joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4befd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
mov dword [edx], ecx
mov dword [eax], ebx
mov ecx, dword [edx]
cmp ecx, dword [ebp + 0x10]
je 0x4bf190
mov edi, dword [ebp + 0x1c]
cmp ebx, edi
je 0x4bf190
mov edx, dword [ebp + 8]
movzx esi, word [edx]
nop word cs:[eax + eax]
nop
movzx edx, word [ecx]
mov dword [ebp - 0x1c], ebx
mov ebx, edx
and ebx, 0xfc00
cmp si, 2
jb 0x4bf060
movzx ebx, bx
cmp ebx, 0xdc00
jne 0x4bf1a2
movzx esi, si
add edx, 0xffff2400
mov dword [ebp - 0x10], 0
shl esi, 0xa
or edx, esi
cmp edx, 0x7f
ja 0x4bf08c
mov ebx, edx
xor esi, esi
jmp 0x4bf0d0
movzx esi, bx
cmp esi, 0xd800
jne 0x4bf080
shl edx, 0xa
mov bl, 1
add edx, 0xfca10000
mov dword [ebp - 0x10], ebx
cmp edx, 0x7f
jbe 0x4bf04d
jmp 0x4bf08c
mov dword [ebp - 0x10], 0
cmp edx, 0x7f
jbe 0x4bf04d
mov ebx, edx
cmp edx, 0x7ff
ja 0x4bf0b0
shr ebx, 6
mov esi, 1
or bl, 0xc0
jmp 0x4bf0d0
cmp edx, 0xffff
ja 0x4bf16c
shr ebx, 0xc
mov esi, 2
or bl, 0xe0
nop word [eax + eax]
mov dword [ebp - 0x14], ebx
mov ebx, esi
mov dword [ebp - 0x18], esi
inc esi
mov bl, 1
sub edi, dword [ebp - 0x1c]
cmp edi, esi
jl 0x4bf190
or bl, byte [ebp - 0x10]
mov edi, dword [ebp + 0x14]
add ecx, 2
cmp bl, 1
mov dword [edi], ecx
jne 0x4bf108
mov ecx, dword [eax]
mov ebx, dword [ebp - 0x14]
cmp esi, 2
lea edi, [ecx + 1]
mov dword [eax], edi
mov byte [ecx], bl
jl 0x4bf13c
dec esi
mov ecx, dword [ebp - 0x18]
inc esi
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx - 6]
nop word cs:[eax + eax]
nop dword [eax]
mov edi, dword [eax]
dec esi
lea ebx, [edi + 1]
mov dword [eax], ebx
mov ebx, edx
shr ebx, cl
add ecx, 0xfffffffa
and bl, 0x3f
or bl, 0x80
cmp esi, 1
mov byte [edi], bl
jg 0x4bf120
shr edx, 0xa
cmp byte [ebp - 0x10], 0
mov ecx, 1
cmove edx, ecx
mov ecx, dword [ebp + 8]
mov word [ecx], dx
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 0x10]
je 0x4bf190
mov ebx, dword [eax]
mov edi, dword [ebp + 0x1c]
mov esi, edx
cmp ebx, edi
jne 0x4bf010
jmp 0x4bf190
shr ebx, 0x12
mov dword [ebp - 0x18], 3
or bl, 0xf0
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
xor bl, 1
movzx esi, bl
lea esi, [esi + esi + 1]
xor ebx, ebx
jmp 0x4bf0db
xor eax, eax
cmp ecx, dword [ebp + 0xc]
sete al
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
mov eax, 2
jmp 0x4bf198
Function at 0x4c5d30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [0x6ccc30]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00406c70
xor esi, esi
cmp eax, 3
jl 0x4c5e5c
push 0x6586d4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4c5e5c
mov edi, eax
push 0x6604a5
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c5e5c
mov ebx, eax
push 0x6604c7
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c5e5c
mov ecx, ebx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x14], 0
call dword [0x64689c]
lea eax, [ebp - 0x14]
push eax
push 0
push 1
push 0
call ebx
mov edi, dword [ebp - 0x14]
xor esi, esi
test edi, edi
je 0x4c5e5c
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4c5e5c
mov ecx, ebx
mov edi, eax
call dword [0x64689c]
lea eax, [ebp - 0x14]
push eax
push 0
push 1
push edi
call ebx
test eax, eax
je 0x4c5e5c
mov ecx, dword [ebp - 0x60]
call dword [0x64689c]
lea eax, [ebp + 0xc]
push 0
push 0
push 4
push eax
push 0x20000
push 0
push edi
call ecx
test eax, eax
je 0x4c5e5c
mov esi, dword [ebp + 0x30]
lea eax, [ebp - 0x5c]
mov edx, edi
mov ecx, 0x11
mov ebx, dword [ebp + 0x14]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x24]
mov esi, dword [ebp + 0x20]
mov dword [ebp - 0x5c], 0x48
mov dword [ebp - 0x18], edx
mov edi, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
or ecx, 0x1080000
push dword [ebp + 0x34]
push eax
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push ecx
push esi
push edi
push edx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ce525
mov eax, esi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c5e70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x6c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4c6cf0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
call fcn.00406c70
xor esi, esi
cmp eax, 2
jg 0x4c606b
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x78], 0x44
mov word [ebp - 0x30], 0
call fcn.0040ee10
mov eax, 1
lock xadd dword [0x6d20b0], eax
test eax, eax
sete byte [ebp - 0x2f]
je 0x4c5f9d
mov al, byte [ebp - 0x30]
test al, al
je 0x4c601d
mov esi, dword [ebp + 0x24]
mov ebx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x78]
mov dword [ebp - 0x10], 1
or esi, 0x1080000
push dword [ebp + 0x34]
push eax
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push esi
push dword [ebp + 0x20]
push ebx
push ecx
push edx
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
cmp byte [ebp - 0x2f], 0
jne 0x4c6025
jmp 0x4c605c
mov al, byte [ebp - 0x30]
test al, al
jne 0x4c5f4a
cmp dword [0x6d20a8], 0
jne 0x4c5f4a
mov dword [ebp - 0x10], 1
push 0x6d20a8
push str.NtCreateProcessEx
call fcn.0043c2d0
add esp, 8
cmp dword [0x6d20a8], 0
je 0x4c5f47
mov eax, dword [ebp + 0xc]
mov dword [0x6d20a4], eax
push 0x6586d4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x2c]
push 0x4c5cc0
push str.NtCreateProcessEx
push 0x660559
push eax
call fcn.0040ee40
cmp dword [ebp - 0x28], 0
je 0x4c5f47
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xchg dword [0x6d20ac], eax
mov byte [ebp - 0x30], 1
jmp 0x4c5f52
xor esi, esi
cmp byte [ebp - 0x2f], 0
je 0x4c605c
cmp byte [ebp - 0x30], 0
mov dword [ebp - 0x34], esi
je 0x4c6047
xor eax, eax
xchg dword [0x6d20ac], eax
mov dword [0x6d20a8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [ebp - 0x34]
mov dword [0x6d20a4], eax
lock dec dword [0x6d20b0]
lea ecx, [ebp - 0x2c]
call fcn.0049e5e0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x6c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c66a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4c6d30
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ecx], 0
mov byte [ecx + 4], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x54], 0
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x5c], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x64], 0
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x6c], 0
mov dword [ecx + 0x68], 0
mov dword [ecx + 0x74], 0
mov dword [ecx + 0x70], 0
mov dword [ebp - 0x10], 0
call fcn.0040e440
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x4c67e9
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
mov dword [ecx], 0
inc eax
cmp eax, 2
jb 0x4c67e9
call fcn.0040e440
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4c6c70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x20]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov edi, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x10], ebx
mov dword [ebx], 0
push edi
mov edi, eax
push esi
push edx
push ecx
push dword [ebp - 0x14]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x4c6cdf
mov edi, dword [edi]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 3
push 0
push 0
push dword [ebp - 0x10]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [ecx + ecx*4]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x4c8a50
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x418
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x422]
push 0x20a
push 0
push eax
call fcn.0061e8c0
add esp, 0xc
cmp dword [ebp + 0xc], 0
mov ebx, 0x658578
je 0x4c8ad9
lea edi, [ebp - 0x218]
push 0x20a
push 0
push edi
call fcn.0061e8c0
add esp, 0xc
push 0x105
push edi
push dword [ebp + 0xc]
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x4c8ad9
push 0
push 0
push 0x105
lea edi, [ebp - 0x422]
push edi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.005d4880
add esp, 0x24
test eax, eax
mov ebx, 0x658578
cmove ebx, edi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], 0
push ebx
call fcn.005d3244
add esp, 4
mov edi, eax
cmp eax, 7
jbe 0x4c8b19
sub esp, 0xc
mov al, byte [ebp - 0x218]
mov ecx, esi
mov byte [esp + 4], al
mov dword [esp + 8], ebx
mov dword [esp], edi
call fcn.00405590
jmp 0x4c8b31
mov eax, edi
mov dword [esi + 0x10], edi
add eax, edi
push eax
push ebx
push esi
call fcn.0061e340
add esp, 0xc
mov word [esi + edi*2], 0
mov eax, esi
add esp, 0x418
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4cff70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x6ccc30]
xor eax, ebp
mov dword [esp + 0x78], eax
call fcn.00401460
mov esi, eax
mov eax, dword [eax]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x64689c]
mov ecx, esi
call edi
mov ecx, eax
call fcn.004014e0
xor esi, esi
test al, al
je 0x4d008d
call fcn.0040bd50
test eax, eax
je 0x4d008d
mov edx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x24]
mov edi, dword [ebp + 0x28]
lea esi, [esp + 0x30]
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], edx
add ecx, edx
mov edx, dword [ebp + 0x20]
add edi, edx
mov dword [esp + 0x34], edx
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edi
mov edi, dword [ebp + 0x14]
add edx, edx
test edi, edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edi
je 0x4d0074
mov ebx, dword [ebp + 0x2c]
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x14]
push 0
push eax
call fcn.004dd330
xorps xmm0, xmm0
lea eax, [esp + 0x40]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 0x70], 0
lea ecx, [esp + 0x20]
lea edx, [esp + 0x28]
lea ebx, [esp + 0x10]
lea esi, [ebp + 0x10]
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
push eax
push ecx
push edx
push ebx
push esi
lea eax, [ebp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
push 0x11f
lea eax, [esp + 0x34]
push eax
call fcn.004d00b0
add esp, 0x24
test eax, eax
je 0x4d0078
mov word [edi], 0
xor esi, esi
jmp 0x4d008d
cmp dword [esp + 0x4c], 1
sete al
cmp dword [esp + 0x54], 0
setne cl
and cl, al
movzx esi, cl
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.005ce525
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x28
Function at 0x4d1c10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0x4d48f0
mov eax, dword fs:[0]
mov dword [esi + 0x38], eax
lea eax, [esi + 0x38]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esi + 8], vtable.std::_Func_impl_no_alloc_class__public_virtual:_void___thiscall_acrobat_broker::SandboxBrokerClientImpl::TaskbarMoveTab_unsigned_int__unsigned_int__struct_HWND____::_1::_lambda_6___void___.0
mov dword [esi + 0x40], 0
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x14], eax
lea eax, [esi + 8]
mov dword [esi + 0x2c], eax
push eax
call fcn.0041c200
mov edi, dword [esi + 0x2c]
test edi, edi
je 0x4d1ca3
mov ecx, dword [edi]
lea eax, [esi + 8]
xor ebx, ebx
cmp edi, eax
setne bl
mov ecx, dword [ecx + 0x10]
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 4], ecx
call dword [0x64689c]
mov ecx, edi
push ebx
call dword [esi + 4]
mov dword [esi + 0x2c], 0
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x4d1ce0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e5bf0

Function at 0x4d7530
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
xor esi, esi
test eax, eax
je 0x4d761f
cmp dword [0x6d2600], 0
je 0x4d761f
cmp dword [0x6d2608], 0
je 0x4d761f
mov edi, dword [0x6d2604]
mov dword [ebp - 0x10], ecx
mov ebx, dword [edi + 4]
mov edx, edi
cmp byte [ebx + 0xd], 0
jne 0x4d7594
mov edx, edi
nop word cs:[eax + eax]
nop
xor ecx, ecx
cmp dword [ebx + 0x10], eax
setb cl
cmovae edx, ebx
mov ebx, dword [ebx + ecx*8]
cmp byte [ebx + 0xd], 0
je 0x4d7580
cmp byte [edx + 0xd], 0
jne 0x4d761f
cmp edi, edx
je 0x4d761f
cmp dword [edx + 0x10], eax
ja 0x4d761f
mov edi, dword [ebp - 0x10]
mov dword [edi + 8], 0
push eax
call fcn.004d9f60
mov esi, eax
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4d762b
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], 0
test eax, eax
je 0x4d75e3
push eax
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
mov dword [edi + 0x18], 0
cmp dword [edi + 0x2c], 0
je 0x4d7611
cmp dword [edi + 0x30], 8
lea ebx, [edi + 0x1c]
mov eax, ebx
jb 0x4d75f6
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [edi + 0x30], 8
jb 0x4d7605
mov ebx, dword [ebx]
mov dword [edi + 0x2c], 0
mov word [ebx], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x10], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [edi + 0x18]
test eax, eax
jne 0x4d75d5
jmp 0x4d75e3
Function at 0x4dc720
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x424
mov dword [ecx + 0x24], 0
mov esi, ecx
mov eax, dword [ecx + 4]
test eax, eax
je 0x4dc83d
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
test eax, eax
je 0x4dc763
push eax
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
mov dword [esi + 8], 0
cmp dword [esi + 0x1c], 0
lea edi, [esi + 0xc]
je 0x4dc793
cmp dword [esi + 0x20], 8
mov eax, edi
jb 0x4dc776
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x20], 8
mov eax, edi
jb 0x4dc787
mov eax, dword [edi]
mov dword [esi + 0x1c], 0
mov word [eax], 0
lea ebx, [ebp - 0x430]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4dc87e
lea eax, [ebp - 0x228]
push eax
push 0
push 0x673a9c
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4dc87e
lea ebx, [ebp - 0x228]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
movsd xmm0, qword [0x673aac]
movsd xmm1, qword [0x673aa4]
lea eax, [ebp - 0x20]
movsd qword [ebp - 0x18], xmm0
movsd qword [ebp - 0x20], xmm1
push 0
push eax
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov dword [esi + 4], eax
mov dword [esi + 8], 0
push ebx
call fcn.005d3244
add esp, 4
mov ebx, eax
mov eax, dword [esi + 0x20]
cmp eax, ebx
jae 0x4dc84d
sub esp, 0xc
mov al, byte [ebp - 0x10]
mov ecx, edi
mov byte [esp + 4], al
lea eax, [ebp - 0x228]
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00405590
jmp 0x4dc872
mov eax, dword [esi + 8]
test eax, eax
jne 0x4dc755
jmp 0x4dc763
lea ecx, [ebp - 0x228]
cmp eax, 8
jb 0x4dc85a
mov edi, dword [edi]
mov eax, ebx
mov dword [esi + 0x1c], ebx
add eax, ebx
push eax
push ecx
push edi
call fcn.0061e340
add esp, 0xc
mov word [edi + ebx*2], 0
push dword [esi + 0x44]
push dword [esi + 4]
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov dword [esi + 0x28], 0
add esp, 0x424
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4dc890
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4dd240
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x18
call fcn.005d0220
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [esi + 0x18], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x30], 7
mov dword [esi + 0x2c], 0
mov word [esi + 0x1c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x4c], 1
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 1
mov dword [esi + 0x68], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], 1
push 8
call fcn.005d0220
add esp, 4
mov edx, dword [ebp - 0x20]
mov dword [eax + 4], 0
lea ecx, [edx + 0x58]
mov dword [edx + 0x58], eax
mov dword [eax], ecx
mov dword [edx + 0x40], 0
mov dword [edx + 0x3c], 0
mov dword [edx + 0x48], 0
mov dword [edx + 0x44], 0
cmp byte [0x6d25fc], 0
jne 0x4dc9cd
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 2
add eax, 0x10
mov dword [ebp - 0x24], eax
push str.LPK.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4dc9e1
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push str.GDI32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4dc9cd
push str.GdiInitializeLanguagePack
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
test eax, eax
je 0x4dc9cd
mov dword [ebp - 0x10], 0xffffffff
call dword [0x64689c]
mov dword [ebp - 0x10], 2
push 0
call ecx
jmp 0x4dc9cd
Function at 0x4dd560
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4e4b20
mov edi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
lea esi, [edi + 0x18]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x4dd634
xor ecx, ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], esi
nop dword [eax]
cmp ecx, 2
ja 0x4dd627
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0
push 0
push 0x673db0
push 0x673db0
push 0
push 0x673db0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [ebp - 0x20]
inc ecx
test eax, eax
je 0x4dd5b0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
cmp dword [eax + 0x14], 0x15555555
je 0x4dd68d
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x2c], eax
push 0xc
call fcn.005d0220
add esp, 4
mov ecx, dword [ebp - 0x30]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x24]
inc dword [ecx + 0x14]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 4]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [edx + 4], eax
mov dword [ecx], eax
mov ecx, dword [ebp - 0x20]
jmp 0x4dd5b0
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4dd684
mov ecx, dword [edi + 0x10]
dec eax
mov ecx, dword [ecx]
mov ebx, dword [ecx + 8]
mov edx, dword [ecx]
mov dword [edi + 0x14], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x20], ebx
mov dword [eax], edx
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
push 0xc
push ecx
call fcn.005d319e
add esp, 8
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x20], 0
jmp 0x4dd662
push str.list_too_long
call fcn.006068d7
add esp, 4
nop word [eax + eax]
push ebp
sub esp, 0x14
add ebp, 0xc
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add esp, 0x14
pop ebp
ret
Function at 0x4e6d80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4e7610
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
lea eax, [esi + 0xc]
mov dword [esi], vtable.acrobat_broker::WininetCallbackReceiver.0
mov word [esi + 4], 0
mov byte [esi + 6], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [ebp - 0x20], eax
push 0x18
call fcn.005d0220
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x10], 0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x24]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x510430
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x210
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x21a]
push ebx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x5104a0
push ebx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x5104a0
cmp byte [ebp + 0xc], 0
je 0x5104c6
mov ecx, 0x105
mov eax, ebx
nop dword [eax]
cmp word [eax], 0
je 0x51047e
add eax, 2
dec ecx
jne 0x510470
jmp 0x5104a0
xor edi, edi
mov edx, edi
movzx edi, word [edi + edi + 0x659400]
test di, di
je 0x5104c0
mov word [eax + edx*2], di
lea edi, [edx + 1]
cmp ecx, edi
jne 0x510480
mov word [eax + edx*2], 0
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], 0
mov eax, esi
add esp, 0x210
pop esi
pop edi
pop ebx
pop ebp
ret
mov word [eax + edx*2], 0
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], 0
push ebx
call fcn.005d3244
add esp, 4
mov edi, eax
cmp eax, 7
jbe 0x510503
sub esp, 0xc
mov al, byte [ebp - 0x10]
mov ecx, esi
mov byte [esp + 4], al
mov dword [esp + 8], ebx
mov dword [esp], edi
call fcn.00405590
jmp 0x5104b3
mov eax, edi
mov dword [esi + 0x10], edi
add eax, edi
push eax
push ebx
push esi
call fcn.0061e340
add esp, 0xc
mov word [esi + edi*2], 0
jmp 0x5104b3