joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4207f0
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x96c
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x260], 0x44
push 0
push eax
call fcn.005b3770
movups xmm0, xmmword [str.explorer.exe]
mov ax, word [0x6232e0]
push 0x1ee
mov word [ebp - 0x1f8], ax
lea eax, [ebp - 0x1f6]
movups xmmword [ebp - 0x210], xmm0
push 0
movq xmm0, qword [0x6232d8]
push eax
movq qword [ebp - 0x200], xmm0
call fcn.005b3770
add esp, 0x18
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x260]
push eax
push 0
push 0
push 0x44
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x4209d0
mov eax, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov dword [ebp - 0x760], eax
mov eax, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov dword [ebp - 0x758], eax
mov eax, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
mov dword [ebp - 0x754], eax
mov eax, dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 0
mov dword [ebp - 0x750], eax
lea eax, [ebp - 0x764]
push 0
push eax
push dword [ebp - 0x540]
mov dword [ebp - 0x75c], ebx
call esi
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
push 0x104
lea eax, [ebp - 0x74c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0x530]
mov ecx, 0x80
push eax
push dword [ebp - 0x53c]
mov esi, 0x420780
lea edi, [ebp - 0x964]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x530], 0x10003
call dword [sym.imp.KERNEL32.DLL_GetThreadContext]
mov esi, dword [ebp - 0x46c]
add esi, 0xfffffbdc
and esi, 0xffffffe0
mov dword [ebp - 0x968], esi
lea eax, [esi - 4]
mov dword [ebp - 0x46c], eax
lea eax, [esi + 4]
mov dword [ebp - 0x478], eax
lea eax, [ebp - 0x214]
push eax
push 0x40
push 0x424
push esi
push dword [ebp - 0x540]
call dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
push 0
push 0x424
lea eax, [ebp - 0x968]
push eax
push esi
push dword [ebp - 0x540]
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
push 0x424
push esi
push dword [ebp - 0x540]
call dword [sym.imp.KERNEL32.DLL_FlushInstructionCache]
lea eax, [ebp - 0x530]
push eax
push dword [ebp - 0x53c]
call dword [sym.imp.KERNEL32.DLL_SetThreadContext]
push dword [ebp - 0x53c]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
push dword [ebp - 0x53c]
call ebx
push dword [ebp - 0x540]
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00599c70
mov esp, ebp
pop ebp
ret
Function at 0x42a0f0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x26
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42a19e
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
lea eax, [ebp - 0x20c]
push 0x62325c
push eax
call fcn.005c94f3
add esp, 0xc
test eax, eax
je 0x42a19e
cmp word [ebp - 0x20c], 0
jne 0x42a158
xor ecx, ecx
jmp 0x42a170
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42a161
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00407060
push 1
push 0x62325c
mov ecx, esi
call fcn.004097c0
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.00599c70
mov esp, ebp
pop ebp
ret
Function at 0x42a300
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e60b0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
cmp dword [edi + 0x10], eax
sete al
test al, al
je 0x42a357
mov bl, 1
jmp 0x42a4e5
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.00429f20
test al, al
jne 0x42a37a
push 1
push str.7430
mov ecx, esi
call fcn.00407060
xor bl, bl
jmp 0x42a4e5
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
cmp eax, 3
je 0x42a3e2
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x42a3a4
mov eax, dword [esi]
jmp 0x42a3a6
mov eax, esi
xor ecx, ecx
mov word [eax], cx
cmp dword [edi + 0x14], 8
jb 0x42a3b3
mov edi, dword [edi]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
mov ecx, esi
test eax, eax
je 0x42a3d1
push 0x624128
call fcn.00407010
xor bl, bl
jmp 0x42a4e5
push 0x62412c
call fcn.00407010
xor bl, bl
jmp 0x42a4e5
xor eax, eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 2
cmp dword [edi + 0x14], 8
jb 0x42a412
mov edx, dword [edi]
jmp 0x42a414
mov edx, edi
lea eax, [ebp - 0x58]
push eax
call fcn.0042a020
add esp, 4
test eax, eax
js 0x42a46d
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.00429f20
test al, al
je 0x42a46d
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call ebx
cmp eax, 3
je 0x42a46d
mov ecx, esi
call fcn.004090b0
push 0x624128
mov ecx, esi
call fcn.00407010
lea ecx, [ebp - 0x40]
call fcn.00406e20
lea ecx, [ebp - 0x58]
call fcn.00406e20
xor bl, bl
jmp 0x42a4e5
lea ecx, [ebp - 0x40]
call fcn.00406e20
lea ecx, [ebp - 0x58]
call fcn.00406e20
xor eax, eax
mov dword [ebp - 0x5c], 7
mov dword [ebp - 0x60], 0
mov word [ebp - 0x70], ax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 3
call fcn.0042a0f0
test al, al
jne 0x42a4a8
push str.7430
jmp 0x42a4d4
mov edx, edi
lea ecx, [ebp - 0x70]
call fcn.0040df10
test al, al
jne 0x42a4c8
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.0040df10
test al, al
jne 0x42a4c8
mov bl, 1
jmp 0x42a4dd
mov ecx, esi
call fcn.004090b0
push 0x62290c
mov ecx, esi
call fcn.00407010
xor bl, bl
lea ecx, [ebp - 0x70]
call fcn.00406e20
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x42a4fa
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00407b40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
Function at 0x430760
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e6af8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x43088e
cmp byte [ebx + 0x3d], 0
je 0x43088e
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x4307b9
xor al, al
jmp 0x430890
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00408350
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x43081f
sub eax, 1
je 0x430823
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x430876
xor bl, bl
jmp 0x430878
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x430858
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.005ca8fd
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x43081b
cmp byte [ebx + 0x3d], 0
je 0x430876
test esi, esi
jne 0x4307e1
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00408420
jmp 0x4307de
mov bl, 1
cmp ecx, 0x10
jb 0x43088a
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00407440
mov al, bl
jmp 0x430890
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret

Function at 0x435870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push edi
cmp dword [ebx + 0x50], 0
je 0x435883
call fcn.00435940
mov eax, fcn.0042c970
test eax, eax
je 0x4358af
push str.Starting_thread_for_Extraction_Progress.
push 0x622628
push 0x622628
push str.AppsPanelInterface
push str.WAMB
push 0x1e
call fcn.0042c970
add esp, 0x18
push 4
mov byte [ebx + 0x54], 1
call fcn.00599c81
mov edi, eax
add esp, 4
mov eax, 0x435a50
mov dword [ebp - 4], edi
mov dword [edi], 0
mov dword [edi], 0
mov dword [ebx + 0x50], edi
test eax, eax
je 0x43592c
push esi
push 8
call fcn.00599c81
add esp, 4
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 4], esi
push 0
push 0
push esi
push 0x4ba6b0
push 0
movq qword [esi], xmm0
push 0
mov dword [esi], 0x435a50
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x435929
push 8
push esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0059a537
add esp, 8
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], eax
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451ff0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4076
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x67d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00599c81
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.005969c7
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x459610
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e98c8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x67d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
sete al
test al, al
jne 0x459697
push str.cci.countryCode
lea ecx, [ebp - 0x30]
call fcn.00406e60
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0xd4]
call fcn.004310b0
mov ecx, dword [ebp - 0x18]
add ecx, 0x28
cmp ecx, esi
je 0x459682
push 0xffffffffffffffff
push 0
push esi
call fcn.00407550
mov eax, dword [ebp - 0x1c]
cmp eax, 8
jb 0x459697
inc eax
lea ecx, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
call fcn.00407b40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x45fd30
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
push 0
push 1
push 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push str.VIKeyContainer
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x45fd7f
push 8
push 1
push eax
push str.VIKeyContainer
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x45fdc2
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push 0
test eax, eax
je 0x45fdb9
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x45fdd6
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret 0x10
push 0
push ebx
push edi
push 2
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x45fe17
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45fe25
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
test eax, eax
je 0x45fe35
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop ebx
call fcn.00599c70
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4683b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ed8e8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x68cae4]
cmp eax, dword [ecx + 4]
jle 0x46843c
push 0x68cae4
call fcn.0059a283
add esp, 4
cmp dword [0x68cae4], 0xffffffff
jne 0x46843c
xor eax, eax
mov dword [0x68cadc], 7
push 0x603bc0
mov dword [0x68cad8], 0
mov word [0x68cac8], ax
call fcn.00599f0a
add esp, 4
push 0x68cae4
call fcn.0059a244
add esp, 4
cmp dword [0x68cadc], 8
mov eax, 0x68cac8
mov dword [0x68cad8], 0
cmovae eax, dword [0x68cac8]
xor ecx, ecx
mov word [eax], cx
cmp dword [0x68cad8], ecx
sete al
test al, al
je 0x46857b
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
call fcn.0049c0e0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4684ac
push ecx
lea ecx, [ebp - 0x28]
call fcn.0049ccd0
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.0049c0e0
test al, al
je 0x4684c5
push str.OOBE
lea ecx, [ebp - 0x28]
call fcn.004096d0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4684e7
push ecx
lea ecx, [ebp - 0x28]
call fcn.0049ccd0
add esp, 4
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28]
mov ecx, 0x68cac8
push eax
call fcn.00407550
cmp esi, 1
jne 0x468537
push str.temp_lbs_wid
lea ecx, [ebp - 0x40]
call fcn.00406e60
push ecx
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 1
mov ecx, 0x68cac8
call fcn.0049c840
mov eax, dword [ebp - 0x2c]
add esp, 4
cmp eax, 8
jb 0x468566
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00407b40
jmp 0x468566
cmp esi, 2
jne 0x468566
push str.temp_ins_lbs_wid
lea ecx, [ebp - 0x40]
call fcn.00406e60
push ecx
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 2
mov ecx, 0x68cac8
call fcn.0049c840
add esp, 4
lea ecx, [ebp - 0x40]
call fcn.00406e20
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x46857b
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00407b40
mov eax, 0x68cac8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
Function at 0x477590
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ef7c0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x67d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
movss xmm0, dword [0x654784]
movss dword [ebp - 0x18], xmm0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x477606
push 0x58
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push ebx
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
movd xmm0, esi
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x654870]
movss dword [ebp - 0x18], xmm0
mov edx, dword [edi + 0x28]
test edx, edx
je 0x477679
xor ecx, ecx
mov dword [ebp - 0x10], ecx
test edx, edx
je 0x477631
mov eax, dword [edx]
lea ecx, [ebp - 0x10]
push ecx
push 0x63e674
push edx
call dword [eax]
mov ecx, dword [ebp - 0x10]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x10], ecx
movss xmm0, dword [ebp - 0x18]
mov dword [ebp - 4], 0
mulss xmm0, dword [0x654894]
mov edx, dword [ecx]
push 0
push 0
cvttss2si eax, xmm0
movss xmm0, dword [ebp - 0x18]
mulss xmm0, dword [0x65487c]
push eax
cvttss2si eax, xmm0
push eax
call dword [edx + 0x30]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x477679
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [edi + 0x2c]
test edx, edx
je 0x4776ea
xor ecx, ecx
mov dword [ebp - 0x14], ecx
test edx, edx
je 0x4776a4
mov eax, dword [edx]
lea ecx, [ebp - 0x14]
push ecx
push 0x63e674
push edx
call dword [eax]
mov ecx, dword [ebp - 0x14]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x14], ecx
movss xmm1, dword [ebp - 0x18]
mov dword [ebp - 4], 1
movaps xmm0, xmm1
mulss xmm0, dword [0x654894]
mov edx, dword [ecx]
mulss xmm1, dword [0x65487c]
push 0
cvttss2si eax, xmm0
push 0
push eax
cvttss2si eax, xmm1
push eax
call dword [edx + 0x30]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4776ea
mov edx, dword [eax]
push eax
call dword [edx + 8]
lea ecx, [edi + 0x2c]
call fcn.004a6160
lea ecx, [edi + 0x28]
call fcn.004a60d0
cmp dword [edi + 0x24], 2
jne 0x477725
mov eax, dword [edi + 0x68]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x477712
push 5
push eax
call esi
mov eax, dword [edi + 0x6c]
test eax, eax
je 0x47771e
push 0
push eax
call esi
mov dword [edi + 0x24], 0
mov dword [edi + 0x24], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478630
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx + 0x21], 0
je 0x4786f4
call fcn.00470b00
movss xmm0, dword [0x654784]
movss dword [ebp - 4], xmm0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x478698
push 0x58
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push edi
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
movd xmm1, esi
cvtdq2ps xmm1, xmm1
divss xmm1, dword [0x654870]
movss dword [ebp - 4], xmm1
jmp 0x4786a0
movss xmm1, dword [0x654784]
movaps xmm0, xmm1
mulss xmm0, dword [0x654878]
push 0
push ecx
lea ecx, [ebx + 0x28]
cvttss2si esi, xmm0
movaps xmm0, xmm1
mulss xmm0, dword [0x65487c]
push esi
cvttss2si edi, xmm0
push edi
call fcn.004a6280
movss xmm0, dword [ebp - 4]
mulss xmm0, dword [0x654890]
push esi
push ecx
mov ecx, ebx
cvttss2si eax, xmm0
add ecx, 0x2c
push eax
push edi
call fcn.004a6280
lea ecx, [ebx + 0x28]
call fcn.004a60d0
jmp 0x4786fc
lea ecx, [ebx + 0x28]
call fcn.004a6160
lea ecx, [ebx + 0x2c]
call fcn.004a60d0
cmp dword [ebx + 0x24], 2
jne 0x47872f
mov eax, dword [ebx + 0x68]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x47871c
push 5
push eax
call esi
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x478728
push 0
push eax
call esi
mov dword [ebx + 0x24], 0
pop edi
pop esi
mov dword [ebx + 0x24], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4844a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f1516
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
push ecx
lea edx, [ebp - 0x40]
mov dword [ebp - 4], eax
lea ecx, [eax + 0x1c]
call fcn.0049bbd0
add esp, 4
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
mov word [ebp - 0x28], ax
push 0x1d
push str.AdobePIIcom.adobe.pii.prefs
call fcn.00407060
push ecx
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.0049c840
mov byte [ebp - 4], 0
add esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x48453f
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407b40
xor bl, bl
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48465a
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
setne al
test al, al
je 0x484589
sub esp, 0xc
lea ecx, [ebp - 0x40]
call fcn.004b9950
add esp, 0xc
jmp 0x48465a
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x1c]
call fcn.004a8220
test al, al
je 0x48462b
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
push str._prefs_property__keypiiNoticeShown_
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 4
call fcn.00406e60
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004ac650
lea ecx, [ebp - 0x70]
call fcn.00406e20
cmp dword [ebp - 0x44], 0x10
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
push 0x637960
call fcn.005c8f06
add esp, 8
movzx ebx, bl
test eax, eax
mov ecx, 1
cmove ebx, ecx
lea ecx, [ebp - 0x58]
call fcn.00406ec0
mov byte [ebp - 4], 6
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x484644
mov ecx, esi
xor esi, esi
test ecx, ecx
je 0x484644
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp byte [ebp - 0x14], 0
je 0x484650
call dword [sym.imp.ole32.dll_CoUninitialize]
test esi, esi
je 0x48465a
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x48466f
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.00407b40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret