joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fb60
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
shl edx, 0xc
xor ecx, 1
mov ebp, eax
push edi
lea edi, [eax + edx]
mov edx, ecx
push esi
and edx, 1
push ebx
sub esp, 0x2c
mov esi, dword [0x42b070]
mov byte [esp + 0x1b], dl
mov ebx, esi
lea esi, [esi + edi - 1]
neg ebx
and ebp, ebx
and esi, ebx
mov dword [esp + 0x1c], ebp
cmp ebp, esi
jae 0x40fbe3
mov dword [esp + 0x14], eax
mov edx, ebp
mov ebp, 1
cmp dword [esp + 0x14], edx
seta bl
cmp edi, edx
setbe cl
or bl, cl
jne 0x40fbb7
cmp byte [esp + 0x1b], 0
je 0x40fbd9
mov ebx, edx
mov ecx, edx
mov eax, ebp
shr ebx, 0x11
shr ecx, 0xc
and ebx, 0x1fff
shl eax, cl
add ebx, 0x307c
lock or dword [ebx*4 + 0x42b3a0], eax
add edx, 0x1000
cmp edx, esi
jb 0x40fba0
cmp dword [0x42282c], 1
mov dword [esp + 0xc], 0x449f90
sbb eax, eax
and eax, 0xffffffc4
add eax, 0x40
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
sub esi, eax
mov dword [esp], eax
mov dword [esp + 4], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x40fc20
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.un_VirtualProtect_failed:_errcode_0x_X_n
mov dword [esp + 4], eax
call sym._GC_log_printf
mov dword [esp], str.un_VirtualProtect_failed
call sym._GC_default_on_abort.lto_priv.75
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_DebugBreak]

Function at 0x40fc50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov ecx, dword [0x42b100]
test ecx, ecx
je 0x40fc9f
mov edx, dword [0x42b0fc]
test edx, edx
jne 0x40fc9f
mov edx, dword [eax + 4]
cmp edx, 0x449f74
je 0x40fc79
mov ecx, dword [0x42b364]
test ecx, ecx
je 0x40fca0
cmp eax, 0x449fc0
jne 0x40fc90
ret
mov edx, dword [0x42b364]
and eax, 0xfffff000
test edx, edx
je 0x40fd10
ret
push ebx
mov ebx, eax
mov eax, edx
xor ecx, ecx
and eax, 0xfffff000
mov edx, 1
sub esp, 8
call sym._GC_remove_protection.part.34.lto_priv.78
cmp ebx, 0x449fc0
je 0x40fd00
mov eax, dword [0x42b100]
test eax, eax
je 0x40fd00
mov eax, ebx
mov ebx, dword [0x42b0fc]
and eax, 0xfffff000
test ebx, ebx
jne 0x40fd00
mov ecx, dword [0x42b364]
test ecx, ecx
jne 0x40fd00
add esp, 8
xor ecx, ecx
mov edx, 1
pop ebx
jmp sym._GC_remove_protection.part.34.lto_priv.78
add esp, 8
pop ebx
ret
xor ecx, ecx
mov edx, 1
jmp sym._GC_remove_protection.part.34.lto_priv.78
Function at 0x40fd20
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov edx, dword [eax]
xor eax, eax
cmp dword [edx], 0xc0000005
je 0x40fd40
add esp, 0x10
pop ebx
pop esi
pop edi
ret 4
cmp dword [edx + 0x14], 1
jne 0x40fd36
mov ecx, dword [edx + 0x18]
mov edx, ecx
shr edx, 0x16
mov ebx, dword [edx*4 + 0x446d94]
mov edx, ecx
shr edx, 0xc
and edx, 0x3ff
mov edx, dword [ebx + edx*4]
test edx, edx
jne 0x40fd7a
mov edx, dword [0x42b058]
cmp edx, 0xffffffff
je 0x40fd36
add esp, 0x10
pop ebx
pop esi
pop edi
jmp edx
mov edx, dword [0x42b070]
cmp dword [0x42282c], 1
mov dword [esp + 0xc], 0x449f90
sbb eax, eax
mov ebx, edx
and eax, 0xffffffc4
mov dword [esp + 4], edx
neg ebx
add eax, 0x40
and ebx, ecx
mov dword [esp + 8], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x40fe0f
mov eax, dword [0x42b070]
xor edx, edx
mov esi, 1
shr eax, 0xc
je 0x40fe05
lea esi, [esi]
lea esi, [esi]
mov eax, ebx
mov ecx, ebx
mov edi, esi
shr eax, 0x11
shr ecx, 0xc
and eax, 0x1fff
shl edi, cl
add eax, 0x307c
lock or dword [eax*4 + 0x42b3a0], edi
mov eax, dword [0x42b070]
shr eax, 0xc
add edx, 1
add ebx, 0x1000
cmp eax, edx
ja 0x40fdd0
mov eax, 0xffffffff
