joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ac60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574af6
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x428], ecx
mov eax, dword [ebp + 8]
lea esi, [ecx + 4]
push esi
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x440], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp - 0x424]
mov dword [ebp - 4], 0
test edi, edi
je 0x48ad5f
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0053f340
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
jle 0x48ad5f
cmp eax, 0x103
jae 0x48ad5f
lea eax, [ebp - 0x218]
push str.STATIC
push eax
call fcn.0040c291
add esp, 8
test eax, eax
jne 0x48ad5f
push 0x208
push eax
lea eax, [ebp - 0x420]
push eax
lfence
call fcn.0053f340
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x48ad5f
cmp eax, 0x103
jae 0x48ad5f
lea eax, [ebp - 0x420]
push str.swBrowser
push eax
call fcn.0040c291
add esp, 8
test eax, eax
sete bl
jmp 0x48ad61
xor bl, bl
mov edi, dword [ebp - 0x428]
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x43c]
push eax
lea ecx, [edi + 0x30]
call fcn.00424480
mov ecx, dword [ebp - 0x434]
cmp byte [ecx + 0xd], 0
jne 0x48ad94
mov eax, dword [ebp - 0x424]
cmp eax, dword [ecx + 0x10]
jae 0x48ae12
cmp dword [edi + 0x34], 0xaaaaaaa
je 0x48ae41
mov edi, dword [edi + 0x30]
lea eax, [ebp - 0x424]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x428]
add eax, 0x30
mov dword [ebp - 0x430], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x42c], 0
push 0x18
lfence
call fcn.00406a5e
mov ecx, dword [ebp - 0x424]
add esp, 4
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0x428]
push eax
push dword [ebp - 0x438]
mov byte [eax + 0x14], 0
push dword [ebp - 0x43c]
mov dword [eax], edi
lea ecx, [ecx + 0x30]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov word [eax + 0xc], 0
call fcn.0040f7c0
mov ecx, eax
mov byte [ecx + 0x14], bl
push esi
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret 4
call fcn.00478c50
int3
Function at 0x48b7a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574b9b
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x440], ax
lea eax, [ebp - 0x440]
push eax
push 1
push 0
push str.4021007
call fcn.0040cf80
add esp, 0x10
movzx eax, ax
cmp word [ebp - 0x440], 0
je 0x48b819
lea eax, [ebp - 0x440]
push eax
push 0
push 0
push str.4021007
call fcn.0040cf80
add esp, 0x10
movzx eax, ax
test ax, ax
jne 0x48b825
xor al, al
jmp 0x48b9d5
xor bl, bl
test esi, esi
je 0x48b9d3
cmp esi, 0xffff
je 0x48b9d3
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x48b9d3
cmp dword [0x5f17b0], 0
je 0x48b9d3
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x43c], 0
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x48b9d3
mov eax, dword [ebp - 0x43c]
test eax, eax
je 0x48b9d3
cmp eax, dword [0x5f17b0]
jne 0x48b9d3
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0053f340
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
jle 0x48b9d3
cmp eax, 0x103
jae 0x48b9d3
push dword [0x5ed21c]
lea eax, [ebp - 0x218]
push eax
call fcn.0040c291
add esp, 8
test eax, eax
jne 0x48b9d3
push 0x208
push eax
lea eax, [ebp - 0x420]
push eax
lfence
call fcn.0053f340
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, eax
test esi, esi
jle 0x48b93e
cmp esi, 0x103
jae 0x48b93c
push dword [0x5ed218]
lea eax, [ebp - 0x420]
push eax
call fcn.0040c291
add esp, 8
test eax, eax
je 0x48b953
test esi, esi
jne 0x48b9d3
mov eax, dword [0x5ed218]
cmp word [eax], 0
jne 0x48b9d3
push dword [ebp - 0x43c]
lea eax, [ebp - 0x438]
push eax
call fcn.004687f0
add esp, 8
cmp dword [ebp - 0x428], 0
mov dword [ebp - 4], 0
je 0x48b9ae
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
push dword [0x5ed220]
cmovae eax, dword [ebp - 0x438]
push eax
call fcn.0040c291
add esp, 8
test eax, eax
jne 0x48b9ae
lea ecx, [ebp - 0x438]
mov bl, 1
call fcn.0040a280
jmp 0x48b9d3
mov ecx, dword [ebp - 0x424]
mov dword [ebp - 4], 1
cmp ecx, 8
jb 0x48b9d3
inc ecx
push ecx
push dword [ebp - 0x438]
lea ecx, [ebp - 0x438]
call fcn.0040a2e0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
Function at 0x48ce70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574ca3
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5edd38]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], edi
mov dword [edi + 0x24], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x2c], 0
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov esi, dword [ebp + 0x24]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x14], eax
mov al, byte [ebp + 0x28]
mov byte [ebp - 4], 1
mov dword [edi + 0xc], ebx
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], esi
mov byte [edi + 0x20], al
mov dword [edi + 0x30], 0
test al, al
jne 0x48cf51
xor ecx, ecx
test esi, esi
je 0x48cf0f
add edx, 0xc
cmp dword [edx], ecx
cmova ecx, dword [edx]
lea edx, [edx + 0x10]
sub esi, 1
jne 0x48cf02
mov eax, 0x100000
cmp ecx, eax
cmova ecx, eax
mov dword [edi + 0x28], ecx
lea eax, [ecx + 0xa]
push eax
call fcn.0041c49f
mov esi, eax
add esp, 4
mov eax, dword [edi + 0x24]
cmp eax, esi
je 0x48cf3d
push eax
call fcn.0041c2b1
add esp, 4
mov dword [edi + 0x24], esi
push 0
call fcn.0041c2b1
add esp, 4
cmp dword [edi + 0x24], 0
je 0x48d006
xor ecx, ecx
mov dword [ebp - 0x10], ebx
mov eax, ebx
mov edx, 0x40
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.0041c49f
add esp, 4
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x48cfa2
push 0x48d210
push 0x48ce10
push dword [ebp + 0x14]
mov dword [eax], ebx
lea ebx, [eax + 4]
push 0x40
push ebx
call fcn.0053cc6e
jmp 0x48cfa4
xor ebx, ebx
mov eax, dword [edi + 0x2c]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x48cfe5
test eax, eax
je 0x48cfe0
push 0x48d210
push dword [eax - 4]
lea esi, [eax - 4]
mov byte [ebp - 4], 3
push 0x40
push eax
call fcn.00440a94
mov eax, dword [esi]
shl eax, 6
add eax, 4
push eax
push esi
call fcn.0053cd72
add esp, 8
mov byte [ebp - 4], 1
mov dword [edi + 0x2c], ebx
mov eax, ebx
test eax, eax
je 0x48d006
mov ecx, edi
call fcn.0048d450
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
lea ecx, [ebp - 0x1c]
call fcn.0048d020
push 0x5d9a74
lea eax, [ebp - 0x1c]
push eax
call fcn.0053e427
int3
Function at 0x48d9b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 4], 0
jg 0x48d9f8
jl 0x48d9dc
mov edx, dword [ebp - 0x14]
cmp dword [edx], 0x7fffffff
ja 0x48d9f8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 4], 0xffffffff
jg 0x48d9fd
jl 0x48d9f8
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0x80000001
jae 0x48d9fd
jmp 0x48da9c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 8]
test eax, eax
je 0x48da19
mov dword [ebp - 0x1c], 0
jmp 0x48da20
mov dword [ebp - 0x1c], 2
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x48da9c
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ecx + 0xc]
jae 0x48da9c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0x24], ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp + 0x14]
push eax
call fcn.0048ca00
add esp, 8
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48da8f
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jae 0x48da91
jmp 0x48da9c
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
jmp 0x48da3f
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
Function at 0x48e280
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x19], 0
jne 0x48e2d0
cmp dword [edi + 0x1c], 0xffffffff
jne 0x48e2d0
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x48e2ae
mov eax, dword [edi]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi + 0x1c], eax
sete al
mov byte [edi + 0x19], al
mov ecx, dword [edi + 0x1c]
cmp ecx, 0xffffffff
je 0x48e3ad
cmp byte [esi], 0
jne 0x48e3ad
mov eax, dword [esi + 4]
test eax, eax
jne 0x48e30a
push eax
push eax
push eax
movzx eax, byte [ebp + 0x10]
shl eax, 0x18
add eax, 2
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x48e32f
cmp dword [esi + 8], 0
jne 0x48e3b1
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov dword [ebp - 0x40], edi
mov dword [esi + 8], edi
test edi, edi
jne 0x48e334
mov byte [esi], 1
jmp 0x48e3ad
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
lea eax, [ebp - 0x3c]
push 0x1c
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x48e399
mov edi, dword [ebp - 0x30]
lea eax, [ebp - 0x20]
add edi, dword [ebp - 0x38]
push 0x1c
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x38]
jne 0x48e389
nop dword [eax + eax]
add edi, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x38]
je 0x48e370
sub edi, dword [ebp - 0x40]
je 0x48e399
mov eax, dword [esi + 8]
dec eax
add eax, edi
mov dword [esi + 0xc], eax
jmp 0x48e3ac
push dword [esi + 8]
mov byte [esi], 1
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 8], 0
pop ebx
cmp dword [esi + 8], 0
mov ecx, dword [ebp - 4]
setne al
pop edi
xor ecx, ebp
pop esi
call fcn.00401682
mov esp, ebp
pop ebp
ret
Function at 0x48eeb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x148], ecx
lea ecx, [ebp - 0x144]
push ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x48ef4d
push ebx
lea eax, [ebp - 0x140]
mov dword [ebp - 0x140], 0x136
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x48ef1d
xor bl, bl
jmp 0x48ef3c
push dword [ebp - 0x148]
lea eax, [ebp - 0x13c]
mov ecx, esi
push eax
push 0
push edi
mov bl, 1
call dword [0x5817c0]
call esi
add esp, 0x10
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
pop ebx
jne 0x48ef65
push dword [ebp - 0x148]
mov ecx, esi
push 0
push 0
push edi
call dword [0x5817c0]
call esi
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00401682
mov esp, ebp
pop ebp
ret

Function at 0x48f270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x48f2cc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x48f2cc
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x48f2ba
cmp esi, edx
jae 0x48f2cc
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x48f2a8
cmp esi, edx
jae 0x48f2cc
cmp word [esi], 0
je 0x48f2cc
mov eax, esi
lfence
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x48f3a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574e87
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x5edd38]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5f2008]
test eax, eax
jne 0x48f4ca
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
test esi, esi
je 0x48f4b0
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
lfence
push 0x5f42f8
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041bedf
mov edi, eax
add esp, 8
test edi, edi
je 0x48f4b0
lea ecx, [esi*2 + 2]
push ecx
push 0
push edi
lfence
call fcn.0053f340
add esp, 0xc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x48f4a7
cmp eax, esi
ja 0x48f4a7
push edi
lea ecx, [ebp - 0x28]
lfence
call fcn.0040e610
mov ecx, dword [0x5f2008]
mov dword [ebp - 4], 0
test ecx, ecx
jne 0x48f487
push 0x18
call fcn.00406a5e
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x48f47e
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.0040a1e0
mov dword [0x5f2008], eax
jmp 0x48f49f
xor eax, eax
mov dword [0x5f2008], eax
jmp 0x48f49f
lea eax, [ebp - 0x28]
cmp ecx, eax
je 0x48f49f
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00408f30
lea ecx, [ebp - 0x28]
call fcn.0040a280
push edi
call fcn.0041c2b1
add esp, 4
mov eax, dword [0x5f2008]
test eax, eax
jne 0x48f4ca
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [eax + 0x14], 8
jb 0x48f4d2
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48fb30
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574fa8
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x18], 0
push eax
call fcn.004db5c0
add esp, 0x10
cmp dword [ebp - 0x14], 0x14
mov dword [ebp - 4], 0
jg 0x48fba1
jne 0x48fd11
cmp dword [ebp - 0x18], 0xc
jl 0x48fd11
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48fd11
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.SHELL32.dll_PathIsExe]
test eax, eax
je 0x48fd11
push 6
xor eax, eax
mov dword [ebp - 0x40], 0
push str._pass
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.00408f30
mov ecx, esi
mov byte [ebp - 4], 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48fc01
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x50]
call fcn.0040ddb0
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x50]
mov edx, dword [ebp - 0x50]
cmp ecx, 8
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
cmovae eax, edx
movlpd qword [ebp - 0x6c], xmm0
cmp dword [ebp - 0x24], 8
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x5c], xmm0
mov dword [ebp - 0x8c], 0x3c
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], eax
test eax, eax
je 0x48fcfb
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x74], 0
push eax
mov dword [ebp - 0x70], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
test eax, eax
je 0x48fce0
push 0x20006
push 0x58bcb8
xorps xmm0, xmm0
lea ecx, [ebp - 0x20]
push 0x80000001
movlpd qword [ebp - 0x20], xmm0
call fcn.0040c860
cmp dword [ebp - 0x20], 0
mov byte [ebp - 4], 2
je 0x48fcd8
push 1
push str.bWasUserPassThroughed
lea ecx, [ebp - 0x20]
call fcn.00473a30
lea ecx, [ebp - 0x20]
call fcn.0040c8e0
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 3
cmp eax, 8
jb 0x48fd13
inc eax
lea ecx, [ebp - 0x50]
push eax
push dword [ebp - 0x50]
call fcn.0040a2e0
jmp 0x48fd13
mov byte [ebp - 4], 4
cmp ecx, 8
jb 0x48fd11
lea eax, [ecx + 1]
push eax
push edx
lea ecx, [ebp - 0x50]
call fcn.0040a2e0
xor bl, bl
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 4], 5
cmp ecx, 8
jb 0x48fd2f
inc ecx
push ecx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
call fcn.0040a2e0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
Function at 0x4940f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x5f3144], 0
jne 0x49416d
push 0x104
push 0
push 0x5f3040
call fcn.0053f340
add esp, 0xc
mov eax, 1
mov word [0x5f3144], ax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push str.SOFTWAREAdobeAcroPerf
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x49416d
push 0x5ed8e8
push 0x5f3040
lea ecx, [ebp - 8]
push ecx
push 0
push str.tOutputDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x5f3040], 0
je 0x494189
push dword [0x5ed8e8]
push 0x5f3040
call fcn.004953a0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret

Function at 0x4941a0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
call fcn.00495370
mov ecx, esi
pop esi
jmp fcn.00495400
Function at 0x4961d0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575497
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5edd38]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x14], 0
je 0x496225
mov dword [ebx], 0x58f120
mov dword [ebx + 0x50], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
push 0
lea esi, [ebx + 4]
mov ecx, ebx
push 0
push esi
mov dword [ebp - 0x10], esi
call fcn.00496010
mov eax, dword [ebx]
push 8
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], esi
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + ebx - 4], eax
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00406a5e
mov esi, eax
add esp, 4
test esi, esi
je 0x496289
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov byte [ebp - 4], 2
call fcn.0046ce4a
add esp, 4
mov dword [esi + 4], eax
jmp 0x49628b
xor esi, esi
lea eax, [ebx + 4]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea edx, [eax + 0x24]
mov dword [eax + 0x2c], edx
lea edi, [eax + 0x14]
mov dword [eax + 0x1c], edi
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov esi, dword [ebp - 0x10]
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov ebx, dword [ebp + 8]
mov ecx, ebx
not ecx
mov dword [edi], 0
mov dword [edx], 0
and ecx, 1
shl ecx, 2
mov eax, ebx
mov edx, ecx
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
or edx, 8
mov dword [esi + 0x38], 0
and al, 8
cmove edx, ecx
mov eax, edx
or eax, 0x10
and bl, 4
cmove eax, edx
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4965b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575500
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi], 0
jne 0x49668b
lea esi, [edi + 8]
push 0x58f164
push esi
call fcn.0047a5e0
add esp, 8
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.00497650
push 0
push 0
call fcn.004149b0
mov eax, dword [0x5f38d8]
add esp, 8
test eax, eax
je 0x496683
cmp eax, 2
je 0x496683
cmp dword [0x5f38d0], 0
jne 0x496634
push 0xffffffffffffffff
push dword [0x5f38c8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x49663f
mov ecx, dword [0x5f38c4]
call fcn.00414cb0
call fcn.00497040
test al, al
je 0x49667b
push 2
push 0
push 0
push dword [0x5f38e0]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x14]
push 0
push ecx
push dword [ebp - 0x1c]
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push dword [0x5f38e0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x2d]
call fcn.004966d0
lea ecx, [ebp - 0x2c]
call fcn.0040ba20
push dword [edi + 0xac]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [edi + 8]
call fcn.00496970
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret

Function at 0x498380
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push esi
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], 0x100
push eax
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test esi, esi
jne 0x4983f4
lea edx, [ebp - 0x204]
push edi
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4983d3
sub edx, edi
lea eax, [ebp - 0x204]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.00408f30
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00401682
mov esp, ebp
pop ebp
ret 8