joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d890
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x53451c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x46da0f
cmp dword [ebp + 0xc], 0x20
jb 0x46da0f
push 0x400
lea eax, [ebp - 0x504]
mov dword [ebp - 0x50c], 1
push 0
push eax
mov dword [ebp - 0x508], 0x400
call fcn.00478a90
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x50c]
push eax
push 0x508a2c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x46da0f
lea ecx, [ebp - 0x504]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d920
sub ecx, edx
cmp ecx, 0x40
jne 0x46da0f
lea edx, [ecx + 0x40]
push esi
lea ecx, [ebp - 0x84]
lea esi, [ebp - 0x504]
mov eax, ecx
sub esi, eax
lea eax, [edx - 0x60]
test eax, eax
je 0x46d95c
mov al, byte [esi + ecx]
test al, al
je 0x46d95c
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x46d946
test edx, edx
lea eax, [ecx - 1]
lea esi, [ebp - 0x4e4]
mov edx, 0x80
cmovne eax, ecx
lea ecx, [ebp - 0x104]
mov byte [eax], 0
mov eax, ecx
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7fffff7e]
test eax, eax
je 0x46d999
mov al, byte [esi + ecx]
test al, al
je 0x46d999
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x46d980
test edx, edx
lea eax, [ecx - 1]
push 0x400
cmovne eax, ecx
push 0
mov byte [eax], 0
lea eax, [ebp - 0x504]
push eax
call fcn.00478a90
push 0x400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0046da20
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
test eax, eax
jne 0x46da0f
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
push edi
call fcn.0046eca0
neg eax
pop edi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ba88
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0046ba88
mov esp, ebp
pop ebp
ret
Function at 0x46e790
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c10
call fcn.0046bef0
mov eax, dword [0x53451c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c10], eax
test eax, eax
je 0x46e8fd
cmp dword [ebp + 0xc], 0
je 0x46e8fd
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop dword [eax]
push esi
push 0x508880
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.0046ed10
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x46e8e0
push 0x2710
xorps xmm0, xmm0
mov dword [ebp - 0x2c0c], 0
lea eax, [ebp - 0x2bfc]
movq qword [ebp - 0x2c08], xmm0
push 0
push eax
mov dword [ebp - 0x2c00], 0
mov dword [ebp - 0x2c08], 0
mov dword [ebp - 0x2c04], 0
call fcn.00478a90
add esp, 0xc
lea eax, [ebp - 0x2c0c]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2bfc]
push eax
push 0xc
lea eax, [ebp - 0x2c08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x46e8d5
push 0x3e8
lea eax, [ebp - 0x4ec]
push 0
push eax
call fcn.00478a90
lea eax, [ebp - 0x4ec]
push eax
push 1
push dword [ebp - 0x2be4]
lea eax, [ebp - 0x2bfc]
push eax
call fcn.0046fb60
add esp, 0x1c
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2c10]
call fcn.0046eca0
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x46e8ea
inc esi
cmp esi, 0x10
jl 0x46e7d0
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ba88
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0046ba88
mov esp, ebp
pop ebp
ret
Function at 0x46e910
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x53451c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x46e9f8
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00478a90
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
je 0x46e9f8
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46e967
sub ecx, esi
mov eax, 0x103
sar ecx, 1
sub eax, ecx
cmp edx, eax
jae 0x46e9f8
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x46e990
mov eax, dword [0x508870]
mov esi, ebx
mov dword [edi], eax
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x46e9a5
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x46e9c0
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ba88
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ba88
mov esp, ebp
pop ebp
ret
Function at 0x46ea10
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x53451c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.00478a90
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.0046da20
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x46ea7a
mov al, byte [edi + ecx]
test al, al
je 0x46ea7a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x46ea61
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x46ea9b
inc eax
sub ecx, 1
jne 0x46ea90
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x46eaf0
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x46eae5
lea edi, [ebp - 0x84]
mov eax, SysReAllocString
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x46eae4
mov bl, byte [edi + ecx]
test bl, bl
je 0x46eae4
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x46ead0
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.00478a90
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x508a2c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x46ebaa
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x46eb74
test cl, cl
je 0x46eb70
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x46eb74
add eax, 2
add esi, 2
test cl, cl
jne 0x46eb54
xor eax, eax
jmp 0x46eb79
sbb eax, eax
or eax, 1
test eax, eax
je 0x46ebaa
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46eb86
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46ebb3
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x508a2c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046ba88
mov esp, ebp
pop ebp
ret
Function at 0x470920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor al, al
push edi
xor edi, edi
test esi, esi
je 0x4709e7
push ebx
mov ecx, dword [ebp + 8]
mov dl, byte [edi + ecx]
xor dl, al
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
movzx ecx, cl
xor al, 0x8c
and bl, 1
movzx eax, al
cmove eax, ecx
inc edi
cmp edi, esi
jb 0x470935
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4722a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4403
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x53451c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x5345a8]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00472190
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x472481
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00478a90
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x50aaa8
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x472481
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x472375
cmp eax, 2
jne 0x472481
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x472396
test cl, 1
jne 0x472481
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x47239c
jmp 0x472481
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x472481
call fcn.004069f0
mov ecx, eax
test ecx, ecx
je 0x4724ac
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.00470390
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x50aab0
push eax
call fcn.0041b350
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.00470920
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x472465
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x472406
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.00472500
push dword [0x5345b0]
lea eax, [ebp - 0x74]
push dword [0x5345ac]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x472442
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x47245e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x472483
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x472481
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x47248e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ba88
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004062a0
int3
Function at 0x4725f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4438
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x53451c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x5345a8]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00472190
test eax, eax
je 0x472718
mov esi, dword [ebp - 0x18]
mov edi, dword [str.SOFTWAREComMaster]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x4726c3
cmp dword [esi], 0
je 0x4726b6
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x472683
mov eax, 1
jmp 0x4726e4
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4726bc
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x4726e4
cmp dword [esi + 4], 0
jne 0x4726c3
mov eax, 1
jmp 0x4726e4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x47270e
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x4726f6
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x47271b
xor ebx, ebx
jmp 0x4727bf
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x4727bf
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x472778
mov ecx, dword [ebx]
test ecx, ecx
je 0x4727de
push ecx
push eax
call fcn.00493f68
add esp, 8
test eax, eax
je 0x472778
mov edx, dword [edi]
test edx, edx
je 0x472778
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x472750
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x472783
lea eax, [edx + 0xd]
jmp 0x4727b8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x472790
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x50aaa8
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x4727ca
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004062a0
int3
Function at 0x474000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x474071
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x47403f
cmp eax, 2
jne 0x47405b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x47406b
test ecx, ecx
je 0x474066
test cl, 1
jne 0x47405b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x47406b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4786e0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x53451c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
js 0x47884c
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00478a90
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call edi
test esi, esi
jle 0x47874f
lea eax, [ebp - 0x20c]
push eax
call edi
sub esi, 1
jne 0x478741
mov eax, dword [0x5391f8]
mov esi, dword [eax]
cmp esi, eax
je 0x47884c
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
nop word [eax + eax]
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.00478a90
add esp, 0xc
lea eax, [ebp - 0x20c]
push dword [esi + 0x14]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esi + 0x10]
test eax, eax
jne 0x478873
cmp ecx, 8
jne 0x478804
push 0x208
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00478a90
add esp, 0xc
lea eax, [ebp - 0x414]
push 0
push 0x1a
push eax
push 0
call edi
push str.MasterPDFData
lea eax, [ebp - 0x414]
push eax
call ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x47885f
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x47882a
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x478826
cmp esi, dword [eax + 8]
jne 0x478826
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x478816
mov esi, eax
jmp 0x478840
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x478840
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x478834
cmp esi, dword [0x5391f8]
jne 0x478770
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ba88
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ba88
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ba88
mov esp, ebp
pop ebp
ret

Function at 0x4b0420
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b0025

Function at 0x4b042b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b01a6

Function at 0x4b722e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b6a08

Function at 0x4b7239
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b6c43

Function at 0x4b7f29
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b7cb0
Function at 0x4c7740
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.004c7d50
add esp, 8
test al, al
je 0x4c7765
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4c7765
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x4c7d50
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x4c9200
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c922b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4c922b
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x45bd23
Capabilities:
Check for vm using instruction vpcext

Disassembly:
ja 0x45bda2
mov es, word [edx + 0x3f]
leave
mov eax, dword [0x532a736f]
jae 0x45bd57
push ebx
push es
jo 0x45bdad
xor bl, byte [eax]
cmc
lodsb al, byte [esi]

Function at 0x45bd3b
Capabilities:
Check for vm using instruction vpcext

Disassembly:
jne 0x45bd49
or dword [ebx + 0x669ca9c4], 0x7d4cdc8d
jno 0x45bdae
invalid

Function at 0x45bd6f
Capabilities:
Check for vm using instruction vpcext

Disassembly:
inc ebp
jp fcn.0045bd0b
pop ds
inc esp
sbb byte [ecx], cl
pop es
mov eax, 0xf04d932
aas
jae 0x45bce9
aad 0xed
dec esi
xchg esi, eax
push 0x7a
push eax
scasb al, byte es:[edi]
scasd eax, dword es:[edi]
loop 0x45bcf4
jne 0x45bcf9
pushal
test eax, 0x486387be
mov byte [0x95769568], al
lodsd eax, dword [esi]

Function at 0x45bd7f
Capabilities:
Check for vm using instruction vpcext

Disassembly:
invalid
xchg esi, eax
mov eax, 0xf047ee2b
sub esp, dword [ecx + edi*2 - 0x6ad3cc1d]
jns 0x45bd6c
xor ebp, dword [edx*4 - 0x6cab5005]
xor ebp, dword [edx*4 - 0x6cab5005]
mov edi, dword [ecx + 0x30]
push eax
daa
lea edi, [ecx - 0x7c06f302]
inc edx
clc
in al, 0x78
cmp dword [edx], 0x32087006
sbb ch, dh
jnp 0x45bdcb
jo 0x45bd89
jnp 0x45bd5a
cmc
wait
sub byte [ecx - 0x48e7ea8c], ah
shr byte [ebp + 0x332df213], 0xc8
outsb dx, byte [esi]
sahf
mov ebp, 0xb450b42f
iretd
jge 0x45be21
jmp 0x211bcc67
mov bh, 4
inc eax
cmc
dec esi
arpl word [eax - 5], bp
shr dword [edi - 0xf], cl
cmp dword [edi], esp
lahf
jge 0x45bdff
jns 0x45be71
dec eax
jl 0x45be63
sbb dword [ebp + esi + 0x3ea2b08a], ebx
xor ebp, dword [ebx]
invalid
in eax, dx
std
mov ah, 0xf0
loope 0x45be3a
clc
test byte [edi + 0x46a0e2d6], dh
add dword [esi + 0x244b40d], esp
sub ecx, dword [esi - 0x6c]
jno 0x45be47
mov byte [edx + eax - 0x5e], ah
pop eax
sub byte [eax + 0x39], ch
int 0x19
je 0x45be04
add ah, byte fs:[edx - 0x5f93d7a8]
cmp ebp, ecx
sbb dword [esi + edi*4 + 0x41], esi
inc ecx
mov eax, dword [0xf0a9ea87]
pop esi
ljmp 0x6487
enter 0xffffffffffffd140, 0x45
iretd
test al, 0xb7
pop esi
aas
test ebp, eax
mov esp, 0xff56b4c1
or dword [ecx], ecx
adc eax, 0xce61b56e
xor al, 0xaf
mov esp, 0xb156a70
cmc
salc
cmp al, 0x4b
jb 0x45bf12
mov edi, 0x59518e93
sbb bh, bl
adc edi, esp
push ebp
out 0x55, eax
and esi, eax
stosd dword es:[edi], eax
adc dh, ch
jb 0x45be9b
loope 0x45bebd
invalid
wait
pop ecx
xchg al, bh
pop ecx
mov byte [0xdd8d4577], al
pop edi
cmp eax, edx
cmp ah, ah
aaa
sub esp, edx
dec ebx
cld
imul edx, dword [ebp - 0x1ea300b1], 0x76459309
xchg ebx, eax
inc ebp
nop
or edi, edi
cmpsd dword [esi], dword es:[edi]
ljmp 0x2d4d
sub dword [esi], edx
loope 0x45bf50
mov ch, 0x7e
push es
aaa
scasd eax, dword es:[edi]
das
aad 0x4c
sub edi, ebp
les eax, [edx]
sub al, 0x8f
invalid
cmp esp, dword [ebx + ebp*8 + 0x32595bc3]
or bh, byte [ecx - 0x5dea8aec]
and eax, 0x62c90145
ror dword [esi + 0x63], 0xb2
adc ch, byte [esi]
dec edi
dec ecx
push ebx
inc ebp
jmp dword [ebp + 7]