joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100079e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x98
mov edi, dword [eax + 0x78]
cmp word [eax + 0x54], 0
movdqu xmm0, xmmword [0x10023b90]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 1
movups xmmword [esp + 0x48], xmm0
je 0x10007b96
mov ebx, dword [edi]
test ebx, ebx
je 0x10007b96
test edx, edx
js 0x10007ba0
add dword [esp + 0x30], edx
mov dword [esp], ebx
call sym._wined3d_vertex_declaration_get_parent
mov edi, dword [esp + 0x34]
movzx edx, word [edi + 0x54]
mov edi, edx
and edi, dword [eax + 0x10]
jne 0x10007a6e
jmp 0x10007b96
mov edx, dword [esp + 0x40]
cmp dword [esp + 0x44], edx
je 0x10007b96
bsf eax, edi
mov ecx, 0xffffffff
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x40], edi
cmove eax, ecx
mov esi, 1
mov ecx, eax
add eax, 1
lea eax, [eax + eax*4]
shl esi, cl
lea edx, [edx + eax*4]
mov dword [esp + 0x44], esi
xor edi, esi
mov esi, dword [edx - 0x10]
mov ebx, dword [edx - 8]
mov dword [esp + 0x38], edx
mov dword [esp], esi
call sym._wined3d_buffer_get_parent
mov dword [esp], esi
mov dword [esp + 0x3c], eax
call sym._wined3d_buffer_get_resource
mov esi, eax
lea eax, [esp + 0x6c]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._wined3d_resource_get_desc
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
imul eax, ebx
add eax, dword [edx - 0xc]
imul ebx, dword [ebp + 8]
mov dword [esp + 0x48], eax
add ebx, eax
mov eax, dword [esp + 0x94]
cmp ebx, eax
cmova ebx, eax
mov eax, dword [ecx + 0x10]
mov dword [esp], eax
mov dword [esp + 0x50], ebx
call sym._wined3d_buffer_get_resource
lea ecx, [esp + 0x48]
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x20], ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sym._wined3d_device_context_copy_sub_resource_region
test eax, eax
jns 0x10007a60
test byte [0x1001c03c], 2
je 0x10007a60
mov dword [esp + 0xc], str.Failed_to_update_buffer._n
mov dword [esp + 8], str.d3d9_device_upload_sysmem_vertex_buffers
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
mov edx, dword [esp + 0x40]
cmp dword [esp + 0x44], edx
jne 0x10007a6e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edx
neg eax
cmp eax, ecx
jbe 0x10007a38
test byte [0x1001c03c], 1
je 0x10007a3c
mov dword [esp + 0xc], str.System_memory_vertex_data_offset_is_negative._n
mov dword [esp + 8], str.d3d9_device_upload_sysmem_vertex_buffers
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_2
jmp 0x10007a3c
Function at 0x1001b160
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x1001b1b8
cmp byte [esi + ebx - 1], 0xa
je 0x1001b18c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x1002e0c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x438d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2c000]
push edi
or ebp, 0xffffffff
jmp 0x438d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x438d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x438d48
mov eax, 1
add ebx, ebx
jne 0x438d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x438d60
jne 0x438d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x438d60
xor ecx, ecx
sub eax, 3
jb 0x438d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x438e02
mov ebp, eax
add ebx, ebx
jne 0x438d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x438da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x438dcc
inc ecx
add ebx, ebx
jne 0x438db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x438dad
jne 0x438dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x438dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x438dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x438ddd
jmp 0x438d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x438dec
add edi, ecx
jmp 0x438d4e
pop esi
mov edi, esi
mov ecx, 0x572
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x438e0a
cmp byte [edi], 0xc
jne 0x438e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x438e0f
lea edi, [esi + 0x36000]
mov eax, dword [edi]
or eax, eax
je 0x438e7e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x38e5c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x38efc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x438e3c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x38f00]
or eax, eax
je 0x438e78
mov dword [ebx], eax
add ebx, 4
jmp 0x438e59
call dword [esi + 0x38f04]
popal
jmp 0x40ef82