jmp 0x40fd36
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.un_VirtualProtect_failed:_errcode_0x_X_n
mov dword [esp + 4], eax
call sym._GC_log_printf
mov dword [esp], str.un_VirtualProtect_failed
call sym._GC_default_on_abort.lto_priv.75
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x40fdb5
Function at 0x4135b0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
push edi
push esi
xor esi, esi
push ebx
mov ebx, eax
sub esp, 0x2ec
call sym._GC_win32_unprotect_thread
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea ebp, [esp + 0x10]
lea esi, [esi]
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], ebp
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
je 0x4135f1
cmp dword [esp + 0x10], 0x103
jne 0x4136a0
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
sub esp, 4
cmp eax, 0xffffffff
je 0x413661
cmp dword [0x42b04c], 1
sbb eax, eax
and eax, 0xbffffffc
add eax, 0x40010007
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
sub esp, 8
test eax, eax
jne 0x4136c0
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
cmp eax, 0xffffffff
jne 0x413661
mov dword [esp], str.ResumeThread_failed_in_suspend_loop
call sym._GC_default_on_abort.lto_priv.75
call dword [sym.imp.KERNEL32.dll_DebugBreak]
cmp esi, 1
jle 0x413676
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
add esi, 1
cmp esi, 0xf423f
jle 0x4135d0
mov dword [esp], str.SuspendThread_loop_failed
call sym._GC_default_on_abort.lto_priv.75
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x4135d0
mov eax, ebx
call sym._GC_delete_thread
add esp, 0x2ec
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x14]
or byte [ebx + 0x10], 0x40
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0xa4]
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0xb0]
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0xb4]
mov dword [ebx + 0x24], eax
mov eax, dword [esp + 0xb8]
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0xbc]
mov dword [ebx + 0x2c], eax
mov eax, dword [esp + 0xc0]
mov dword [ebx + 0x30], eax
mov eax, dword [esp + 0xc4]
mov dword [ebx + 0x34], eax
mov eax, dword [esp + 0xc8]
mov dword [ebx + 0x38], eax
mov eax, dword [esp + 0xd8]
mov dword [ebx + 0x14], eax
add esp, 0x2ec
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x413730
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xbc
mov eax, dword [0x42b0e0]
test eax, eax
jne 0x413760
mov eax, dword [0x449eb4]
test eax, eax
je 0x41377d
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x449eb4]
sub esp, 4
test eax, eax
jne 0x413806
mov eax, dword [0x42b0c4]
mov edi, dword [0x449f60]
mov dword [0x449eb4], 1
test edi, edi
jne 0x413830
mov edx, dword [0x42b0e0]
test edx, edx
jne 0x413930
mov dword [0x449eb4], 0
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.GC_ABORT_ON_LEAK
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4137e2
mov dword [esp], str.Leaked_or_smashed_objects_encountered
call sym._GC_default_on_abort.lto_priv.75
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov ebx, dword [0x42b0e0]
test ebx, ebx
je 0x4137a8
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x449eb4], 0
sub esp, 4
mov ecx, dword [0x42b0e0]
test ecx, ecx
je 0x41374c
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [edi*4]
lea ebx, [esp + 0x10]
mov dword [esp + 4], 0x449ec0
mov dword [esp + 8], esi
mov dword [esp], ebx
call sym._memcpy
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0x449ec0
mov dword [0x449f60], 0
call sym._memset
mov eax, dword [0x42b0e0]
test eax, eax
jne 0x413950
mov dword [esp + 4], edi
add esi, ebx
mov dword [esp], str.Found__u_leaked_objects:_n
call sym._GC_err_printf
jmp 0x4138c3
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ebp + 0xc]
mov eax, edi
call sym._free_internal.isra.31.lto_priv.69
mov edi, dword [0x42b0e0]
test edi, edi
jne 0x413910
add ebx, 4
cmp esi, ebx
je 0x4137c0
mov edi, dword [ebx]
mov dword [esp], edi
call sym._GC_default_print_heap_obj_proc
test edi, edi
je 0x4138b8
mov edx, edi
mov eax, dword [0x42b0e0]
shr edx, 0x16
mov ecx, dword [edx*4 + 0x446d94]
mov edx, edi
shr edx, 0xc
and edx, 0x3ff
mov ebp, dword [ecx + edx*4]
test eax, eax
je 0x4138a0
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
jmp 0x4138a0
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x4138b8
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x4137e2
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x41387e
Function at 0x415150
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [0x42b3e0]
mov edx, dword [0x42b3e8]
sub edx, ebx
cmp eax, 0xfffffff7
ja 0x415320
lea esi, [eax + 7]
and esi, 0xfffffff8
cmp esi, edx
jbe 0x415215
cmp esi, 0xffff
ja 0x4152b1
mov ecx, dword [0x42b36c]
test ecx, ecx
je 0x415230
mov dword [esp + 4], 0x11000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ebx, [eax + 0xfff]
sub esp, 8
and ebx, 0xfffff000
cmp dword [0x42b42c], 0x1ff
jbe 0x4151d6
mov dword [esp], str.Too_many_heap_sections
call sym._GC_default_on_abort.lto_priv.75
call dword [sym.imp.KERNEL32.dll_DebugBreak]
test ebx, ebx
je 0x4152a0
mov eax, dword [0x42b42c]
add dword [0x42b3c0], 0x10000
cmp dword [0x42b370], 2
lea edx, [eax + 1]
mov dword [eax*4 + 0x43f594], ebx
mov dword [0x42b42c], edx
je 0x4152f0
lea eax, [ebx + 0x10000]
mov dword [0x42b3e8], eax
add esi, ebx
mov dword [0x42b3e0], esi
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
cmp dword [0x42282c], 1
mov edx, dword [0x42b364]
mov dword [esp], 0
sbb eax, eax
and eax, 0xffffffc4
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, dword [0x42b368]
or ah, 0x30
mov dword [esp + 8], eax
xor eax, eax
test edx, edx
sete al
add eax, 0x10000
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov ebx, eax
test eax, 0xfff
je 0x4151b8
mov dword [esp], str.Bad_VirtualAlloc_result
call sym._GC_default_on_abort.lto_priv.75
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x4151b8
mov dword [esp + 4], esi
mov dword [esp], str.GC_Warning:_Out_of_memory___trying_to_allocate_requested_amount___lu_bytes_..._n
call dword [0x422830]
mov eax, esi
call sym._GC_win32_get_mem
mov ebx, eax
test eax, eax
je 0x415330
add dword [0x42b3c0], esi
cmp dword [0x42b370], 2
jne 0x41521d
mov dword [esp + 4], esi
mov dword [esp], str.Got__lu_bytes_from_OS_n
call sym._GC_log_printf
jmp 0x41521d
mov dword [esp + 4], 0x10000
mov dword [esp], str.Got__lu_bytes_from_OS_n
call sym._GC_log_printf
lea eax, [ebx + 0x10000]
mov dword [0x42b3e8], eax
jmp 0x415215
mov esi, 0xfffffff8
cmp edx, 0xfffffff7
jbe 0x4152b1
jmp 0x415215
xor ebx, ebx
jmp 0x41521d
Function at 0x416fd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ecx, dword [0x42b100]
test ecx, ecx
je 0x417080
mov edx, dword [0x42b420]
test edx, edx
je 0x417080
lea esi, [eax + eax*4]
mov ebx, dword [0x449e88]
add esi, esi
cmp esi, ebx
jg 0x417017
jmp 0x417066
add ebx, 1
cmp esi, ebx
je 0x417060
call sym._GC_mark_some.constprop.51
test eax, eax
je 0x417010
mov eax, dword [0x42b0f8]
test eax, eax
jne 0x417060
cmp dword [0x420028], 0xf423f
mov eax, dword [0x449e98]
je 0x41718a
cmp eax, 2
jle 0x41717a
mov eax, sym._GC_never_stop_func.lto_priv.66
call sym._GC_stopped_mark.lto_priv.93
test eax, eax
jne 0x4171ca
add dword [0x449e98], 1
mov ebx, dword [0x449e88]
test ebx, ebx
jle 0x417089
sub ebx, esi
mov eax, 0
cmovs ebx, eax
mov dword [0x449e88], ebx
add esp, 0x14
pop ebx
pop esi
ret
mov eax, dword [0x42b0f8]
test eax, eax
je 0x417090
add esp, 0x14
pop ebx
pop esi
ret
call sym._GC_should_collect.lto_priv.79
test eax, eax
je 0x417089
mov eax, dword [0x42b100]
test eax, eax
je 0x4171b0
mov ebx, dword [0x449e9c]
test ebx, ebx
jne 0x4170c1
mov eax, dword [0x447e58]
cmp eax, dword [0x420024]
jl 0x417170
mov ecx, dword [0x42b370]
test ecx, ecx
jne 0x4171da
call sym._GC_promote_black_lists.lto_priv.94
mov edx, 1
xor eax, eax
call sym._GC_reclaim_all.lto_priv.73
mov dword [esp + 4], 0
mov dword [esp], sym._clear_marks_for_block.lto_priv.60
call sym._GC_apply_to_all_blocks.constprop.57
mov dword [0x42b3fc], 0
mov dword [0x42b420], 5
mov dword [0x42b418], 0
mov dword [0x447e58], 0
mov dword [0x42b048], 1
cmp dword [0x420028], 0xf423f
je 0x41713d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x447e54], eax
mov eax, sym._GC_timeout_stop_func
call sym._GC_stopped_mark.lto_priv.93
test eax, eax
jne 0x4171a0
mov edx, dword [0x42b048]
test edx, edx
jne 0x417089
add dword [0x449e98], 1
jmp 0x417089
add eax, 1
mov dword [0x447e58], eax
jmp 0x417126
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x447e54], eax
mov eax, dword [0x449e98]
cmp eax, 2
jg 0x417047
mov eax, sym._GC_timeout_stop_func
jmp 0x41704c
add esp, 0x14
pop ebx
pop esi
jmp sym._GC_finish_collection.lto_priv.92
mov esi, dword [0x42b0f8]
test esi, esi
jne 0x417089
add esp, 0x14
mov eax, sym._GC_never_stop_func.lto_priv.66
pop ebx
pop esi
jmp sym._GC_try_to_collect_inner.part.56.lto_priv.72
call sym._GC_finish_collection.lto_priv.92
mov ebx, dword [0x449e88]
jmp 0x417066
mov eax, dword [0x42b3c4]
mov dword [esp], str._Full_mark_for_collection__lu_after__lu_allocd_bytes_n
mov dword [esp + 8], eax
mov eax, dword [0x42b318]
add eax, 1
mov dword [esp + 4], eax
call sym._GC_log_printf
jmp 0x4170cf
Function at 0x417420
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x42b0e8]
test eax, eax
je 0x417432
mov eax, dword [0x449f68]
test eax, eax
je 0x417440
ret
push ebx
sub esp, 0x18
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call ebx
cmp eax, dword [0x42b050]
je 0x417460
add esp, 0x18
pop ebx
ret
mov eax, dword [0x42b0e0]
test eax, eax
jne 0x417560
call ebx
mov edx, eax
shr edx, 8
xor edx, eax
movzx edx, dl
mov edx, dword [edx*4 + 0x44a000]
test edx, edx
je 0x417619
cmp eax, dword [edx + 8]
jne 0x41760f
mov ebx, dword [0x42b0e0]
test ebx, ebx
jne 0x417580
mov eax, dword [0x42b0e4]
test eax, eax
je 0x417651
mov eax, dword [0x42b450]
test eax, eax
je 0x4174d1
mov ebx, dword [0x42b0e0]
test ebx, ebx
jne 0x4175ce
mov eax, dword [0x42b450]
test eax, eax
je 0x4174ea
call sym._GC_notify_or_invoke_finalizers.part.16.lto_priv.85
mov eax, dword [0x42b0e0]
test eax, eax
je 0x4174ea
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
call sym._GC_noop6.constprop.47
mov eax, dword [0x42b0f8]
test eax, eax
jne 0x4175b0
call sym._GC_never_stop_func.lto_priv.66
test eax, eax
jne 0x4175b0
mov eax, sym._GC_never_stop_func.lto_priv.66
call sym._GC_try_to_collect_inner.part.56.lto_priv.72
mov ebx, eax
mov eax, dword [0x42b0e0]
test eax, eax
jne 0x41763c
test ebx, ebx
je 0x417547
mov eax, dword [0x42b450]
test eax, eax
je 0x417547
mov eax, dword [0x42b0e0]
test eax, eax
jne 0x417595
mov edx, dword [0x42b450]
test edx, edx
je 0x417547
call sym._GC_notify_or_invoke_finalizers.part.16.lto_priv.85
mov eax, dword [0x42b0c4]
test eax, eax
je 0x417454
add esp, 0x18
pop ebx
jmp sym._GC_print_all_errors.lto_priv.83
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
jmp 0x41746d
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x41749f
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x42b450]
sub esp, 4
test eax, eax
jne 0x417542
nop
mov eax, dword [0x42b0e0]
test eax, eax
je 0x417547
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x417547
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x42b450]
sub esp, 4
test ecx, ecx
jne 0x4174cc
mov edx, dword [0x42b0e0]
test edx, edx
je 0x4174ea
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x4174d1
mov edx, dword [edx]
test edx, edx
jne 0x417488
mov ecx, dword [0x42b0e0]
test ecx, ecx
je 0x417454
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x417454
mov dword [esp], 0x42b0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x417522
call sym._GC_init
jmp 0x4174ac
Function at 0x418738
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, eax
mov dword [esp + 8], ebx
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._vfprintf
call sym._abort

Function at 0x419240
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x41925f
mov eax, 0
jmp 0x4192a3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x419282
mov eax, 0
jmp 0x4192a3
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x41929e
mov eax, 0
jmp 0x4192a3
mov eax, 1
leave
ret

Function at 0x4192a5
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x419304
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x4192fc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x4192fc
mov eax, dword [ebp - 4]
jmp 0x419318
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x4192d9
mov eax, 0
leave
ret
Function at 0x7c6cce
Capabilities:
Parse pe header

Disassembly:
call 0x7c6014
jmp 0x7c6d08
push dword [esp + 0x14]
pushal
lea esp, [esp + 0x4a]
push edx
jmp 0x7c6cde
push edx
push dword [esp]
pop dword [esp + 2]
push dword [esp + 6]
mov dword [esp + 0x6c], esi
jmp 0x7c6d88
mov edx, eax
mov eax, dword [edx]
pop edx
mov eax, dword [eax + 8]
jmp 0x7c6d2a
pop eax
call fcn.007c6d6f
and byte [ecx + 0x7ca35031], ah
invalid
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push edx
jmp 0x7c6cfe
push eax
jmp 0x7c600f
lea esp, [esp + 1]
mov dword [esp + 0x68], edi
lea esp, [esp + 0x68]
mov eax, dword fs:[0x30]
jmp 0x7c6d21
push edx
mov byte [esp], dh
mov dword [esp], eax
push dword [esp + 2]
lea esp, [esp + 7]
mov byte [esp], dh
jmp 0x7c6d41

Function at 0x7c6d6f
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
push eax
jmp 0x7c400c
call 0x7c4011
jmp 0x7c4b44
mov eax, 0x9a7fee2c
bswap eax
mov eax, dword [esp]
call fcn.007c4b29
mov dword [esp + 0xb], esi
call fcn.007c4be9
push dword [esp + 2]
mov dword [esp + 5], eax
pushal
push dword [esp + 0x34]
pushal
lea esp, [esp + 0x59]
call fcn.007c4bca
xor dword [ecx + 0x7eb34021], esi
xor byte [ebx], dh
sub ch, byte [eax - 0x18]
out dx, eax
pop esi
pushfd
add dword [esp], 0x63fe5a49
pushal
pop word [esp + 0x17]
jmp 0x7c4b53
movzx ebx, word [eax + 0x3c]
jmp 0x7c6d55
add ebx, eax
cmp word [ebx], 0x4550
jmp 0x7c6e7f
xor ax, ax
lea esp, [esp + 4]
cmp word [eax], 0x5a4d
jmp 0x7c6d9c
je 0x7c6030
sub eax, 0x10000
jmp 0x7c6d76
sbb ch, al
inc ecx
sal dword [eax + 0x2859543], 1
mov al, 0x43
xchg ebp, eax
test dword [edx], eax
nop
test dword [edx], 0x57c745ea
xor al, cl
std
js 0x7c6de4
mov dword [eax - 0x75], edi
fst qword [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
fimul dword [ebp - 0x3a]
push esp
xor ecx, esi
dec ecx
idiv dword [ebx - 0x15]
invalid
jns 0x7c6de0
dec esp
mov eax, dword [0x2fdcb525]
stc
rcl dword [esi - 0x3c]
mov dword [0xcb41b65e], eax
pop ebx
int 0x2a
jmp 0x750250dc
je 0x7c372c
jne 0x7c6da2
lea ecx, [0xda17e49d]
sbb eax, 0xa66b0c9e
jnp 0x7c6f05
arpl word [esi], ax
cmc
and byte [ebp - 0xc], dh
push 0xd
cld
cmp byte [ebp - 0x1f], ah
jno 0x7c6eb7
jecxz 0x7c6ede
movsd dword es:[edi], dword [esi]
and dh, byte [eax - 0x1a35dd29]
not dword [bp + si - 0x719f]
sbb eax, 0x98690e98
imul edi, dword [ebp - 0xb], 0x65
or al, 0xff
jp 0x7c6f2f
push cs
imul ebx, dword [eax + 0x65f57d6b], 0x6d7aff0c
out 0x74, al
adc ebp, esi
imul edx, dword [edi + 0x1dee8b1b], 0x127cffd4
jne 0x7c6e56
pop ecx
retf
invalid
and dword [eax - 0x4d], eax
jle 0x7c6f3b
mov dl, 0x20
inc edi
mov dl, 0x6f
xor dword [edi + 0x6cb14227], esi
sub dword [eax + 0x6ca8593e], ebp
inc ecx
lds edx, [ebp + 0x3c]
iretd
cmp dword [esi - 0x6a], 0xffffffe1
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
mov cl, byte [ecx]
mov word [edx], es
xchg esp, eax
add ah, byte [ebp - 0x6c]
xchg ecx, eax
sbb dword [ecx - 0xe61e418], ecx
jp 0x7c6f24
call 0xdc79e9cf
pop edi
iretd
invalid
Function at 0x4096c0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 0x40], eax
xor eax, eax
mov word [ebp - 0x248], ax
push 0x206
push 0
lea ecx, [ebp - 0x246]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor edx, edx
mov word [ebp - 0x450], dx
push 0x206
push 0
lea eax, [ebp - 0x44e]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x40974f
mov edx, dword [ebp + 0xc]
push edx
push 0x104
lea eax, [ebp - 0x450]
push eax
call fcn.004062c0
push 0x40b3b4
push 0x104
lea ecx, [ebp - 0x450]
push ecx
call fcn.00406310
jmp 0x40979e
lea edx, [ebp - 0x450]
push edx
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x409780
push 0x40b3b8
push 0x104
lea eax, [ebp - 0x450]
push eax
call fcn.00406310
jmp 0x40979e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40b3d8
push str.SHGetFolderPath_failed
call fcn.004080a0
add esp, 0xc
jmp 0x409874
lea ecx, [ebp - 0x450]
push ecx
push 0x104
lea edx, [ebp - 0x248]
push edx
call fcn.004062c0
push str.AdobeARMHelper.exe
push 0x104
lea eax, [ebp - 0x248]
push eax
call fcn.00406310
push 0xffffffffffffffff
lea ecx, [ebp - 0x248]
push ecx
call fcn.004095f0
add esp, 8
test eax, eax
jne 0x4097fc
push 0x357
lea edx, [ebp - 0x248]
push edx
push str.Service_workflow_failed__file_not_valid:
call fcn.004080a0
add esp, 0xc
jmp 0x409874
mov dword [ebp - 0x3c], 0
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x540
mov dword [ebp - 0x20], 5
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
lea edx, [ebp - 0x248]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40985b
push 0
push 0x40b48c
push str.ShellExecuteEx_succeeded
call fcn.004080a0
add esp, 0xc
jmp 0x409874
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40b4c4
push str.ShellExecuteEx_failed
call fcn.004080a0
add esp, 0xc
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.00407458
mov esp, ebp
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219