or_not_valid:
push eax
call fcn.00401e97
add esp, 0xc
mov esi, eax
mov dword [esp + 0x230], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push 0x1fc98
mov ecx, eax
mov edx, 0x48baa8
call fcn.0040c8ce
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004025e7
push 0xd
pop eax
jmp 0x42554d
xor eax, eax
inc eax
jmp 0x42554d
push str.SHGetFolderPath_in_GetLauncherPath_failed:
lea ecx, [esp + 0x10]
call fcn.0040215a
push ebx
lea eax, [esp + 0x10]
push eax
push 1
mov dword [esp + 0x23c], esi
call fcn.0040e50d
mov ecx, dword [esp + 0x18]
add esp, 0xc
add ecx, 0xfffffff0
mov esi, eax
call fcn.004025e7
mov eax, esi
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0043a688
mov esp, ebp
pop ebp
ret
Function at 0x425570
Capabilities:
Get file version info

Disassembly:
push 0x18
mov eax, 0x45431a
call fcn.0043cf0a
cmp dword [ebp + 0x10], 0
je 0x4255b5
push str.GetFileVersion__:
lea ecx, [ebp - 0x10]
call fcn.0040215a
and dword [ebp - 4], 0
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 2
call fcn.0040e087
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004025e7
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x14], eax
test eax, eax
je 0x425706
push eax
call fcn.004297ce
pop ecx
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
mov eax, dword [ebp + 8]
push dword [ebp - 0x14]
mov eax, dword [eax]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4256c6
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x45ed08
push dword [ebp - 0x10]
call sub.VERSION.dll_VerQueryValueW
cmp eax, 1
jne 0x4256aa
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax + 0xa]
mov edx, dword [ebp + 0xc]
push dword [ebp - 0x10]
mov dword [edx], ecx
movzx ecx, word [eax + 8]
mov dword [ebx], ecx
movzx ecx, word [eax + 0xe]
mov dword [edi], ecx
movzx eax, word [eax + 0xc]
mov dword [esi], eax
call fcn.004297c3
cmp dword [ebp + 0x10], 0
pop ecx
je 0x4256a2
call fcn.00429b48
push eax
lea ecx, [ebp + 0x10]
call fcn.0040fc71
push str.File_version:__1_u_._2_u_._3_u_._4_u_
lea ecx, [ebp + 8]
mov dword [ebp - 4], 1
call fcn.0040215a
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 2
push dword [esi]
push dword [edi]
push dword [ebx]
push dword [eax]
lea eax, [ebp + 0x10]
push dword [ebp + 8]
push eax
call fcn.0040d001
push 0
lea eax, [ebp + 0x10]
push eax
push 2
call fcn.0040e50d
mov ecx, dword [ebp + 8]
add esp, 0x24
add ecx, 0xfffffff0
call fcn.004025e7
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.004025e7
xor eax, eax
inc eax
jmp 0x42573d
cmp dword [ebp + 0x10], 0
je 0x4256fb
push str.VerQueryValue___failed_in_GetFileVersion__.
lea ecx, [ebp + 0x10]
call fcn.0040215a
mov dword [ebp - 4], 3
jmp 0x4256e0
cmp dword [ebp + 0x10], 0
je 0x4256fb
push str.GetFileVersionInfo___failed_in_GetFileVersion__.
lea ecx, [ebp + 0x10]
call fcn.0040215a
mov dword [ebp - 4], 4
push 0
lea eax, [ebp + 0x10]
push eax
push 1
call fcn.0040e50d
mov ecx, dword [ebp + 0x10]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025e7
push dword [ebp - 0x10]
call fcn.004297c3
pop ecx
jmp 0x42573b
cmp dword [ebp + 0x10], 0
je 0x42573b
push str.GetFileVersionInfoSize___failed_in_GetFileVersion__.
lea ecx, [ebp - 0x14]
call fcn.0040215a
push 0
lea eax, [ebp - 0x14]
push eax
push 1
mov dword [ebp - 4], 5
call fcn.0040e50d
mov ecx, dword [ebp - 0x14]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025e7
xor eax, eax
call fcn.0043cfe2
ret
Function at 0x4260a6
Capabilities:
Get common file path

Disassembly:
push 0x428
mov eax, 0x454297
call fcn.0043cf73
mov eax, dword [ebp + 8]
mov dword [ebp - 0x430], eax
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x424], ax
xor esi, esi
lea eax, [ebp - 0x422]
push esi
push eax
call fcn.0043b400
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
push esi
push esi
push 0x25
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
cmp ebx, esi
jne 0x4261df
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x42c]
call fcn.0040215a
push str.Msi.dll
lea ecx, [ebp - 0x42c]
mov dword [ebp - 4], esi
call fcn.004089c0
xor eax, eax
push edi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
call fcn.0043b400
add esp, 0xc
push esi
push esi
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x42c]
mov dword [ebp - 0x434], 0x104
call sub.msi.dll_MsiMessageBoxW
cmp eax, esi
jne 0x4261a3
mov ecx, dword [ebp - 0x430]
lea eax, [ebp - 0x21c]
push eax
call fcn.00402123
push str.MSI_version:
lea ecx, [ebp - 0x428]
call fcn.0040215a
push esi
push dword [ebp - 0x430]
lea eax, [ebp - 0x428]
push eax
push 1
mov byte [ebp - 4], 1
call fcn.0040e087
add esp, 0x10
jmp 0x4261c9
push str.Unable_to_determine_MSI_version
lea ecx, [ebp - 0x428]
call fcn.0040215a
push esi
lea eax, [ebp - 0x428]
push eax
push 1
mov byte [ebp - 4], 2
call fcn.0040e50d
add esp, 0xc
mov ecx, dword [ebp - 0x428]
add ecx, 0xfffffff0
call fcn.004025e7
mov ecx, dword [ebp - 0x42c]
jmp 0x42620e
push str.SHGetFolderPath_in_GetMsiVersion_failed:
lea ecx, [ebp - 0x428]
call fcn.0040215a
push ebx
lea eax, [ebp - 0x428]
push eax
push 1
mov dword [ebp - 4], 3
call fcn.0040e50d
mov ecx, dword [ebp - 0x428]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025e7
call fcn.0043cff6
ret
Function at 0x427da9
Capabilities:
Query service status

Disassembly:
push 0x34
mov eax, 0x453f1d
call fcn.0043cf0a
push 4
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, 0x2722c
mov dword [ebp - 0x18], eax
cmp dword [0x48bab0], esi
je 0x427eb1
cmp eax, edi
je 0x427eb1
push 4
push str.MSIServer
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
add esi, 0x64
mov ebx, eax
cmp dword [0x48bab0], esi
je 0x427e70
cmp ebx, edi
je 0x427e70
lea eax, [ebp - 0x1c]
push eax
push 0x24
lea eax, [ebp - 0x40]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov esi, 0x27164
cmp dword [0x48bab0], esi
je 0x427e28
cmp eax, edi
je 0x427e28
cmp dword [ebp - 0x38], 4
jne 0x427e5e
inc edi
jmp 0x427e5e
push 0x47988c
lea ecx, [ebp - 0x10]
call fcn.0040215a
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x10]
push ecx
push esi
mov ecx, eax
mov edx, 0x48baa8
call fcn.0040c8ce
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004025e7
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push dword [ebp - 0x18]
call esi
mov eax, edi
jmp 0x427ee5
push str.OpenSCManager_failed:
lea ecx, [ebp - 0x14]
call fcn.0040215a
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x14]
push ecx
push esi
mov ecx, eax
mov edx, 0x48baa8
call fcn.0040c8ce
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004025e7
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x427ee3
push str.OpenSCManager_failed:
lea ecx, [ebp - 0x18]
call fcn.0040215a
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x18]
push ecx
push esi
mov ecx, eax
mov edx, 0x48baa8
call fcn.0040c8ce
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004025e7
xor eax, eax
call fcn.0043cfe2
ret
Function at 0x428503
Capabilities:
Delete directory
Set file attributes

Disassembly:
push 0x28
mov eax, 0x453e5f
call fcn.0043cf0a
and dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x42865c
cmp eax, 4
jb 0x42865c
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040219e
push 0x5c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0040887f
cmp eax, 0xffffffff
je 0x42857d
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx - 0xc]
dec ecx
cmp eax, ecx
jne 0x42857d
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.004088a1
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00408b86
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004025e7
push 0x471584
lea ecx, [ebp - 0x14]
call fcn.004089c0
lea ecx, [ebp - 0x34]
call fcn.0043602d
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0x14]
push 0
push edi
lea ecx, [ebp - 0x34]
call fcn.004360c5
test eax, eax
je 0x42860f
lea ecx, [ebp - 0x34]
call fcn.00435d2d
lea ecx, [ebp - 0x34]
mov ebx, eax
call fcn.00435fee
test eax, eax
jne 0x42860b
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x34]
call fcn.004362f2
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x34]
push 0x10
lea ecx, [ebp - 0x34]
call dword [eax + 0x38]
test eax, eax
je 0x4285f4
push ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.0040219e
call fcn.00428503
pop ecx
jmp 0x4285fc
lea esi, [ebp - 0x18]
call fcn.0042866a
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004025e7
test ebx, ebx
jne 0x4285a8
lea ecx, [ebp - 0x34]
call fcn.00435c47
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x428645
push 0x186a0
lea eax, [ebp + 8]
push eax
push 2
call fcn.0040e50d
add esp, 0xc
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.00436056
lea ecx, [edi - 0x10]
call fcn.004025e7
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004025e7
call fcn.0043cfe2
ret

Function at 0x42866a
Capabilities:
Delete file
Set file attributes

Disassembly:
push ecx
mov eax, esi
call fcn.00401000
test eax, eax
je 0x42869f
push 0x80
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42869f
push 0x186a0
push esi
push 2
call fcn.0040e50d
add esp, 0xc
pop ecx
ret
Function at 0x428873
Capabilities:
Reference sql statements

Disassembly:
push 0x10
mov eax, 0x453dd1
call fcn.0043cf0a
call fcn.00429b48
push eax
lea ecx, [ebp - 0x18]
call fcn.0040fc71
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp + 0x10]
push 0x45eeb4
mov byte [ebp - 4], 2
call fcn.00408af6
mov eax, dword [ebp + 0xc]
push dword [eax]
lea eax, [ebp - 0x18]
push str.SELECT_Value_FROM_Property_WHERE_Property.Property_s
push eax
call fcn.004020ef
add esp, 0xc
cmp dword [ebp - 0x10], esi
je 0x4288cc
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
call sub.msi.dll_MsiEnumClientsA
mov edi, eax
cmp edi, esi
je 0x42893a
push 0x473a44
lea ecx, [ebp + 0xc]
call fcn.0040215a
mov byte [ebp - 4], 3
push edi
lea eax, [ebp + 0xc]
push eax
push 2
call fcn.0040e50d
mov ecx, dword [ebp + 0xc]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025e7
cmp dword [ebp - 0x14], esi
je 0x42891d
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x10], esi
je 0x42892a
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea ecx, [ebx - 0x10]
call fcn.004025e7
mov eax, edi
call fcn.0043cfe2
ret
push esi
push dword [ebp - 0x10]
call sub.msi.dll_MsiViewModify
mov edi, eax
cmp edi, esi
je 0x42895c
push str.MsiViewExecute__
lea ecx, [ebp + 0xc]
call fcn.0040215a
mov byte [ebp - 4], 4
jmp 0x4288f6
cmp dword [ebp - 0x14], esi
je 0x428969
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
call sub.msi.dll_MsiDatabaseIsTablePersistentA
mov edi, eax
cmp edi, esi
jne 0x428910
push dword [ebp + 0x10]
push 1
push dword [ebp - 0x14]
call fcn.00428a06
mov edi, eax
add esp, 0xc
cmp edi, esi
je 0x4289ea
push str.MsiGetRecordString__
lea ecx, [ebp + 0xc]
call fcn.0040215a
push edi
lea eax, [ebp + 0xc]
push eax
push 2
mov byte [ebp - 4], 5
call fcn.0040e50d
mov ecx, dword [ebp + 0xc]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025e7
cmp dword [ebp - 0x14], esi
je 0x4289cc
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x10], esi
je 0x4289d9
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov esi, edi
lea ecx, [ebx - 0x10]
call fcn.004025e7
mov eax, esi
jmp 0x428934
cmp dword [ebp - 0x14], esi
je 0x4289f7
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x10], esi
je 0x4289db
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
jmp 0x4289db
Function at 0x428ce8
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x486d50]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp - 0x74], ax
xor ebx, ebx
lea eax, [ebp - 0x72]
push ebx
push eax
mov edi, ecx
call fcn.0043b400
xor eax, eax
push esi
mov word [ebp + 0x198], ax
lea eax, [ebp + 0x19a]
push ebx
push eax
call fcn.0043b400
add esp, 0x18
mov eax, 0x105
push eax
lea ecx, [ebp + 0x198]
push ecx
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push eax
lea eax, [ebp - 0x74]
push eax
push 0x476a18
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x428d9b
mov eax, dword [ebp - 0x78]
xor ecx, ecx
cmp ecx, 0x103
je 0x428d95
xor edx, edx
push 0xa
pop esi
div esi
mov dx, word [edx*2 + str.0123456789]
mov word [edi + ecx*2], dx
inc ecx
cmp eax, ebx
ja 0x428d75
xor eax, eax
mov word [edi + ecx*2], ax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x428db1
push str.thsnYaVieBoda
call fcn.0042234d
mov ecx, dword [ebp + 0x3a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a688
add ebp, 0x3a8
leave
ret
Function at 0x428dc9
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x3c
mov eax, 0x453d1d
call fcn.0043cf73
mov esi, edx
mov dword [ebp - 0x38], ecx
xor ebx, ebx
call fcn.0040234f
push 8
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.0043b400
add esp, 0xc
push 8
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.0043b400
add esp, 0xc
push 8
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.0043b400
add esp, 0xc
push esi
lea ecx, [ebp - 0x28]
call fcn.0040219e
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.0040c88f
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax - 0xc]
lea eax, [eax + eax + 2]
mov ecx, 0x48b428
mov dword [ebp - 0x48], eax
call fcn.0040c88f
mov dword [ebp - 0x3c], eax
mov eax, dword [0x48b428]
mov eax, dword [eax - 0xc]
shr eax, 1
inc eax
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
push str.Encrypted_by_Adobe.
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
je 0x428ec3
mov esi, str.0123456789ABCDEF
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
cmp dword [ebp - 0x30], ebx
jbe 0x428eb5
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + esi]
mov ecx, dword [ebp - 0x38]
shr eax, 4
movzx eax, byte [ebp + eax - 0x24]
push eax
call fcn.0040fc59
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + esi]
mov ecx, dword [ebp - 0x38]
and eax, 0xf
movzx eax, byte [ebp + eax - 0x24]
push eax
call fcn.0040fc59
inc esi
cmp esi, dword [ebp - 0x30]
jb 0x428e7f
push dword [ebp - 0x2c]
xor ebx, ebx
inc ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x428ef1
push str.Encryption_failed.
lea ecx, [ebp - 0x34]
call fcn.0040215a
push ebx
lea eax, [ebp - 0x34]
push eax
push 1
mov byte [ebp - 4], 1
call fcn.0040e50d
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x34]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025e7
push 0xffffffffffffffff
lea ecx, [ebp - 0x28]
call fcn.00408a9c
push 0xffffffffffffffff
mov ecx, 0x48b428
call fcn.00408a9c
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.004025e7
mov eax, ebx
call fcn.0043cff6
ret
Function at 0x42911c
Capabilities:
Create process on windows
Persist via run registry key

Disassembly:
push 0x14
mov eax, 0x45364f
call fcn.0043cf0a
call fcn.00429b48
push eax
lea ecx, [ebp - 0x14]
call fcn.0040fc71
xor edi, edi
push 0x48b964
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
call fcn.00408b86
mov esi, 0x48b904
mov eax, esi
call fcn.004051e1
test eax, eax
mov eax, str.ReaderReader_sl.exe
jne 0x429162
mov eax, str.AcrobatAcrobat_sl.exe
push eax
lea ecx, [ebp - 0x14]
call fcn.004089c0
mov eax, esi
call fcn.004051e1
test eax, eax
mov eax, str.Adobe_Reader_Speed_Launcher
jne 0x429180
mov eax, str.Adobe_Acrobat_Speed_Launcher
push eax
lea ecx, [ebp - 0x18]
call fcn.0040215a
mov byte [ebp - 4], 1
call fcn.00429b48
push eax
lea ecx, [ebp - 0x10]
call fcn.0040fc71
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
push dword [ebp - 0x18]
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.0042429b
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
add esp, 0x10
cmp dword [eax - 0xc], edi
je 0x4291d9
lea eax, [ebp - 0x10]
push eax
call fcn.004295f4
push esi
lea ecx, [ebp - 0x10]
call fcn.0040b384
test eax, eax
je 0x429220
push 5
push edi
push edi
push esi
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x21
mov eax, str.Unable_to_launch:
jl 0x4291f5
mov eax, str.Launched:
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215a
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 2
mov byte [ebp - 4], 3
call fcn.0040e087
mov ecx, dword [ebp - 0x1c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004025e7
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004025e7
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004025e7
lea ecx, [esi - 0x10]
call fcn.004025e7
call fcn.0043cfe2
ret