joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d16c1
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
mov esi, ecx
xor bh, bh
push edi
mov dword [esi + 0x204], 9
movq xmm0, qword [str.Adobe_ALM]
movq qword [esi + 0x102], xmm0
mov al, byte [0x63e504]
mov byte [esi + 0x10a], al
xor eax, eax
mov word [esi + 0x100], 0
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x4d16f7
xor edi, edi
mov eax, edi
mov bl, byte [edi + esi]
cdq
idiv dword [esi + 0x204]
movzx eax, byte [edx + esi + 0x102]
add al, bl
add bh, al
movzx ecx, bh
movzx eax, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov byte [ecx + esi], bl
cmp edi, 0x100
jl 0x4d1704
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4d1740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d1750

Function at 0x4d1750
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
test ecx, ecx
je 0x4d17db
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4d17db
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x4d17db
mov dl, byte [esi + 0x101]
sub ecx, edi
push ebx
mov bh, byte [esi + 0x100]
mov byte [ebp + 0xf], dl
mov dword [ebp + 8], ecx
dec eax
lea edi, [edi + 1]
mov dword [ebp + 0x10], eax
inc bh
mov al, byte [ebp + 0xf]
movzx edx, bh
mov bl, byte [edx + esi]
add al, bl
movzx ecx, al
mov byte [ebp + 0xf], al
movzx eax, byte [ecx + esi]
mov byte [edx + esi], al
mov byte [ecx + esi], bl
movzx eax, byte [edx + esi]
mov ecx, dword [ebp + 8]
add al, bl
movzx eax, al
movzx eax, byte [eax + esi]
xor al, byte [ecx + edi - 1]
mov byte [edi - 1], al
mov eax, dword [ebp + 0x10]
test eax, eax
jg 0x4d1781
mov dl, byte [ebp + 0xf]
mov al, 1
mov byte [esi + 0x100], bh
pop ebx
pop edi
mov byte [esi + 0x101], dl
pop esi
pop ebp
ret 0xc
pop edi
xor al, al
pop esi
pop ebp
ret 0xc

Function at 0x4d17f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
mov esi, ecx
xor bh, bh
push edi
xor eax, eax
mov word [esi + 0x100], 0
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x4d1802
xor edi, edi
nop
mov eax, edi
mov bl, byte [edi + esi]
cdq
idiv dword [esi + 0x204]
movzx eax, byte [edx + esi + 0x102]
add al, bl
add bh, al
movzx ecx, bh
movzx eax, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov byte [ecx + esi], bl
cmp edi, 0x100
jl 0x4d1810
pop edi
pop esi
pop ebx
ret
Function at 0x4d1850
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4d18d8
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x4d18d8
mov edx, 0x100
push ebx
cmp eax, edx
push edi
cmovge eax, edx
push eax
mov dword [esi + 0x204], eax
lea eax, [esi + 0x102]
push ecx
push eax
call fcn.00571b10
add esp, 0xc
mov word [esi + 0x100], 0
xor bh, bh
xor eax, eax
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x4d1894
xor edi, edi
mov eax, edi
mov bl, byte [edi + esi]
cdq
idiv dword [esi + 0x204]
movzx eax, byte [edx + esi + 0x102]
add al, bl
add bh, al
movzx ecx, bh
movzx eax, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov byte [ecx + esi], bl
cmp edi, 0x100
jl 0x4d18a1
pop edi
pop ebx
mov al, 1
pop esi
pop ebp
ret 8
xor al, al
pop esi
pop ebp
ret 8

Function at 0x4d1910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x4d195e
push ebx
push esi
mov ebx, 0x63e598
mov byte [edx], 0xd0
push edi
mov esi, 0x63e59a
lea eax, [edx + 3]
sub ebx, edx
mov edi, 0x15
movzx ecx, byte [esi - 1]
lea esi, [esi + 3]
xor cl, byte [edx]
lea eax, [eax + 3]
mov byte [eax - 5], cl
movzx ecx, byte [edx]
xor cl, byte [esi - 3]
mov byte [eax - 4], cl
movzx ecx, byte [ebx + eax - 3]
xor cl, byte [edx]
mov byte [eax - 3], cl
sub edi, 1
jne 0x4d1934
pop edi
pop esi
pop ebx
mov eax, 0x40
pop ebp
ret 4

Function at 0x4d1970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x4d19d7
push ebx
mov ebx, 0x63e620
mov byte [edx], 0x30
push esi
mov ecx, 0x63e621
lea eax, [edx + 3]
sub ebx, edx
mov esi, str.1e210
sub ecx, edx
push edi
mov dword [ebp + 8], ecx
mov edi, 0x56
nop
movzx ecx, byte [esi - 1]
lea esi, [esi + 4]
xor cl, byte [edx]
lea eax, [eax + 4]
mov byte [eax - 6], cl
movzx ecx, byte [esi - 4]
xor cl, byte [edx]
mov byte [eax - 5], cl
movzx ecx, byte [ebx + eax - 4]
xor cl, byte [edx]
mov byte [eax - 4], cl
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx + eax - 4]
xor cl, byte [edx]
mov byte [eax - 3], cl
sub edi, 1
jne 0x4d19a0
pop edi
pop esi
pop ebx
mov eax, 0x159
pop ebp
ret 4

Function at 0x4d1a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x4d1a5e
push ebx
push esi
mov ebx, 0x63e5d8
mov byte [edx], 0xbd
push edi
mov esi, 0x63e5da
lea eax, [edx + 3]
sub ebx, edx
mov edi, 0x15
movzx ecx, byte [esi - 1]
lea esi, [esi + 3]
xor cl, byte [edx]
lea eax, [eax + 3]
mov byte [eax - 5], cl
movzx ecx, byte [edx]
xor cl, byte [esi - 3]
mov byte [eax - 4], cl
movzx ecx, byte [ebx + eax - 3]
xor cl, byte [edx]
mov byte [eax - 3], cl
sub edi, 1
jne 0x4d1a34
pop edi
pop esi
pop ebx
mov eax, 0x40
pop ebp
ret 4
Function at 0x4d1e70
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6026f8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x6c2d9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
push 0x63e788
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__struct__Mbstatet_.0
call fcn.00439b60
lea eax, [ebp - 0x3c]
push eax
call fcn.0055f4ac
add esp, 4
lea ecx, [ebp - 0x70]
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
call fcn.00439c20
mov dword [esi], vtable.std::codecvt_utf8_wchar_t__1114111__0_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4d6420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60336e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6c2d9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov byte [edi + 0x18], 0
lea esi, [edi + 0x40]
mov byte [ebp - 4], 1
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0055d382
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x48]
mov byte [ebp - 4], 2
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0055d382
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x50], eax
mov eax, edi
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4dc0d8
Capabilities:
Reference sql statements

Disassembly:
push 0x28
mov eax, 0x6002e8
call fcn.0055e666
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
lea eax, [edi + 0x30]
push eax
lea esi, [edi + 0x18]
push esi
call fcn.004dccf8
add esp, 0xc
test al, al
jne 0x4dc118
push 0xa
pop esi
jmp 0x4dc261
lea eax, [ebp - 0x28]
push eax
call fcn.004dcc5e
pop ecx
test al, al
jne 0x4dc14d
lea eax, [ebp - 0x28]
push eax
call fcn.004dcdf2
pop ecx
test al, al
je 0x4dc13c
xor esi, esi
inc esi
jmp 0x4dc261
push esi
call fcn.004dbf40
mov esi, eax
pop ecx
test esi, esi
jne 0x4dc261
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ebx
push dword [ebp + 8]
cmovae eax, dword [ebp - 0x28]
lea esi, [edi + 4]
push esi
push eax
call fcn.00468c93
add esp, 0x10
test eax, eax
je 0x4dc17d
push eax
mov dword [esi], ebx
call fcn.004dbfba
pop ecx
mov esi, eax
jmp 0x4dc261
push 0x7d0
push dword [esi]
call fcn.004678f1
cmp byte [edi + 0x4c], 0
mov esi, ebx
pop ecx
pop ecx
mov dword [edi], ebx
je 0x4dc261
mov eax, dword [edi + 0x50]
mov ecx, ebx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ebx
sub eax, ebx
je 0x4dc1c1
sub eax, 1
je 0x4dc1bc
sub eax, 1
jne 0x4dc1c1
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
push 3
jmp 0x4dc1c3
xor ebx, ebx
inc ebx
jmp 0x4dc1c4
push 2
pop ebx
push str.SELECT_value_FROM_pcd_meta_WHERE_key__schema_version
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x34], ecx
push eax
push edi
call fcn.004dc673
mov esi, eax
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov ecx, eax
test esi, esi
jne 0x4dc21a
push dword [ebp - 0x2c]
call fcn.00586b5f
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
mov dword [esp], str.SELECT_value_FROM_pcd_meta_WHERE_key__schema_compatibility_version
push eax
push edi
call fcn.004dc673
mov ecx, dword [ebp - 0x34]
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4dc217
push dword [ebp - 0x2c]
call fcn.00586b5f
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x30]
cmp ebx, ecx
jge 0x4dc223
push 0xd
pop esi
jmp 0x4dc258
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jg 0x4dc254
push eax
mov ecx, edi
call fcn.004dc276
mov esi, eax
test esi, esi
jne 0x4dc249
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jle 0x4dc22e
jmp 0x4dc25f
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, dword [ebp - 0x2c]
cmove esi, ecx
test esi, esi
je 0x4dc25f
mov ecx, edi
call fcn.004dc0aa
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00438df0
mov eax, esi
call fcn.0055e621
ret 4
Function at 0x4dca33
Capabilities:
Create directory

Disassembly:
push 0x1c
mov eax, 0x603a88
call fcn.0055e666
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push 4
pop edi
push esi
push eax
call fcn.004e1e72
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call fcn.004dcdf2
add esp, 0xc
test al, al
jne 0x4dca7b
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
neg eax
sbb eax, eax
and edi, eax
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00438b50
mov eax, edi
call fcn.0055e621
ret

Function at 0x4dca8e
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x240
mov eax, 0x603ab8
call fcn.0055e666
mov esi, dword [ebp + 8]
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x21c], 7
mov bl, cl
mov dword [ebp - 0x220], ecx
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x24c]
mov dword [ebp - 4], ecx
push eax
push ecx
push ecx
push 0x2b
push ecx
mov dword [ebp - 0x24c], ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
lea eax, [ebp - 0x218]
push eax
js 0x4dcb33
push dword [ebp - 0x24c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4dcb23
cmp word [ebp - 0x218], 0
jne 0x4dcb01
xor eax, eax
jmp 0x4dcb0e
lea eax, [ebp - 0x218]
push eax
call fcn.0058a0c5
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00438be0
mov bl, 1
push dword [ebp - 0x24c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor edi, edi
jmp 0x4dcb73
xor edi, edi
push edi
push edi
push 0x2b
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4dcb73
cmp word [ebp - 0x218], di
jne 0x4dcb51
mov eax, edi
jmp 0x4dcb5e
lea eax, [ebp - 0x218]
push eax
call fcn.0058a0c5
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00438be0
mov bl, 1
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x4dcbe9
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
cmp word [eax + ecx*2 - 2], 0x5c
jne 0x4dcba9
lea eax, [ecx - 1]
push edi
push eax
lea ecx, [ebp - 0x230]
call fcn.004dd026
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.004e1f25
pop ecx
pop ecx
push eax
mov ecx, esi
call fcn.004dc9e2
push edi
push 1
lea ecx, [ebp - 0x248]
call fcn.00438df0
mov edi, str.Adobe
push edi
call fcn.0058dc70
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0043f550
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.00438b50
mov al, bl
call fcn.0055e621
ret
Function at 0x4dcc00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6c2d9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004e1e72
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
pop ecx
cmovae eax, dword [ebp - 0x1c]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4dcc3f
test al, 0x10
jbe 0x4dcc3f
mov bl, 1
jmp 0x4dcc41
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00438b50
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0055d371
mov esp, ebp
pop ebp
ret

Function at 0x4dcdf2
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6c2d9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004e1e72
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
pop ecx
cmovae eax, dword [ebp - 0x1c]
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0
push 1
lea ecx, [ebp - 0x1c]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
call fcn.00438b50
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0055d371
mov esp, ebp
pop ebp
ret
Function at 0x4e1610
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
pop ebp
ret

Function at 0x4e2de0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.0055d950
mov eax, dword [0x6c2d9c]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x4e2e7f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4e2e7f
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0x118]
lea eax, [esp + 0x14]
push 0x100
push eax
call fcn.00439950
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00580f23
add esp, 0x1c
or ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
lea ecx, [esp + 4]
push 0
push ecx
test eax, eax
mov ecx, 0x100
cmovs eax, ecx
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0055d371
add esp, 0x108
ret
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0x118]
lea eax, [esp + 0x14]
push 0xff
push eax
call fcn.00439950
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00580f23
add esp, 0x1c
mov byte [esp + 0x107], 0
call fcn.004e2ca0
test eax, eax
jle 0x4e2f13
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x4e2f27
push 0
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0055d371
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0055d371
add esp, 0x108
ret

Function at 0x4eb570
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
pop ebp
ret
Function at 0x5179f0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push 0xc
mov esi, ecx
call fcn.0055d382
add esp, 4
mov dword [eax], esi
mov edx, dword [esi + 4]
push 0
push 4
push eax
push 0x508750
push 0
mov dword [eax + 4], edx
mov edx, dword [esi + 8]
push 0
mov dword [eax + 8], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
jmp dword [sym.imp.KERNEL32.dll_SwitchToThread]

Function at 0x53a040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
test edx, edx
je 0x53a0b7
push ebx
push esi
push edi
mov esi, 0x666e1a
mov byte [edx], 0xda
mov edi, 0x666e18
mov dword [ebp + 8], 0x33
mov ebx, 0x666e19
lea eax, [edx + 3]
mov ecx, esi
sub edi, edx
sub ebx, edx
sub ecx, edx
mov dword [ebp - 4], ecx
movzx ecx, byte [esi - 1]
lea esi, [esi + 5]
xor cl, byte [edx]
lea eax, [eax + 5]
mov byte [eax - 7], cl
movzx ecx, byte [esi - 5]
xor cl, byte [edx]
mov byte [eax - 6], cl
movzx ecx, byte [edi + eax - 5]
xor cl, byte [edx]
mov byte [eax - 5], cl
movzx ecx, byte [ebx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 4], cl
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
sub dword [ebp + 8], 1
mov byte [eax - 3], cl
jne 0x53a075
pop edi
pop esi
pop ebx
mov eax, 0x100
mov esp, ebp
pop ebp
ret
Function at 0x54a9e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x605be0
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x6c2d9c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x12c], ecx
xor bl, bl
mov dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
je 0x54abd1
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call fcn.00587fa6
add esp, 8
test eax, eax
jne 0x54aa48
mov bl, 1
jmp 0x54abd1
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp dword [ebp + 0x1c], 8
lea edi, [ebp + 8]
mov esi, dword [ebp + 0x18]
cmovae edi, dword [ebp + 8]
mov byte [ebp - 4], 1
test esi, esi
je 0x54abc9
push 0x100
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.00572a10
add esp, 0xc
mov ecx, 0x6690e8
mov edx, 0x100
movzx eax, word [ecx]
cmp ax, dx
jae 0x54aae0
movzx eax, al
add ecx, 2
mov byte [ebp + eax - 0x128], 1
cmp ecx, 0x6690ec
jne 0x54aa95
or ecx, 0xffffffff
lea eax, [esi - 1]
cmp eax, ecx
cmovb ecx, eax
lea ecx, [edi + ecx*2]
movzx eax, word [ecx]
cmp ax, dx
jae 0x54aad3
cmp byte [ebp + eax - 0x128], 0
jne 0x54ab1b
cmp ecx, edi
je 0x54abc9
sub ecx, 2
jmp 0x54aac1
or ecx, 0xffffffff
lea eax, [esi - 1]
cmp eax, ecx
cmovb ecx, eax
lea ecx, [edi + ecx*2]
nop
movzx esi, word [ecx]
mov edx, 2
mov eax, 0x6690e8
nop dword [eax]
cmp word [eax], si
je 0x54ab1b
add eax, 2
sub edx, 1
jne 0x54ab00
cmp ecx, edi
je 0x54ab16
sub ecx, 2
jmp 0x54aaf0
or ecx, 0xffffffff
jmp 0x54ab1f
sub ecx, edi
sar ecx, 1
cmp ecx, 0xffffffff
je 0x54abc9
push ecx
push 0
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp + 8]
call fcn.00443db0
push eax
lea ecx, [ebp - 0x28]
call fcn.004408d0
lea ecx, [ebp - 0x148]
call fcn.004389a0
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00438a60
mov esi, dword [ebp - 0x12c]
mov ecx, esi
call fcn.0054a9e0
cmp al, 1
jne 0x54abc9
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call fcn.00589c9c
add esp, 4
test eax, eax
jne 0x54abae
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push str.Created__S
push 0
push 4
push str.AdobeGCUpdaterCFU
push dword [esi + 4]
call fcn.004ae670
add esp, 0x18
mov bl, 1
jmp 0x54abc9
push str.Failed_to_Create__S
push 0
push 4
push str.AdobeGCUpdaterCFU
push dword [esi + 4]
call fcn.004ae670
add esp, 0x14
xor bl, bl
lea ecx, [ebp - 0x28]
call fcn.004389a0
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x54ac07
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x54abfd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x54ac27
push edx
push ecx
call fcn.0055d3b2
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055d371
mov esp, ebp
pop ebp
ret 0x18
call fcn.0057bc5b
int3
Function at 0x556330
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6c2d9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x5563be
test esi, esi
je 0x5563be
push ebx
lea ecx, [ebp - 0x14]
xor bl, bl
push ecx
push 1
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5563a3
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5563a3
cmp dword [ebp - 0x10], 0
mov eax, 1
movzx ebx, bl
cmove ebx, eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d371
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0055d371
mov esp, ebp
pop ebp
ret
Function at 0x55cc40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x6c2d9c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 4
call fcn.0055d382
mov esi, eax
add esp, 4
test esi, esi
je 0x55cc6c
mov dword [esi], 0
jmp 0x55cc6e
xor esi, esi
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x41c], 0
push 0
push eax
mov dword [ebp - 0x418], 0xf
mov byte [ebp - 0x42c], 0
call fcn.00572a10
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00572a10
add esp, 0x18
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push 0x2e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x55cce6
push 0x104
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00587ca9
add esp, 0xc
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x55ccf0
sub ecx, edx
lea eax, [ebp - 0x20c]
push ecx
push eax
lea ecx, [ebp - 0x42c]
call fcn.00450ff0
push 0x62dab8
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00461410
push 0x62ed94
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00461410
push 0x62dab8
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00461410
push 0x62ed78
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00461410
lea ecx, [ebp - 0x108]
add esp, 0x30
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x55cd70
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
lea ecx, [ebp - 0x42c]
call fcn.00450ff0
cmp dword [ebp - 0x418], 0x10
lea eax, [ebp - 0x42c]
push esi
cmovae eax, dword [ebp - 0x42c]
push eax
call fcn.00468953
add esp, 8
test eax, eax
je 0x55cdbb
push 4
push esi
call fcn.0055d3b2
add esp, 8
xor esi, esi
mov edx, dword [ebp - 0x418]
cmp edx, 0x10
jb 0x55cdf1
mov ecx, dword [ebp - 0x42c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x55cde7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x55ce02
push edx
push ecx
call fcn.0055d3b2
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0055d371
mov esp, ebp
pop ebp
ret
call fcn.0057bc5b
int3