joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aa780
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x526190
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
xor bl, bl
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x40], eax
mov dword [ecx + 0x14], 0
cmp dword [eax + 0x10], 0
mov byte [ebp - 0x2d], bl
mov dword [ebp - 0x2c], str.AdobeUpdater.exe
mov dword [ebp - 0x28], str.Adobe_Updater.exe
mov dword [ebp - 0x24], str.ReaderUpdater.exe
mov dword [ebp - 0x20], str.AcrobatUpdater.exe
mov dword [ebp - 0x1c], str.Acrobat.exe
mov dword [ebp - 0x18], str.AcroRdUWP.exe
je 0x4aa816
xor esi, esi
mov ecx, eax
call fcn.00423ea0
push eax
push dword [ebp + esi*4 - 0x2c]
call fcn.00409df7
add esp, 8
test eax, eax
je 0x4aa836
mov eax, dword [ebp - 0x40]
inc esi
cmp esi, 6
jb 0x4aa7f5
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 8
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
movq qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov esi, 0x20
mov dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x3c]
call fcn.004af540
mov ebx, dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
push eax
push 0x80
push ebx
mov dword [ebp - 0x14], 0
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x4aa8c9
lea esp, [esp]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x3c]
shr eax, 2
cmp eax, esi
jb 0x4aa95a
add esi, esi
push esi
call fcn.004af540
mov ebx, dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
push eax
lea eax, [esi*4]
mov dword [ebp - 0x14], 0
push eax
push ebx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x4aa890
mov eax, ebx
mov dword [ebp - 0x38], eax
sub eax, ebx
xor edi, edi
sar eax, 2
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4aa933
lea esp, [esp]
mov eax, dword [ebx + edi*4]
push eax
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00476b10
add esp, 8
cmp dword [ebp - 0x18], 8
lea esi, [ebp - 0x2c]
mov ecx, dword [ebp - 0x40]
cmovae esi, dword [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00423ea0
push eax
push esi
call fcn.00409df7
add esp, 8
test eax, eax
je 0x4aa96b
cmp dword [ebp - 0x18], 8
mov byte [ebp - 4], 0
jb 0x4aa92d
push dword [ebp - 0x2c]
call fcn.004085be
add esp, 4
inc edi
cmp edi, dword [ebp - 0x14]
jb 0x4aa8e0
xor esi, esi
test ebx, ebx
je 0x4aa942
push ebx
call fcn.004085be
add esp, 4
test esi, esi
je 0x4aa981
mov eax, dword [ebp - 0x48]
mov dword [eax + 0x14], 1
mov dword [eax + 0x1c], esi
mov al, 1
jmp 0x4aa818
push eax
call fcn.004af540
mov eax, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x3c]
jmp 0x4aa8ce
cmp dword [ebp - 0x18], 8
mov esi, dword [ebp - 0x44]
jb 0x4aa935
push dword [ebp - 0x2c]
call fcn.004085be
add esp, 4
jmp 0x4aa935
mov al, byte [ebp - 0x2d]
jmp 0x4aa818
Function at 0x4aff20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x526a88
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
lea esi, [ecx + 0x1c]
push esi
mov dword [ebp - 0x38], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [ebp - 4], 0
xor eax, eax
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 1
mov ecx, dword [eax + 4]
mov edi, dword [eax + 0x14]
sub ecx, dword [eax]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x4b003d
lea ebx, [edi + edi*2]
shl ebx, 3
cmp eax, edi
jbe 0x4b00ae
mov ecx, dword [ebp - 0x34]
push 0x54bd1c
mov eax, dword [ecx]
add eax, ebx
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0042e6e0
add esp, 0xc
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040af40
cmp dword [ebp - 0x3c], 8
mov byte [ebp - 4], 1
jb 0x4affed
push dword [ebp - 0x50]
call fcn.004085be
add esp, 4
mov eax, dword [ebp - 0x34]
inc edi
add ebx, 0x18
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, edi
ja 0x4affae
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4b003d
lea ecx, [ebx - 1]
cmp ebx, ecx
jae 0x4b0026
push str.invalid_string_position
call fcn.004f78dc
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
xor edx, edx
mov word [eax + ecx*2], dx
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], 0
test ebx, ebx
je 0x4b00b8
push 0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWAREAdobeAcrobat_ReaderDCPrivileged
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4b00b8
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
add eax, eax
push eax
push ecx
push 1
push 0
push str.tHostWhiteList
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [ebp - 0x30]
test eax, eax
push dword [ebp - 0x2c]
mov ecx, 1
movzx ebx, bl
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4b00bb
