joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40abf9
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x41c040]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
mov dword [esp + 0x18], ecx
xor ecx, ecx
mov dword [esp + 0x20], eax
inc edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
test ebx, ebx
je 0x40ac37
mov dword [ebx], ecx
push eax
call dword [sym.imp.ntdll.dll_NtDeleteKey]
mov esi, eax
cmp esi, 0xc0000034
jne 0x40ac6d
test byte [ebp + 8], 1
je 0x40aca7
push 2
pop edi
test ebx, ebx
je 0x40ac57
mov dword [ebx], edi
xor eax, eax
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041ba49
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0xc000003a
jne 0x40ac7f
test byte [ebp + 8], 2
je 0x40aca7
push 3
jmp 0x40ac50
cmp esi, 0xc000017c
jne 0x40ac91
test byte [ebp + 8], 4
je 0x40aca7
push 4
jmp 0x40ac50
cmp esi, 0xc0000121
jne 0x40aca3
test byte [ebp + 8], 8
je 0x40aca7
push 5
jmp 0x40ac50
test esi, esi
jns 0x40ac51
mov eax, dword [esp + 0x18]
cmp byte [eax], 0
je 0x40ad59
mov ecx, dword [esp + 0x10]
mov eax, ecx
or eax, dword [esp + 0xc]
jne 0x40ad3f
mov edx, dword [0x7ffe0004]
mov eax, 0x7ffe0324
mov dword [esp + 0x10], edx
mov ecx, dword [eax]
add eax, 0xfffffffc
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov eax, 0x7ffe0328
mov eax, dword [eax]
cmp ecx, eax
je 0x40ad0b
mov edx, 0x7ffe0324
lea ebx, [edx - 4]
lea edi, [edx + 4]
pause
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [esp + 0x14], eax
mov eax, dword [edi]
cmp ecx, eax
jne 0x40acf0
mov ebx, dword [esp + 0x1c]
xor edi, edi
mov edx, dword [esp + 0x10]
inc edi
mov eax, ecx
mul edx
mov ecx, eax
mov eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mul dword [esp + 0x10]
shl ecx, 8
shrd eax, edx, 0x18
shr edx, 0x18
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
jmp 0x40ad43
mov eax, dword [esp + 0xc]
push ecx
push eax
push ecx
mov ecx, dword [esp + 0x24]
push esi
call fcn.004092ff
mov eax, dword [esp + 0x20]
jmp 0x40ac37
mov dword [esp + 0xc], esi
and dword [esp + 0x30], 0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0x402b4c
mov dword [esp + 0x2c], 0x402d70
mov dword [esp + 0x30], 0x49f
call fcn.00408a15
mov eax, esi
jmp 0x40ac59
Function at 0x40ad94
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x41c040]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp + 0x20]
xor esi, esi
push edi
mov edi, dword [ebp + 0x24]
inc ebx
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], esi
test edi, edi
je 0x40ade7
mov dword [edi], esi
mov esi, dword [ebp + 0x1c]
test eax, eax
je 0x40ae06
push esi
push 0
push eax
call sub.ntdll.dll_memset
mov eax, dword [esp + 0x38]
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x18], 0x7ffe0324
mov dword [esp + 0x1c], 0x7ffe0320
mov dword [esp + 0x20], 0x7ffe0328
push ecx
push esi
push eax
push dword [ebp + 0x14]
push dword [esp + 0x44]
push edx
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
cmp esi, 0xc0000023
je 0x40ae41
cmp esi, 0x80000005
jne 0x40ae4b
test byte [ebp + 8], 1
jne 0x40af69
cmp esi, 0xc0000034
jne 0x40ae60
test byte [ebp + 8], 2
je 0x40ae68
push 3
jmp 0x40af6b
test esi, esi
jns 0x40af17
mov eax, dword [esp + 0x28]
cmp byte [eax], 0
je 0x40af36
mov ecx, dword [esp + 0x10]
mov eax, ecx
or eax, dword [esp + 0xc]
jne 0x40af00
mov eax, dword [esp + 0x18]
mov edx, dword [0x7ffe0004]
mov dword [esp + 0x10], edx
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
cmp ecx, eax
je 0x40aecc
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
pause
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [esp + 0x24], eax
mov eax, dword [edi]
cmp ecx, eax
jne 0x40aeb1
mov edi, dword [esp + 0x38]
xor ebx, ebx
mov edx, dword [esp + 0x10]
inc ebx
mov eax, ecx
mul edx
mov ecx, eax
mov eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mul dword [esp + 0x10]
shl ecx, 8
shrd eax, edx, 0x18
shr edx, 0x18
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
jmp 0x40af04
mov eax, dword [esp + 0xc]
push ecx
push eax
push ecx
mov ecx, dword [esp + 0x34]
push esi
call fcn.004092ff
mov ecx, dword [esp + 0x14]
jmp 0x40af22
mov ecx, dword [esp + 0x14]
mov eax, dword [ebp + 0x1c]
cmp eax, dword [ecx]
jb 0x40af88
test esi, esi
jns 0x40af6c
mov eax, dword [esp + 0x2c]
mov esi, dword [ebp + 0x1c]
mov edx, dword [esp + 0x30]
jmp 0x40ae1e
mov dword [esp + 0xc], esi
and dword [esp + 0x48], 0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], 0x402b4c
mov dword [esp + 0x44], 0x402d88
mov dword [esp + 0x48], 0x4e4
call fcn.00408a15
mov eax, esi
jmp 0x40af74
push 2
pop ebx
test edi, edi
je 0x40af72
mov dword [edi], ebx
xor eax, eax
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041ba49
mov esp, ebp
pop ebp
ret 0x20
call fcn.00408a2d
int3
Function at 0x40af93
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x41c040]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x1c]
push ebx
xor ebx, ebx
mov dword [esp + 0xc], ecx
and dword [esp + 4], ebx
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x24]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], esi
push edi
test esi, esi
je 0x40afd8
and dword [esi], ebx
push dword [ebp + 0x20]
push edx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push eax
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov edi, eax
test edi, edi
jns 0x40b0c3
mov eax, dword [esp + 0x14]
cmp byte [eax], 0
je 0x40b090
mov ecx, dword [esp + 0xc]
mov eax, ebx
or eax, ecx
jne 0x40b072
mov edx, dword [0x7ffe0004]
mov ebx, 0x7ffe0324
mov dword [esp + 0xc], edx
mov ecx, dword [ebx]
lea eax, [ebx - 4]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
lea eax, [ebx + 4]
mov eax, dword [eax]
cmp ecx, eax
je 0x40b04c
lea edx, [ebx - 4]
lea esi, [ebx + 4]
pause
mov ecx, dword [ebx]
mov eax, dword [edx]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
cmp ecx, eax
jne 0x40b034
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
mov eax, ecx
mul edx
mov ebx, eax
mov ecx, edx
mov eax, dword [esp + 0x10]
mul dword [esp + 0xc]
shld ecx, ebx, 8
shrd eax, edx, 0x18
shl ebx, 8
shr edx, 0x18
add ebx, eax
adc ecx, edx
mov dword [esp + 0xc], ecx
push ecx
push ecx
mov ecx, dword [esp + 0x1c]
push ebx
push edi
call fcn.004092ff
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x40afd8
mov dword [esp + 0x28], edi
and dword [esp + 0x38], 0
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], 0x402b4c
mov dword [esp + 0x34], 0x402da4
mov dword [esp + 0x38], 0x520
call fcn.00408a15
mov eax, edi
jmp 0x40b0cf
test esi, esi
je 0x40b0cd
mov dword [esi], 1
xor eax, eax
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041ba49
mov esp, ebp
pop ebp
ret 0x20
Function at 0x40b0e8
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x41c040]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
xor ebx, ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0x10]
inc ebx
push edi
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
test edi, edi
je 0x40b12d
mov dword [edi], edx
push ecx
push eax
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov esi, eax
cmp esi, 0xc0000034
jne 0x40b164
test byte [ebp + 8], 1
je 0x40b17a
push 2
pop ebx
test edi, edi
je 0x40b14e
mov dword [edi], ebx
xor eax, eax
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041ba49
mov esp, ebp
pop ebp
ret 0x10
cmp esi, 0xc000017c
jne 0x40b176
test byte [ebp + 8], 2
je 0x40b17a
push 3
jmp 0x40b147
test esi, esi
jns 0x40b148
mov eax, dword [esp + 0x1c]
cmp byte [eax], 0
je 0x40b230
mov ecx, dword [esp + 0x14]
mov eax, ecx
or eax, dword [esp + 0x10]
jne 0x40b212
mov edx, dword [0x7ffe0004]
mov eax, 0x7ffe0324
mov dword [esp + 0x14], edx
mov ecx, dword [eax]
add eax, 0xfffffffc
mov eax, dword [eax]
mov dword [esp + 0x18], eax
mov eax, 0x7ffe0328
mov eax, dword [eax]
cmp ecx, eax
je 0x40b1de
mov edx, 0x7ffe0324
lea edi, [edx - 4]
lea ebx, [edx + 4]
pause
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [esp + 0x18], eax
mov eax, dword [ebx]
cmp ecx, eax
jne 0x40b1c3
mov edi, dword [esp + 0x20]
xor ebx, ebx
mov edx, dword [esp + 0x14]
inc ebx
mov eax, ecx
mul edx
mov ecx, eax
mov eax, edx
shld eax, ecx, 8
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
mul dword [esp + 0x14]
shl ecx, 8
shrd eax, edx, 0x18
shr edx, 0x18
add ecx, eax
mov eax, dword [esp + 0x10]
adc eax, edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x40b216
mov eax, dword [esp + 0x10]
push ecx
push eax
push ecx
mov ecx, dword [esp + 0x28]
push esi
call fcn.004092ff
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
jmp 0x40b12d
mov dword [esp + 0x10], esi
and dword [esp + 0x38], 0
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0x402b4c
mov dword [esp + 0x34], 0x402dc0
mov dword [esp + 0x38], 0x557
call fcn.00408a15
mov eax, esi
jmp 0x40b150
Function at 0x40c657
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x41c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x401364]
or dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], eax
mov eax, dword [0x401368]
mov dword [ebp - 0x18], eax
mov eax, dword [0x40135c]
push ebx
mov dword [ebp - 0x14], eax
mov ebx, ecx
mov eax, dword [0x401360]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push esi
push edi
mov dword [ebp - 0x30], eax
xor edi, edi
lea eax, [ebp - 0x38]
mov dword [ebp - 8], edi
push eax
push 0x20019
lea eax, [ebp - 0x20]
mov dword [ebp - 0x44], edi
push eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov esi, eax
test esi, esi
js 0x40c76d
lea eax, [ebp - 8]
push eax
push edi
push edi
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp esi, 0x80000005
je 0x40c707
cmp esi, 0xc0000023
jne 0x40c736
lea edx, [ebp - 0x44]
mov ecx, eax
call fcn.0041830e
mov edi, dword [ebp - 0x3c]
mov esi, eax
test esi, esi
js 0x40c76d
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push edi
push 2
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
mov eax, dword [ebp - 0xc]
test esi, esi
js 0x40c76d
mov dword [ebp - 0x44], eax
cmp eax, 0x10
jb 0x40c76d
test edi, edi
je 0x40c76d
mov ecx, dword [edi + 8]
mov edx, ebx
call fcn.0041830e
mov esi, eax
test esi, esi
js 0x40c76d
push dword [edi + 8]
lea eax, [edi + 0xc]
push eax
push dword [ebx + 8]
call sub.ntdll.dll_memcpy
mov eax, dword [edi + 8]
add esp, 0xc
mov dword [ebx], eax
cmp esi, 0xc0000034
je 0x40c77d
cmp esi, 0xc000003a
jne 0x40c782
mov esi, 0xc015001a
test edi, edi
je 0x40c78e
lea ecx, [ebp - 0x44]
call fcn.0041a38f
cmp dword [ebp - 0x20], 0xffffffff
je 0x40c79d
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ba49
mov esp, ebp
pop ebp
ret
Function at 0x411622
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x41c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], 0x18
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
push 4
push ebx
push ebx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], ebx
push eax
push 0x2001f
lea eax, [ebp - 8]
mov dword [ebp - 0x18], 0x40
push eax
mov edi, ecx
mov dword [ebp - 0x1c], 0x401374
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ntdll.dll_NtCreateKey]
mov esi, eax
test esi, esi
jns 0x411686
push 0x5d
mov ebx, 0x403760
jmp 0x4116a7
push 0x10
push edi
push 3
push ebx
push 0x40137c
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov esi, eax
test esi, esi
jns 0x4116e6
push 0x66
mov ebx, 0x403848
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], esi
pop edi
test eax, eax
je 0x4116c2
cmp eax, 0xffffffff
je 0x4116c2
and dword [ebp - 8], 0
push eax
call dword [sym.imp.ntdll.dll_NtClose]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x4036ec
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0x403720
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], ebx
call fcn.00408a15
mov eax, esi
jmp 0x4116fe
mov eax, dword [ebp - 8]
test eax, eax
je 0x4116fc
cmp eax, 0xffffffff
je 0x4116fc
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ba49
mov esp, ebp
pop ebp
ret
Function at 0x41307c
Capabilities:
Parse credit card information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
mov edi, edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x10]
mov dword [edi + 8], ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [edi + 4], eax
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ecx
mov eax, dword [ebx + 0x10]
cmp dword [ebx + 0x14], eax
jb 0x4130d0
mov dword [edi + 4], eax
mov dword [edi], 3
xor eax, eax
jmp 0x41319a
mov esi, dword [ebx + 0x18]
mov ecx, esi
call dword [0x41e158]
mov ecx, dword [ebp - 8]
jmp 0x413185
cmp ecx, 0x61
jb 0x4130ed
cmp ecx, 0x7a
jbe 0x41316b
lea eax, [ecx - 0x41]
cmp eax, 0x19
jbe 0x41316b
lea eax, [ecx - 0x30]
cmp eax, 9
jbe 0x41316b
cmp ecx, 0x2f
ja 0x413133
cmp ecx, 0x28
jae 0x413171
cmp ecx, 0xa
je 0x413171
cmp ecx, 0xd
je 0x413171
cmp ecx, 0x1f
jbe 0x413151
cmp ecx, 0x21
jbe 0x413171
cmp ecx, 0x22
jbe 0x413151
cmp ecx, 0x25
jbe 0x413171
cmp ecx, 0x27
jne 0x413151
cmp dword [ebx + 0x24], 0xa
sete al
jmp 0x41316d
cmp ecx, 0x3a
jb 0x413151
cmp ecx, 0x3b
jbe 0x413171
cmp ecx, 0x3d
je 0x413171
cmp ecx, 0x3e
jbe 0x413151
cmp ecx, 0x40
jbe 0x413171
cmp ecx, 0x5f
je 0x413171
mov eax, dword [ebp - 8]
mov dword [edi], 0xc
sub eax, dword [ebx + 0x14]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x10], eax
jmp 0x4130c9
mov al, 1
test al, al
je 0x413151
mov esi, dword [ebx + 0x18]
mov ecx, esi
inc dword [ebp - 0xc]
mov dword [ebp - 8], edx
call dword [0x41e158]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call esi
mov ecx, eax
mov dword [ebp - 0x14], edx
cmp ecx, 0xffffffff
jne 0x4130e3
mov eax, edx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ba49
mov esp, ebp
pop ebp
ret
Function at 0x419946
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x41c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ecx]
push esi
push edi
mov edi, dword [ecx + 8]
lea esi, [ebp - 0x208]
add ebx, edi
mov dword [ebp - 0x210], edx
xor ecx, ecx
mov dword [ebp - 0x218], 0x200
mov dword [ebp - 0x21c], ecx
mov eax, esi
mov dword [ebp - 0x214], eax
cmp edi, ebx
jae 0x419aa9
lea eax, [ebp - 8]
sub eax, esi
and eax, 0xfffffffe
cmp eax, 8
jl 0x419a81
mov dl, cl
mov byte [ebp - 0x209], cl
mov cl, byte [edi]
inc edi
push 0x3d
cmp edi, ebx
je 0x4199c1
mov dl, byte [edi]
inc edi
xor eax, eax
mov word [esi + 4], ax
pop eax
jmp 0x4199c6
pop eax
mov word [esi + 4], ax
cmp edi, ebx
je 0x4199d5
mov al, byte [edi]
inc edi
mov byte [ebp - 0x209], al
xor eax, eax
mov word [esi + 6], ax
movzx ecx, cl
mov eax, ecx
movzx edx, dl
shr eax, 2
and ecx, 3
shl ecx, 4
movzx eax, byte [eax + 0x4050e0]
mov word [esi], ax
mov eax, edx
shr eax, 4
or eax, ecx
mov cl, byte [ebp - 0x209]
movzx eax, byte [eax + 0x4050e0]
mov word [esi + 2], ax
xor eax, eax
cmp word [esi + 4], ax
jne 0x419a2f
and edx, 0xf
movzx eax, cl
shr eax, 6
shl edx, 2
or eax, edx
movzx eax, byte [eax + 0x4050e0]
mov word [esi + 4], ax
xor eax, eax
cmp word [esi + 6], ax
jne 0x419a46
movzx eax, cl
and eax, 0x3f
movzx eax, byte [eax + 0x4050e0]
mov word [esi + 6], ax
add esi, 8
lea eax, [ebp - 8]
cmp esi, eax
jne 0x419a76
push dword [ebp - 0x210]
lea edx, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x200
push ecx
call fcn.0041b6e1
test eax, eax
js 0x419aab
lea esi, [ebp - 0x208]
cmp edi, ebx
jae 0x419a81
xor ecx, ecx
jmp 0x419993
lea eax, [ebp - 0x208]
cmp esi, eax
je 0x419aa9
push dword [ebp - 0x210]
sub esi, eax
lea edx, [ebp - 0x21c]
push ecx
mov dword [ebp - 0x21c], esi
call fcn.0041b6e1
test eax, eax
js 0x419aab
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ba49
mov esp, ebp
pop ebp
ret
Function at 0x401020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.00401fc0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret
Function at 0x402a90
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ffa7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4a0b70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.ARM.0
push 0x490484
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00403590
mov dword [ebp - 4], 0
push str.Adobe_Acrobat
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00403590
mov byte [ebp - 4], 1
push str.Adobe_Reader
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00403590
mov byte [ebp - 4], 2
push 0x4904b4
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00403590
mov byte [ebp - 4], 3
push str.Adobe_Reader_Updater
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00403590
mov byte [ebp - 4], 4
push 0x4904e4
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00403590
mov byte [ebp - 4], 5
push str.ReaderUpdater.exe
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.00403590
mov byte [ebp - 4], 6
push str.AcrobatUpdater.exe
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00403590
mov byte [ebp - 4], 7
push str.AdobeARM.bin
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00403590
mov byte [ebp - 4], 8
push str.RevertToAUM
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.00403590
mov byte [ebp - 4], 9
push str.RevertToSemiFromFullAuto
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00403590
mov byte [ebp - 4], 0xa
push str.DisplayFilesInUseInHandler
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00403590
mov byte [ebp - 4], 0xb
push str.thsnYaVieBoda
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.00403590
mov byte [ebp - 4], 0xc
push str.https:__armmf.adobe.com_arm_manifests_win_
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00403590
mov byte [ebp - 4], 0xd
push str.http:__www.adobe.com_support_downloads_product.jsp_product1platformWindows
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.00403590
mov byte [ebp - 4], 0xe
push str.http:__www.adobe.com_support_downloads_product.jsp_product10platformWindows
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.00403590
mov byte [ebp - 4], 0xf
push str.SOFTWAREAdobeAdobe_ARM1.0ARM
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00403590
mov byte [ebp - 4], 0x10
push str.iLogLevel
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.00403590
mov byte [ebp - 4], 0x11
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00403590
mov byte [ebp - 4], 0x12
push str.AdobeARM.log
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call fcn.00403590
mov byte [ebp - 4], 0x13
push str.AdobeARM_backup.log
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.00403590
mov byte [ebp - 4], 0x14
push str.ForceError
mov ecx, dword [ebp - 0x10]
add ecx, 0x58
call fcn.00403590
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x408b20
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jne 0x408b33
xor al, al
jmp 0x408b65
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.00408920
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x408b63
xor eax, eax
cmp dword [ebp - 4], 0
setne al
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov al, 1
jmp 0x408b65
xor al, al
mov esp, ebp
pop ebp
ret 8

Function at 0x40b895
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 2
test eax, eax
jle 0x40b8d4
push esi
movzx esi, byte [ecx]
xor ebx, ebx
dec eax
inc ecx
mov bh, byte [ecx]
or esi, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or esi, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or esi, ebx
inc ecx
xor edx, esi
test eax, eax
jg 0x40b8af
pop esi
and edi, 3
xor eax, eax
dec edi
je 0x40b8f0
dec edi
je 0x40b8e9
dec edi
jne 0x40b8f5
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
pop edi
xor eax, edx
pop ebx
pop ebp
ret 0xc

Function at 0x40cd0e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0x18]
push esi
push edi
xor edi, edi
cmp byte [ebp + 0x24], 0
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0xc]
mov word [ebx + 0xc], di
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x24], ecx
mov dword [ebx + 0x28], edi
mov esi, 0x8000
jne 0x40cd5e
push esi
push eax
add eax, esi
push eax
call fcn.00431a90
add esp, 0xc
mov word [ebx + 0x2c], di
mov dword [ebx + 0x30], edi
call fcn.0040c767
mov eax, dword [ebx + 0x14]
and dword [ebx + 0x20], edi
push 2
mov word [ebx + 0x3c], si
mov dword [ebx + 0x34], esi
add eax, esi
pop ecx
movzx edi, byte [eax]
mov edx, dword [ebx + 0x20]
shl edx, 5
xor edx, edi
and edx, 0x7fff
inc eax
dec ecx
mov dword [ebx + 0x20], edx
jne 0x40cd7c
cmp byte [ebp + 0x24], cl
je 0x40cda2
mov edi, ebx
call fcn.0040c5c4
jmp 0x40cdb3
xor eax, eax
mov ecx, esi
mov edx, dword [ebx + 0x18]
and word [eax + edx], 0
inc eax
inc eax
dec ecx
jne 0x40cda6
push 8
pop edi
push 0x43
pop edx
mov eax, ebx
call fcn.0040ba09
push 0x4b
pop edx
call fcn.0040ba09
call fcn.0040ca93
mov ecx, dword [ebp + 0x28]
inc eax
inc eax
cmp byte [ebp + 0x24], 0
movzx eax, ax
mov dword [ecx], eax
je 0x40cdf1
mov eax, dword [ebx + 0x14]
push esi
lea ecx, [eax + 0x8000]
push ecx
push eax
call fcn.00431a90
add esp, 0xc
mov eax, dword [ebx + 0x28]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 3
pop ebx
pop ebp
ret 0x24