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x30018427
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov eax, dword [0x300033f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x474], eax
push 0x105
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor esi, esi
cmp eax, esi
jne 0x30018463
xor eax, eax
jmp 0x30018589
add eax, eax
lea ecx, [ebp + eax - 0x260]
cmp word [ecx], 0x5c
je 0x3001847f
mov word [ecx], 0x5c
mov word [ebp + eax - 0x25e], si
push ebx
push edi
push 0x106
lea eax, [ebp - 0x260]
push eax
mov edi, 0x30003538
push edi
call fcn.300183fc
push 8
push esi
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
jne 0x300184bf
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, esi
je 0x30018571
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x30003524
push ebx
call edi
push 0x30003504
push ebx
mov dword [ebp - 0x478], eax
call edi
cmp eax, esi
mov dword [ebp - 0x470], eax
je 0x30018571
cmp dword [ebp - 0x474], esi
mov ebx, 0x300034f0
mov edi, 0x300034a0
je 0x30018549
cmp dword [ebp - 0x478], esi
je 0x30018571
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x474]
call dword [ebp - 0x478]
cmp eax, esi
jne 0x30018542
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x468]
push eax
push esi
push esi
lea eax, [ebp - 0x54]
push eax
push esi
push ebx
push edi
mov dword [ebp - 0x46c], 0x104
call dword [ebp - 0x470]
cmp eax, esi
je 0x30018575
cmp eax, 0x642
je 0x30018575
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x468]
push eax
push esi
push esi
push esi
push esi
push ebx
push edi
mov dword [ebp - 0x46c], 0x104
call dword [ebp - 0x470]
test eax, eax
je 0x30018575
xor eax, eax
jmp 0x30018587
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x300200d4], eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.30017978
leave
ret 4

Function at 0x30018626
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x300033f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
xor ebx, ebx
push 0x300035bc
mov dword [ebp - 0x318], ebx
mov byte [ebp - 0x108], bl
call fcn.300183d3
push esi
lea eax, [ebp - 0x108]
push eax
push edi
call fcn.300183d3
lea eax, [ebp - 0x318]
push eax
push 0x20019
push ebx
push 0x30003568
push 0x80000002
mov dword [ebp - 0x31c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x314]
push eax
push ebx
push ebx
push 0x30003548
push dword [ebp - 0x318]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x31c]
pop edi
shr eax, 1
cmp dword [ebp - 0x318], ebx
pop esi
mov word [ebp + eax*2 - 0x314], bx
pop ebx
je 0x300186e1
push dword [ebp - 0x318]
invalid
invalid
pushal
Function at 0x401938
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x438400
call fcn.00402170
push 1
call fcn.00401c06
pop ecx
test al, al
jne 0x4017ef
push 7
call fcn.00401f1c
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00401bd1
mov byte [ebp - 0x24], al
mov eax, dword [0x43ab84]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4017e8
test eax, eax
jne 0x401859
mov dword [0x43ab84], ecx
push 0x413164
push 0x41314c
call fcn.004066a3
pop ecx
pop ecx
test eax, eax
je 0x40183c
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x401932
push 0x413148
push 0x413140
call fcn.00406647
pop ecx
pop ecx
mov dword [0x43ab84], 2
jmp 0x40185e
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00401d73
pop ecx
call fcn.00401f10
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x40188e
push esi
call fcn.00401ce9
pop ecx
test al, al
je 0x40188e
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0040215d
call esi
call fcn.00401f16
mov esi, eax
cmp dword [esi], edi
je 0x4018ac
push esi
call fcn.00401ce9
pop ecx
test al, al
je 0x4018ac
push dword [esi]
call fcn.0040696f
pop ecx
call fcn.00402038
movzx eax, ax
push eax
call fcn.004065fb
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0040206e
test al, al
jne 0x4018d7
push esi
call fcn.004069a7
test bl, bl
jne 0x4018e0
call fcn.0040694a
push edi
push 1
call fcn.00401d90
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x401932
call fcn.004021b6
ret
call fcn.00401e57
jmp 0x4017d0

Function at 0x403e88
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x4132f8
push str.FlsAlloc
push 0
call fcn.00403e08
mov esi, eax
add esp, 0x10
test esi, esi
je 0x403eba
push dword [ebp + 8]
mov ecx, esi
call fcn.0040215d
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x403efc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x41331c
push str.FlsGetValue
push 2
call fcn.00403e08
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x403f2d
mov ecx, esi
call fcn.0040215d
call esi
jmp 0x403f33
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x403f36
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x413330
push str.FlsSetValue
push 3
call fcn.00403e08
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x403f6a
mov ecx, esi
call fcn.0040215d
call esi
jmp 0x403f70
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401d70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.00403210
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret

Function at 0x402470
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jne 0x402483
xor al, al
jmp 0x4024b5
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402230
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x4024b3
xor eax, eax
cmp dword [ebp - 4], 0
setne al
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov al, 1
jmp 0x4024b5
xor al, al
mov esp, ebp
pop ebp
ret 8

Function at 0x414831
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp ecx, dword [0x44eca0]
jne 0x41483b
repz ret
jmp 0x41a6db
inc dword [eax]
je 0x41b49e
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.0041927c
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x41a718
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x41a761
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x41a70b
call fcn.0041930b
stosb byte es:[edi], al
and bl, al
adc eax, dword [eax - 0x72b5b]
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0041930b
into
inc ebx
inc ecx
or byte [ebp - 0x72b7b], 0xff
push eax
call fcn.0041931b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004192d0
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.0041930b
outsd dx, dword [esi]
xor esp, eax
jae 0x41a7b1
test esi, ebx
clc
invalid
test eax, ebp
clc
invalid
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41a28e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dh, al
test dword [ecx + 0x11fffffc], esp
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0041931b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004192d0
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0041930b
or eax, esi
iretd

Function at 0x424cb0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041ba9f
and dword [ebp - 4], 0
cmp dword [0x452c28], 0
mov ebx, eax
jne 0x424d61
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x424e12
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x424e12
push eax
call fcn.0041ba2d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x452c28], eax
call esi
push eax
call fcn.0041ba2d
mov dword [esp], 0x43fb18
push edi
mov dword [0x452c2c], eax
call esi
push eax
call fcn.0041ba2d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x452c30], eax
call esi
push eax
call fcn.0041ba2d
pop ecx
mov dword [0x452c38], eax
test eax, eax
je 0x424d61
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041ba2d
pop ecx
mov dword [0x452c34], eax
mov eax, dword [0x452c34]
cmp eax, ebx
je 0x424db9
cmp dword [0x452c38], ebx
je 0x424db9
push eax
call fcn.0041baa8
push dword [0x452c38]
mov esi, eax
call fcn.0041baa8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x424db9
test edi, edi
je 0x424db9
call esi
test eax, eax
je 0x424db0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x424db0
test byte [ebp - 0xc], 1
jne 0x424db9
or dword [ebp + 0x10], 0x200000
jmp 0x424df2
mov eax, dword [0x452c2c]
cmp eax, ebx
je 0x424df2
push eax
call fcn.0041baa8
pop ecx
test eax, eax
je 0x424df2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x424df2
mov eax, dword [0x452c30]
cmp eax, ebx
je 0x424df2
push eax
call fcn.0041baa8
pop ecx
test eax, eax
je 0x424df2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x452c28]
call fcn.0041baa8
pop ecx
test eax, eax
je 0x424e12
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x424e14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b790
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439b5b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x44eca0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call fcn.00402690
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x10]
call fcn.004031d0
push eax
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00403240
cmp dword [ebp - 0x14], 0
jne 0x42b80e
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.004027b0
push str.AdobeARM1.0AdobeARM.exe
mov ecx, dword [ebp + 8]
call fcn.00402810
jmp 0x42b858
push str.SHGetFolderPath_in_GetARMExePath_failed:
lea ecx, [ebp - 0x18]
call fcn.004026b0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
push 1
call fcn.004381d0
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00407a90
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407a90
mov eax, dword [ebp - 0x1c]
jmp 0x42b871
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407a90
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x42ba40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0x452d54], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x452d5c], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x452d58], edx
mov dword [0x452d6c], 0
push 0
push 0
push 0
push 0x42b990
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x42bba0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x44eca0]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov ecx, 0x20
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea edi, [ebp - 0x90]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], 0
mov dword [ebp - 0x94], 0
cmp dword [ebp - 0x94], 8
jae 0x42bd3d
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x94]
movzx ecx, byte [eax]
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x94]
add edx, 1
mov dword [ebp - 0x94], edx
cmp dword [ebp - 0x94], 8
jae 0x42bc34
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x94]
movzx ecx, byte [eax]
mov dword [ebp - 0xa4], ecx
mov edx, dword [ebp - 0x94]
add edx, 1
mov dword [ebp - 0x94], edx
jmp 0x42bc3e
mov dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0x94], 8
jae 0x42bc76
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x94]
movzx edx, byte [ecx]
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0x94]
add eax, 1
mov dword [ebp - 0x94], eax
jmp 0x42bc80
mov dword [ebp - 0xa8], 0
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0x98]
shr edx, 2
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dx, word [ebp + edx*2 - 0x90]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xa0]
shr ecx, 4
mov edx, dword [ebp - 0x98]
and edx, 3
shl edx, 4
or ecx, edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov cx, word [ebp + ecx*2 - 0x90]
mov word [edx + eax*2], cx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x9c]
shr eax, 6
mov ecx, dword [ebp - 0xa0]
and ecx, 0xf
shl ecx, 2
or eax, ecx
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov ax, word [ebp + eax*2 - 0x90]
mov word [ecx + edx*2], ax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x9c]
and edx, 0x3f
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dx, word [ebp + edx*2 - 0x90]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x42bbda
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, 0x3d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov word [ecx + eax*2], dx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov word [edx + ecx*2], ax
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00414831
mov esp, ebp
pop ebp
ret
Function at 0x42c430
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x44eca0]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov byte [ebp - 5], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0x10
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x42c503
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 0x8003
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x42c503
cmp dword [ebp - 0xc], 0
je 0x42c503
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x42c503
push 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 2
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x42c503
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042c340
add esp, 0x10
movzx ecx, al
test ecx, ecx
je 0x42c503
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.0042bba0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x42c503
mov byte [ebp - 5], 1
cmp dword [ebp - 0xc], 0
je 0x42c513
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x10], 0
je 0x42c525
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, byte [ebp - 5]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00414831
mov esp, ebp
pop ebp
ret