joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1439
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x4d05d6
call fcn.004b814b
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x4b1463
lea eax, [ebp + 8]
push eax
call fcn.00455f70
pop ecx
jmp 0x4b15de
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0x4b1491
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x4b1491
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x4b15de
mov eax, dword [esi + 0x4c]
cmp eax, ebx
je 0x4b15d9
cmp dword [esi + 0x3c], ebx
jne 0x4b14ba
push eax
push edi
call fcn.004b0bfa
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0x4b15de
jmp 0x4b15d9
movzx eax, di
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
call fcn.004445c9
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.004445ef
mov ecx, eax
call fcn.00444aea
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004445ef
mov ecx, eax
call fcn.00444aea
lea edx, [ebp - 0x38]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x4b15ab
cmp eax, 1
jg 0x4b15e6
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004445ef
mov ecx, eax
call fcn.00444aea
mov edi, dword [ebp - 0x38]
sub edi, eax
je 0x4b1550
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004445ef
mov ecx, eax
call fcn.00444aea
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004ba952
add esp, 0x10
cmp edi, eax
jne 0x4b15cd
lea eax, [ebp - 0x30]
mov byte [esi + 0x42], 1
cmp dword [ebp - 0x3c], eax
jne 0x4b1616
test edi, edi
ja 0x4b1576
cmp dword [ebp - 0x18], 0x20
push 0
lea ecx, [ebp - 0x2c]
jae 0x4b15d2
push 8
call fcn.00444644
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004445ef
mov ecx, eax
call fcn.00444aea
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004445ef
mov ecx, eax
call fcn.00444aea
lea edx, [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x40]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [ebp - 0x3c]
push edx
lea edx, [ebp - 0x2e]
push edx
lea edx, [ebp - 0x30]
push edx
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x4b1507
push 0
lea ecx, [ebp - 0x2c]
push 1
call fcn.00404ef5
mov eax, 0xffff
call fcn.004b81ce
ret 4
cmp eax, 3
jne 0x4b15cd
push dword [esi + 0x4c]
push dword [ebp - 0x30]
call fcn.004b0bfa
movzx esi, word [ebp + 8]
pop ecx
pop ecx
test al, al
jne 0x4b1605
mov esi, 0xffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404ef5
mov ax, si
jmp 0x4b15de
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404ef5
mov ax, word [ebp + 8]
jmp 0x4b15de

Function at 0x4b196e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x52472c]
jne 0x4b1978
repz ret
jmp fcn.004bab96
Function at 0x4c6d70
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004b55cc
and dword [ebp - 4], 0
cmp dword [0x527fa4], 0
mov ebx, eax
jne 0x4c6e21
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4c6ed2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4c6ed2
push eax
call fcn.004b555a
mov dword [esp], 0x4ed058
push edi
mov dword [0x527fa4], eax
call esi
push eax
call fcn.004b555a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x527fa8], eax
call esi
push eax
call fcn.004b555a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x527fac], eax
call esi
push eax
call fcn.004b555a
pop ecx
mov dword [0x527fb4], eax
test eax, eax
je 0x4c6e21
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004b555a
pop ecx
mov dword [0x527fb0], eax
mov eax, dword [0x527fb0]
cmp eax, ebx
je 0x4c6e79
cmp dword [0x527fb4], ebx
je 0x4c6e79
push eax
call fcn.004b55d5
push dword [0x527fb4]
mov esi, eax
call fcn.004b55d5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4c6e79
test edi, edi
je 0x4c6e79
call esi
test eax, eax
je 0x4c6e70
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4c6e70
test byte [ebp - 0xc], 1
jne 0x4c6e79
or dword [ebp + 0x10], 0x200000
jmp 0x4c6eb2
mov eax, dword [0x527fa8]
cmp eax, ebx
je 0x4c6eb2
push eax
call fcn.004b55d5
pop ecx
test eax, eax
je 0x4c6eb2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4c6eb2
mov eax, dword [0x527fac]
cmp eax, ebx
je 0x4c6eb2
push eax
call fcn.004b55d5
pop ecx
test eax, eax
je 0x4c6eb2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x527fa4]
call fcn.004b55d5
pop ecx
test eax, eax
je 0x4c6ed2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4c6ed4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4cd45f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movsx ecx, ax
shr eax, 0x10
cwde
push ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and dword [eax], 0
push edi
mov edi, dword [esi + 0x30]
mov dword [ebp - 0xc], ecx
jmp 0x4cd4c7
mov ebx, dword [edi]
xor eax, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x38]
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4cd4c4
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x74]
test al, al
je 0x4cd4c4
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x7c]
test al, al
jne 0x4cd4e2
mov edi, dword [edi + 8]
test edi, edi
jne 0x4cd47f
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x4cd4da
mov eax, dword [ecx]
call dword [eax + 0x54]
and dword [esi + 0x34], edi
pop edi
xor eax, eax
pop ebx
leave
ret 4
mov ecx, dword [esi + 0x34]
cmp ebx, ecx
je 0x4cd4f5
test ecx, ecx
je 0x4cd4f2
mov eax, dword [ecx]
call dword [eax + 0x54]
mov dword [esi + 0x34], ebx
push 1
xor edi, edi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jbe 0x4cd50a
inc edi
mov eax, dword [ebp - 0xc]
mov ecx, dword [esi + 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edi
mov eax, dword [ecx]
push edx
call dword [eax + 0x50]
mov eax, dword [esi + 4]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x10
mov dword [ebp - 0x34], 2
call dword [sym.imp.USER32.dll_TrackMouseEvent]
jmp 0x4cd4da
Function at 0x974502
Capabilities:
Encode data using xor

Disassembly:
call 0x9745b7
pop eax
xor byte [ebp + 0x51], cl
lds esi, [ebx + edi - 0x7c01a5d8]
mov edx, 0xc5aab36f
je 0x9384bf
push edi
rol dword [ebx], 0
push edx
mov edi, edx
jae 0x9384f1
sub esi, dword [edx + 0x5f]
xor eax, 0xb3c0afa1
mov ds, word [bx + di]
js 0x9384d4
call 0x974502
adc al, al
add eax, dword [eax]
dec edi
sar dword [ebp + reloc.MSVCRT.dll_strncpy], cl
jo 0x938575
ljmp 0xadb2:0x5b25229a
pop es
xchg byte [ecx], al
add byte [ebp + 0x18727e8], ah
add cl, al
call fcn.00950e21
add dword [eax], eax
inc eax
call fcn.00950f55
jg 0x938567
ror byte [ecx + eax + 0x38e80700], 0x8e
add dword [eax], eax
mov word [ecx], es
add byte [edi], al
call 0x9513c1
sti
call fcn.009516e6
dec esi
call fcn.00951713
jbe 0x938580
jge 0x938598
invalid
invalid
test ecx, ecx
push ax
call fcn.009764e5
popal
sahf
sbb cl, byte [eax - 0x453e511]
ror byte [ebp - 0x24], cl
das
lea ecx, ss:[edi - 0xa9]
lea ecx, [edi - 0xa9]
lea esp, [esp + 1]
jmp 0x97444e
shr ebx, 0x10
jmp 0x97449d
lea esp, [esp + 0x1c]
clc
push bp
lea esp, [esp + 2]
mov dword [ebp - 0xc], ebx
jmp 0x9744af
cmp bx, cx
pushfd
mov word [esp + 1], bx
jmp 0x9744f3
mov ecx, 0xfafb0bc2
pushal
pop dword [esp + 9]
add ecx, 0x505f43d
jmp 0x974476
sub esp, 0x12
lea esp, [esp + 2]
mov dword [ebp - 0x10], eax
sub esp, 0x10
pop dword [esp + 2]
jmp 0x974486
lea esp, [esp + 0x20]
jne 0x9384eb
call 0x9744dd
lea esp, [esp + 4]
jmp 0x97453a
xor edx, edx
jmp 0x974542
movzx ecx, bx
inc ecx
stc
dec edx
jmp 0x974524
div ecx
push esi
jmp 0x97456c
lea esp, [esp + 4]
movzx eax, ax
pushfd
mov dword [ebp - 4], eax
jmp 0x97457d
lea esp, [esp + 4]
jmp 0x9384bf
shr eax, 0x10
clc
sub ecx, eax
jmp 0x974a28
lea esp, [esp + 4]
jmp 0x974412
Function at 0xa2dc7d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xa2dcb8
mov dword [esp], ecx
rdtsc
bswap edx
lea ebp, [esp + 4]
add al, cl
jmp 0xa2dd2c
push word [esp + 1]
jmp 0xa2dce2
ja 0xa2dca2
mov dx, word [esp]
push ax
jmp 0xa2dcfb

Function at 0xa375b0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x24], eax
jmp 0xa3757b
call 0xa3635d
jmp 0xa37657
mov eax, edi
call fcn.00a36a11
mov ebx, ecx
lea ebx, reloc.MSVCRT.dll_strncpy
mov dword [ebx], eax
pop ebx
movzx ebx, byte [eax]
jmp 0xa37565
add ebx, 0x9b08f04f
jmp 0xa37594
popal
popfd
ret
cmp ebx, 0x9b08f11b
je 0xa375f8
jne 0xa362b0
lea ecx, [eax*4]
popal
call 0xa375b0
sbb al, 0x66
push dword [esp + 3]
call fcn.00a375ed
xor eax, dword [eax]
add byte [eax], al
arpl word [0x36f5], ax
jg 0xa375b6
push 0xd
cld
dec edi
popal
mov al, byte [0x64751ae3]
popfd
ret
inc dword [esp + 8]
popfd
ret
add byte [eax], al
jmp 0xa37600
pushfd
cmp dword [esp + 4], 0
jmp 0xa37686
call 0xa3764a
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
fsub dword [edx]
lodsd eax, dword [esi]
cmp eax, 0x3c07b744
setbe byte [ecx]
rcr byte [eax + 0x2d], 0x88
xor ebx, dword [edi]
cmpsd dword [esi], dword es:[edi]
pop eax
sub eax, 0xa71f3388
jmp 0xa3763a
jne 0xa375ce
pushal
jmp 0xa36358

Function at 0xad1638
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
xchg bl, dh
dec di
jmp 0xad16d5
push word [esp + 5]
mov ecx, esi
xchg di, si
mov ch, 0x86
add esp, 7
jmp 0xad16be
xchg ch, ah
mov ecx, esi
sete al
mov dword [esp + 0xd], ebp
lea ebx, [ebp*4]
popal
jmp 0xad167d
mov esi, 0x99ef47d4
sub esp, 0xf
mov dh, byte [esp + 0x16]
not dx
pop edi
jmp 0xad16eb
neg dl
shr si, cl
std
mov ch, cl
mov byte [esp], dl
cpuid
jmp 0xad16a8
bswap eax
push dword [esp + 0x16]
mov edi, 0x2ac2d5ca
rdtsc
xchg word [esp + 0xb], dx
xchg dh, ah
jmp 0xad1693
xchg byte [esp + 0xe], ah
mov byte [esp + 0x10], bh
mov al, byte [esp + 0xb]
neg ch
rdtsc
jmp 0xad172c
push dword [esp + 3]
mov ecx, dword [esp + 6]
not ebp
jmp 0xad17a5
lea ebp, [esi + 0x84]
xchg dword [esp + 0xd], edi
add esp, 0xe
pop si
xchg bx, cx
rcl cl, cl
jmp 0xad1716
rdtsc
mov si, di
mov ax, di
lea esp, [esp + 1]
pop eax
bswap esi
jmp 0xad177d
not ch
not dh
mov byte [esp + 3], dh
lea esp, [esp + 1]
call fcn.00ad17bd
invalid
mov eax, dword [esp + 4]
rdtsc
xchg word [esp], bx
pushfd
xchg dword [esp + 5], ebp
xchg ecx, eax
jmp 0xad1742
xchg byte [esp], dl
mov ebp, dword [esp + 3]
xchg esi, eax
lea ebx, [eax + esi]
add eax, ecx
or esi, 0x30c7ea64
jmp 0xad1753
lea edx, [edx*4]
mov esi, 0x5a9d8ad3
sub di, 0x67d2
xchg bx, ax
cmc
std
jmp 0xad176a
Function at 0xad17bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebx
pop eax
jmp 0xad17c6
std
bsr bp, sp
xchg ah, cl
push dword [esp + 1]
mov bx, 0xf3e0
mov dword [esp + 5], esi
jmp 0xad1bae
lea edi, reloc.MSVCRT.dll_strncpy
bsr ax, si
mov ebp, edi
push dword [esp + 1]
xchg bl, ah
add esp, 0
jmp 0xad18ca
rdtsc
mov edx, ebx
bsf ecx, ebp
mov bh, byte [esp + 5]
mov cl, byte [esp + 9]
push word [esp + 3]
jmp 0xad17ea
pushfd
mov eax, dword [esp + 9]
add esp, 6
xchg byte [esp + 5], ch
inc cx
bswap ecx
jmp 0xad186a
add esp, 4
bts ax, ax
clc
push dword [esp + 4]
not dx
cld
jmp 0xad1827
std
inc bp
lea eax, [esp + ebp]
mov ebp, dword [esp + 3]
xchg word [esp + 9], bx
bsr edi, esp
jmp 0xad183d
neg cl
clc
push dword [esp + 2]
pop word [esp + 7]
std
xchg byte [esp], bh
jmp 0xad18b3
mov esi, dword [esp + 0xc]
mov word [esp + 4], sp
xchg byte [esp + 0xa], cl
pop word [esp + 5]
mov dl, 0xa5
bswap ecx
jmp 0xad1856
lea esp, [esp + 4]
lea eax, reloc.MSVCRT.dll_strncpy
xchg bh, ch
xchg dword [esp + 0xb], ebx
jmp 0xad19e6
mov si, word [esp + 1]
cpuid
pushfd
mov word [esp + 6], bx
push eax
jmp 0xad189d
bsf bx, bx
cmc
mov dword [esp + 8], ebx
mov ax, 0x4371
mov di, 0x2f0c
neg edi
jmp 0xad1885
pop ebx
lea esi, [ebx + edi]
mov ecx, ebx
rdtsc
pop bx
mov edx, ecx
jmp 0xad1921
bsr bp, sp
mov al, 0x76
neg dh
mov cx, 0x36e8
lea eax, reloc.MSVCRT.dll_strncpy
xchg cl, al
jmp 0xad18df
lea esi, [eax*4]
mov ebp, 0x1d486a59
jmp 0xad1971
xchg edi, eax
mov edi, 0xc1e437b
not dx
mov byte [esp], dh
cld
cmc
jmp 0xad190b
dec bx
mov eax, edi
lea ecx, [eax + edi]
sub esp, 8
bswap edi
lea esi, [ecx + ebx]
jmp 0xad195b
cpuid
mov cx, 0x67f3
mov edx, 0x425b91e8
pop di
neg si
cmc
jmp 0xad1932
xchg ebx, ecx
clc
sub esp, 0x15
pop word [esp + 0x12]
cld
xchg ebx, edx
jmp 0xad1989
lea esi, [ebx - 0xa3]
lea ecx, [esi + 0xe1]
dec ebx
mov cx, sp
sub esp, 0x14
add esp, 0x13
jmp 0xad1948
bsf edx, edx
bsf bx, di
mov ch, 0x58
neg dx
xchg bl, bh
mov edx, ecx
jmp 0xad199f
xchg bp, bx
clc
sub esp, 0x1f
xchg dword [esp + 0xc], edx
xchg ebp, edi
bswap ebp
call fcn.00ad19cc
dec esp
fisttp word [ebp - 0x7899e5fc]
je 0xad19e0
lea eax, [edx + ebx]
xchg word [esp + 9], si
add esp, 0xb
mov eax, ecx
or dword [ebx - reloc.MSVCRT.dll_strncpy], eax
setne ch
adc ebx, edx
jmp 0xad18f5
push ecx
rcl byte [ebx - 0x36]
rdtsc
rdtsc
setns bh
stc
pop bx
cmc
push word [esp + 3]
jmp 0xad19b5
mov bp, 0xd903
mov eax, 0x6f7b2767
xchg dword [esp + 1], edi
bsr dx, si
push word [esp + 2]
sub esp, 0
jmp 0xad1811
mov dl, al
mov dl, 0x60
pop word [esp + 2]
xchg word [esp + 2], ax
mov bp, word [esp + 7]
not ah
jmp 0xad1aa8
Function at 0xad1a3f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop di
rdtsc
mov edi, edx
neg ax
jmp 0xad1a7f
lea esi, [edx*4]
add esp, 0x28
add esp, 0
pushfd
pop word [esp]
mov dx, di
jmp 0xad1b4f
mov cl, dl
sets cl
dec ebp
rdtsc
lea ecx, [edx + ebx]
mov eax, dword [esp]
jmp 0xad1b14
lea eax, [edi - 0x4e]
neg dh
not bx
mov dx, 0xca3b
cld
jmp 0xad1afe
mov cl, ah
xchg bl, al
cld
pop bp
lea ebp, [eax*4]
mov dh, 0x3c
jmp 0xad1ac6
sbb si, 0x3d18
cpuid
sets al
mov ax, 0xcb92
jmp 0xad1b24
mov bh, dl
adc cl, 0xd7
cmc
bswap esi
mov ecx, dword [esp]
bsr ecx, eax
jmp 0xad1ad6
sub esp, 3
mov ebp, 0x1696c8d3
sub esp, 0xf
pop dword [esp + 4]
clc
stc
jmp 0xad1b7a
xchg byte [esp + 3], bh
pop dword [esp]
lea eax, [edx + esi]
rdtsc
dec ah
mov si, di
jmp 0xad1b64
mov dl, bl
mov ax, 0xfeca
lea edx, reloc.MSVCRT.dll_strncpy
bsr cx, bx
pop cx
clc
jmp 0xad1aec
dec di
mov word [esp + 0xc], di
cpuid
xchg ch, ah
btc cx, bx
jmp 0xad1b8d
pushfd
inc di
push dword [esp + 0xb]
xchg edi, eax
xchg dx, bx
mov bx, word [esp + 6]
jmp 0xad1b37
mov al, cl
mov cx, 0x26be
neg al
pop word [esp + 0xd]
pop ebx
xchg al, ah
jmp 0xad1bf7
mov dl, byte [esp + 8]
sub esp, 7
mov ebp, esi
cld
mov bh, 0x71
mov dword [esp + 3], esp
jmp 0xad1cf0
sets bl
ror cx, cl
sub esp, 0x1c
stc
xchg byte [esp + 0xc], ah
setl ah
jmp 0xad1bc8
not si
not dl
inc bp
not al
rdtsc
mov dword [esp + 5], ebx
jmp 0xad1bde
pushal
lea esp, [esp + 0x4d]
mov bh, ch
mov dx, 0x299d
lea eax, [ecx*4]
call fcn.00ad1c6c
lea ecx, reloc.MSVCRT.dll_strncpy
lea edi, [esi + edi]
xchg dx, bx
rdtsc
jmp 0xad1d33
mov dword [esp + 3], ebp
mov si, word [esp + 0xc]
mov byte [esp + 1], dh
mov eax, dword [esp + 0x1b]
mov esi, ebx
pop word [esp + 0x23]
jmp 0xad1c99
bswap ebx
xchg byte [esp + 2], ch
lea eax, [eax*4]
not dh
mov ch, byte [esp + 2]
xchg dword [esp + 1], esi
jmp 0xad1d49
lea esp, [esp + 4]
mov byte [esp + 2], cl
ror ecx, cl
xchg byte [esp + 3], dh
mov esi, dword [esp]
push dword [esp]
jmp 0xad1d0a
xchg byte [esp + 1], bl
mov ebp, dword [esp + 6]
lea edx, [eax + edx]
ror dx, 4
mov cx, word [esp + 9]
bswap esi
jmp 0xad1e2d
stc
mov di, word [esp]
xchg byte [esp], bh
mov ecx, dword [esp]
jmp 0xad1db3
lea esp, [esp + 2]
mov ebp, dword [esp]
lea esi, [ecx*4]
bswap esi
mov al, byte [esp]
mov di, word [esp]
jmp 0xad1d84
lea ebp, [esi*4]
mov edx, dword [esp]
call fcn.00ad1dfe
sti
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
in al, dx
push cs
mov word [edx], es
xchg esp, eax
inc eax
cdq
clc
invalid
add esp, 5
mov dword [esp], eax
lea ecx, [ebp*4]
sbb bp, bp
and edi, edi
pop di
jmp 0xad1d9a
cld
lea ebx, [esp + ebp]
xchg byte [esp + 8], dh
neg cl
lea edx, [ebx + esi]
lea ebx, [ebp*4]
jmp 0xad1dd2
Function at 0xad40d7
Capabilities:
Access peb ldr_data

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bh, bh
sub byte [eax + eax*4], 0xa1
add byte [eax - 0x2dbeb76], bl
inc dword [eax + 0xa1802c]
pushfd
pushal
mov dl, byte [esp]
std
jmp 0xad15d8
jmp 0xad2003
not ecx
shl edx, 0xb
cpuid
lea ebx, [eax*4]
call fcn.00ad1522
lea ebx, [esi*4]
mov esi, 0x7453a283
mov bp, 0xde84
lea ebp, [eax + ebp]
inc edx
cld
jmp 0xad1547
call 0xad2008
jmp 0xad24e0
pop eax
sub eax, 0xad2008
jmp 0xad25f0
popal
jmp 0xad14c1
cmp dword [eax + reloc.MSVCRT.dll_strncpy], 0
je 0xad14d0
lea esp, [esp + 8]
jmp 0xad25c2
call 0xad3ffd
jmp 0xad413d
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0xad4115
mov eax, dword [eax + 0x1c]
jmp 0xad40ff
mov eax, dword [eax]
jmp 0xad4164
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xad40e1
pop eax
sub eax, 0x6d3ffd
push eax
jmp 0xad14e6
mov eax, dword [eax + 8]
push eax
jmp 0xad3ff8
Function at 0x23802f58
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x824
mov eax, 0x23908fa8
call fcn.23803221
call fcn.23803257
lea ecx, [ebp - 0x81c]
call fcn.23803c48
mov eax, dword [0x239840f4]
push str.JavaScriptPerms
xor ebx, ebx
push str.FeatureLockdown
mov dword [ebp - 4], ebx
call dword [eax + 0x5c0]
push str.BlackList
push eax
mov eax, dword [0x23984114]
call dword [eax + 0x114]
xor edi, edi
add esp, 0x10
inc edi
push edi
lea ecx, [ebp - 0x81c]
mov esi, eax
call fcn.2382207a
push edi
lea ecx, [ebp - 0x81c]
mov dword [ebp - 0x81c], esi
call fcn.2382207a
lea ecx, [ebp - 0x828]
call fcn.23803c48
mov ax, word [0x2397de1c]
mov ecx, 0xffff
mov byte [ebp - 4], 1
cmp ax, cx
jne 0x23802ff1
mov ecx, 0x2397de1c
call fcn.238022e3
movzx eax, ax
push str.Reader
push eax
mov eax, dword [0x239840b0]
call dword [eax + 0x2c]
pop ecx
push eax
call fcn.2382207a
pop ecx
pop ecx
test ax, ax
je 0x23803025
mov eax, dword [0x239827d4]
mov esi, str.SOFTWAREAdobeAcrobat_Reader11.0JavaScriptPerms
call dword [eax + 0xcb8]
test ax, ax
je 0x2380302a
mov esi, str.SOFTWAREAdobeAdobe_Acrobat11.0JavaScriptPerms
lea eax, [ebp - 0x830]
push eax
push edi
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x238030b3
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x814]
push eax
push ebx
push str.tBlackList
push dword [ebp - 0x830]
mov dword [ebp - 0x820], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x238030a7
cmp dword [ebp - 0x814], edi
jne 0x238030a7
push ebx
call fcn.2382207a
pop ecx
push eax
push ebx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.2382207a
push edi
lea ecx, [ebp - 0x828]
call fcn.2382207a
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
lea ecx, [ebp - 0x81c]
call fcn.2382207a
test eax, eax
jne 0x238030d9
push ebx
push ebx
lea ecx, [ebp - 0x828]
call fcn.2382207a
test eax, eax
je 0x23803185
call fcn.238632bf
cmp dword [0x23982638], ebx
jne 0x2380314f
push edi
push 0x14
call fcn.2382207a
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0x814], esi
mov byte [ebp - 4], 2
cmp esi, ebx
je 0x2380311f
push ecx
mov dword [ebp - 0x820], esp
lea eax, [ebp - 0x829]
mov dword [ebp - 0x820], esp
push eax
mov ecx, esi
call fcn.23818594
mov eax, esi
jmp 0x23803121
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x23982638], eax
cmp eax, ebx
jne 0x2380314f
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], bl
call fcn.23803ba1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x81c]
call fcn.23803ba1
xor eax, eax
jmp 0x238031a4
push ecx
push ecx
lea eax, [ebp - 0x81c]
mov ecx, esp
mov dword [ebp - 0x814], esp
push eax
call fcn.2382207a
call fcn.23863099
lea eax, [ebp - 0x828]
mov ecx, esp
mov dword [ebp - 0x814], esp
push eax
call fcn.2382207a
call fcn.23863099
pop ecx
pop ecx
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], bl
call fcn.23803ba1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x81c]
call fcn.23803ba1
mov eax, edi
call fcn.238040e1
ret
Function at 0x23855293
Capabilities:
Set registry value

Disassembly:
push 0x19c
mov eax, 0x23911df9
call fcn.23803221
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
mov esi, ecx
jb 0x238552af
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x9c]
call fcn.2382207a
mov edi, eax
xor ebx, ebx
push 0x23921b70
lea ecx, [ebp - 0x80]
mov dword [ebp - 4], ebx
call fcn.2382207a
push edi
push eax
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 1
call fcn.2382207a
push 0x23921b6c
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 2
call fcn.2382207a
add esp, 0x18
cmp dword [esi + 0x14], 0x10
mov byte [ebp - 4], 3
jb 0x23855300
mov esi, dword [esi]
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.2382207a
add esp, 0xc
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 5
call fcn.2382207a
push ebx
push esi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 6
call fcn.2382207a
push ebx
push esi
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 7
call fcn.2382207a
push ebx
push esi
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 8
call fcn.2382207a
call fcn.23819efd
test eax, eax
je 0x2385544d
mov dword [ebp - 0x1a4], ebx
lea eax, [ebp - 0x1a4]
push eax
push 0x239219ec
push 4
push ebx
push 0x239219fc
mov byte [ebp - 4], 9
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jne 0x23855437
push ecx
mov ecx, dword [ebp - 0x1a4]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a8], esp
cmp eax, ebx
je 0x238553a6
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
call fcn.238b8e99
mov edi, eax
pop ecx
cmp edi, ebx
je 0x23855437
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x238553c2
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x19c]
push 3
mov dword [ebp - 0x1a0], ecx
push eax
lea ecx, [ebp - 0x1a0]
call fcn.2382207a
push dword [ebp - 0x1a0]
mov byte [ebp - 4], 0xa
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
lea eax, [ebp - 0x19c]
mov byte [ebp - 4], 9
cmp dword [ebp - 0x1a0], eax
je 0x2385540d
push dword [ebp - 0x1a0]
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
movzx ecx, byte [ebp + 0xc]
mov eax, dword [ebp - 0x1a4]
mov edx, dword [eax]
push ecx
push esi
push edi
push eax
call dword [edx + 0x78]
mov eax, dword [ebp - 0x1a4]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x8c]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x1a4]
mov byte [ebp - 4], 8
cmp eax, ebx
je 0x23855489
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x23855489
call fcn.2382207a
mov esi, eax
movzx eax, byte [ebp + 0xc]
mov dword [ebp - 0x1a4], eax
cmp esi, ebx
je 0x23855489
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x2385546e
lea eax, [ebp - 0x2c]
push 4
lea ecx, [ebp - 0x1a4]
push ecx
push 4
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.2382207a
call fcn.238040e1
ret