joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a920
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, ecx
push eax
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebx
call fcn.00409680
mov ecx, dword [ebx + 0x98]
mov eax, dword [eax]
test ecx, ecx
mov dword [esp + 0xc], eax
jne 0x40a959
push eax
mov ecx, ebx
call fcn.00409720
test eax, eax
jne 0x40aa6e
mov eax, dword [0x6ede48]
push esi
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push edi
mov edi, dword [sym.imp.USER32.dll_LoadCursorA]
cmp eax, 4
jne 0x40a993
mov dword [0x6ede48], 3
call fcn.006061a0
call fcn.006061a0
mov eax, dword [eax + 0xc]
push 0x84
push eax
call edi
push eax
call esi
mov eax, dword [0x6ede60]
cmp eax, 3
jne 0x40a9f5
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
mov cl, ah
test cl, cl
je 0x40a9e2
mov dword [0x6ede48], 2
call fcn.006061a0
call fcn.006061a0
mov eax, dword [eax + 0xc]
push 0x87
push eax
call edi
push eax
call esi
mov eax, dword [0x6ede48]
cmp eax, 1
jne 0x40aa34
mov ecx, ebx
call fcn.00406e10
jmp 0x40aa40
mov ecx, ebx
mov dword [0x6ede48], 1
call fcn.00406e10
jmp 0x40aa40
cmp eax, 4
jne 0x40a9cf
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
xor edx, edx
mov dl, ah
test dl, dl
je 0x40aa28
mov dword [0x6ede48], 1
call fcn.006061a0
call fcn.006061a0
mov eax, dword [eax + 0xc]
push 0x86
jmp 0x40a9c9
mov dword [0x6ede48], 2
jmp 0x40aa39
cmp eax, 2
jne 0x40aa40
mov ecx, ebx
call fcn.00406e60
mov eax, dword [esp + 0x14]
xor ecx, ecx
pop edi
cmp eax, ecx
mov dword [ebx + 0x98], ecx
pop esi
je 0x40aa68
push eax
mov ecx, ebx
mov dword [ebx + 0x94], 1
call fcn.00409550
pop ebx
ret 0xc
mov dword [ebx + 0x94], ecx
pop ebx
ret 0xc
Function at 0x40b8a0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x110
push ebx
mov ebx, ecx
push ebp
push esi
test ebx, ebx
push edi
mov word [ebx + 0x3e], 0x4e4
je 0x40b8bb
lea edi, [ebx + 4]
jmp 0x40b8bd
xor edi, edi
mov esi, dword [esp + 0x124]
mov ecx, 0xd
xor eax, eax
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
test ebp, ebp
jne 0x40b8eb
test esi, esi
je 0x40b8eb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
lea eax, [esp + 0x1c]
push 0x104
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
ja 0x40b916
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
ja 0x40b941
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push esi
call fcn.005e6f29
add esp, 4
mov dword [ebx + 0x38], eax
push eax
push esi
lea eax, [esp + 0x24]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40b975
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [ebx + 0x38]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
push 0x68f440
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x40b9a7
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
test ebx, ebx
je 0x40b9b0
lea edi, [ebx + 4]
jmp 0x40b9b2
xor edi, edi
mov esi, dword [esp + 0x10]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x38]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
push str.VarFileInfoTranslation
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40b9e9
cmp dword [esp + 0x14], 4
jb 0x40b9e9
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov dword [ebx + 0x3c], edx
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebx + 4]
xor eax, eax
pop edi
cmp ecx, 0xfeef04bd
pop esi
pop ebp
sete al
pop ebx
add esp, 0x110
ret 4
Function at 0x40cf00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x616778
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, ecx
push esi
call fcn.0040ce80
test eax, eax
je 0x40d00e
push ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], vtable.CRgn.0
mov eax, dword [esi + 0xc]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi]
sub eax, ebx
sub ecx, edx
push eax
push ecx
push 0
push 0
mov dword [esp + 0x34], 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
lea ecx, [esp + 0x10]
call fcn.005eff45
lea eax, [esp + 0xc]
mov ecx, edi
push eax
call fcn.005ef95d
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov eax, dword [edi + 4]
mov ebx, dword [sym.imp.GDI32.dll_SetViewportOrgEx]
neg ecx
push 0
push ecx
neg edx
push edx
push eax
call ebx
mov ecx, dword [esp + 0x34]
mov eax, dword [edi + 4]
push eax
mov edx, dword [ecx]
call dword [edx + 0xe0]
mov ecx, dword [edi + 4]
push 0
push 0
push 0
push ecx
call ebx
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 0xcc0020
mov ecx, dword [esi]
push 0
push 0
push edx
mov edx, dword [esi + 0xc]
sub edx, eax
push edx
mov edx, dword [esi + 8]
sub edx, ecx
push edx
push eax
mov eax, dword [esp + 0x48]
push ecx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
lea ecx, [esp + 0xc]
call fcn.005eff9c
mov dword [esp + 0xc], vtable.CGdiObject.0
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 1
call fcn.005eff9c
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
lea ecx, [esp + 8]
call fcn.005ef358
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], 2
push ecx
lea ecx, [esp + 0xc]
call fcn.005ef40f
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [ecx]
call dword [edx + 0xe0]
lea ecx, [esp + 8]
call fcn.005ef446
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.005ef48d
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc

Function at 0x40dd00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6168ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [esi + 0x14]
mov dword [esi], 0x633448
mov ecx, edi
call fcn.005e5dd9
mov dword [edi], method.CPtrArray.virtual_0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor ebx, ebx
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
push ebx
mov ecx, edi
mov dword [esp + 0x20], ebx
mov dword [esi], 0x6333b8
mov dword [esi + 4], eax
call fcn.005e659f
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov edx, dword [0x6ede48]
push esi
mov dword [esi + 0x3c], edx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.0053c0d0
mov ecx, eax
call fcn.0053c190
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x40dd17
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6168ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [esi + 0x14]
mov dword [esi], 0x633448
mov ecx, edi
call fcn.005e5dd9
mov dword [edi], method.CPtrArray.virtual_0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor ebx, ebx
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
push ebx
mov ecx, edi
mov dword [esp + 0x20], ebx
mov dword [esi], 0x6333b8
mov dword [esi + 4], eax
call fcn.005e659f
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov edx, dword [0x6ede48]
push esi
mov dword [esi + 0x3c], edx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.0053c0d0
mov ecx, eax
call fcn.0053c190
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x410b70
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x3c
test eax, eax
push ebx
push ebp
push esi
push edi
mov ebx, ecx
jne 0x410b8e
mov ecx, dword [0x6eddd4]
mov eax, 0xe8cd
sub eax, ecx
mov ecx, dword [esp + 0x58]
mov dword [ebx + 0xbc], eax
test ecx, ecx
mov ebp, 0x40002810
je 0x410ba6
mov ebp, 0x50002810
push eax
xor ecx, ecx
sub esp, 0x10
xor edx, edx
mov eax, esp
xor esi, esi
push ebp
push 0x8800
mov dword [eax], ecx
mov ecx, dword [esp + 0x6c]
xor edi, edi
push ecx
mov dword [eax + 4], edx
mov ecx, ebx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
call fcn.00606704
test eax, eax
jne 0x410bdf
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0xc
mov edx, dword [ebx + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x31
push edx
call ebp
push eax
call fcn.005eff30
mov edx, dword [eax + 4]
lea ecx, [esp + 0x10]
push ecx
push 0x3c
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov edi, str.Tahoma
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], 0xd
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0xa8]
mov ecx, esi
call fcn.005eff9c
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
mov ecx, esi
call fcn.005eff45
test esi, esi
je 0x410c5d
mov esi, dword [esi + 4]
mov edx, dword [ebx + 0x1c]
push 1
push esi
push 0x30
push edx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3c
ret 0xc
Function at 0x4118d0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x616fbe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc4
push ebx
push ebp
mov ebp, ecx
push esi
xor ebx, ebx
push edi
lea ecx, [esp + 0x48]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
xor esi, esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call fcn.005f6bae
lea eax, [esp + 0x10]
mov dword [esp + 0xdc], ebx
push eax
push 1
push ebx
push str.SoftwareFoxit_SoftwareFoxit_ReaderDockState_PRO
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x411a56
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push ebx
push edx
push ebx
push 0x6edc4c
push eax
call edi
test eax, eax
jne 0x411a56
mov eax, dword [esp + 0x14]
cmp eax, 1
jbe 0x411a56
push eax
call fcn.005e6f29
add esp, 4
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push esi
push edx
push ebx
push 0x6edc4c
push eax
call edi
test eax, eax
jne 0x411a56
cmp esi, ebx
je 0x411a56
push 0x400
lea ecx, [esp + 0x24]
call fcn.005f73ba
mov ecx, dword [esp + 0x14]
mov byte [esp + 0xdc], 1
push ecx
push esi
lea ecx, [esp + 0x28]
call fcn.005f75a0
mov edx, dword [esp + 0x20]
push ebx
push ebx
lea ecx, [esp + 0x28]
call dword [edx + 0x28]
push ebx
push 0x1000
lea eax, [esp + 0x28]
push 1
push eax
lea ecx, [esp + 0xa0]
call fcn.005f02f7
lea ecx, [esp + 0x90]
mov byte [esp + 0xdc], 2
push ecx
lea ecx, [esp + 0x4c]
call fcn.005f6ca2
lea ecx, [esp + 0x90]
mov dword [esp + 0x18], 1
mov byte [esp + 0xdc], 1
call fcn.005f03d3
lea ecx, [esp + 0x20]
mov byte [esp + 0xdc], bl
call fcn.005f7442
mov edi, dword [esp + 0xe4]
lea edx, [esp + 0x48]
push edx
push edi
mov ecx, ebp
call fcn.00411880
test eax, eax
je 0x411a52
lea eax, [esp + 0x48]
mov ecx, ebp
push eax
push edi
call fcn.00411cc0
jmp 0x411a56
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x411a65
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x411a72
push esi
call fcn.005e6f52
add esp, 4
lea ecx, [esp + 0x48]
mov dword [esp + 0xdc], 0xffffffff
call fcn.005f6c41
mov ecx, dword [esp + 0xd4]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xd0
ret 4
Function at 0x411ab0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x616ff9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc0
push ebx
push ebp
mov ebx, ecx
push esi
push edi
lea ecx, [esp + 0x44]
call fcn.005f6bae
mov ebp, dword [esp + 0xe0]
lea eax, [esp + 0x44]
push eax
mov ecx, ebp
mov dword [esp + 0xdc], 0
call fcn.005f6f37
lea ecx, [esp + 0x44]
push ecx
push ebp
mov ecx, ebx
call fcn.00411e20
push 0x400
lea ecx, [esp + 0x20]
call fcn.005f73ba
mov edx, dword [esp + 0x1c]
push 0
push 0
lea ecx, [esp + 0x24]
mov byte [esp + 0xe0], 1
call dword [edx + 0x28]
push 0
push 0x1000
lea eax, [esp + 0x24]
push 0
push eax
lea ecx, [esp + 0x9c]
call fcn.005f02f7
lea ecx, [esp + 0x8c]
mov byte [esp + 0xd8], 2
push ecx
lea ecx, [esp + 0x48]
call fcn.005f6ca2
lea ecx, [esp + 0x8c]
call fcn.005f0608
mov edx, dword [esp + 0x1c]
push 0
push 0
lea ecx, [esp + 0x24]
call dword [edx + 0x28]
lea ecx, [esp + 0x1c]
call fcn.005ebb1f
mov esi, eax
push esi
call fcn.005e6f29
add esp, 4
mov edi, eax
lea ecx, [esp + 0x1c]
push esi
push edi
call fcn.005f755f
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
push 2
push 0
push str.SoftwareFoxit_SoftwareFoxit_ReaderDockState_PRO
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x411bdf
mov ecx, dword [esp + 0x18]
push esi
push edi
push 3
push eax
push 0x6edc4c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x411bdf
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x18]
test eax, eax
je 0x411bee
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x411bfb
push edi
call fcn.005e6f52
add esp, 4
test ebp, ebp
je 0x411c09
push ebp
mov ecx, ebx
call fcn.00411eb0
jmp 0x411c0e
mov eax, 1
mov edx, dword [0x6925b8]
mov dword [esp + 0x10], edx
push eax
lea eax, [esp + 0x14]
push 0x68f6a8
push eax
mov byte [esp + 0xe4], 3
call fcn.005e382e
add esp, 0xc
call fcn.006061a0
mov ecx, dword [esp + 0x10]
mov eax, dword [eax + 4]
push ecx
push str.Bars
push str.DockState_PRO
mov ecx, eax
call fcn.005f7784
lea ecx, [esp + 0x10]
mov byte [esp + 0xd8], 2
call fcn.005eaf86
lea ecx, [esp + 0x8c]
mov byte [esp + 0xd8], 1
call fcn.005f03d3
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd8], 0
call fcn.005f7442
lea ecx, [esp + 0x44]
mov dword [esp + 0xd8], 0xffffffff
call fcn.005f6c41
mov ecx, dword [esp + 0xd0]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xcc
ret 4
Function at 0x4150e0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x617388
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x104
push ebx
push esi
push edi
mov ebx, dword [esp + 0x120]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x12c]
mov dword [esp + 0x118], 0
test eax, eax
mov eax, dword [esp + 0x128]
je 0x41515b
test eax, eax
je 0x415191
mov edi, str.PDF_Files_.pdf_.PDFForm_Data_Files__.fdf_.FDFAll_Files_._.
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4151c1
test eax, eax
je 0x415191
mov edi, str.PDF_Files_.pdf_.PDFAll_Files_._.
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 0x98], 0x68f498
jmp 0x4151c1
mov edi, str.Form_Data_Files__.fdf_.FDFAll_Files_._.
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 0x98], str..fdf
lea ecx, [esp + 0xc]
push 0x7c
push ecx
call fcn.00460b49
add esp, 8
test eax, eax
je 0x4151e7
mov byte [eax], 0
inc eax
push 0x7c
push eax
call fcn.00460b49
add esp, 8
test eax, eax
jne 0x4151d4
mov ecx, dword [ebx + 0x90]
mov eax, dword [esp + 0x130]
lea edx, [esp + 0xc]
or ecx, 0x1206
test eax, eax
mov dword [ebx + 0x68], edx
mov dword [ebx + 0x90], ecx
je 0x415224
mov edi, dword [0x6edc50]
mov ecx, 0x5dc
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [0x6edc50]
mov dword [ebx + 0x78], eax
jmp 0x415292
mov ecx, dword [esp + 0x124]
mov eax, dword [ecx - 8]
test eax, eax
je 0x415299
mov edi, dword [0x6edc50]
mov ecx, 0x5dc
xor eax, eax
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x124]
lea ecx, [esp + 0x124]
mov eax, dword [edx - 8]
push eax
call fcn.005eb3b6
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push 0xffffffffffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [0x6edc50]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x128]
call fcn.005eb405
mov ecx, dword [0x6edc50]
mov dword [ebx + 0x78], ecx
mov dword [ebx + 0x7c], 0x1770
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x4152aa
mov dword [ebx + 0x5c], 0x58
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0xb8]
lea ecx, [esp + 0x124]
mov esi, eax
mov dword [esp + 0x118], 0xffffffff
call fcn.005eaf86
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x110
ret
Function at 0x416200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x617510
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
mov eax, dword [ebx + 0xc]
mov dword [esp + 0xc], ecx
cmp eax, 0x8164
jne 0x4163c0
mov edi, dword [ecx + 0x248]
xor esi, esi
cmp edi, esi
je 0x4163c0
mov dword [esp + 0x10], vtable.CMenu.0
mov dword [esp + 0x14], esi
mov dword [esp + 0x30], esi
call fcn.006061a0
mov eax, dword [eax + 0xc]
push 0x33c
push eax
call dword [sym.imp.USER32.dll_LoadMenuA]
push eax
lea ecx, [esp + 0x14]
call fcn.005ec3f1
mov eax, dword [esp + 0x14]
push esi
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.005ec3be
mov edx, dword [edi + 0x1c]
mov esi, eax
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x18]
push ecx
push eax
push 0x433
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x18]
mov ecx, edi
push eax
call fcn.005efb8f
mov ecx, dword [esp + 0x14]
push 0x33c
push ecx
call fcn.004285d0
mov bl, byte [esp + 0x48]
add esp, 8
test bl, 1
je 0x416318
mov edx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 8
push 0x816b
push edx
call edi
mov eax, dword [esi + 4]
push 8
push 0x816a
push eax
call edi
mov ecx, dword [esi + 4]
push 8
push 0x8169
push ecx
call edi
mov edx, dword [esi + 4]
push 8
push 0x8165
push edx
call edi
mov eax, dword [esi + 4]
push 8
push 0x8167
push eax
call edi
mov ecx, dword [esi + 4]
push 8
push 0x8166
push ecx
call edi
jmp 0x41637d
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
test bl, 0x20
je 0x416330
mov eax, dword [esi + 4]
push 8
push 0x816a
push eax
call edi
test bl, 0x10
je 0x416342
mov ecx, dword [esi + 4]
push 8
push 0x8169
push ecx
call edi
test bl, 2
je 0x416354
mov edx, dword [esi + 4]
push 8
push 0x8165
push edx
call edi
test bl, 4
je 0x416366
mov eax, dword [esi + 4]
push 8
push 0x8167
push eax
call edi
test bl, 8
je 0x416378
mov ecx, dword [esi + 4]
push 8
push 0x8166
push ecx
call edi
test bl, 0x40
je 0x41638a
mov edx, dword [esi + 4]
push 8
push 0x8168
push edx
call edi
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push 0x40
mov ecx, esi
call fcn.005e803f
mov dword [esp + 0x10], vtable.CMenu.0
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 1
call fcn.005ec448
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc
Function at 0x418fee
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x617881
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x6925b8]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 0x18]
mov dword [ecx], eax
mov edx, dword [0x6925b8]
lea ebx, [esi + 0x1c]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebx], edx
mov eax, dword [0x6925b8]
mov dword [esi + 0x44], eax
push 0x6edc4c
mov byte [esp + 0x20], 2
call fcn.005eb10f
push 0x6edc4c
mov ecx, ebx
call fcn.005eb10f
push 0x6edc4c
lea ecx, [esp + 0x10]
mov dword [esi + 0x10], edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x14], 0x4e
mov dword [esi + 0xc], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
call fcn.005eaff4
lea ecx, [esp + 0xc]
call fcn.005eaf86
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x419a80
Capabilities:
Delete registry value

Disassembly:
push ecx
push str.FoxitReader.Document
push 0x6edc4c
push 0x68f498
push SysReAllocStringLen
call fcn.0042ae90
push str.application_pdf
push str.Content_Type
push 0x68f498
push SysReAllocStringLen
call fcn.0042ae90
push 0x6904a0
push str.BrowseInPlace
push str.FoxitReader.Document
push SysReAllocStringLen
call fcn.0042ae90
push str.14E8BBD8_1D1C_4D56_A4DA_D20B75EB814E
push str.CLSID
push str.MIMEDatabaseContent_Type_application_pdf
push SysReAllocStringLen
call fcn.0042ae90
add esp, 0x40
push 0x68f498
push str.Extension
push str.MIMEDatabaseContent_Type_application_pdf
push SysReAllocStringLen
call fcn.0042ae90
add esp, 0x10
lea eax, [esp]
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdf
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x419b31
mov ecx, dword [esp]
push str.Application
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.FoxitReader.Document
push str.Progid
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdf
push SysReAllocStringLen
call fcn.0042ae90
call fcn.00419b60
add esp, 0x14
ret