joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010cd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x794
push edi
call fcn.00538682
xor edi, edi
test al, al
je 0x401136
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x4010e7
sub eax, edx
sar eax, 1
cmp eax, 0x3ca
jb 0x401136
movzx eax, word [esi]
xor edx, edx
lea ecx, [esi + 2]
jmp 0x40111c
cmp edx, 0x3c9
jae 0x401121
mov word [ebp + edx*2 - 0x794], ax
movzx eax, word [ecx]
inc edx
inc ecx
inc ecx
cmp ax, di
jne 0x401106
push 1
push edi
push edi
lea eax, [ebp - 0x794]
mov word [ebp + edx*2 - 0x794], di
push eax
jmp 0x40113b
push 1
push edi
push edi
push esi
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
leave
ret

Function at 0x4011af
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
xor ebx, ebx
push ebx
push 2
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40120b
mov eax, dword [ebp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4011d9
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x14]
push 1
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x40120d
xor al, al
pop ebx
pop ebp
ret 0x10

Function at 0x40124c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
push esi
push edi
mov edi, eax
call fcn.00538682
test al, al
je 0x40126e
cmp edi, 5
jle 0x40126e
xor al, al
jmp 0x4012ce
mov esi, 0x11c
push esi
lea eax, [esp + 0xc]
push 0
push eax
call fcn.005fc0d0
mov eax, dword [ebp + 8]
add esp, 0xc
push 3
mov dword [esp + 0x10], edi
pop edi
push edi
push 2
push 0
mov dword [esp + 0x14], esi
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0
mov dword [esp + 0x20], eax
call esi
push edi
push 1
push edx
push eax
call esi
push edi
push 0x20
push edx
push eax
call esi
push edi
push 0x10
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x401d61
Capabilities:
Copy file

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb eax, eax
neg eax
ret 8
Function at 0x401d7a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0x410]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor eax, eax
inc eax
push eax
mov dword [ebp + 8], eax
call esi
mov edi, str.PicoPDF__lu__d
jmp 0x401db9
inc dword [ebp + 8]
push dword [ebp + 8]
call esi
push eax
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.00401000
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
push ebx
call fcn.00401f51
push ebx
call fcn.00401e3b
test al, al
jne 0x401db1
push ebx
call fcn.00401e26
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x401e3b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 4

Function at 0x401e52
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401e65
xor al, al
jmp 0x401e68
and eax, 1
ret 4

Function at 0x401e6b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401e7e
xor al, al
jmp 0x401e84
shr eax, 4
and eax, 1
ret 4

Function at 0x40b784
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
push esi
mov esi, dword [eax + 8]
push edi
mov edi, dword [eax + 0x14]
call fcn.0054a8b7
imul esi, edi
add esi, esi
cmp eax, esi
jae 0x40b7a7
xor al, al
jmp 0x40b80b
or dword [esp + 0x40], 0xffffffff
and dword [esp + 0x44], 0
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov esi, dword [esp + 0x38]
call fcn.0054a8b7
test eax, eax
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
jge 0x40b7df
fadd dword [0x694148]
test esi, esi
mov dword [esp + 0xc], esi
fild dword [esp + 0xc]
jge 0x40b7f1
fadd dword [0x694148]
fdivp st(1)
fld1
fsubrp st(1)
fcomp dword [0x6944cc]
fnstsw ax
test ah, 5
jp 0x40b809
xor eax, eax
inc eax
jmp 0x40b80b
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d2fb
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp word [esi], 0
jne 0x40d30e
xor al, al
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x50
jne 0x40d30a
mov ecx, esi
lea eax, [ebp - 0x208]
call fcn.00401b6e
lea eax, [ebp - 0x208]
push 0x63b49c
push eax
call fcn.00613e25
test eax, eax
pop ecx
pop ecx
jne 0x40d341
mov al, 1
leave
ret
lea eax, [ebp - 0x208]
push str..pfx
push eax
call fcn.00613e25
neg eax
pop ecx
sbb al, al
pop ecx
inc al
leave
ret
Function at 0x40d4df
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
push str.UxTheme.dll
mov dword [esi], ebx
call edi
push str.dwmapi.dll
mov dword [esi + 4], eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
cmp eax, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
je 0x40d603
push str.OpenThemeData
push eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi + 4]
push str.CloseThemeData
push eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 4]
push str.DrawThemeBackground
push eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 4]
push str.GetThemeColor
push eax
call edi
mov dword [esi + 0x20], eax
mov eax, dword [esi + 4]
push str.GetThemeSysColorBrush
push eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 4]
push str.GetThemePartSize
push eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi + 4]
push str.GetThemeBackgroundContentRect
push eax
call edi
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 4]
push str.GetThemeFont
push eax
call edi
mov dword [esi + 0x30], eax
mov eax, dword [esi + 4]
push str.IsAppThemed
push eax
call edi
mov dword [esi + 0x34], eax
mov eax, dword [esi + 4]
push str.DrawThemeParentBackground
push eax
call edi
mov dword [esi + 0x38], eax
mov eax, dword [esi + 4]
push str.SetWindowTheme
push eax
call edi
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 4]
push str.IsThemeBackgroundPartiallyTransparent
push eax
call edi
mov dword [esi + 0x40], eax
mov eax, dword [esi + 4]
push str.DrawThemeTextEx
push eax
call edi
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
push str.GetThemeSysFont
push eax
call edi
mov dword [esi + 0x48], eax
mov eax, dword [esi + 4]
push str.IsThemeActive
push eax
call edi
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 4]
push str.DrawThemeIcon
push eax
call edi
mov dword [esi + 0x50], eax
mov eax, dword [esi + 4]
push str.EnableThemeDialogTexture
push eax
call edi
mov dword [esi + 0x54], eax
jmp 0x40d636
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x40d674
push str.DwmIsCompositionEnabled
push eax
call edi
mov dword [esi + 0x58], eax
mov eax, dword [esi + 8]
push str.DwmSetWindowAttribute
push eax
call edi
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 8]
push str.DwmExtendFrameIntoClientArea
push eax
call edi
mov dword [esi + 0x60], eax
mov eax, dword [esi + 8]
push str.DwmDefWindowProc
push eax
call edi
mov dword [esi + 0x64], eax
jmp 0x40d680
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
pop edi
mov eax, esi
pop ebx
ret
Function at 0x40d926
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0
mov esi, eax
mov byte [ebp - 1], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
mov dword [ebp - 0xc], edi
je 0x40d9a2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [ebp - 8], eax
je 0x40d998
mov edi, ebx
shr edi, 1
lea eax, [edi + 1]
push eax
call fcn.00496cd5
push ebx
push dword [ebp - 8]
push dword [esi]
call fcn.005fbd60
mov eax, dword [esi]
and word [eax + edi*2], 0
mov ecx, dword [esi]
lea eax, [edi - 1]
add esp, 0xc
mov dword [esi + 4], eax
and word [ecx + eax*2], 0
mov byte [ebp - 1], 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, byte [ebp - 1]
pop edi
pop esi
leave
ret

Function at 0x40d9e8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
call fcn.0040d9cf
test al, al
jne 0x40d9fe
pop esi
ret
push ebx
push str.Rich_Text_Format
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
jne 0x40da22
xor al, al
jmp 0x40da5c
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov edi, eax
push edi
call fcn.0049702b
push edi
push ebx
push dword [esi]
call fcn.005fbd60
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esi]
mov ecx, esi
mov byte [eax + edi - 1], 0
call fcn.0049700e
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, 1
pop edi
pop ebx
pop esi
ret

Function at 0x40da5f
Capabilities:
Open clipboard

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40da74
sub eax, ecx
push str.Rich_Text_Format
inc eax
push eax
push dword [esp + 0xc]
call fcn.0058aa8b
push dword [esp + 8]
call fcn.0058a947
call dword [sym.imp.USER32.dll_CloseClipboard]
ret 8
Function at 0x41226a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push edi
mov eax, esi
call fcn.00575668
lea eax, [esi + 0x2bc]
mov dword [eax], 0x649320
mov dword [eax], 0x6493c8
lea ebx, [esi + 0x2c0]
xor edi, edi
push edi
mov eax, ebx
mov dword [esi], 0x649328
mov dword [esi + 0x32], 0x64b1d8
call fcn.004b7335
mov eax, dword [ebp + 8]
mov dword [ebx], 0x649240
lea ebx, [esi + 0x345]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov edi, dword [eax + 4]
push ebx
call fcn.004a3e50
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push dword [ebx]
mov dword [ebx + 4], ecx
call fcn.004c8216
xor eax, eax
cmp dword [esi + 0x349], eax
lea edi, [esi + 0x34d]
mov word [edi], ax
mov word [esi + 0x555], ax
je 0x412301
mov ecx, dword [ebx]
mov eax, edi
call fcn.00401ad4
xor ebx, ebx
jmp 0x412325
lea eax, [ebp - 0x20c]
push eax
call fcn.0048a778
xor ebx, ebx
cmp word [ebp - 0x20c], bx
je 0x412325
lea ecx, [ebp - 0x20c]
mov eax, edi
call fcn.00401ad4
cmp word [edi], bx
jne 0x412339
push edi
push ebx
push ebx
push 5
push ebx
mov word [edi], bx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
pop edi
mov eax, esi
pop ebx
leave
ret 4

Function at 0x412d23
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x61c
push edi
lea edi, [esp + 0x418]
call fcn.0048a719
mov eax, edi
push eax
lea eax, [esp + 0xc]
push eax
call fcn.00410d8c
xor edi, edi
lea eax, [esp + 0x210]
push eax
push edi
push edi
push 5
push edi
mov word [esp + 0x224], di
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.PDF__.pdf_
lea eax, [esp + 0x214]
push eax
push str.Save_As
lea eax, [esp + 0x14]
push eax
push dword [ebp + 8]
call fcn.0049c3f8
push eax
mov eax, 0x63c580
call fcn.00536d77
test al, al
je 0x412dc3
movzx eax, word [esp + 8]
xor ecx, ecx
cmp word [esp + 8], di
lea edx, [esp + 0xa]
je 0x412dbd
cmp ecx, 0x103
jae 0x412dbd
mov word [esi + ecx*2], ax
movzx eax, word [edx]
inc ecx
inc edx
inc edx
cmp ax, di
jne 0x412da6
mov word [esi + ecx*2], di
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4224c4
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x208]
push eax
push ebx
push ebx
push 0x26
push ebx
mov word [ebp - 0x208], bx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, 0x631a7c
push esi
push 0x631ac4
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
call fcn.0053768f
push dword [ebp + 0xc]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.00401f51
mov edi, str..exe
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x618]
push eax
mov eax, dword [ebp + 0x10]
call fcn.0053768f
push dword [ebp + 0x10]
call fcn.00401e3b
test al, al
je 0x422549
mov al, 1
jmp 0x422695
lea eax, [ebp - 0x208]
call fcn.005366fc
push esi
push 0x631ac4
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
call fcn.0053768f
push esi
push str.Program_Files
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x820]
call fcn.0053768f
push dword [ebp + 0xc]
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.00401f51
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x618]
push eax
mov eax, dword [ebp + 0x10]
call fcn.0053768f
push dword [ebp + 0x10]
call fcn.00401e3b
test al, al
jne 0x422542
cmp byte [ebp + 8], bl
jne 0x422695
lea eax, [ebp - 0x208]
push eax
push ebx
push ebx
push 0x26
push ebx
mov word [ebp - 0x208], bx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
mov ebx, str.NCH_Swift_Sound
push ebx
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
call fcn.0053768f
push dword [ebp + 0xc]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.00401f51
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x618]
push eax
mov eax, dword [ebp + 0x10]
call fcn.0053768f
push dword [ebp + 0x10]
call fcn.00401e3b
test al, al
jne 0x422542
lea eax, [ebp - 0x208]
call fcn.005366fc
push esi
push ebx
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
call fcn.0053768f
push esi
push str.Program_Files
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x820]
call fcn.0053768f
push dword [ebp + 0xc]
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.00401f51
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x618]
push eax
mov eax, dword [ebp + 0x10]
call fcn.0053768f
push dword [ebp + 0x10]
call fcn.00401e3b
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4276e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c0
push ebx
push esi
push edi
lea eax, [ebp - 0x5b4]
push eax
call fcn.0048a778
xor ebx, ebx
cmp word [ebp - 0x5b4], bx
lea eax, [ebp - 0x22c]
jne 0x42771e
push eax
push ebx
push ebx
push 5
push ebx
mov word [ebp - 0x22c], bx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x427729
lea ecx, [ebp - 0x5b4]
call fcn.00401ad4
cmp word [ebp - 0x22c], bx
je 0x427806
lea eax, [ebp - 8]
push eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.0045a0f8
lea esi, [ebp - 0x24]
call fcn.004971c7
cmp dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], ebx
jne 0x427766
mov eax, 0x631a7c
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea edx, [ebp - 8]
push edx
push ebx
lea edx, [ebp - 0x22c]
push edx
push 0x63c7ec
lea edx, [ebp - 0x24]
push edx
call fcn.005370e9
test al, al
je 0x4277f5
mov edi, dword [esi + 4]
push str.Loading_PDF_File
lea eax, [ebp - 0x3ac]
call fcn.0040d84a
xor edi, edi
cmp dword [ebp - 0x20], ebx
jbe 0x4277ea
jmp 0x4277a9
mov esi, dword [ebp + 8]
cmp edi, dword [ebp - 0x20]
mov word [ebp - 0x7bc], bx
jae 0x4277c7
lea eax, [ebp - 0x7bc]
push eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + edi*4]
call fcn.00401050
lea eax, [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x2be]
push eax
push esi
lea esi, [ebp - 8]
call fcn.00427605
cmp dword [ebp - 8], 1
je 0x4277ea
inc edi
cmp edi, dword [ebp - 0x20]
jb 0x4277a6
lea eax, [ebp - 0x3ac]
call fcn.0040d8e1
lea eax, [ebp - 0x24]
call fcn.00401bb7
push dword [ebp - 0x14]
call fcn.005f858a
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x427b37
Capabilities:
Get common file path

Disassembly:
cmp dword [esi + 0x22f3], 0
push edi
jne 0x427b53
mov edx, str.Open_a_PDF_to_use_editing_features
mov eax, 0x3e8
push esi
call fcn.00424541
pop edi
ret
mov edx, esi
call fcn.00431411
mov edi, eax
test edi, edi
je 0x427bd7
lea ecx, [esi + 0x25af]
call fcn.0048e959
test eax, eax
je 0x427b74
call fcn.004448f5
cmp byte [edi + 0xb0e], 0
je 0x427b85
mov ecx, esi
pop edi
jmp fcn.00427bd9
lea ecx, [edi + 0x695]
call fcn.0054ad9c
test al, al
jne 0x427bd7
mov eax, edi
call fcn.0045acef
test al, al
jne 0x427bab
mov edx, str.This_is_a_Read_Only_file._You_will_not_be_able_to_make_any_edits_to_this_document.
mov eax, 0x3f2
jmp 0x427b4b
add edi, 0x59
push edi
call fcn.00401e52
test al, al
je 0x427bc4
mov edx, str.File_is_read_only._Use_Save_As_to_save_edits
mov eax, 0x3f3
jmp 0x427b4b
push 0
push esi
call fcn.00477a3d
test al, al
je 0x427bd7
push edi
push esi
call fcn.00428165
pop edi
ret

Function at 0x427bd9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x834
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x22f3], ebx
push edi
mov dword [esp + 0x1c], esi
jne 0x427c0d
mov edx, str.Open_a_PDF_to_use_editing_features
mov eax, 0x3e8
push esi
call fcn.00424541
jmp 0x427da1
mov edx, esi
call fcn.00431411
mov edi, eax
cmp edi, ebx
je 0x427da1
lea ecx, [esi + 0x25af]
call fcn.0048e959
cmp eax, ebx
je 0x427c32
call fcn.004448f5
mov eax, edi
call fcn.0045acef
test al, al
jne 0x427c49
mov edx, str.This_is_a_Read_Only_file._You_will_not_be_able_to_make_any_edits_to_this_document.
mov eax, 0x3f3
jmp 0x427c02
push ebx
push esi
call fcn.00477a3d
test al, al
je 0x427da1
xor edx, edx
cmp byte [edi + 0xb0e], bl
jne 0x427c86
lea ecx, [edi + 0x59]
jmp 0x427c75
cmp edx, 0x103
jae 0x427c7f
mov word [esp + edx*2 + 0x20], ax
inc edx
movzx eax, word [ecx]
inc ecx
inc ecx
cmp ax, bx
jne 0x427c67
mov word [esp + edx*2 + 0x20], bx
jmp 0x427cc8
push 2
lea eax, [edi + 0xb0f]
pop esi
jmp 0x427c9f
cmp edx, 0x103
jae 0x427ca9
mov word [esp + edx*2 + 0x20], cx
inc edx
movzx ecx, word [eax]
add eax, esi
cmp cx, bx
jne 0x427c91
mov word [esp + edx*2 + 0x20], bx
lea ecx, [edi + 0x59]
xor edx, edx
jmp 0x427cbe
cmp edx, 0x103
jae 0x427cc8
inc edx
movzx eax, word [ecx]
add ecx, esi
invalid
invalid
Function at 0x427da8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
xor ebx, ebx
cmp dword [esi + 0x22f3], ebx
push edi
jne 0x427dcd
push esi
mov edx, str.Open_a_PDF_to_use_the_Export_feature
call fcn.00432dd1
jmp 0x427e68
mov edx, esi
call fcn.00431411
mov edi, eax
cmp edi, ebx
je 0x427e68
push 2
push esi
call fcn.00477a3d
test al, al
je 0x427e68
cmp byte [edi + 0xb0e], bl
lea edx, [edi + 0xb0f]
jne 0x427dfb
lea edx, [edi + 0x59]
push dword [ebp + 8]
lea edi, [ebp - 0x424]
call fcn.00537573
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.0045a2ed
lea eax, [ebp - 0x21c]
push eax
push ebx
push ebx
push 5
push ebx
mov word [ebp - 0x21c], bx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push dword [ebp - 0x10]
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x21c]
push ecx
push str.Export
mov ecx, edi
push ecx
push eax
mov eax, dword [ebp + 8]
call fcn.00536d77
test al, al
je 0x427e5f
mov eax, edi
push eax
push esi
call fcn.00427e6e
push dword [ebp - 0x10]
call fcn.005f858a
pop ecx
pop edi
pop ebx
leave
ret 4
Function at 0x428315
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11d0
call fcn.0060f180
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x21]
test eax, eax
push edi
jne 0x42833b
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
mov ecx, dword [ebx + 4]
push str.Owner_password_is_required_to_extract_pages
push ecx
lea edi, [ebp - 0x79c]
call fcn.004171dd
test al, al
je 0x428332
cmp byte [esi + 0xb0e], 0
je 0x428364
add esi, 0xb0f
jmp 0x428367
add esi, 0x59
mov ecx, esi
lea eax, [ebp - 0x11cc]
call fcn.00401ad4
mov ecx, esi
lea esi, [ebp - 0xbb4]
call fcn.005375ef
lea eax, [ebp - 0x20c]
push eax
mov eax, esi
push eax
lea eax, [ebp - 0x11cc]
push eax
mov eax, dword [ebp + 0x10]
call fcn.00462d2b
xor esi, esi
lea eax, [ebp - 0x594]
push eax
push esi
push esi
push 5
push esi
mov word [ebp - 0x594], si
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [ebx + 4]
push str.PDF__.pdf_
lea ecx, [ebp - 0x594]
push ecx
push str.Save_Extracted_Page_As...
lea ecx, [ebp - 0x20c]
push ecx
push eax
mov eax, 0x63c580
call fcn.00536d77
test al, al
je 0x428332
mov edi, dword [ebx + 4]
push str.Extracting_pages_from_PDF
lea eax, [ebp - 0x38c]
call fcn.0040d84a
lea eax, [ebp - 0x79c]
push eax
lea eax, [ebp - 0x29e]
push eax
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x9ac]
call fcn.00461fb0
lea eax, [ebp - 0x79c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x9a8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x29e]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00462e43
cmp dword [ebp + 0xc], esi
je 0x42845e
xor bl, bl
lea eax, [ebp - 0x9ac]
call fcn.00462026
lea eax, [ebp - 0x38c]
call fcn.0040d8e1
mov al, bl
jmp 0x428334
lea ecx, [ebp - 0x20c]
lea eax, [ebp - 0xfc4]
call fcn.00401b1a
lea eax, [ebp - 0xfc4]
push eax
push str.Extract_pages_complete._Created_file:__s
mov eax, 0x104
lea edi, [ebp - 0xdbc]
call fcn.005383cd
pop ecx
pop ecx
mov eax, edi
push eax
mov eax, ebx
call fcn.004356b1
movzx eax, word [ebp - 0x20c]
xor ecx, ecx
cmp word [ebp - 0x20c], si
lea edx, [ebp - 0x20a]
je 0x4284ca
cmp ecx, 0x103
jae 0x4284ca
mov word [ebx + ecx*2 + 0x2c61], ax
movzx eax, word [edx]
inc ecx
inc edx
inc edx
cmp ax, si
jne 0x4284af
mov word [ebx + ecx*2 + 0x2c61], si
mov bl, 1
jmp 0x428441

Function at 0x42eaf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea esi, [ebx + 0x2c61]
xor edi, edi
cmp word [esi], di
je 0x42eb77
mov ecx, esi
lea eax, [ebp - 0x38c]
call fcn.00401b6e
lea eax, [ebp - 0x38c]
push 0x63c580
push eax
call fcn.00613e25
test eax, eax
pop ecx
pop ecx
jne 0x42eb63
mov edi, dword [ebx + 4]
push str.Loading_PDF_File
lea eax, [ebp - 0x184]
call fcn.0040d84a
push esi
lea eax, [ebp - 0x96]
push eax
lea eax, [ebp + 8]
push eax
mov eax, ebx
call fcn.00432642
lea eax, [ebp - 0x184]
call fcn.0040d8e1
jmp 0x42eb77
push 1
push edi
push edi
push esi
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, ebx
call fcn.004356d9
pop edi
pop esi
pop ebx
leave
ret 4