joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406a0e
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
sub esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4119e8]
je 0x406a29
inc edi
cmp edi, 0x17
jl 0x406a1a
cmp edi, 0x17
jae 0x406ba9
push ebp
push 3
call fcn.0040b683
cmp eax, 1
pop ecx
je 0x406b75
push 3
call fcn.0040b683
test eax, eax
pop ecx
jne 0x406a5d
cmp dword [0x4110f8], 1
je 0x406b75
cmp ebx, 0xfc
je 0x406ba8
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4342c8
push ebp
call fcn.004050d8
add esp, 0xc
or eax, eax
je 0x406a93
push esi
push esi
push esi
push esi
push esi
call fcn.00403c3f
add esp, 0x14
push 0x104
mov esi, 0x4342e1
push esi
push 0
mov byte [0x4343e5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x406ad7
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004050d8
add esp, 0xc
or eax, eax
je 0x406ad7
sub eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00403c3f
add esp, 0x14
push esi
call fcn.00401d50
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x406b1c
push esi
call fcn.00401d50
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4345dc
push 0x40eb04
sub ecx, eax
push ecx
push eax
call fcn.00409ab6
add esp, 0x14
test eax, eax
je 0x406b1c
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00403c3f
add esp, 0x14
jmp 0x406b1e
sub esi, esi
push 0x40eb00
push ebx
push ebp
call fcn.004099f7
add esp, 0xc
test eax, eax
je 0x406b3e
push esi
push esi
push esi
push esi
push esi
call fcn.00403c3f
add esp, 0x14
push dword [edi*8 + 0x4119ec]
push ebx
push ebp
call fcn.004099f7
add esp, 0xc
or eax, eax
je 0x406b60
push esi
push esi
push esi
push esi
push esi
call fcn.00403c3f
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0040b4e5
add esp, 0xc
jmp 0x406ba8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
pop ebp
cmp ebp, esi
je 0x406ba8
cmp ebp, 0xffffffff
je 0x406ba8
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4119ec]
push dword [esi]
call fcn.00401d50
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4070e0
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x4346e8]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
sub esi, esi
cmp eax, ebx
push 2
pop ebp
jne 0x407129
call edi
push eax
pop esi
cmp esi, ebx
je 0x407110
mov dword [0x4346e8], 1
jmp 0x407132
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x407124
push ebp
pop eax
mov dword [0x4346e8], eax
jmp 0x407129
mov eax, dword [0x4346e8]
cmp eax, 1
jne 0x4071b6
cmp esi, ebx
jne 0x407145
call edi
push eax
pop esi
cmp esi, ebx
jne 0x407145
xor eax, eax
jmp 0x40720e
cmp word [esi], bx
push esi
pop eax
je 0x40715a
add eax, ebp
cmp word [eax], bx
jne 0x40714c
add eax, ebp
cmp word [eax], bx
jne 0x40714c
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x4071ab
push ebp
call fcn.0040513d
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x4071ab
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
jne 0x4071a7
push dword [esp + 0x10]
call fcn.0040504a
pop ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push ebx
pop eax
jmp 0x40720e
cmp eax, ebp
je 0x4071be
cmp eax, ebx
jne 0x40713e
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push eax
pop esi
cmp esi, ebx
je 0x40713e
cmp byte [esi], bl
je 0x4071dc
inc eax
cmp byte [eax], bl
jne 0x4071d2
inc eax
cmp byte [eax], bl
jne 0x4071d2
sub eax, esi
inc eax
mov ebp, eax
push ebp
call fcn.0040513d
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x4071fa
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x40713e
push ebp
push esi
push edi
call fcn.00405260
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x40b0c0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
cmp word [ecx], 0x5a4d
je 0x40b0ce
sub eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40b0cb
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
push ecx
pop eax
ret

Function at 0x40b0f0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
sub edx, edx
or esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x40b12c
mov edi, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x40b122
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x40b12e
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x40b112
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x20c0388
Capabilities:
Encode data using xor

Disassembly:
in al, dx
out 0xc8, al
push edi
adc cl, byte [eax + 0x44d2b6f1]
xor byte [ecx - 0x4bd3a006], cl
sbb eax, 0xeaa6955b
ret 0xd3d0
jmp 0x20c0392
pushal
call 0x20c0398
pop ebp
sub ebp, 0x10
sub ebp, 0x1cc0388
jmp 0x20c03ae
mov eax, 0x1cc0388
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b3
lds eax, [ecx + 0x4cc0]
add byte [ecx + 0x5b3], bh
mov edx, 0xf97b6088
xor byte [eax], dl
inc eax
dec ecx
jne 0x20c03c5
jmp 0x20c03d8
add eax, dword [ebp + 3]
add dword [eax + ecx*4 + 0x49098888], esi
jo 0x20c036c
mov byte [eax - 0x73cfba75], cl
mov byte [eax - 0x775fcd78], cl
mov byte [eax + 0x408b6a7f], cl
add ecx, dword [ecx]
test byte [eax + 0x4d8b8888], cl
add eax, 0x174acec
mov word [ebp + eax + 0x174acec], gs
mov word [eax - 0x7720da2c], gs
loopne 0x20c03b4
fdivp st(4)
mov dword [ecx - 0xf1f535c], ecx
mov bl, 0x3b
arpl word [eax - 0x73], sp
mov byte [eax - 0x77599e78], cl
mov byte [eax + 0x3d5dcdd], cl
or eax, 0x88888880
add ebx, dword [0x88888884]
add eax, dword [0x88888898]
dec ecx
popal
mov bh, byte [ecx - 0x73b5f476]
rol dword [edi + 0x77777c0d], 0x77
add esp, dword [esp + ebp*4 - 0x735313fb]
dec edx
test byte [eax - 0x7353fbfd], cl
mov byte [eax + 0x25d4e088], cl
fisttp word [eax - 0x3215e20]
mov dword [ecx + 0x60d9aca4], ecx
lea ecx, [eax - 0x3c9e7778]
mov cl, byte [eax - 0x5313fa78]
je 0x20c047b
movsb byte es:[edi], byte [esi]
lodsb al, byte [esi]
add esp, dword [edi + esi*2 - 3]
ja 0x20c047d
ja 0x20c047d
test byte [edi - 3], dh
and byte [eax - 0x10], 0x88
mov byte [eax - 0x777fcafd], cl
mov byte [eax - 0x301986f7], cl
adc byte [ecx + ecx], ah
jns 0x20c047e
iretd
Function at 0x406020
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
push esi
mov esi, dword [esp + 8]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 4], eax
call fcn.0040de50
cmp eax, 0x17
je 0x40605e
mov dword [esi], 0x40d4a0
pop esi
ret
mov dword [esi], 0x405ff0
pop esi
ret

Function at 0x406070
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x4c
mov eax, dword [0x442f98]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
mov ebx, dword [esp + 0x58]
push ebp
push esi
mov esi, dword [esp + 0x5c]
mov eax, dword [esi + 0x18]
shr eax, 3
and eax, 0x3f
cmp eax, 0x38
push edi
mov edi, 0x38
jb 0x4060a2
mov edi, 0x78
sub edi, eax
push edi
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0042e030
add esp, 0xc
mov byte [esp + 0x10], 0x80
lea ecx, [esp + edi + 0x11]
lea eax, [esi + 0x1a]
mov ebp, 2
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub ebp, 1
jne 0x4060c5
add edi, 8
push edi
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00405ef0
add esp, 0xc
lea ecx, [ebx + 1]
lea eax, [esi + 0xa]
lea edi, [ebp + 4]
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x406105
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 4], eax
call fcn.0040de50
cmp eax, 0x17
je 0x406174
pop edi
mov dword [esi], 0x40d4a0
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00434ca0
add esp, 0x4c
ret
mov ecx, dword [esp + 0x58]
pop edi
mov dword [esi], 0x405ff0
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00434ca0
add esp, 0x4c
ret
Function at 0x416de0
Capabilities:
Hash data using sha1

Disassembly:
call fcn.0040de50
add eax, 0xfffffffd
cmp eax, 0x25
ja case.0x416df4.8
movzx eax, byte [eax + 0x416e7c]
jmp dword [eax*4 + 0x416e68]
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x41c010
jmp 0x416e3a
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x41aed0
jmp 0x416e3a
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x419e20
jmp 0x416e3a
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x416db0
jmp 0x416e3a
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x40a980
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x416eb0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x60
mov eax, dword [0x442f98]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x6c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x70]
push edi
mov edi, dword [esp + 0x78]
lea ecx, [esp + 0x1c]
and ecx, 7
push 0x48
lea ebx, [esp + 0x28]
sub ebx, ecx
push 0
push ebx
mov dword [esp + 0x1c], eax
call fcn.0042e030
mov edx, dword [esi + 0x18]
and edx, 0x3f
mov eax, 0x40
sub eax, edx
add esp, 0xc
cmp eax, 8
ja 0x416f01
add eax, 0x40
mov ecx, dword [esi + 0x14]
mov ebp, dword [esi + 0x18]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebp
shr edx, 0x1d
or ecx, edx
mov byte [ebx], 0x80
lea edx, [ebp*8]
mov dword [esp + 0x18], edx
mov edx, ecx
shr edx, 0x18
mov byte [eax + ebx - 8], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + ebx - 7], dl
mov edx, ecx
shr edx, 8
mov byte [eax + ebx - 6], dl
mov byte [eax + ebx - 5], cl
mov ecx, dword [esp + 0x18]
mov edx, ecx
shr edx, 0x18
mov byte [eax + ebx - 4], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + ebx - 3], dl
mov edx, ecx
mov byte [eax + ebx - 1], cl
mov ecx, dword [esp + 0x10]
push ecx
push eax
shr edx, 8
push ebx
push esi
mov byte [eax + ebx - 2], dl
call fcn.00416cb0
movzx edx, byte [esi + 3]
mov byte [edi], dl
movzx eax, byte [esi + 2]
mov byte [edi + 1], al
mov ecx, dword [esi]
shr ecx, 8
mov byte [edi + 2], cl
movzx edx, byte [esi]
mov byte [edi + 3], dl
movzx eax, byte [esi + 7]
mov byte [edi + 4], al
movzx ecx, byte [esi + 6]
mov byte [edi + 5], cl
mov edx, dword [esi + 4]
shr edx, 8
mov byte [edi + 6], dl
movzx eax, byte [esi + 4]
mov byte [edi + 7], al
movzx ecx, byte [esi + 0xb]
mov byte [edi + 8], cl
movzx edx, byte [esi + 0xa]
mov byte [edi + 9], dl
mov eax, dword [esi + 8]
shr eax, 8
mov byte [edi + 0xa], al
movzx ecx, byte [esi + 8]
mov byte [edi + 0xb], cl
movzx edx, byte [esi + 0xf]
mov byte [edi + 0xc], dl
movzx eax, byte [esi + 0xe]
mov byte [edi + 0xd], al
mov ecx, dword [esi + 0xc]
shr ecx, 8
mov byte [edi + 0xe], cl
movzx edx, byte [esi + 0xc]
mov byte [edi + 0xf], dl
movzx eax, byte [esi + 0x13]
mov byte [edi + 0x10], al
movzx ecx, byte [esi + 0x12]
mov byte [edi + 0x11], cl
mov edx, dword [esi + 0x10]
shr edx, 8
mov byte [edi + 0x12], dl
movzx eax, byte [esi + 0x10]
push esi
mov byte [edi + 0x13], al
call fcn.00416de0
push 0x140
push 0
add esi, 0x60
push esi
call fcn.0042e030
mov ecx, dword [esp + 0x8c]
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00434ca0
add esp, 0x60
ret
Function at 0x41eeb0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436388
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x442f98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
call fcn.0041fb30
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov word [esi + 0xc], 0
lea edi, [esi + 0x10]
mov ebx, dword [ecx]
mov ecx, edi
push ebx
mov dword [ebp - 0x1c], edi
call fcn.0041f530
lea eax, [ebx + 0x18]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x18]
call fcn.0041f530
mov dword [edi + 0x30], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41f700
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x442f98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
push ebx
push esi
mov esi, dword [ebp + 0x1c]
xor bl, bl
push edi
mov edi, dword [ebp + 8]
push eax
push ecx
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
mov dword [ebp - 0x818], edx
push 0x400
push eax
call fcn.0041fa80
add esp, 0x14
test eax, eax
js 0x41f7da
lea eax, [ebp - 0x808]
mov dword [ebp - 0x808], 0
push eax
push 1
push 0
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f7da
mov dword [ebp - 0x80c], eax
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x814], 4
push eax
lea eax, [ebp - 0x80c]
push eax
push 0
push dword [ebp - 0x818]
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f7ce
cmp dword [ebp - 0x80c], 4
jne 0x41f7ce
cmp dword [ebp - 0x810], eax
mov bl, 1
setne al
mov dword [esi], eax
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434ca0
mov esp, ebp
pop ebp
ret
Function at 0x421630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x442f98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
push 0x208
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x210], 0
call sub.VCRUNTIME140.dll_memset
mov bx, word [ebp + 0x10]
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x214], 0
cmp dword [ebp + 0xc], eax
mov dword [ebp - 0x218], 0
sete al
mov dword [ebp - 0x21c], 4
movzx esi, ax
lea eax, [ebp - 0x20c]
test bx, bx
je 0x4216b1
push str.SoftwareAdobeAcrobat_ReaderDCFeatureState
jmp 0x4216b6
push str.SoftwareAdobeAdobe_AcrobatDCFeatureState
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x421783
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push dword [ebp - 0x220]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42174e
cmp dword [ebp - 0x214], 4
jne 0x42174e
push dword [ebp - 0x210]
xor ebx, ebx
cmp dword [ebp - 0x218], ebx
setne bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ax, bx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ca0
mov esp, ebp
pop ebp
ret
cmp word [ebp + 0x10], 0
mov ebx, esi
je 0x421763
test edi, edi
je 0x421763
mov eax, 1
mov word [edi], ax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ax, bx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ca0
mov esp, ebp
pop ebp
ret
mov eax, esi
test bx, bx
je 0x421798
test edi, edi
je 0x421798
mov eax, 1
mov word [edi], ax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434ca0
mov esp, ebp
pop ebp
ret
Function at 0x423040
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x43f010]
push ebx
mov ebx, dword [0x43f00c]
push esi
mov esi, ecx
mov dword [ebp - 8], esi
push edi
mov edi, 1
cmp ebx, eax
jae 0x4230d4
test edi, edi
js 0x4230d1
mov esi, dword [ebx]
test esi, esi
je 0x4230ca
mov edi, dword [esi + 8]
mov dword [ebp - 4], 0
test edi, edi
je 0x4230ca
lea eax, [ebp - 4]
mov ecx, edi
push eax
push 0x4392b8
push dword [esi + 0xc]
call dword [0x438430]
call edi
mov edi, eax
test edi, edi
js 0x4230ae
mov eax, dword [esi + 0x10]
add eax, 4
push eax
push 5
push 4
push dword [ebp - 4]
push dword [esi]
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
mov edi, eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4230c5
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x438430]
call esi
mov eax, dword [0x43f010]
add ebx, 4
cmp ebx, eax
jb 0x423062
mov esi, dword [ebp - 8]
test edi, edi
js 0x4231b7
jne 0x4231b3
cmp byte [esi + 0x3c], 0
je 0x42315b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
test eax, eax
je 0x423154
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x422d90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x423129
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x30], ebx
test ebx, ebx
je 0x423154
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edi, eax
test edi, edi
jns 0x42314b
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x423163
mov edi, 0x80004005
jmp 0x423167
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edi, eax
test edi, edi
jns 0x4231b7
mov esi, dword [0x43f00c]
xor eax, eax
mov edx, dword [0x43f010]
cmp esi, edx
jae 0x4231b7
nop dword [eax]
test eax, eax
jne 0x4231b7
mov ecx, dword [esi]
test ecx, ecx
je 0x4231a1
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + 4]
test eax, eax
je 0x4231a1
push eax
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
mov edx, dword [0x43f010]
add esi, 4
cmp esi, edx
jb 0x423180
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [esi + 0x3c], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4237d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4367b6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x442f98]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call fcn.00424be0
mov esi, eax
mov dword [ebp - 0x420], esi
test esi, esi
jne 0x423876
push 2
push eax
push edi
call fcn.00424be0
mov esi, eax
mov dword [ebp - 0x420], eax
test esi, esi
jne 0x423876
call fcn.004220d0
mov edi, eax
jmp 0x423990
push dword [ebp - 0x41c]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x423894
call fcn.004220d0
jmp 0x423983
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
jne 0x4238b2
call fcn.004220d0
jmp 0x423983
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x424], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x4238d3
mov edi, 0x8007000e
jmp 0x423985
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x4239c9
jb 0x4238f1
cmp eax, 0xffffffff
ja 0x4239c9
cmp eax, 0x400
jbe 0x423906
push eax
lea ecx, [ebp - 0x418]
call fcn.00421f50
jmp 0x42392c
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x42392c
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x423943
mov edi, 0x8007000e
jmp 0x423985
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x423963
call fcn.004220d0
jmp 0x423983
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00423630
mov edi, eax
test esi, esi
je 0x423990
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4239a9
lea ecx, [ebp - 0x418]
call fcn.00422440
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00434ca0
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00422110
int3
Function at 0x424200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
test edi, edi
je 0x424276
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push 0x4392c8
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebx + 1]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x424276
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push ebx
push 0x4392f4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x424265
cmp dword [ebp - 4], eax
cmove esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x424336
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwarePoliciesAdobeAdobe_AcrobatDCFeatureLockDown
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4242df
lea eax, [ebp - 0x10]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
push esi
push str.bEnableATL7Compat
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4242d6
cmp dword [ebp - 8], 4
jne 0x4242d6
mov eax, 1
cmp dword [ebp - 0xc], eax
cmove esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x424327
push str.SetProcessDEPPolicy
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [ebp - 0x10], ecx
test ecx, ecx
je 0x424327
test edi, edi
je 0x424315
mov eax, esi
xor eax, 1
lea eax, [eax*2 + 1]
jmp 0x424317
xor eax, eax
push eax
call dword [0x438430]
call dword [ebp - 0x10]
mov ebx, eax
test ebx, ebx
jne 0x424388
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x42433f
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push str.NtSetInformationProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x424388
lea esi, [esi*4 + 9]
test edi, edi
jne 0x424362
mov esi, 2
push 4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push 0x22
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [ebp - 0xc]
mov ecx, esi
push eax
call dword [0x438430]
call esi
xor ebx, ebx
test eax, eax
setns bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret