joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49e99e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24c
mov eax, 0x55d14c
call fcn.00503628
mov ecx, dword [0x5da474]
xor ebx, ebx
mov eax, dword fs:[0x2c]
mov edi, 0x5d9574
mov esi, dword [ebp + 8]
mov eax, dword [eax + ecx*4]
lea ecx, [eax + 0xc]
mov eax, dword [0x5d958c]
cmp eax, dword [ecx]
jg 0x49ebc1
cmp dword [0x5d9584], 0
jbe 0x49e9f0
push esi
push edi
call fcn.0049dfc0
pop ecx
pop ecx
jmp 0x49ebbb
push edi
call fcn.0049e67c
cmp dword [0x5d9584], 0
pop ecx
mov byte [ebp - 0x249], bl
je 0x49ebaa
push 0x57cbbc
mov ecx, edi
call fcn.0044d946
push 0x57cb70
mov ecx, edi
call fcn.0044d946
push str.WebResources
mov ecx, edi
call fcn.0044d946
push edi
lea ecx, [ebp - 0x230]
call fcn.0049daa8
xor ecx, ecx
lea eax, [ebp - 0x254]
push eax
inc ecx
push ecx
push ebx
push dword [0x5cc240]
mov dword [ebp - 4], ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49eb05
mov edi, 0x208
lea eax, [ebp - 0x218]
push edi
push ebx
push eax
call fcn.005050d0
add esp, 0xc
mov dword [ebp - 0x258], edi
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push dword [0x5cc244]
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, 0x5d9574
test eax, eax
jne 0x49ead9
cmp dword [ebp - 0x250], 1
jne 0x49ead9
push 0x57cb70
mov ecx, edi
mov byte [ebp - 0x249], 1
call fcn.0044d946
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.0044d946
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x249], 0
je 0x49eb05
sub esp, 0x18
mov ecx, esp
push edi
call fcn.0049daa8
call fcn.0049efdf
add esp, 0x18
test al, al
jne 0x49eb72
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.0049dd36
push 0x57cb70
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.0049d273
sub esp, 0xc
mov byte [ebp - 4], 2
mov ecx, esp
push str.Resource0
push eax
push ecx
call fcn.0049d256
add esp, 0xc
call fcn.0049efdf
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
mov bl, al
call fcn.0044d7e3
test bl, bl
je 0x49eb8c
push 0x57cb70
mov ecx, edi
call fcn.0044d946
push str.Resource0
mov ecx, edi
call fcn.0044d946
push esi
push edi
call fcn.0049dfc0
pop ecx
pop ecx
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.0044d7e3
mov al, bl
jmp 0x49ebbb
push edi
call fcn.0049e0bc
pop ecx
test al, al
jne 0x49eb72
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x49eba1
mov eax, dword [esi]
xor ebx, ebx
mov dword [esi + 0x10], ebx
mov byte [eax], bl
jmp 0x49eb7d
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x49ebb4
mov eax, dword [esi]
mov dword [esi + 0x10], ebx
mov byte [eax], bl
xor al, al
call fcn.005035d7
ret
push 0x5d958c
call fcn.00503551
cmp dword [0x5d958c], 0xffffffff
pop ecx
jne 0x49e9d9
push 0x5743ac
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0044b93e
push 0x56f4f0
call fcn.005034c0
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x5d958c
call fcn.00503500
pop ecx
jmp 0x49e9d9
Function at 0x49ec47
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x55d183
call fcn.00503628
xor esi, esi
inc esi
cmp dword [0x5d959c], 0
jne 0x49ed2f
xor eax, eax
mov dword [0x5d959c], 2
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
push 7
pop ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x14], ebx
and dword [ebp - 4], 0
xor eax, eax
and dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
push eax
call fcn.0049e67c
cmp dword [ebp - 0x18], 0
pop ecx
je 0x49ecec
mov edi, 0x57cb70
lea ecx, [ebp - 0x28]
push edi
call fcn.0044d946
push 0x57cb74
lea ecx, [ebp - 0x28]
call fcn.0044d946
cmp dword [ebp - 0x18], 0
je 0x49ecec
push edi
lea ecx, [ebp - 0x28]
call fcn.0044d946
push str.aaFEAT.api
lea ecx, [ebp - 0x28]
call fcn.0044d946
cmp dword [ebp - 0x14], ebx
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49ecec
mov dword [0x5d959c], esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jbe 0x49ed2f
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], esi
cmp eax, 0x1000
jb 0x49ed26
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0044d116
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x30]
push eax
push ecx
call fcn.00503276
pop ecx
pop ecx
cmp dword [0x5d959c], esi
sete al
call fcn.005035d7
ret

Function at 0x49ed3e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCProcessTerminationFix
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49ed9d
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
push ebx
push ebx
push str.bDisableProcessTerminationFix
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x49ed94
cmp dword [ebp - 8], ebx
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret
Function at 0x49ee60
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x20
mov eax, 0x55d1fe
call fcn.00503628
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
xor ebx, ebx
call fcn.0044b93e
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x49eeda
cmp dword [esi + 0x10], ebx
je 0x49eeda
cmp dword [ebp - 0x14], 7
lea ecx, [ebp - 0x2c]
push ecx
push 0x20019
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], ebx
cmova eax, dword [ebp - 0x28]
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49eeda
cmp dword [esi + 0x14], 0xf
jbe 0x49eebb
mov esi, dword [esi]
push ebx
push ebx
push ebx
push ebx
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x2c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
setne bl
lea ecx, [ebp - 0x28]
call fcn.0044d7e3
mov al, bl
call fcn.005035d7
ret

Function at 0x49eeea
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49ef49
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
push ebx
push ebx
push str.CEFSecurityMK
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x49ef40
cmp dword [ebp - 8], ebx
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret
Function at 0x4b38c6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
movzx eax, ax
mov edx, ecx
push edi
mov edi, eax
mov dword [ebp - 8], eax
shr edi, 8
mov ebx, ecx
cmp dword [ebp + 0x10], ecx
jbe 0x4b3925
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + ebx*2]
mov esi, eax
movzx eax, al
shr esi, 8
add esi, edx
cmp edi, eax
jb 0x4b3925
jne 0x4b391d
cmp edx, esi
jge 0x4b391d
mov eax, dword [ebp + 8]
movzx eax, al
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
movzx eax, byte [edx + eax]
cmp ax, word [ebp - 4]
je 0x4b3949
inc edx
cmp edx, esi
jl 0x4b390b
inc ebx
mov edx, esi
cmp ebx, dword [ebp + 0x10]
jb 0x4b38e7
mov bl, 1
cmp dword [ebp + 0x1c], ecx
jbe 0x4b395c
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp - 8]
movzx eax, byte [ecx + esi]
test al, al
jns 0x4b394d
inc ecx
and eax, 0x7f
shl eax, 8
movzx edx, byte [ecx + esi]
or edx, eax
jmp 0x4b394f
xor al, al
jmp 0x4b395e
mov edx, eax
sub edi, edx
js 0x4b395c
xor bl, 1
inc ecx
cmp ecx, dword [ebp + 0x1c]
jb 0x4b3932
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ba180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x20]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [esi], eax
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 0x10]
je 0x4ba2e9
mov eax, ecx
xor ebx, ebx
mov dword [ebp - 8], eax
inc ebx
mov edx, dword [ebp + 0x1c]
mov ecx, eax
cmp dword [esi], edx
je 0x4ba2e9
mov edx, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp - 1], 0
movzx edi, word [edx]
cmp bx, di
jae 0x4ba1ff
lea eax, [ecx + 0x2400]
mov edx, 0x3ff
cmp ax, dx
ja 0x4ba2f8
mov eax, edi
lea edx, [ecx - 0xdc00]
shl eax, 0xa
or edx, eax
mov cl, byte [ebp - 1]
cmp edx, 0x80
jae 0x4ba221
mov bl, dl
xor edi, edi
jmp 0x4ba251
mov edx, eax
lea eax, [ecx + 0x2800]
mov ecx, 0x3ff
cmp ax, cx
ja 0x4ba1ee
add edx, 0xffff2840
mov cl, bl
shl edx, 0xa
mov byte [ebp - 1], cl
jmp 0x4ba1f1
mov ebx, edx
cmp edx, 0x800
jae 0x4ba236
shr ebx, 6
xor edi, edi
or bl, 0xc0
inc edi
jmp 0x4ba251
cmp edx, 0x10000
jae 0x4ba248
shr ebx, 0xc
or bl, 0xe0
push 2
jmp 0x4ba250
shr ebx, 0x12
or bl, 0xf0
push 3
pop edi
movzx eax, cl
mov ecx, dword [ebp - 8]
xor eax, 1
add eax, eax
cmp edi, 3
cmovb eax, edi
mov dword [ebp - 0x10], eax
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [esi]
cmp eax, dword [ebp - 0xc]
jl 0x4ba2e9
mov eax, ecx
mov ecx, dword [ebp + 0x14]
add eax, 2
cmp byte [ebp - 1], 0
mov dword [ecx], eax
jne 0x4ba28d
cmp edi, 3
jb 0x4ba28d
mov ebx, dword [ebp - 0xc]
jmp 0x4ba296
mov eax, dword [esi]
mov byte [eax], bl
inc dword [esi]
mov ebx, dword [ebp - 0x10]
mov eax, dword [esi]
mov dword [ebp - 8], eax
test ebx, ebx
je 0x4ba2be
imul ecx, edi, 6
mov edi, dword [ebp - 8]
sub ecx, 6
mov eax, edx
dec ebx
shr eax, cl
and al, 0x3f
or al, 0x80
mov byte [edi], al
inc dword [esi]
mov eax, dword [esi]
mov dword [ebp - 8], eax
test ebx, ebx
jg 0x4ba2a2
xor ebx, ebx
shr edx, 0xa
inc ebx
movzx eax, dx
cmp byte [ebp - 1], 0
mov ecx, ebx
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp - 8], eax
cmp ecx, dword [ebp + 0x10]
jne 0x4ba1ac
xor eax, eax
cmp dword [ebp + 0xc], ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x1c
push 2
pop eax
jmp 0x4ba2f1
Function at 0x4bc046
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x98
mov eax, 0x55fe58
call fcn.00503628
xor ebx, ebx
call fcn.004bc343
test al, al
je 0x4bc225
cmp byte [0x5d97db], bl
jne 0x4bc0bf
lea eax, [ebp - 0x9c]
mov byte [0x5d97db], 1
push eax
push str.SOFTWAREAdobeAcroPerf
push 0x80000001
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0xa0], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0xa0]
push eax
push 0x5d97e0
lea eax, [ebp - 0xa4]
push eax
push ebx
push str.tOutputDir
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [0x5d97da], bl
lea ecx, [ebp - 0x38]
mov eax, 0x581e28
mov edi, 0x581e2c
push str.AcroCEF_TimeInfo
cmove edi, eax
call fcn.0044b88b
push 0xa
lea eax, [ebp - 0x20]
mov dword [ebp - 4], ebx
push eax
mov byte [ebp - 0x20], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00514258
mov esi, eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x98]
push 0x5d97e0
push eax
call fcn.004bbe22
add esp, 0x18
push esi
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00445da0
push eax
lea ecx, [ebp - 0x80]
call fcn.0044b82e
push edi
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.00445da0
push eax
lea ecx, [ebp - 0x68]
call fcn.0044b82e
push 4
push str..log
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.0044d8dd
push eax
lea ecx, [ebp - 0x50]
call fcn.0044b82e
lea ecx, [ebp - 0x38]
call fcn.0044d7bd
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x38]
call fcn.0044d550
lea ecx, [ebp - 0x50]
call fcn.0044d7bd
lea ecx, [ebp - 0x68]
call fcn.0044d7bd
lea ecx, [ebp - 0x80]
call fcn.0044d7bd
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], bl
call fcn.0044d7bd
cmp dword [ebp - 0x24], 0xf
lea eax, [ebp - 0x38]
push 0x581e4c
cmova eax, dword [ebp - 0x38]
push eax
call fcn.0051124e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4bc21d
call fcn.004bc2d4
mov esi, eax
mov edx, dword [esi]
mov ecx, dword [edx]
mov dword [ebp - 0x9c], ecx
cmp ecx, edx
je 0x4bc216
movsd xmm0, qword [ecx + 0x28]
ucomisd xmm0, qword [0x577838]
lahf
test ah, 0x44
jnp 0x4bc201
add ecx, 0x10
cmp dword [ecx + 0x14], 0xf
jbe 0x4bc1e3
mov ecx, dword [ecx]
divsd xmm0, qword [0x57ca48]
push ecx
push ecx
push ecx
movsd qword [esp], xmm0
push str._lf_t_s_n
push edi
call fcn.004bc47e
add esp, 0x14
lea ecx, [ebp - 0x9c]
call fcn.0044c31e
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [esi]
jne 0x4bc1c5
push edi
call fcn.00511a33
pop ecx
lea ecx, [ebp - 0x38]
call fcn.0044d7bd
call fcn.005035d7
ret
Function at 0x4bc343
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5cc440]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x5d97d9], 0
jne 0x4bc3cf
cmp byte [0x5d97da], 0
mov byte [0x5d97d9], 1
je 0x4bc3cf
push esi
push edi
push 0xc
pop ecx
lea eax, [ebp - 0x38]
mov esi, 0x581db8
push eax
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
push 1
xor esi, esi
lea eax, [ebp - 0x34]
push esi
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x38], esi
je 0x4bc3cd
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], esi
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], 4
push eax
push esi
push esi
push str.bLaunchTiming
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x3c], esi
push dword [ebp - 0x38]
setne byte [0x5d97d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov al, byte [0x5d97d8]
xor ecx, ebp
call fcn.005035b5
leave
ret

Function at 0x4c74b6
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555edf
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5cc440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], vtable.rna::messaging::NamedPipeChannelServer.0
call fcn.00533b90
cmp dword [edi + 0xc], 0xffffffff
je 0x4c7510
push 0xfa
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [edi + 0xac]
test ebx, ebx
je 0x4c752c
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x57044c]
mov ecx, ebx
call esi
mov ebx, dword [edi + 0xb0]
test ebx, ebx
je 0x4c7548
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x57044c]
mov ecx, ebx
call esi
lea ecx, [edi + 0xb4]
call fcn.0044fe4b
lea esi, [edi + 0x94]
lea ecx, [esi + 0x14]
call fcn.0044fe4b
mov ecx, esi
call fcn.004a1185
lea ecx, [edi + 0x50]
call fcn.004a13dc
lea ecx, [edi + 0x38]
call fcn.0044d7e3
lea ecx, [edi + 0x20]
call fcn.0044d7e3
mov dword [edi], vtable.rna::messaging::IpcChannelBase.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4c8e0f
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x561f6c
call fcn.005035f5
mov esi, ecx
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004cc948
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
push 0x4c8d00
push ebx
push ebx
call fcn.005181cc
add esp, 0x20
mov dword [esi], eax
test eax, eax
je 0x4c8e53
call fcn.005035c3
ret 4
push 6
mov dword [edi], ebx
call fcn.004efde0
int3
Function at 0x4c8e5d
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x561f96
call fcn.005035f5
mov esi, ecx
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004cc982
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
push 0x4c8d60
push ebx
push ebx
call fcn.005181cc
add esp, 0x20
mov dword [esi], eax
test eax, eax
je 0x4c8ea1
call fcn.005035c3
ret 4
push 6
mov dword [edi], ebx
call fcn.004efde0
int3
Function at 0x4cfb5f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
call fcn.004d5a54
push str.Acrobat
mov ecx, eax
call fcn.00460886
lea ecx, [ebp - 4]
xor esi, esi
push ecx
push 1
test al, al
mov edx, str.SoftwareAdobeAdobe_AcrobatDCPrivileged
push esi
mov ecx, str.SoftwareAdobeAcrobat_ReaderDCPrivileged
cmovne ecx, edx
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cfbe4
lea eax, [ebp - 0x10]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
push esi
push str.bProtectedMode
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4cfbe4
cmp dword [ebp - 8], 4
jne 0x4cfbe4
cmp dword [ebp - 0xc], esi
setne al
jmp 0x4cfbe6
xor al, al
pop esi
leave
ret
Function at 0x4cfbe9
Capabilities:
Accept command line arguments

Disassembly:
push 0x440
mov eax, 0x562faa
call fcn.00503628
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x44c], esi
mov ecx, esi
push 0x57433a
mov dword [ebp - 4], ebx
mov dword [ebp - 0x448], ebx
call fcn.0044b88b
mov dword [ebp - 4], ebx
mov dword [ebp - 0x448], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4cfdc9
push 0x400
lea eax, [ebp - 0x410]
push eax
push ebx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x4cfd74
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x428]
call fcn.0044b88b
xor ecx, ecx
lea eax, [ebp - 0x428]
inc ecx
cmp dword [ebp - 0x414], 0xf
push ecx
cmova eax, dword [ebp - 0x428]
push 0x57cdfc
push 0xffffffffffffffff
push dword [ebp - 0x418]
mov dword [ebp - 4], ecx
push eax
call fcn.004c8ffa
add esp, 0x14
cmp eax, 0xffffffff
je 0x4cfd66
lea ecx, [ebp - 0x441]
inc eax
push ecx
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x440]
call fcn.004b59cb
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x448], 3
call fcn.0044d7bd
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x428]
call fcn.0044d550
lea ecx, [ebp - 0x440]
call fcn.0044d7bd
cmp dword [ebp - 0x414], 0xf
lea eax, [ebp - 0x428]
push 1
cmova eax, dword [ebp - 0x428]
push 0x57a1dc
push ebx
push dword [ebp - 0x418]
push eax
call fcn.0049b60e
add esp, 0x14
cmp eax, 0xffffffff
je 0x4cfd66
lea ecx, [ebp - 0x441]
push ecx
push eax
push ebx
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x440]
call fcn.004b59cb
lea eax, [ebp - 0x440]
mov dword [ebp - 0x448], 7
push eax
mov ecx, esi
call fcn.0044c281
lea ecx, [ebp - 0x440]
call fcn.0044d7bd
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], bl
call fcn.0044d7bd
push str.Acrobat
mov ecx, esi
call fcn.00460886
test al, al
jne 0x4cfd94
push str.AcroRd32
mov ecx, esi
call fcn.00460886
test al, al
je 0x4cfdc2
call fcn.004d5ac6
test al, al
je 0x4cfdc2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.__typerenderer
push eax
call fcn.00507893
pop ecx
pop ecx
test eax, eax
jne 0x4cfdc2
push 6
push str.Broker
mov ecx, esi
call fcn.0044d8dd
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.005035d7
ret 4
Function at 0x4d549f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555df8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5cc440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xf
jbe 0x4d54cc
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret

Function at 0x4d5bf2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 1
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d5c40
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
test esi, esi
je 0x4d5c3a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4d5c40
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret

Function at 0x4d6866
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x55c53b
call fcn.00503628
mov edi, ecx
mov eax, dword [ebp + 8]
push dword [edi + 8]
mov esi, dword [eax + 8]
push esi
push 1
push dword [eax + 4]
call fcn.00512c29
add esp, 0x10
cmp eax, esi
jne 0x4d6897
call fcn.005035d7
ret 4
call fcn.00509aa0
mov esi, dword [eax]
lea eax, [edi + 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004d24b9
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x40]
push str.Failed_writing_to_file
push eax
call fcn.004a01ae
add esp, 0x14
push esi
push eax
mov byte [ebp - 4], 1
call fcn.004d660a
int3