push str.invalid_vector_T__subscript
call fcn.004f78dc
mov ebx, dword [ebp - 0x30]
cmp dword [ebp - 0x14], 8
jb 0x4b00cc
push dword [ebp - 0x28]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
push esi
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
Function at 0x4b51a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52741b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x238], edi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
jne 0x4b51e6
mov al, 1
jmp 0x4b5345
xor bl, bl
cmp dword [esi + 0x14], 8
jb 0x4b51f2
mov eax, dword [esi]
jmp 0x4b51f4
mov eax, esi
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x4b5213
cmp eax, 0x50
je 0x4b5213
cmp eax, 0xb7
jne 0x4b5343
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.004f9050
add esp, 0xc
mov dword [ebp - 0x220], 7
xor eax, eax
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x234]
mov word [ebp - 0x234], ax
push 0xffffffffffffffff
push eax
push esi
call fcn.00407d00
cmp dword [ebp - 0x220], 8
lea edx, [ebp - 0x234]
mov ecx, dword [edi]
cmovae edx, dword [ebp - 0x234]
push edx
push 0
mov eax, dword [ecx]
push 0
mov dword [ebp - 4], 0
call dword [eax + 0x60]
test eax, eax
jne 0x4b532c
cmp dword [ebp - 0x220], 8
lea esi, [ebp - 0x234]
lea ecx, [ebp - 0x21c]
mov edx, 0x105
cmovae esi, dword [ebp - 0x234]
mov eax, ecx
xor edi, edi
sub esi, eax
lea eax, [edx + 0x7ffffef9]
test eax, eax
je 0x4b52cf
movzx eax, word [esi + ecx]
test ax, ax
je 0x4b52cf
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x4b52b1
jmp 0x4b52d3
test edx, edx
jne 0x4b52db
sub ecx, 2
mov edi, 0x8007007a
xor eax, eax
mov word [ecx], ax
test edi, edi
js 0x4b532c
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x4b532c
push 0x54a898
push 0x105
lea eax, [ebp - 0x21c]
push eax
call fcn.0042ede0
test eax, eax
js 0x4b532c
mov ecx, dword [ebp - 0x238]
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
mov ecx, dword [ecx]
mov eax, dword [ecx]
call dword [eax + 0x60]
test eax, eax
sete bl
cmp dword [ebp - 0x220], 8
jb 0x4b5343
push dword [ebp - 0x234]
call fcn.004085be
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 4

Function at 0x4b5370
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [esi + 0x10], 0
je 0x4b53b6
cmp dword [esi + 0x14], 8
jb 0x4b538a
mov eax, dword [esi]
jmp 0x4b538c
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b53b6
cmp dword [esi + 0x14], 8
jb 0x4b539f
mov esi, dword [esi]
mov ecx, dword [edi]
push esi
push 5
push 2
mov eax, dword [ecx]
call dword [eax + 0x60]
neg eax
pop edi
sbb eax, eax
inc eax
pop esi
pop ebp
ret 4
pop edi
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x4b53c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52745e
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x57fd48]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x430], 0
test al, 1
jne 0x4b5441
or eax, 1
mov dword [0x57fd48], eax
xor eax, eax
mov dword [ebp - 4], 0
push 0x52c6b0
mov dword [0x57fd44], 7
mov dword [0x57fd40], 0
mov word [0x57fd30], ax
call fcn.00405b6d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [0x57fd2c], 0
jne 0x4b54ef
lea eax, [ebp - 0x42c]
mov byte [0x57fd2c], 1
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAeDebug
push 0x80000002
mov dword [ebp - 0x42c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b54ef
push 0x410
push eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x420]
push eax
call fcn.004f9050
add esp, 0xc
mov dword [ebp - 0x428], 0x410
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push str.Debugger
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b54e3
lea eax, [ebp - 0x420]
mov ecx, 0x57fd30
push eax
call fcn.0040b8c0
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x57fd30
mov word [esi], ax
call fcn.00407d00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x4b5660
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x527506
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x57fd68]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x80], 0
test al, 1
jne 0x4b56dc
or eax, 1
mov dword [0x57fd68], eax
xor eax, eax
mov dword [ebp - 4], 0
push 0x52c5f0
mov dword [0x57fd64], 7
mov dword [0x57fd60], 0
mov word [0x57fd50], ax
call fcn.00405b6d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [0x57fd4c], 0
jne 0x4b5873
lea eax, [ebp - 0x48]
mov byte [0x57fd4c], 1
push eax
call fcn.004b53c0
add esp, 4
cmp dword [ebp - 0x38], 0
mov dword [ebp - 4], 1
je 0x4b585b
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004800c0
add esp, 8
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 2
je 0x4b584a
lea eax, [ebp - 0x28]
xor bl, bl
push 0
push eax
call fcn.0041f410
add esp, 8
test al, al
je 0x4b5822
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHELL32.dll_PathIsExe]
test eax, eax
jne 0x4b5766
push 0x54d380
lea ecx, [ebp - 0x28]
call fcn.0042ec80
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push str.drwtsn32.exe
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00409df7
add esp, 8
test eax, eax
jne 0x4b57aa
push eax
push str.drwtsn32.exe
lea eax, [ebp - 0x7c]
push 0x29
push eax
call fcn.0042ef80
add esp, 0x10
lea ecx, [ebp - 0x28]
push eax
call fcn.00407e20
lea ecx, [ebp - 0x7c]
call fcn.004087d0
jmp 0x4b5822
lea ecx, [ebp - 0x64]
call fcn.004710c0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 3
call fcn.00471480
test al, al
je 0x4b5812
xorps xmm0, xmm0
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x30], xmm0
call fcn.00471070
xor eax, eax
mov dword [ebp - 0x68], 7
mov dword [ebp - 0x6c], 0
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x7c]
push 1
push eax
call fcn.0047f910
add esp, 0xc
lea ecx, [ebp - 0x7c]
mov bl, al
call fcn.004087d0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.004710e0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.00471100
test bl, bl
je 0x4b584a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b584a
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28]
mov ecx, 0x57fd50
push eax
call fcn.00407d00
cmp dword [ebp - 0x14], 8
jb 0x4b585b
push dword [ebp - 0x28]
call fcn.004085be
add esp, 4
cmp dword [ebp - 0x34], 8
mov dword [ebp - 4], 0xffffffff
jb 0x4b5873
push dword [ebp - 0x48]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x57fd50
mov word [esi], ax
call fcn.00407d00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x4b5c90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x527652
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x220], ebx
mov byte [ebp - 0x219], bl
test esi, esi
je 0x4b5d22
cmp word [esi], bx
je 0x4b5d22
push esi
lea ecx, [ebp - 0x238]
call fcn.004076f0
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x238]
push 0
mov ebx, 1
push eax
mov dword [ebp - 0x220], ebx
call fcn.0041f410
add esp, 8
test al, al
jne 0x4b5d22
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b5d22
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov byte [ebp - 0x21a], bl
test eax, eax
jne 0x4b5d29
mov byte [ebp - 0x21a], 0
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x4b5d4c
cmp dword [ebp - 0x224], 8
jb 0x4b5d4c
push dword [ebp - 0x238]
call fcn.004085be
add esp, 4
cmp byte [ebp - 0x21a], 0
je 0x4b5dae
push esi
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00403897
add esp, 0xc
test eax, eax
jne 0x4b5dae
push str.Common
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x4b5dae
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b5daa
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4b5daa
mov al, 1
jmp 0x4b5db4
xor al, al
jmp 0x4b5db4
mov al, byte [ebp - 0x219]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x4bb010
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x527ac8
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x25c], 0
lea ecx, [ebp - 0x254]
push 0x2b
xor eax, eax
mov dword [ebp - 0x258], 0
push str.SoftwareAdobeRepairAcrobat_ReaderDCIOD
xor bh, bh
mov dword [ebp - 0x240], 7
mov dword [ebp - 0x244], 0
mov word [ebp - 0x254], ax
call fcn.00407750
push 0x2e
xor eax, eax
mov dword [ebp - 4], 0
push str.SoftwareAdobeAcrobat_ReaderDCInstallerIOD
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x228], 7
mov dword [ebp - 0x22c], 0
mov word [ebp - 0x23c], ax
call fcn.00407750
cmp dword [ebp - 0x240], 8
lea ecx, [ebp - 0x258]
push ecx
push 0x20019
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x254]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4bb126
cmp dword [ebp - 0x228], 8
lea ecx, [ebp - 0x258]
push ecx
push 0x20019
lea eax, [ebp - 0x23c]
cmovae eax, dword [ebp - 0x23c]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4bb226
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004f9050
add esp, 0xc
mov dword [ebp - 0x224], 0x20a
lea eax, [ebp - 0x224]
mov dword [ebp - 0x220], 0
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push str.Library
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4bb21a
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x274]
call fcn.004076f0
lea eax, [ebp - 0x274]
mov byte [ebp - 4], 2
push 0
push eax
mov dword [ebp - 0x25c], 1
call fcn.0041f410
add esp, 8
test al, al
jne 0x4bb1ca
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4bb1ca
mov bl, 1
jmp 0x4bb1cc
xor bl, bl
cmp dword [ebp - 0x260], 8
mov dword [ebp - 4], 1
jb 0x4bb1ea
push dword [ebp - 0x274]
call fcn.004085be
add esp, 4
test bl, bl
je 0x4bb21a
call fcn.00440170
test al, al
je 0x4bb21a
lea eax, [ebp - 0x21c]
push eax
call fcn.0040f410
test eax, eax
je 0x4bb21a
push str.MaintenanceRepair
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [edi], eax
setne bh
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x228], 8
jb 0x4bb23d
push dword [ebp - 0x23c]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0x228], 7
cmp dword [ebp - 0x240], 8
mov dword [ebp - 0x22c], 0
mov word [ebp - 0x23c], ax
jb 0x4bb271
push dword [ebp - 0x254]
call fcn.004085be
add esp, 4
mov al, bh
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x4c0650
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x527c52
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], 0
xor ecx, ecx
mov edi, 0x57fdd0
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x4c07da
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], eax
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
push 0x20019
push str.SOFTWAREMicrosoftOffice11.0CommonInstallRoot
push 0x80000002
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.0040dca0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
push ecx
push str.Path
mov ecx, eax
mov dword [ebp - 0x44], 1
call fcn.004197c0
test eax, eax
jne 0x4c070e
cmp dword [ebp - 0x30], eax
je 0x4c070e
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c070e
mov bl, 1
jmp 0x4c0710
xor bl, bl
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], 1
call fcn.0040dfb0
test bl, bl
je 0x4c072a
mov ecx, 1
jmp 0x4c079e
push 0x20019
push str.SOFTWAREMicrosoftOffice11.0OutlookInstallRoot
push 0x80000002
lea ecx, [ebp - 0x4c]
call fcn.0040dca0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
push ecx
push str.Path
mov ecx, eax
mov dword [ebp - 0x44], 2
call fcn.004197c0
test eax, eax
jne 0x4c077f
cmp dword [ebp - 0x18], eax
je 0x4c077f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c077f
mov bl, 1
jmp 0x4c0781
xor bl, bl
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], 1
call fcn.0040dfb0
mov ecx, 1
test bl, bl
jne 0x4c079e
mov ecx, 2
xor eax, eax
lock cmpxchg dword [edi], ecx
cmp dword [ebp - 0x14], 8
jb 0x4c07b5
push dword [ebp - 0x28]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
jb 0x4c07da
push dword [ebp - 0x40]
call fcn.004085be
add esp, 4
xor ecx, ecx
xor eax, eax
lock cmpxchg dword [edi], ecx
dec eax
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x4cd190
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x78], 0
je 0x4cd1bc
cmp dword [esi + 0x7c], 0
je 0x4cd1bc
cmp dword [esi + 0x80], 0
je 0x4cd1bc
cmp dword [esi + 0x84], 0
je 0x4cd1bc
cmp dword [esi + 0x88], 0
jne 0x4cd22f
push str.prntvpt.dll
call fcn.0042ea80
mov edi, eax
add esp, 4
test edi, edi
jne 0x4cd1d5
pop edi
pop esi
xor al, al
pop ebx
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PTOpenProvider
push edi
call ebx
mov dword [esi + 0x78], eax
test eax, eax
je 0x4cd1cf
push str.PTConvertDevModeToPrintTicket
push edi
call ebx
mov dword [esi + 0x7c], eax
test eax, eax
je 0x4cd1cf
push str.PTCloseProvider
push edi
call ebx
mov dword [esi + 0x80], eax
test eax, eax
je 0x4cd1cf
push str.PTConvertPrintTicketToDevMode
push edi
call ebx
mov dword [esi + 0x84], eax
test eax, eax
je 0x4cd1cf
push str.PTReleaseMemory
push edi
call ebx
mov dword [esi + 0x88], eax
test eax, eax
je 0x4cd1cf
pop edi
pop esi
mov al, 1
pop ebx
ret

Function at 0x4ce210
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x527b38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x4ce335
cmp byte [ebx + 0x45], 0
je 0x4ce335
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4ce264
xor al, al
jmp 0x4ce337
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x40]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4ce2ce
dec eax
je 0x4ce2d2
sub eax, 2
je 0x4ce31e
xor bl, bl
jmp 0x4ce320
mov byte [ebx + 0x45], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x4ce304
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004fc90e
add esp, 0x10
cmp esi, eax
jne 0x4ce2ca
cmp byte [ebx + 0x45], 0
je 0x4ce31e
test esi, esi
jne 0x4ce294
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00471550
jmp 0x4ce294
mov bl, 1
cmp dword [ebp - 0x14], 0x10
jb 0x4ce331
push dword [ebp - 0x28]
call fcn.004085be
add esp, 4
mov al, bl
jmp 0x4ce337
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret