joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428fa0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51dec8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x579630]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov eax, dword [ebp + 8]
lea edi, [ebx + 0x34]
mov dword [ebx + 0x10], eax
lea eax, [ebx + 0x38]
push eax
mov dword [ebp - 4], 0
mov dword [ebx], vtable.acrobat_broker::SandboxClipboardDispatcher.0
mov dword [ebx + 0x14], 0
mov dword [edi], 0
mov byte [ebx + 0x50], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x553268
lea ecx, [ebx + 4]
call fcn.00416560
push 0x5532b8
lea ecx, [ebx + 4]
call fcn.00416560
push 0x553308
lea ecx, [ebx + 4]
call fcn.00416560
push 0x553358
lea ecx, [ebx + 4]
call fcn.00416560
push 0x5533a8
lea ecx, [ebx + 4]
call fcn.00416560
push 0x5533f8
lea ecx, [ebx + 4]
call fcn.00416560
push 0x553448
lea ecx, [ebx + 4]
call fcn.00416560
push 0x553498
lea ecx, [ebx + 4]
call fcn.00416560
push 0x5534e8
lea ecx, [ebx + 4]
call fcn.00416560
push 0x553538
lea ecx, [ebx + 4]
call fcn.00416560
push 0x553588
lea ecx, [ebx + 4]
call fcn.00416560
push 0x5535d8
lea ecx, [ebx + 4]
call fcn.00416560
push 0x553628
lea ecx, [ebx + 4]
call fcn.00416560
push 0x553678
lea ecx, [ebx + 4]
call fcn.00416560
push 0x5536c8
lea ecx, [ebx + 4]
call fcn.00416560
push 0x553718
lea ecx, [ebx + 4]
call fcn.00416560
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [ebx + 0x18], eax
call esi
push edi
push 0
push ebx
push 0x429630
mov dword [ebx + 0x1c], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push 0x553764
mov dword [ebx + 0x14], eax
call esi
push 0x553770
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x429b50
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51dfea
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x579630]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx], vtable.acrobat_broker::ExecProcessDispatcher.0
lea ecx, [ebx + 0x10]
mov dword [ebp - 4], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
call fcn.00405f00
mov dword [ebx + 0x10], eax
push 0
mov byte [ebp - 4], 1
mov dword [ebx + 0x30], 0
mov dword [ebp - 0x20], 0x4508a0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.0040dae0
movdqu xmm0, xmmword [ebp - 0x20]
movzx eax, al
lea ecx, [ebx + 0x38]
push eax
push 0x4503b0
sub esp, 0x10
mov eax, esp
push 0x44acd0
movdqu xmmword [eax], xmm0
call fcn.00429d70
push 1
push 0
push 0
sub esp, 0x10
mov dword [ebp - 0x20], fcn.00434be0
mov eax, esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebx + 0x440]
mov dword [ebp - 0x14], 0
movdqu xmm0, xmmword [ebp - 0x20]
push 0x4d5bf0
movdqu xmmword [eax], xmm0
call fcn.00429d70
mov eax, dword [ebp + 8]
mov dword [ebx + 0x848], eax
mov dword [ebx + 0x84c], 0
mov dword [ebx + 0x850], 0
mov dword [ebx + 0x854], 0
lea eax, [ebx + 0x18]
mov byte [ebp - 4], 4
push eax
mov word [ebx + 0x858], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edi, dword [0x57f480]
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [edi + 0x5d]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
je 0x429ccb
mov edi, dword [0x57f480]
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [edi + 0x39]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
je 0x429ccb
mov eax, 1
jmp 0x429ccd
xor eax, eax
mov esi, dword [ebp - 0x10]
push 0x555748
lea ecx, [esi + 4]
mov byte [esi + 0x858], al
call fcn.00416560
push 0x555798
lea ecx, [esi + 4]
call fcn.00416560
push 0x5557e8
lea ecx, [esi + 4]
call fcn.00416560
push 0x555838
lea ecx, [esi + 4]
call fcn.00416560
push 0x555888
lea ecx, [esi + 4]
call fcn.00416560
push 0x5558d8
lea ecx, [esi + 4]
call fcn.00416560
push 0x555928
lea ecx, [esi + 4]
call fcn.00416560
push 0x555978
lea ecx, [esi + 4]
call fcn.00416560
push 0x5559c8
lea ecx, [esi + 4]
call fcn.00416560
push 0x555a18
lea ecx, [esi + 4]
call fcn.00416560
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42a500
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51e0ce
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x579630]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ebx, [edi + 4]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x14]
mov dword [edi], vtable.acrobat_broker::SandboxPreviewDispatcher.0
mov dword [edi + 0x10], eax
mov dword [ebp - 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.004295d0
mov dword [edi + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x1c], 0
lea esi, [eax + 0x5c]
add edi, 0x20
mov ecx, esi
mov byte [ebp - 4], 1
mov byte [eax + 0x58], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0042a630
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
add eax, 0x40
mov byte [ebp - 4], 2
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x554c20
mov ecx, ebx
call fcn.00416560
push 0x554c70
mov ecx, ebx
call fcn.00416560
push 0x554cc0
mov ecx, ebx
call fcn.00416560
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call esi
mov ebx, dword [ebp - 0x10]
push 0
push 0
push 0
push 0
mov dword [ebx + 0x24], eax
call esi
push edi
push 0
push ebx
push 0x42a800
push 0
push 0
mov dword [ebx + 0x28], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x1c], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42a700
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51e0f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x579630]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov eax, dword [ebp + 8]
lea ebx, [edi + 0x18]
mov dword [edi], vtable.acrobat_broker::SandboxDDEDispatcher.0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0
mov dword [ebx], 0
cmp dword [0x57f480], 0
mov dword [ebp - 4], 0
jne 0x42a784
lea ecx, [ebp - 0x1c]
call fcn.004f9515
push 0x56ae68
lea eax, [ebp - 0x1c]
push eax
call fcn.004f85a4
lea eax, [edi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x555208
lea ecx, [edi + 4]
call fcn.00416560
push 0x555258
lea ecx, [edi + 4]
call fcn.00416560
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [edi + 0x1c], eax
call esi
push ebx
push 0
push edi
push 0x42a9f0
push 0
push 0
mov dword [edi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x14], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42aad0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51e149
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x579630]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea ebx, [ecx + 4]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ecx], vtable.acrobat_broker::SandboxTaskbarManagerDispatcher.0
mov dword [ebp - 4], 0
mov dword [ecx + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
lea esi, [ecx + 0x48]
mov dword [ecx + 0x24], 0
lea edi, [ecx + 0x28]
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov ecx, esi
mov dword [edi], 0
mov byte [ebp - 4], 2
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00405fb0
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 3
mov dword [eax + 0x50], 0
add eax, 0x54
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x556698
mov ecx, ebx
call fcn.00416560
push 0x5566e8
mov ecx, ebx
call fcn.00416560
push 0x556738
mov ecx, ebx
call fcn.00416560
push 0x556788
mov ecx, ebx
call fcn.00416560
push 0x5567d8
mov ecx, ebx
call fcn.00416560
mov ebx, dword [ebp - 0x10]
mov ecx, 0x57fe38
mov eax, ebx
xchg dword [ecx], eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [ebx + 0x2c], eax
call esi
push edi
push 0
push ebx
push 0x42b230
push 0
push 0
mov dword [ebx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x24], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42e350
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51da08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x579630]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x14], 0
xorps xmm0, xmm0
mov dword [ebp - 0x10], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], esi
test edi, edi
je 0x42e3e6
cmp word [edi], si
je 0x42e3e6
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test ebx, ebx
je 0x42e3e6
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], esi
push eax
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0042e450
mov esi, dword [ebp - 0x1c]
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebx - 1]
cmp eax, ecx
je 0x42e3df
mov dword [ebp - 0x18], esi
jmp 0x42e3e6
mov edx, esi
cmp esi, dword [ebp - 0x18]
jne 0x42e3eb
mov edx, 0x52d9b8
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp word [edx], ax
jne 0x42e40a
xor ecx, ecx
jmp 0x42e41f
mov ecx, edx
lea ebx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42e410
sub ecx, ebx
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00407750
test esi, esi
je 0x42e435
push esi
call fcn.004085be
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42e630
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
je 0x42e6cf
mov esi, ebx
cmp word [ebx], di
je 0x42e66f
lea esp, [esp]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42e655
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2]
add esi, 2
cmp word [esi], di
jne 0x42e650
sub esi, ebx
add esi, 2
sar esi, 1
cmp esi, 0x3ffffffe
jb 0x42e684
pop edi
pop esi
xor eax, eax
pop ebx
ret
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
push 0x57fece
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00419c57
mov edi, eax
add esp, 8
test edi, edi
je 0x42e6c8
lea ecx, [esi + esi]
push ecx
push ebx
push ecx
push edi
call fcn.004241e2
add esp, 0x10
test eax, eax
je 0x42e6c8
push edi
call fcn.0041d0a7
add esp, 4
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x42ea80
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51e5f8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x42eba9
cmp word [esi], 0
je 0x42eba9
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.00413650
add esp, 4
test al, al
jne 0x42eaec
xor esi, esi
jmp 0x42eb94
lea eax, [ebp - 0x28]
push eax
call fcn.0042ebd0
add esp, 4
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 1
je 0x42eb6d
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x42eb6d
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x58]
call fcn.004087a0
push 0x52da1c
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.0042ec80
push esi
lea ecx, [ebp - 0x58]
call fcn.0042ec80
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.0040f410
cmp dword [ebp - 0x2c], 8
mov esi, eax
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x58]
call fcn.004087d0
jmp 0x42eb6f
xor esi, esi
cmp dword [ebp - 0x14], 8
jb 0x42eb80
push dword [ebp - 0x28]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp dword [ebp - 0x2c], 8
jb 0x42eba5
push dword [ebp - 0x40]
call fcn.004085be
add esp, 4
mov eax, esi
jmp 0x42ebab
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret

Function at 0x42ebd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x210], 0
call fcn.004f9050
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x42ec4b
cmp eax, 0x104
jae 0x42ec4b
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004076f0
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esi + 0x14], 7
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x52d9b8
mov word [esi], ax
call fcn.00407750
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x42ecd0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x214], ecx
cmp dword [esi + 0x10], 0
jne 0x42ed06
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
push ebx
xor bl, bl
cmp dword [esi + 0x14], 8
jb 0x42ed13
mov eax, dword [esi]
jmp 0x42ed15
mov eax, esi
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x42ed34
cmp eax, 0x50
je 0x42ed34
cmp eax, 0xb7
jne 0x42edcc
cmp dword [esi + 0x14], 8
jb 0x42ed3c
mov esi, dword [esi]
lea ecx, [ebp - 0x210]
mov edx, 0x105
push edi
mov eax, ecx
xor edi, edi
sub esi, eax
mov edi, edi
lea eax, [edx + 0x7ffffef9]
test eax, eax
je 0x42ed6e
movzx eax, word [esi + ecx]
test ax, ax
je 0x42ed6e
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x42ed50
jmp 0x42ed72
test edx, edx
jne 0x42ed7a
sub ecx, 2
mov edi, 0x8007007a
xor eax, eax
test edi, edi
mov word [ecx], ax
pop edi
js 0x42edcc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x42edcc
push 0x54a898
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0042ede0
test eax, eax
js 0x42edcc
mov ecx, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
push edx
push 0
push 0
mov ecx, dword [ecx]
mov eax, dword [ecx]
call dword [eax + 0x60]
test eax, eax
sete bl
mov ecx, dword [ebp - 4]
mov al, bl
pop ebx
xor ecx, ebp
pop esi
call fcn.00401590
mov esp, ebp
pop ebp
ret 4

Function at 0x42ef80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0x10]
xor bl, bl
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov dword [ebp - 0x214], 0
call fcn.004f9050
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x42f033
cmp word [ebp - 0x210], 0
je 0x42f033
test edi, edi
je 0x42f000
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x42f033
cmp byte [ebp + 0x14], 0
je 0x42f031
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x42f033
push 0x54a898
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0042ede0
test eax, eax
js 0x42f033
mov bl, 1
test bl, bl
mov dword [esi + 0x14], 7
mov eax, 0x52d9b8
mov dword [esi + 0x10], 0
lea edx, [ebp - 0x210]
cmove edx, eax
xor eax, eax
mov word [esi], ax
cmp word [edx], ax
jne 0x42f05f
xor ecx, ecx
jmp 0x42f073
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42f064
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00407750
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x42fa90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51e79c
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x428c00
push 0x57fd24
xor bl, bl
call fcn.0041e950
add esp, 8
test al, al
je 0x42fcc9
push 0x20019
push str.SoftwareAdobeAcrobat_ReaderDCFEATcFeatDir
xorps xmm0, xmm0
lea ecx, [ebp - 0x238]
push 0x80000001
movq qword [ebp - 0x238], xmm0
call fcn.0040dca0
xor eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x23c], 7
mov dword [ebp - 0x240], 0
mov word [ebp - 0x250], ax
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 1
push eax
push str.tDIText
lea ecx, [ebp - 0x238]
call fcn.004197c0
test eax, eax
jne 0x42fc83
cmp dword [ebp - 0x240], eax
je 0x42fc83
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00476850
add esp, 8
cmp dword [ebp - 0x220], 0
mov byte [ebp - 4], 2
je 0x42fc6c
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42fc6c
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x42fc6c
cmp dword [ebp - 0x220], 0x104
jae 0x42fc6c
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00403897
add esp, 0xc
test eax, eax
jne 0x42fc5a
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
call fcn.004b5c90
add esp, 4
test al, al
lea eax, [ebp - 0x218]
push eax
jne 0x42fc26
call esi
test eax, eax
jne 0x42fc04
jmp 0x42fc5a
lea ecx, [ebp - 0x268]
call fcn.004076f0
push 1
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.0042f790
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 2
mov bl, al
call fcn.004087d0
test bl, bl
jne 0x42fc6c
push 1
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.0042f790
mov bl, al
cmp dword [ebp - 0x21c], 8
jb 0x42fc83
push dword [ebp - 0x230]
call fcn.004085be
add esp, 4
cmp dword [ebp - 0x23c], 8
jb 0x42fc9a
push dword [ebp - 0x250]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0x23c], 7
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x240], 0
mov word [ebp - 0x250], ax
mov dword [ebp - 4], 0xffffffff
call fcn.0040dfb0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x431910
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51eb35
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x28], 0
mov ecx, ebx
push eax
push 0x52d9b8
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], ebx
mov word [ebx], ax
call fcn.00407750
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 0xf01ff
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x431ae4
mov edi, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 0x24], esi
test edi, edi
je 0x4319d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
cmp edi, 0xffffffff
je 0x4319cc
mov esi, edi
mov dword [ebp - 0x24], esi
call fcn.00410f80
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x4c
mov dword [ebp - 4], 2
mov dword [ebp - 0x1c], 0x4c
call fcn.00425c1e
mov edi, eax
add esp, 4
mov dword [ebp - 0x30], edi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 3
push eax
push dword [ebp - 0x1c]
push edi
push 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x431a25
push edi
call fcn.0041d0a7
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00410ed0
jmp 0x431ae4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push dword [edi]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x431a0b
mov edx, dword [ebp - 0x18]
cmp word [edx], 0
jne 0x431a48
xor ecx, ecx
jmp 0x431a60
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x20], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431a50
sub ecx, dword [ebp - 0x20]
sar ecx, 1
push ecx
push edx
mov ecx, ebx
call fcn.00407750
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call fcn.0041d0a7
add esp, 4
mov byte [ebp - 4], 0
test esi, esi
je 0x431ae4
cmp esi, 0xffffffff
je 0x431ae4
call fcn.00410f80
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x431ae4
push 4
push 0x68
push str.D:DCBCBT_MainImportsOpenChromeChrome_src_base_win_scoped_handle.h
lea ecx, [ebp - 0xe0]
call fcn.0046e250
add eax, 8
mov dword [ebp - 4], 4
push str.Check_failed:_false.
push eax
mov dword [ebp - 0x28], 5
call fcn.0045b4a0
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x28], 1
call fcn.0046e3c0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret