joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5640
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5df440]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x4a5713
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
call fcn.005145e0
movsd xmm1, qword [0x58f228]
divsd xmm1, xmm0
xorps xmm0, xmm0
comisd xmm0, xmm1
movsd qword [ebp - 0xc], xmm1
jae 0x4a5713
push esi
lea eax, [ebp - 0x14]
xor esi, esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x4a56b4
inc esi
cmp esi, 3
ja 0x4a56e0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4a56a0
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.005145e0
mulsd xmm0, qword [ebp - 0xc]
call fcn.005144e0
mov dword [edi], eax
mov eax, edi
pop esi
mov dword [edi + 4], edx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513cac
mov esp, ebp
pop ebp
ret
push 0x34
push 0x58f0a0
push str.0___Boost::Chrono___QueryPerformanceCounter_Internal_Error_
call fcn.0052447d
add esp, 0xc
mov dword [edi], 0
mov dword [edi + 4], 0
mov eax, edi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513cac
mov esp, ebp
pop ebp
ret
push 0x2c
push 0x58f0a0
push str.0___Boost::Chrono___get_nanosecs_per_tic_Internal_Error_
call fcn.0052447d
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [edi], 0
mov eax, edi
mov dword [edi + 4], 0
xor ecx, ebp
pop edi
call fcn.00513cac
mov esp, ebp
pop ebp
ret
Function at 0x4a9073
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov bl, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x4a90e6
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push 0x20019
push edi
push 0x58f5d8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a90e6
cmp dword [esi + 0x14], 0xf
movzx eax, bl
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
jbe 0x4a90bf
mov esi, dword [esi]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a90dd
cmp dword [ebp - 8], edi
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x4a90ed
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov bl, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x4a9160
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push 0x20019
push edi
push str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9160
cmp dword [esi + 0x14], 0xf
movzx eax, bl
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
jbe 0x4a9139
mov esi, dword [esi]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a9157
cmp dword [ebp - 8], edi
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x4a9389
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push ebx
push eax
push 1
xor ebx, ebx
push ebx
push dword [0x5df248]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a93ea
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [0x5df24c]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a93e1
cmp dword [ebp - 0xc], 4
jne 0x4a93e1
cmp dword [ebp - 0x10], ebx
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret
Function at 0x4a93ef
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5df440]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
call fcn.004a94cc
mov esi, eax
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.004a8141
cmp eax, dword [esi]
jne 0x4a9424
xor al, al
jmp 0x4a94be
mov esi, dword [eax + 0x14]
push ebx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.004cd31d
pop ecx
test al, al
je 0x4a9481
cmp dword [ebp + 8], 1
jne 0x4a9481
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], ebx
push eax
push ebx
push ebx
push 0x58b44c
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x4a94bb
cmp dword [ebp - 0x210], ebx
je 0x4a94bb
push dword [ebp - 0x210]
mov ecx, edi
call fcn.004aa5e6
push dword [ebp - 0x210]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x4a94b9
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00516ef0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4a94bb
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004aa5e6
mov bl, 1
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00513cac
leave
ret

Function at 0x4a95c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push esi
push eax
push 1
push 0
push dword [0x5df250]
or esi, 0xffffffff
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9628
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [0x5df254]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a961f
cmp dword [ebp - 0xc], 4
cmove esi, dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x4a962d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24c
mov eax, 0x56e15c
call fcn.00513d1f
mov ecx, dword [0x5ed6c4]
xor ebx, ebx
mov eax, dword fs:[0x2c]
mov edi, 0x5ec7b4
mov esi, dword [ebp + 8]
mov eax, dword [eax + ecx*4]
lea ecx, [eax + 0xc]
mov eax, dword [0x5ec7cc]
cmp eax, dword [ecx]
jg 0x4a9850
cmp dword [0x5ec7c4], 0
jbe 0x4a967f
push esi
push edi
call fcn.004a8c4f
pop ecx
pop ecx
jmp 0x4a984a
push edi
call fcn.004a930b
cmp dword [0x5ec7c4], 0
pop ecx
mov byte [ebp - 0x249], bl
je 0x4a9839
push 0x58f39c
mov ecx, edi
call fcn.0045594e
push 0x58f350
mov ecx, edi
call fcn.0045594e
push str.WebResources
mov ecx, edi
call fcn.0045594e
push edi
lea ecx, [ebp - 0x230]
call fcn.00450b9f
xor ecx, ecx
lea eax, [ebp - 0x254]
push eax
inc ecx
push ecx
push ebx
push dword [0x5df240]
mov dword [ebp - 4], ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9794
mov edi, 0x208
lea eax, [ebp - 0x218]
push edi
push ebx
push eax
call fcn.00516ef0
add esp, 0xc
mov dword [ebp - 0x258], edi
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push dword [0x5df244]
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, 0x5ec7b4
test eax, eax
jne 0x4a9768
cmp dword [ebp - 0x250], 1
jne 0x4a9768
push 0x58f350
mov ecx, edi
mov byte [ebp - 0x249], 1
call fcn.0045594e
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.0045594e
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x249], 0
je 0x4a9794
sub esp, 0x18
mov ecx, esp
push edi
call fcn.00450b9f
call fcn.004a9d4a
add esp, 0x18
test al, al
jne 0x4a9801
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.004a8998
push 0x58f350
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.004476cd
sub esp, 0xc
mov byte [ebp - 4], 2
mov ecx, esp
push str.Resource0
push eax
push ecx
call fcn.004a7f1a
add esp, 0xc
call fcn.004a9d4a
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
mov bl, al
call fcn.0045556e
test bl, bl
je 0x4a981b
push 0x58f350
mov ecx, edi
call fcn.0045594e
push str.Resource0
mov ecx, edi
call fcn.0045594e
push esi
push edi
call fcn.004a8c4f
pop ecx
pop ecx
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.0045556e
mov al, bl
jmp 0x4a984a
push edi
call fcn.004a8d4b
pop ecx
test al, al
jne 0x4a9801
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x4a9830
mov eax, dword [esi]
xor ebx, ebx
mov dword [esi + 0x10], ebx
mov byte [eax], bl
jmp 0x4a980c
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x4a9843
mov eax, dword [esi]
mov dword [esi + 0x10], ebx
mov byte [eax], bl
xor al, al
call fcn.00513cce
ret
push 0x5ec7cc
call fcn.00513c48
cmp dword [0x5ec7cc], 0xffffffff
pop ecx
jne 0x4a9668
push 0x585518
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.00450c25
push 0x5807a0
call fcn.00513bb7
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x5ec7cc
call fcn.00513bf7
pop ecx
jmp 0x4a9668
Function at 0x4a9897
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20019
push ebx
push 0x58f5d8
push 0x80000001
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a98f6
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
push ebx
push ebx
push str.bEnableCrashReporterForCEF
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a98ed
cmp dword [ebp - 8], ebx
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x4a993a
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x56e193
call fcn.00513d1f
xor esi, esi
inc esi
cmp dword [0x5ec7dc], 0
jne 0x4a9a22
xor eax, eax
mov dword [0x5ec7dc], 2
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
push 7
pop ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x14], ebx
and dword [ebp - 4], 0
xor eax, eax
and dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
push eax
call fcn.004a930b
cmp dword [ebp - 0x18], 0
pop ecx
je 0x4a99df
mov edi, 0x58f350
lea ecx, [ebp - 0x28]
push edi
call fcn.0045594e
push 0x58f354
lea ecx, [ebp - 0x28]
call fcn.0045594e
cmp dword [ebp - 0x18], 0
je 0x4a99df
push edi
lea ecx, [ebp - 0x28]
call fcn.0045594e
push str.aaFEAT.api
lea ecx, [ebp - 0x28]
call fcn.0045594e
cmp dword [ebp - 0x14], ebx
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a99df
mov dword [0x5ec7dc], esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jbe 0x4a9a22
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], esi
cmp eax, 0x1000
jb 0x4a9a19
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004543c6
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x30]
push eax
push ecx
call fcn.00513968
pop ecx
pop ecx
cmp dword [0x5ec7dc], esi
sete al
call fcn.00513cce
ret

Function at 0x4a9a31
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAdobe_AcrobatDCProcessTerminationFix
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9a90
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
push ebx
push ebx
push str.bDisableProcessTerminationFix
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a9a87
cmp dword [ebp - 8], ebx
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret
Function at 0x4a9bcb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x20
mov eax, 0x56e23c
call fcn.00513d1f
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
xor ebx, ebx
call fcn.00450c25
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a9c45
cmp dword [esi + 0x10], ebx
je 0x4a9c45
cmp dword [ebp - 0x14], 7
lea ecx, [ebp - 0x2c]
push ecx
push 0x20019
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], ebx
cmova eax, dword [ebp - 0x28]
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9c45
cmp dword [esi + 0x14], 0xf
jbe 0x4a9c26
mov esi, dword [esi]
push ebx
push ebx
push ebx
push ebx
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x2c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
setne bl
lea ecx, [ebp - 0x28]
call fcn.0045556e
mov al, bl
call fcn.00513cce
ret

Function at 0x4a9c55
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9cb4
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
push ebx
push ebx
push str.CEFSecurityMK
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a9cab
cmp dword [ebp - 8], ebx
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x4a9d8e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20019
push ebx
push 0x58f5d8
push 0x80000001
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9ded
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
push ebx
push ebx
push str.bDisableGPU
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a9de4
cmp dword [ebp - 8], ebx
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x4a9e51
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
call fcn.004a9897
mov bl, al
xor esi, esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push 0x20019
push esi
push 0x58f5d8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9eb8
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
push esi
push esi
push str.bEnableCrashReporterForCEF
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a9eaf
cmp dword [ebp - 8], esi
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x4b8eea
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x591968]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x5a
jb 0x4b8eee
pop edi
pop esi
mov byte [ecx + 0x5a], 0
mov eax, ecx
ret

Function at 0x4babf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x20]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [esi], eax
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 0x10]
je 0x4bad59
mov eax, ecx
xor ebx, ebx
mov dword [ebp - 8], eax
inc ebx
mov edx, dword [ebp + 0x1c]
mov ecx, eax
cmp dword [esi], edx
je 0x4bad59
mov edx, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp - 1], 0
movzx edi, word [edx]
cmp bx, di
jae 0x4bac6f
lea eax, [ecx + 0x2400]
mov edx, 0x3ff
cmp ax, dx
ja 0x4bad68
mov eax, edi
lea edx, [ecx - 0xdc00]
shl eax, 0xa
or edx, eax
mov cl, byte [ebp - 1]
cmp edx, 0x80
jae 0x4bac91
mov bl, dl
xor edi, edi
jmp 0x4bacc1
mov edx, eax
lea eax, [ecx + 0x2800]
mov ecx, 0x3ff
cmp ax, cx
ja 0x4bac5e
add edx, 0xffff2840
mov cl, bl
shl edx, 0xa
mov byte [ebp - 1], cl
jmp 0x4bac61
mov ebx, edx
cmp edx, 0x800
jae 0x4baca6
shr ebx, 6
xor edi, edi
or bl, 0xc0
inc edi
jmp 0x4bacc1
cmp edx, 0x10000
jae 0x4bacb8
shr ebx, 0xc
or bl, 0xe0
push 2
jmp 0x4bacc0
shr ebx, 0x12
or bl, 0xf0
push 3
pop edi
movzx eax, cl
mov ecx, dword [ebp - 8]
xor eax, 1
add eax, eax
cmp edi, 3
cmovb eax, edi
mov dword [ebp - 0x10], eax
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [esi]
cmp eax, dword [ebp - 0xc]
jl 0x4bad59
mov eax, ecx
mov ecx, dword [ebp + 0x14]
add eax, 2
cmp byte [ebp - 1], 0
mov dword [ecx], eax
jne 0x4bacfd
cmp edi, 3
jb 0x4bacfd
mov ebx, dword [ebp - 0xc]
jmp 0x4bad06
mov eax, dword [esi]
mov byte [eax], bl
inc dword [esi]
mov ebx, dword [ebp - 0x10]
mov eax, dword [esi]
mov dword [ebp - 8], eax
test ebx, ebx
je 0x4bad2e
imul ecx, edi, 6
mov edi, dword [ebp - 8]
sub ecx, 6
mov eax, edx
dec ebx
shr eax, cl
and al, 0x3f
or al, 0x80
mov byte [edi], al
inc dword [esi]
mov eax, dword [esi]
mov dword [ebp - 8], eax
test ebx, ebx
jg 0x4bad12
xor ebx, ebx
shr edx, 0xa
inc ebx
movzx eax, dx
cmp byte [ebp - 1], 0
mov ecx, ebx
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp - 8], eax
cmp ecx, dword [ebp + 0x10]
jne 0x4bac1c
xor eax, eax
cmp dword [ebp + 0xc], ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x1c
push 2
pop eax
jmp 0x4bad61
Function at 0x4bc7d6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x98
mov eax, 0x570a4c
call fcn.00513d1f
xor ebx, ebx
call fcn.004bcad3
test al, al
je 0x4bc9b5
cmp byte [0x5eca27], bl
jne 0x4bc84f
lea eax, [ebp - 0x9c]
mov byte [0x5eca27], 1
push eax
push str.SOFTWAREAdobeAcroPerf
push 0x80000001
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0xa0], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0xa0]
push eax
push 0x5eca28
lea eax, [ebp - 0xa4]
push eax
push ebx
push str.tOutputDir
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [0x5eca26], bl
lea ecx, [ebp - 0x38]
mov eax, 0x5933d0
mov edi, 0x5933d4
push str.AcroCEF_TimeInfo
cmove edi, eax
call fcn.00450b3c
push 0xa
lea eax, [ebp - 0x20]
mov dword [ebp - 4], ebx
push eax
mov byte [ebp - 0x20], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00524998
mov esi, eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x98]
push 0x5eca28
push eax
call fcn.004bc5b2
add esp, 0x18
push esi
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00442a20
push eax
lea ecx, [ebp - 0x80]
call fcn.00450adf
push edi
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.00442a20
push eax
lea ecx, [ebp - 0x68]
call fcn.00450adf
push 4
push str..log
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.004558e5
push eax
lea ecx, [ebp - 0x50]
call fcn.00450adf
lea ecx, [ebp - 0x38]
call fcn.00455548
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x38]
call fcn.004551af
lea ecx, [ebp - 0x50]
call fcn.00455548
lea ecx, [ebp - 0x68]
call fcn.00455548
lea ecx, [ebp - 0x80]
call fcn.00455548
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], bl
call fcn.00455548
cmp dword [ebp - 0x24], 0xf
lea eax, [ebp - 0x38]
push 0x5933f4
cmova eax, dword [ebp - 0x38]
push eax
call fcn.005219be
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4bc9ad
call fcn.004bca64
mov esi, eax
mov edx, dword [esi]
mov ecx, dword [edx]
mov dword [ebp - 0x9c], ecx
cmp ecx, edx
je 0x4bc9a6
movsd xmm0, qword [ecx + 0x28]
ucomisd xmm0, qword [0x58a1a8]
lahf
test ah, 0x44
jnp 0x4bc991
add ecx, 0x10
cmp dword [ecx + 0x14], 0xf
jbe 0x4bc973
mov ecx, dword [ecx]
divsd xmm0, qword [0x58f228]
push ecx
push ecx
push ecx
movsd qword [esp], xmm0
push str._lf_t_s_n
push edi
call fcn.004bcc0e
add esp, 0x14
lea ecx, [ebp - 0x9c]
call fcn.00451ea3
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [esi]
jne 0x4bc955
push edi
call fcn.005221a3
pop ecx
lea ecx, [ebp - 0x38]
call fcn.00455548
call fcn.00513cce
ret
Function at 0x4bcad3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5df440]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x5eca25], 0
jne 0x4bcb5f
cmp byte [0x5eca26], 0
mov byte [0x5eca25], 1
je 0x4bcb5f
push esi
push edi
push 0xc
pop ecx
lea eax, [ebp - 0x38]
mov esi, 0x593360
push eax
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
push 1
xor esi, esi
lea eax, [ebp - 0x34]
push esi
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x38], esi
je 0x4bcb5d
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], esi
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], 4
push eax
push esi
push esi
push str.bLaunchTiming
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x3c], esi
push dword [ebp - 0x38]
setne byte [0x5eca24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov al, byte [0x5eca24]
xor ecx, ebp
call fcn.00513cac
leave
ret

Function at 0x4bde7f
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x570d24
call fcn.00513cec
mov esi, ecx
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004c1a6a
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
push 0x4bdd70
push ebx
push ebx
call fcn.0052550c
add esp, 0x20
mov dword [esi], eax
test eax, eax
je 0x4bdec3
call fcn.00513cba
ret 4
push 6
mov dword [edi], ebx
call fcn.0050054f
int3

Function at 0x4bdecd
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x570d4e
call fcn.00513cec
mov esi, ecx
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004c1aa4
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
push 0x4bddd0
push ebx
push ebx
call fcn.0052550c
add esp, 0x20
mov dword [esi], eax
test eax, eax
je 0x4bdf11
call fcn.00513cba
ret 4
push 6
mov dword [edi], ebx
call fcn.0050054f
int3
Function at 0x4c4e50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
call fcn.004cb222
push str.Acrobat
mov ecx, eax
call fcn.0046b416
lea ecx, [ebp - 4]
xor esi, esi
push ecx
push 1
test al, al
mov edx, str.SoftwareAdobeAdobe_AcrobatDCPrivileged
push esi
mov ecx, str.SoftwareAdobeAcrobat_ReaderDCPrivileged
cmovne ecx, edx
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c4ed5
lea eax, [ebp - 0x10]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
push esi
push str.bProtectedMode
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4c4ed5
cmp dword [ebp - 8], 4
jne 0x4c4ed5
cmp dword [ebp - 0xc], esi
setne al
jmp 0x4c4ed7
xor al, al
pop esi
leave
ret