joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fa73
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 8]
xor ebx, ebx
call fcn.0040279b
mov eax, dword [ebp - 8]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43fad9
mov eax, dword [ebp - 0xc]
add eax, eax
push eax
push dword [ebp + 0xc]
push 1
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
neg eax
sbb ebx, ebx
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00402def
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x43faeb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 1
push eax
push 0x20019
xor edi, edi
mov dword [ebp - 4], 0x104
push edi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x43fb83
push 0x208
call fcn.0046de68
pop ecx
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 0xea
jne 0x43fb76
push edi
call fcn.0046de4d
mov eax, dword [ebp - 4]
add eax, eax
push eax
call fcn.0046de68
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x43fb83
mov ecx, dword [ebp + 0xc]
push edi
call fcn.004027df
push edi
call fcn.0046de4d
pop ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x43fb99
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push esi
push eax
push 0x20019
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x43fbe5
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x43fbea
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov esi, edx
push eax
push esi
mov ebx, SysReAllocString
xor edi, edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0xf003f
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fc4d
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push edi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
test esi, esi
cmove edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43fc54
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push esi
push eax
push 0x20019
push 0
push 0x49dc68
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x43fcaf
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0xb
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 8
push eax
push esi
push str.iSpeedLauncherLogonTime
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x43fcb4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 8]
xor edi, edi
push eax
lea eax, [ebp - 4]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push 0x49dc68
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43fd0d
push esi
push 8
lea eax, [ebp + 0xc]
push eax
push 0xb
push edi
push str.iSpeedLauncherLogonTime
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
test esi, esi
pop esi
cmove edi, eax
mov eax, edi
pop edi
leave
ret

Function at 0x43fd12
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fd39
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push ebx
push dword [ebp - 4]
xor ebx, ebx
test eax, eax
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
leave
ret
Function at 0x440caf
Capabilities:
Get common file path

Disassembly:
push 8
mov eax, 0x486750
call fcn.00464e48
mov esi, ecx
call fcn.0044afe1
push eax
lea ecx, [ebp - 0x10]
call fcn.00402824
xor edi, edi
lea ecx, [ebp - 0x10]
push 0x104
mov dword [ebp - 4], edi
call fcn.00402b5d
push eax
push edi
push edi
push 0x2b
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.004097d8
test edi, edi
jne 0x440d15
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00402d9f
push str.AdobeARM1.0AdobeARM.exe
mov ecx, esi
call fcn.0040252d
xor esi, esi
inc esi
jmp 0x440d40
push str.SHGetFolderPath_in_GetCurrentExePath_failed:
lea ecx, [ebp - 0x14]
call fcn.0040279b
xor ecx, ecx
mov byte [ebp - 4], 1
push edi
lea edx, [ebp - 0x14]
inc ecx
call fcn.00413e51
pop ecx
mov ecx, dword [ebp - 0x14]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.00402def
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402def
mov eax, esi
call fcn.00464e11
ret

Function at 0x440d53
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x48cf66
call fcn.00464e7c
mov esi, ecx
xor ebx, ebx
test edx, edx
je 0x440d7b
push 0x4e20a0
call fcn.00402d9f
push 0x49fb68
jmp 0x440dbb
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00466990
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x2b
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test edi, edi
jne 0x440e24
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004027df
push str.AdobeARM1.0_
mov ecx, esi
call fcn.0040252d
mov eax, dword [0x4e1f34]
mov ecx, esi
push dword [eax - 0xc]
push eax
call fcn.00402556
mov ecx, dword [esi]
or edx, 0xffffffff
push ebx
call fcn.0042d48a
pop ecx
test eax, eax
je 0x440e1f
push esi
lea eax, [ebp - 0x220]
push str.Not_found_or_not_valid:
push eax
call fcn.00402381
add esp, 0xc
mov esi, eax
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1fc98
mov ecx, 0x4e24cc
call fcn.004121e3
mov ecx, dword [ebp - 0x220]
jmp 0x440e4d
xor eax, eax
inc eax
jmp 0x440e57
push str.SHGetFolderPath_in_GetLauncherPath_failed:
lea ecx, [ebp - 0x21c]
call fcn.0040279b
xor ecx, ecx
mov dword [ebp - 4], ebx
push edi
lea edx, [ebp - 0x21c]
inc ecx
call fcn.00413e51
pop ecx
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.00402def
xor eax, eax
call fcn.00464e26
ret
Function at 0x440e5d
Capabilities:
Get file version info

Disassembly:
push 0x1c
mov eax, 0x48cfc0
call fcn.00464e48
mov dword [ebp - 0x14], edx
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp + 0x14]
xor edi, edi
test esi, esi
je 0x440ea8
push str.GetFileVersion__:
lea ecx, [ebp - 0x10]
call fcn.0040279b
push edi
push ebx
push 2
lea edx, [ebp - 0x10]
mov dword [ebp - 4], edi
pop ecx
call fcn.00413900
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402def
lea eax, [ebp - 0x20]
push eax
push dword [ebx]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x440ff2
push ebx
call fcn.0044a8a2
pop ecx
mov edi, eax
mov eax, dword [ebp - 0x18]
push edi
push ebx
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x440fb9
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x49fb68
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
cmp eax, 1
jne 0x440f9f
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push edi
movzx eax, word [ecx + 0xa]
mov dword [ebx], eax
movzx eax, word [ecx + 8]
mov dword [edx], eax
movzx eax, word [ecx + 0xe]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
movzx eax, word [ecx + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
call fcn.0044a89d
pop ecx
test esi, esi
je 0x440f97
call fcn.0044afe1
push eax
lea ecx, [ebp - 0x10]
call fcn.00402824
push str.File_version:__1_u_._2_u_._3_u_._4_u_
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 1
call fcn.0040279b
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 2
push dword [eax]
mov eax, dword [ebp + 0xc]
push dword [eax]
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x10]
push dword [ebx]
push dword [ebp - 0x14]
push eax
call fcn.00412910
push 0
push 2
lea edx, [ebp - 0x10]
pop ecx
call fcn.00413e51
mov ecx, dword [ebp - 0x14]
add esp, 0x1c
add ecx, 0xfffffff0
call fcn.00402def
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402def
xor eax, eax
inc eax
jmp 0x441024
test esi, esi
je 0x440fe9
push str.VerQueryValue___failed_in_GetFileVersion__.
lea ecx, [ebp - 0x14]
call fcn.0040279b
mov dword [ebp - 4], 3
jmp 0x440fd1
test esi, esi
je 0x440fe9
push str.GetFileVersionInfo___failed_in_GetFileVersion__.
lea ecx, [ebp - 0x14]
call fcn.0040279b
mov dword [ebp - 4], 4
xor ecx, ecx
lea edx, [ebp - 0x14]
push ebx
inc ecx
call fcn.00413e51
pop ecx
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402def
push edi
call fcn.0044a89d
pop ecx
jmp 0x441022
test esi, esi
je 0x441022
push str.GetFileVersionInfoSize___failed_in_GetFileVersion__.
lea ecx, [ebp - 0x18]
call fcn.0040279b
xor ecx, ecx
mov dword [ebp - 4], 5
push edi
lea edx, [ebp - 0x18]
inc ecx
call fcn.00413e51
pop ecx
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00402def
xor eax, eax
call fcn.00464e11
ret
Function at 0x443a28
Capabilities:
Query service status

Disassembly:
push 0x34
mov eax, 0x48d898
call fcn.00464e7c
push 4
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x443a7e
push str.OpenSCManager_failed_in_IsMsiBusy:
lea ecx, [ebp - 0x38]
call fcn.0040279b
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
lea edx, [ebp - 0x38]
pop ecx
call fcn.00413f25
pop ecx
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.00402def
call fcn.00443b3c
jmp 0x443b36
push 4
push str.MSIServer
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x443acd
push str.OpenService_failed_in_IsMsiBusy:
lea ecx, [ebp - 0x38]
call fcn.0040279b
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
lea edx, [ebp - 0x38]
pop ecx
call fcn.00413f25
pop ecx
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.00402def
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x443a74
lea eax, [ebp - 0x40]
push eax
push 0x24
lea eax, [ebp - 0x34]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x443b1c
push str.QueryServiceStatusEx_failed_in_IsMsiBusy:
lea ecx, [ebp - 0x3c]
call fcn.0040279b
push 2
pop esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x3c]
mov ecx, esi
call fcn.00413f25
pop ecx
mov ecx, dword [ebp - 0x3c]
lea ecx, [ecx - 0x10]
call fcn.00402def
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x443ac4
xor eax, eax
inc eax
cmp dword [ebp - 0x2c], 4
push ebx
cmove esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
call fcn.00464e26
ret

Function at 0x443b3c
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.Global_MSIExecute
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x443b5d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x443b59
xor eax, eax
ret
Function at 0x44493b
Capabilities:
Check if file exists
Delete directory
Set file attributes

Disassembly:
push 0x2c
mov eax, 0x48dad8
call fcn.00464e48
mov ebx, ecx
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
je 0x444ad6
cmp dword [eax - 0xc], 4
jb 0x444ad6
add eax, 0xfffffff0
push eax
call fcn.00402d2a
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
push 0x5c
push esi
mov byte [ebp - 4], 1
call fcn.004673a7
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x4449c2
sub ecx, esi
sar ecx, 1
cmp ecx, 0xffffffff
je 0x4449c2
mov eax, dword [esi - 0xc]
dec eax
cmp ecx, eax
jne 0x4449c2
push ecx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.004091c9
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00402d9f
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402def
push 0x49fa34
lea ecx, [ebp - 0x14]
call fcn.0040252d
lea ecx, [ebp - 0x38]
call fcn.0044da63
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x38]
mov esi, dword [ebp - 0x14]
push 0
push esi
call fcn.0044dc50
test eax, eax
je 0x444a88
lea ecx, [ebp - 0x38]
call fcn.0044de00
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x18], eax
call fcn.0044e1f0
test eax, eax
jne 0x444a7e
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.0044df10
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x38]
push 0x10
mov edi, dword [eax + 0x38]
mov ecx, edi
call dword [0x4907c8]
lea ecx, [ebp - 0x38]
call edi
test eax, eax
je 0x444a67
test ebx, ebx
je 0x444a45
push 0
push ebx
lea ecx, [ebp - 0x10]
call fcn.0040920e
cmp eax, 0xffffffff
jne 0x444a6f
mov eax, dword [ebp - 0x10]
push ecx
add eax, 0xfffffff0
mov edi, esp
push eax
mov dword [ebp - 0x1c], edi
call fcn.00402d2a
pop ecx
add eax, 0x10
xor ecx, ecx
mov dword [edi], eax
call fcn.0044493b
pop ecx
jmp 0x444a6f
lea ecx, [ebp - 0x10]
call fcn.00444ae4
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402def
cmp dword [ebp - 0x18], 0
jne 0x4449f1
lea ecx, [ebp - 0x38]
call fcn.0044dbf0
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x444ac3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x444ac3
push eax
push 2
lea edx, [ebp + 8]
pop ecx
call fcn.00413e51
pop ecx
lea ecx, [ebp - 0x38]
call fcn.0044db69
lea ecx, [esi - 0x10]
call fcn.00402def
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x10]
call fcn.00402def
call fcn.00464e11
ret
Function at 0x444ae4
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push 4
mov eax, 0x4850f8
call fcn.00464e48
mov edi, ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x444ba5
xor ebx, ebx
mov ecx, edi
push ebx
push str.ArmUI.ini
call fcn.0040920e
cmp eax, 0xffffffff
je 0x444b76
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.GlobalPdfOnershipInProcessEvent
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
test ebx, ebx
je 0x444b76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xb7
jne 0x444b76
push str.pdf_ownership_takeover_in_process__will_not_cleanup_ArmUI.ini_file
lea ecx, [ebp - 0x10]
call fcn.0040279b
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push 0
push 2
pop ecx
call fcn.00413e51
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402def
jmp 0x444ba5
push 0x80
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x444ba5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
pop ecx
cmp eax, ecx
je 0x444ba5
push eax
mov edx, edi
call fcn.00413f25
pop ecx
call fcn.00464e11
ret

Function at 0x444bab
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [edi]
cmp dword [ecx - 0xc], 0
je 0x444bfb
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x444bce
mov ecx, edi
pop edi
pop esi
pop ebp
jmp fcn.00444ae4
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x444bfb
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x444bee
push 0x4c81ec
mov ecx, esi
call fcn.0040252d
mov eax, dword [edi]
mov ecx, esi
push dword [eax - 0xc]
push eax
call fcn.00402556
pop edi
pop esi
pop ebp
ret
Function at 0x445053
Capabilities:
Reference sql statements

Disassembly:
push 0x10
mov eax, 0x48dc20
call fcn.00464e48
mov esi, edx
mov edi, ecx
call fcn.0044afe1
push eax
lea ecx, [ebp - 0x18]
call fcn.00402824
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp + 8]
push 0x49fb7e
mov byte [ebp - 4], 2
call fcn.0040981c
push dword [esi]
lea eax, [ebp - 0x18]
push str.SELECT_Value_FROM_Property_WHERE_Property.Property_s
push eax
call fcn.00402762
add esp, 0xc
cmp dword [ebp - 0x10], ebx
je 0x4450ae
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
push esi
push edi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.msi.dll_MsiEnumClientsA]
mov edi, eax
test edi, edi
je 0x4450d9
push str.MDOV_error:
lea ecx, [ebp - 0x1c]
call fcn.0040279b
mov byte [ebp - 4], 3
jmp 0x445147
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
mov edi, eax
test edi, edi
je 0x4450fc
push str.MVE_error:
lea ecx, [ebp - 0x1c]
call fcn.0040279b
mov byte [ebp - 4], 4
jmp 0x445147
cmp dword [ebp - 0x14], 0
je 0x44510b
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
mov edi, eax
test edi, edi
jne 0x44515f
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
xor edx, edx
inc edx
call fcn.0044518f
mov edi, eax
pop ecx
test edi, edi
je 0x445161
push str.MGRS_error:
lea ecx, [ebp - 0x1c]
call fcn.0040279b
mov byte [ebp - 4], 5
push edi
push 2
lea edx, [ebp - 0x1c]
pop ecx
call fcn.00413f25
pop ecx
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00402def
mov ebx, edi
cmp dword [ebp - 0x14], 0
je 0x445170
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp dword [ebp - 0x10], 0
je 0x44517f
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
lea ecx, [esi - 0x10]
call fcn.00402def
mov eax, ebx
call fcn.00464e11
ret
Function at 0x445450
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x4dd554]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x20a
lea eax, [ebp - 0x41c]
push ebx
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.00466990
push ebx
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00466990
add esp, 0x18
mov dword [ebp - 0x420], esi
mov ecx, 0x105
mov dword [ebp - 0x428], esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x424], esi
push ecx
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x420]
push eax
push ecx
lea eax, [ebp - 0x41c]
push eax
push 0x4a1390
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x445509
mov ecx, dword [ebp - 0x420]
cmp esi, 0x103
je 0x445503
mov eax, ecx
xor edx, edx
push 0xa
pop ecx
div ecx
mov ecx, eax
mov ax, word [edx*2 + str.0123456789]
mov word [edi + esi*2], ax
inc esi
test ecx, ecx
jne 0x4454df
xor eax, eax
mov word [edi + esi*2], ax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x445526
push str.thsnYaVieBoda
mov edx, 0x104
mov ecx, edi
call fcn.0040d52f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046486a
leave
ret
Function at 0x445535
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x3c
mov eax, 0x48dcb0
call fcn.00464e7c
mov eax, edx
mov dword [ebp - 0x38], eax
mov esi, ecx
mov ecx, eax
xor ebx, ebx
call fcn.004029f6
push 8
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.00466990
add esp, 0xc
lea eax, [ebp - 0x30]
push 8
push ebx
push eax
call fcn.00466990
add esp, 0xc
lea eax, [ebp - 0x40]
push 8
push ebx
push eax
call fcn.00466990
mov eax, dword [esi]
add esp, 0xc
sub eax, 0x10
push eax
call fcn.00402d2a
add eax, 0x10
pop ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], ebx
cmp dword [eax - 4], 1
jle 0x4455a7
push dword [eax - 0xc]
lea ecx, [ebp - 0x28]
call fcn.00402a37
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [eax - 0xc]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov eax, dword [0x4e1f50]
cmp dword [eax - 4], 1
jle 0x4455d4
push dword [eax - 0xc]
mov ecx, 0x4e1f50
call fcn.00402a37
mov eax, dword [0x4e1f50]
mov dword [ebp - 0x3c], eax
mov eax, dword [eax - 0xc]
shr eax, 1
inc eax
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
push str.Encrypted_by_Adobe.
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
je 0x44565e
cmp dword [ebp - 0x30], 0
lea edi, [ebp - 0x24]
mov esi, str.0123456789ABCDEF
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jbe 0x445650
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov ecx, esi
movzx eax, byte [eax + ebx]
shr eax, 4
movsx ax, byte [ebp + eax - 0x24]
movzx eax, ax
push eax
call fcn.00423dfd
mov eax, dword [ebp - 0x2c]
mov ecx, esi
movzx eax, byte [eax + ebx]
and eax, 0xf
movsx ax, byte [ebp + eax - 0x24]
movzx eax, ax
push eax
call fcn.00423dfd
inc ebx
cmp ebx, dword [ebp - 0x30]
jb 0x445614
push dword [ebp - 0x2c]
xor ebx, ebx
inc ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x44568a
push str.Encryption_failed.
lea ecx, [ebp - 0x34]
call fcn.0040279b
xor ecx, ecx
mov byte [ebp - 4], 1
push ebx
lea edx, [ebp - 0x34]
inc ecx
call fcn.00413e51
pop ecx
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx - 0x10]
call fcn.00402def
push 0xffffffffffffffff
lea ecx, [ebp - 0x28]
call fcn.004097d8
push 0xffffffffffffffff
mov ecx, 0x4e1f50
call fcn.004097d8
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00402def
mov eax, ebx
call fcn.00464e26
ret