joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x845058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8451a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x84507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x84506a
add dl, dl
jne 0x845089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8450dc
xor eax, eax
add dl, dl
jne 0x845096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x84517d
add dl, dl
jne 0x8450a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8450b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8450bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8450c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8450d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x845075
mov eax, 1
add dl, dl
jne 0x8450ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8450f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8450e1
sub eax, ebx
mov ebx, 1
jne 0x845128
mov ecx, 1
add dl, dl
jne 0x84510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x845119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x845105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x845075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x84513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x84514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x845136
cmp eax, 0x7d00
jae 0x84516d
cmp eax, 0x500
jb 0x845168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x845075
cmp eax, 0x7f
ja 0x845170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x845075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x84519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x845075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x52ecce
Capabilities:
Encode data using xor

Disassembly:
daa
push esp
dec ebp
xor dl, 0xa3
add al, 0xb0
pop eax
xchg ebx, eax
lcall 0x47f7, 0x9979a743
pop ebp
dec ebx
pop ss
pop es
add bh, byte [ecx - 0x3b]
shl dword [ebx + 0x48], 0x9a
stosd dword es:[edi], eax
add dword [edx - 0x445e377], esi
jg 0x52ed41
ret
xor edx, dword [ebx + 0x29]
jmp 0x52ed4f
push 0x2e
or al, 0x27
xchg dword [ebx], esi
sub bh, ah
cld
cld
push ecx
xor ebp, 0x19
inc ecx
mov bl, 4
outsd dx, dword [esi]
fld xword [esi]
test al, 0xee
sbb byte [ecx], bh
xor eax, 0x90077b55
and ax, 0xbe79
jecxz 0x52ed46
add dword [edi], esp
fidiv word gs:[edi]
push ds
jae 0x52ed69
wait
test al, 0x90
mov esp, 0x9930e1ba
ret 0xa3f1

Function at 0x5309d9
Capabilities:
Encode data using xor

Disassembly:
cmp dl, cl
lahf
pushfd
scasb al, byte es:[edi]
popal
ret 0x3d95
test dword [ebx - 0x6aa042d6], edx
pop edi
xchg ebp, eax
leave
push esi
rcr dword [esi - 0x60], 1
mov edi, 0xc1217192
syscall
pop ecx
push esp
leave
dec esp
jp 0x53097d
sbb dword [ecx], esi
or dl, byte [ebp + 0x2b65a358]
test byte [ebx], al
ret 0x5ed1
pop esi
mov ebx, 0xadd0f96b
enter 0xfffffffffffff913, 0xffffffffffffffb2
stosd dword es:[edi], eax
adc ecx, edi
adc byte [ebx + 0xc6d1f03], bh
dec esp
or edx, dword [edi]
cmp esp, dword [edx]
aaa
mov eax, dword [0xc33e876c]
jmp 0x5309b4
push ebx
lea esi, [ebx + edi*4 - 0x29dfd15c]
pop es
jne 0x530994
jne 0x530990
and dword [ebx], edi
popfd
dec ebx
sub byte [ecx], 0x31
jnp 0x530a5d
sti
sahf
test dword [edx], edi
push ds
std
xor esp, dword [ebx]
mov bl, 0x91
mov ebx, 0x73a1e19d
cmp ah, dl
xor esi, ebx
jns 0x530a3f
cmp eax, 0xd13783a2
rcr dword [ecx + 0x31831793], cl
pop ebx
xchg ecx, eax
stosb byte es:[edi], al
xor eax, 0xea5f74a2
mov bl, 0x1a
mov gs, word [edi - 0x4c826aa8]
scasd eax, dword es:[edi]
pop eax
xchg ebp, eax
jge 0x5309d2
arpl si, ax
sbb edi, ecx
pop eax
and al, byte [ebx + 0x12]
push esi
jge 0x530aa8
cmp byte [ebx - 0x29], ah
jbe 0x530a1a
dec ebp
mov esp, 0xf1a3fd87
inc ebx
sub dword [ecx + 0x60b4c9e9], ebp
and bl, byte [ebx - 0x1fb6ab67]
jle 0x530a1a
wait
cdq
push esp
dec ecx
loopne 0x530ac3
aam 0x28
add ah, cl
cwde
sub byte [edx], al
loope 0x5309e2
add al, 0x4e
push esp
mov esp, dword [ecx]
xor dword [ebx - 0x7d], edx
in eax, dx
out dx, eax
mov eax, dword [0x8cb3d5e9]
xchg dword [eax + 0xbf8046b], ecx
adc esp, esp
push cs
clc
or edx, dword [ebx]
in al, 0xe
mov bh, 0xa3
pop ecx
and ah, byte [ebp - 2]
fld qword [edx - 0x38ce54c7]
lodsb al, byte [esi]
cmp dword [eax - 0x77d70e75], ebx
shr dword [ecx + esi], cl
mov al, byte [0xa9d749f3]
xchg esi, eax
xor dword [0x2759e389], edx
jnp 0x530a7e
insd dword es:[edi], dx
mov edx, 0x4391441d
dec ecx
pushal
salc
or eax, 0xdb406a81
invalid
test byte [ecx], al
xor esi, dword [ebx - 0x54d69187]
fadd qword [0xaa2395ba]
pop ecx
arpl sp, bx
push ecx
dec ecx
invalid
psubsw mm2, qword [edx]
imul esp, dword [ecx - 0x6c], 0x27f35011
push cs
inc esp
xchg esp, eax
add dl, byte [ebx - 0x4c89a5be]
jmp 0xaa20b315

Function at 0x5e8f7e
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x82356841
adc eax, dword [edi + ebp - 0x5afcd00a]
sub dword [esi + 0x2f], ecx
invalid
Function at 0x614ece
Capabilities:
Encode data using xor

Disassembly:
retf 0xc4b2
mov ebx, dword [ebx]
mov esp, 0x6687b53c
xor dword [eax - 0x6a], edx
je 0x614f0c
or ecx, dword [esi]
inc edi
push esp
mov esp, 0xbdc3a289
xchg esp, eax
add cl, byte [edx]
adc al, byte [ebp - 0x72]
mov ah, 0xd6
pop ebp
invalid
pop edi
sti
xchg si, ax
jo 0x614f46
pop ecx
push ebx
sbb byte [esi], ah
push edx
xor dword [esp - 0x35], ecx
adc ah, byte [ebx]
shl dword [ebx + 0x12437517], 1
js 0x614ec2
les eax, [esi + 0x3ca9f8ae]
xchg ebp, eax
lahf
ja 0x614f74
in eax, dx
mov eax, dword [ebp + 0x61]
sal dword [0x465fb3e4], cl
in al, 0xb3
pop edi
inc esi
not ebx
aad 3
jnp 0x614f77
add al, 0xb9
push cs
imul ecx, eax, 0xffffff80
mov eax, 0xb53910b9
ja 0x614fac
enter 0xffffffffffffb880, 0xffffffffffffffb9
adc byte [ecx], bh
mov ch, 0x77
pop ebp
loop 0x614fc9
in al, 0x89
das
jno 0x614f38
inc edi
sbb byte [ecx + 0x23cca057], cl
and al, byte [ecx + 0x6e10725d]
dec esi
invalid
aaa
dec edx
push eax
adc edi, dword [ecx]
pushal
retf
xchg ebx, eax
fist dword [edx - 0x24]
mov ch, byte fs:[ecx + 0x1c36d973]
inc esi
stc
mov ah, byte [edx + ecx*4 - 0x45a2c996]
out dx, al
mov dword [0x4d88e836], eax
stosb byte es:[edi], al
add edi, dword [edx - 0x27516472]
iretd
mov ds, word [ebx + 0x70cfd8ae]
enter 0xffffffffffffea48, 0xffffffffffffffbb
jae 0x61502f
clc
dec eax
adc edx, esp
invalid
add ah, byte [eax - 0x580d09bc]
popfd
outsd dx, dword [esi]
iretd
mov ebp, 0x2b83f34
rol cl, 0x7a
loopne 0x6150a8
cli
xor bl, byte [eax]
inc esi
and eax, 0xdabf224f
jae 0x61501e
pop ss
aam 0x26
invalid
lahf
mov edi, 0x803642d7
adc ebp, dword [esi + 0x59]
in eax, dx
xchg edi, eax
movsb byte es:[edi], byte [esi]
ret 0xf7f
Function at 0x41724d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4172ea
push ebx
push esi
call fcn.00417216
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00415e9b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x417297
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4172e9
push edi
push eax
call fcn.00412fa5
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4172b7
call fcn.0040fb58
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4172e8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00415e9b
add esp, 0x20
test eax, eax
jne 0x4172d6
push edi
call fcn.0040fb58
jmp 0x4172de
push ebx
call fcn.0040fb58
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41c5f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41c61d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41c61d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4085ed
Capabilities:
Create process on windows

Disassembly:
push 0xc
mov eax, 0x4aba20
call fcn.0046ac08
mov esi, ecx
mov dword [ebp - 0x18], esi
call fcn.00450db1
push eax
lea ecx, [ebp - 0x10]
call main
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.004455ee
lea ecx, [ebp - 0x14]
test eax, eax
jne 0x408662
push str.Failed_to_create_launcher_path
call fcn.00402829
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x1b2c4
lea ecx, [esi + 0x558]
call fcn.00415683
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov esi, dword [ebp - 0x10]
push 0xd
pop edi
jmp 0x40876c
push str.Launcher_path:
call fcn.00402829
push ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
push 2
lea edx, [ebp - 0x14]
pop ecx
call fcn.00416dc0
pop ecx
pop ecx
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
push 5
push ebx
push dword [eax]
push esi
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x5163b8], 0x271c8
mov edi, eax
je 0x4086f5
cmp edi, 0x21
jl 0x4086f5
mov ecx, dword [ebp - 0x18]
push str.ShellExecute_succeded.
mov dword [ecx + 0xe4], 1
lea ecx, [ebp - 0x14]
call fcn.00402829
push ebx
push 2
lea edx, [ebp - 0x14]
mov byte [ebp - 4], 5
pop ecx
call fcn.004174f1
pop ecx
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
jmp 0x40876e
push str.ShellExecute_failed
lea ecx, [ebp - 0x14]
call fcn.00402829
mov byte [ebp - 4], 3
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea eax, [ebp - 0x14]
mov ecx, 0x187cc
push eax
cmp edi, 5
mov eax, 0x271c8
cmove eax, ecx
mov ecx, dword [ebp - 0x18]
push eax
add ecx, 0x558
call fcn.00415683
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
cmp edi, 5
jne 0x40876c
push str.ShellExecute_failed_with_SE_ERR_ACCESSDENIED
lea ecx, [ebp - 0x18]
call fcn.00402829
xor ecx, ecx
mov byte [ebp - 4], 4
push ebx
lea edx, [ebp - 0x18]
inc ecx
call fcn.004174f1
pop ecx
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ebx, edi
lea ecx, [esi - 0x10]
call fcn.00402e64
mov eax, ebx
call fcn.0046abd1
ret 8
Function at 0x408b85
Capabilities:
Delete registry key

Disassembly:
push 0x424
mov eax, 0x4abb07
call fcn.0046ac3c
mov esi, ecx
push str.LaunchSafeCleanup...
lea ecx, [ebp - 0x428]
call fcn.00402829
xor ebx, ebx
lea edx, [ebp - 0x428]
push ebx
push 2
pop ecx
mov dword [ebp - 4], ebx
call fcn.004174f1
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, dword [ebp - 0x428]
lea ecx, [ecx - 0x10]
call fcn.00402e64
call fcn.00450db1
push eax
lea ecx, [ebp - 0x428]
call main
lea ecx, [ebp - 0x428]
mov dword [ebp - 4], 1
call fcn.0044554a
test eax, eax
je 0x408d5b
mov edi, 0x208
mov dword [ebp - 0x42c], ebx
push edi
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.004830a0
push edi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004830a0
lea eax, [ebp - 0x218]
push eax
lea edx, [ebp - 0x420]
lea ecx, [ebp - 0x42c]
call fcn.0043bc39
add esp, 0x1c
test eax, eax
je 0x408d5b
lea ecx, [ebp - 0x424]
mov dword [esi + 0xfc], ebx
push str._ArmCleanup
cmp dword [esi + 0xf4], ebx
je 0x408c8c
call fcn.00402829
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x424]
lea ecx, [ebp - 0x428]
call fcn.0043b7d3
pop ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x424]
add ecx, 0xfffffff0
jmp 0x408cbb
call fcn.00402829
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x424]
lea ecx, [ebp - 0x428]
call fcn.0043b9b3
pop ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x424]
lea ecx, [ecx - 0x10]
mov edi, eax
call fcn.00402e64
test edi, edi
jne 0x408ce3
mov edi, ebx
jmp 0x408cdb
cmp edi, 0x14
jge 0x408ce3
push 0xc8
inc edi
call dword [sym.imp.kernel32.dll_Sleep]
cmp dword [esi + 0xfc], ebx
je 0x408cca
cmp dword [esi + 0xfc], ebx
jne 0x408d1d
push str.launch_cleanup_not_confirmed
lea ecx, [ebp - 0x424]
call fcn.00402829
push ebx
push 2
lea edx, [ebp - 0x424]
mov byte [ebp - 4], 4
pop ecx
call fcn.004174f1
pop ecx
mov ecx, dword [ebp - 0x424]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea eax, [ebp - 0x430]
push eax
push 0xf003f
push ebx
push 0x4cc898
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408d5b
push str.Cleanup
push dword [ebp - 0x430]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x428]
lea ecx, [ecx - 0x10]
call fcn.00402e64
call fcn.0046abe6
ret
Function at 0x40a60b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xc
mov eax, 0x4abdd8
call fcn.0046ac08
mov esi, ecx
lea eax, [esi + 0x31c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402829
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], ebx
je 0x40a702
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40a702
cmp dword [esi + 0x1c0], ebx
jne 0x40a683
push str.Report_is_not_enabled_in_Session
lea ecx, [ebp - 0x14]
call fcn.00402829
push 2
pop ecx
push ebx
lea edx, [ebp - 0x14]
mov byte [ebp - 4], cl
call fcn.004174f1
pop ecx
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ebx, 0x30d0e
jmp 0x40a72d
push 0x4cc754
push str.Reported
lea eax, [ebp - 0xd]
mov byte [ebp - 0xd], bl
push eax
lea ecx, [esi + 0x318]
call main
cmp byte [ebp - 0xd], bl
je 0x40a6b7
push str.already_reported
lea ecx, [ebp - 0x14]
call fcn.00402829
mov byte [ebp - 4], 3
jmp 0x40a6e5
push ebx
push str.SessionApplication
lea eax, [ebp - 0xd]
mov byte [ebp - 0xd], bl
push eax
lea ecx, [esi + 0x318]
call main
cmp byte [ebp - 0xd], bl
jne 0x40a72d
push str.Product_info_missing__cannot_report_data
lea ecx, [ebp - 0x14]
call fcn.00402829
mov byte [ebp - 4], 4
push ebx
push 2
lea edx, [ebp - 0x14]
pop ecx
call fcn.004174f1
pop ecx
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push 0x15
pop ebx
jmp 0x40a72d
push str.No_Report_file
lea ecx, [ebp - 0x14]
call fcn.00402829
push ebx
push 2
pop ebx
lea edx, [ebp - 0x14]
mov byte [ebp - 4], 1
mov ecx, ebx
call fcn.004174f1
pop ecx
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402e64
mov eax, ebx
call fcn.0046abd1
ret
Function at 0x40c363
Capabilities:
Create process on windows

Disassembly:
push 0x4c
mov eax, 0x4ac2d0
call fcn.0046ac08
push str.ActivateArmBalloon...
lea ecx, [ebp - 0x18]
call fcn.00402829
xor ebx, ebx
lea edx, [ebp - 0x18]
push ebx
push 2
pop ecx
mov dword [ebp - 4], ebx
call fcn.004174f1
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [0x5163f0]
test ecx, ecx
je 0x40c3bd
cmp dword [0x515f30], ebx
je 0x40c4e0
call main
jmp 0x40c4e0
cmp dword [0x515f4c], ebx
je 0x40c3db
lea eax, [ebp - 0xd]
mov byte [ebp - 0xd], bl
push eax
mov ecx, 0x515e58
call fcn.0040c716
jmp 0x40c4e5
cmp dword [0x515f58], ebx
je 0x40c4be
cmp dword [0x5160d4], ebx
je 0x40c4be
push str._ShowInstallInProgressUI__PRODUCT:Acrobat__LANG:
lea ecx, [ebp - 0x14]
call fcn.00402829
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
mov eax, dword [0x515ff0]
push dword [eax - 0xc]
push eax
call main
call fcn.00450db1
push eax
lea ecx, [ebp - 0x18]
call main
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.0044554a
test eax, eax
jne 0x40c43e
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
jmp 0x40c4ac
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.004830a0
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], esi
mov esi, dword [ebp - 0x18]
push eax
mov dword [ebp - 0x54], 0x540
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x48], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40c4a9
push str.ShellExecuteEx_to_launch_temp_AdobeARM.exe_UI_failed:
lea ecx, [ebp - 0x1c]
call fcn.00402829
mov byte [ebp - 4], 3
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 2
lea edx, [ebp - 0x1c]
pop ecx
call fcn.004175da
pop ecx
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea ecx, [esi - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
jmp 0x40c4e5
mov ecx, 0x515e58
mov dword [0x515f2c], 1
mov dword [0x515f30], ebx
call fcn.0040c032
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
call fcn.0040c673
call fcn.0046abd1
ret
Function at 0x40c4eb
Capabilities:
Create process on windows

Disassembly:
push 0x4c
mov eax, 0x4ac2d0
call fcn.0046ac08
push str.ActivateArmUI...
lea ecx, [ebp - 0x18]
call fcn.00402829
xor ebx, ebx
lea edx, [ebp - 0x18]
push ebx
push 2
pop ecx
mov dword [ebp - 4], ebx
call fcn.004174f1
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [0x5163f0]
test ecx, ecx
je 0x40c545
cmp dword [0x515f30], ebx
je 0x40c668
call main
jmp 0x40c668
cmp dword [0x515f4c], ebx
je 0x40c563
lea eax, [ebp - 0xd]
mov byte [ebp - 0xd], bl
push eax
mov ecx, 0x515e58
call fcn.0040c716
jmp 0x40c66d
cmp dword [0x515f58], ebx
je 0x40c646
cmp dword [0x5160d4], ebx
je 0x40c646
push str._ShowInstallInProgressUI__PRODUCT:Acrobat__LANG:
lea ecx, [ebp - 0x14]
call fcn.00402829
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
mov eax, dword [0x515ff0]
push dword [eax - 0xc]
push eax
call main
call fcn.00450db1
push eax
lea ecx, [ebp - 0x18]
call main
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.0044554a
test eax, eax
jne 0x40c5c6
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
jmp 0x40c634
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.004830a0
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], esi
mov esi, dword [ebp - 0x18]
push eax
mov dword [ebp - 0x54], 0x540
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x48], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40c631
push str.ShellExecuteEx_to_launch_temp_AdobeARM.exe_UI_failed:
lea ecx, [ebp - 0x1c]
call fcn.00402829
mov byte [ebp - 4], 3
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 2
lea edx, [ebp - 0x1c]
pop ecx
call fcn.004175da
pop ecx
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea ecx, [esi - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
jmp 0x40c66d
mov ecx, 0x515e58
mov dword [0x515f2c], 1
mov dword [0x515f30], ebx
call fcn.0040c032
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
call fcn.0040c673
call fcn.0046abd1
ret
Function at 0x40d3bc
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
push 0x104
push ebx
lea edi, [esi + 4]
mov dword [esi], vtable.CArmReport.0
push edi
call fcn.004830a0
add esp, 0xc
push edi
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40d40c
mov ebx, 0x104
mov ecx, edi
push str.Temp_
mov edx, ebx
call main
push str.ArmReport.ini
mov edx, ebx
mov ecx, edi
call main
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x40d44d
Capabilities:
Write file on windows

Disassembly:
push 0x9c
mov eax, 0x4ac47e
call fcn.0046ac3c
mov esi, ecx
mov eax, 0xfeff
xor ebx, ebx
mov word [ebp - 0x78], ax
mov eax, vtable.ATL::CAccessToken.0
mov byte [ebp - 0x71], bl
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 1
push 0x4d0454
push eax
call fcn.0040dc14
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9c]
call main
push ecx
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x9c]
call main
lea eax, [ebp - 0x71]
push eax
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x8c]
call main
push ebx
cmp byte [ebp - 0x71], bl
je 0x40d533
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa8], 0xc
push eax
push 1
push str.D:_D_OICI_GA___BG__D_OICI_GA___AN__A_OICI_GA___AU_
mov dword [ebp - 0xa0], ebx
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x40d58d
push ebx
push 0x80
push 1
lea eax, [ebp - 0xa8]
push eax
jmp 0x40d53b
push 0x80
push 1
push ebx
push ebx
push 0x40000000
lea eax, [esi + 4]
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40d58d
push ebx
lea eax, [ebp - 0x7c]
push eax
push 2
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x40d58d
push ebx
lea eax, [ebp - 0x7c]
mov edi, str._SESSION_
push eax
push edi
call main
pop ecx
lea eax, [eax*2 + 2]
push eax
push edi
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x40d597
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
jmp 0x40d59e
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
lea ecx, [ebp - 0x70]
call fcn.0040dd32
mov esi, vtable.ATL::CAccessToken.0
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x8c], esi
call fcn.0040ddb0
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], esi
call fcn.0040ddb0
mov eax, ebx
call fcn.0046abe6
ret