joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f4aa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
push ebx
mov ebx, dword [ebp + 0xc]
cmp byte [ebx + 0xb0e], 0
push esi
push edi
lea eax, [ebx + 0xb0f]
jne 0x42f4cb
lea eax, [ebx + 0x59]
mov ecx, eax
lea esi, [ebp - 0xa28]
mov dword [ebp + 0xc], eax
call fcn.005375ef
push dword [ebp + 0x10]
mov eax, esi
push eax
push str._s__s.pdf
mov eax, 0x104
lea edi, [ebp - 0xc30]
call fcn.005383cd
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
add esp, 0xc
cmp byte [ebx + 0xb0e], 0
je 0x42f543
lea eax, [ebp - 0x820]
push eax
call fcn.0048a778
xor edi, edi
cmp word [ebp - 0x820], di
lea eax, [ebp - 0x208]
jne 0x42f536
push eax
push edi
push edi
push 5
push edi
mov word [ebp - 0x208], di
call esi
jmp 0x42f553
lea ecx, [ebp - 0x820]
call fcn.00401ad4
jmp 0x42f553
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x208]
call fcn.00401ad4
xor edi, edi
push 0x631a7c
lea eax, [ebp - 0xc30]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x618]
call fcn.0053768f
lea eax, [ebp - 0x410]
push eax
push edi
push edi
push 5
push edi
mov word [ebp - 0x410], di
call esi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push str.PDF__.pdf_
lea ecx, [ebp - 0x410]
push ecx
push str.Save_As
lea ecx, [ebp - 0x618]
push ecx
push eax
mov eax, 0x63c580
call fcn.00536d77
test al, al
je 0x42f5c3
push dword [ebp + 0x14]
lea eax, [ebp - 0x618]
call fcn.00401050
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4321b3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7a0
push edi
push esi
call fcn.00401e3b
test al, al
je 0x4321f7
movzx eax, word [esi]
xor edx, edx
lea ecx, [esi + 2]
jmp 0x4321e7
cmp edx, 0x103
jae 0x4321ec
mov word [ebp + edx*2 - 0x20c], ax
movzx eax, word [ecx]
inc edx
inc ecx
inc ecx
test ax, ax
jne 0x4321d1
and word [ebp + edx*2 - 0x20c], 0
jmp 0x432229
mov edx, dword [ebp + 8]
call fcn.00431411
test eax, eax
je 0x43229f
lea ecx, [eax + 0x59]
lea eax, [ebp - 0x594]
call fcn.00401ad4
push esi
lea eax, [ebp - 0x594]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00401f51
mov eax, dword [ebp + 8]
mov edi, dword [eax + 4]
push str.Loading_PDF_File
lea eax, [ebp - 0x38c]
call fcn.0040d84a
lea ecx, [ebp - 0x20c]
lea eax, [ebp - 0x79c]
call fcn.00401b6e
lea eax, [ebp - 0x79c]
push 0x63c580
push eax
call fcn.00613e25
pop ecx
test eax, eax
pop ecx
lea eax, [ebp - 0x20c]
jne 0x432283
push eax
lea eax, [ebp - 0x29e]
push eax
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 8]
call fcn.00432642
jmp 0x432294
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x38c]
call fcn.0040d8e1
pop edi
leave
ret 4

Function at 0x432cca
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe48
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0
push 0x28
push dword [ebp + 0x10]
lea eax, [ebp - 0x61c]
push eax
mov esi, ecx
call dword [sym.imp.SHLWAPI.dll_PathCompactPathExW]
mov eax, dword [esi]
push 0
lea ecx, [ebp - 0x61c]
push ecx
mov ecx, esi
call dword [eax + 0x20]
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push esi
push eax
call fcn.00459fc8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x432d21
mov dword [ebx], eax
jmp 0x432dc8
mov edx, dword [ebp + 0x10]
push 0x63c580
lea edi, [ebp - 0x20c]
call fcn.00537573
mov eax, edi
push eax
lea eax, [ebp - 0x414]
push eax
push esi
push dword [ebp + 8]
call fcn.00432896
test al, al
jne 0x432d60
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebx], 2
jmp 0x432dc8
mov edx, dword [ebp + 8]
call fcn.00431411
mov edi, eax
test edi, edi
je 0x432d58
lea eax, [ebp - 0xe44]
call fcn.004685c6
push eax
call fcn.00460e89
lea eax, [ebp - 0x20c]
call fcn.0040b166
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xe44]
call fcn.00468660
mov ecx, dword [ebp + 0x10]
lea esi, [ebp - 0x20c]
call fcn.005375ef
mov eax, esi
push eax
lea eax, [ebp - 0xe44]
call fcn.0046860c
lea eax, [ebp - 0xe44]
push eax
push edi
call fcn.00460f90
and dword [ebx], 0
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x458f4d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc44
push ebx
push esi
xor ebx, ebx
mov esi, ecx
cmp byte [esi + 8], bl
push edi
mov word [ebp - 0x418], bx
mov edi, 0x63c580
je 0x458f7b
push edi
lea eax, [ebp - 0x418]
push eax
call fcn.00401df5
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 0x625]
mov dword [ebp - 8], eax
call fcn.0040106b
neg eax
sbb al, al
inc al
mov byte [ebp - 1], al
lea eax, [ebp - 0x210]
jne 0x458fa8
push eax
mov eax, dword [ebp + 0x10]
call fcn.00401050
jmp 0x458fbe
push edi
push eax
call fcn.00401df5
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0x10]
call fcn.00401d61
cmp byte [esi + 8], bl
mov eax, dword [ebp + 8]
mov dword [eax], ebx
lea edi, [ebp - 0x418]
jne 0x458fd1
mov edi, dword [ebp - 8]
mov eax, dword [esi + 4]
cmp eax, ebx
sete cl
cmp eax, ebx
mov byte [ebp + 0x10], cl
jne 0x458fe4
mov eax, dword [esi]
jmp 0x458fe7
push 0x64
pop eax
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push edi
push eax
lea eax, [ebp - 0x8e8]
push eax
call fcn.005052ea
cmp byte [esi + 8], bl
je 0x459016
lea eax, [esi + 0x419]
push eax
lea eax, [ebp - 0x8e8]
call fcn.00505386
lea eax, [ebp - 0x627]
push eax
push dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x8e8]
push eax
call fcn.0051abc9
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x8e8]
mov dword [edi], eax
mov dword [ebp - 0x8e8], 0x692f38
call fcn.0051ab53
cmp byte [ebp - 1], bl
je 0x45905f
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [edi], ebx
jne 0x4590d8
cmp byte [esi + 8], bl
je 0x4590d4
add esi, 9
lea edi, [ebp - 0xc40]
mov word [ebp - 0xc40], bx
mov word [ebp - 0xa38], bx
mov word [ebp - 0x830], bx
mov dword [ebp - 0x628], ebx
mov word [ebp - 0x624], bx
call fcn.0046335a
lea eax, [ebp - 0x624]
push eax
mov eax, dword [ebp - 8]
call fcn.00401050
lea eax, [ebp - 0x418]
push eax
mov eax, edi
push eax
push dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
call fcn.00462c6c
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp + 8]
cmp dword [edi], ebx
je 0x4590e0
push dword [ebp - 8]
call fcn.00401d4e
cmp dword [edi], 2
jne 0x459135
push 0x46
xor ecx, ecx
pop eax
mov edx, 0x643002
cmp ecx, 0x103
jae 0x459109
mov esi, dword [ebp + 0x14]
mov word [esi + ecx*2], ax
movzx eax, word [edx]
inc ecx
inc edx
inc edx
cmp ax, bx
jne 0x4590ef
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 8]
push eax
mov word [esi + ecx*2], bx
mov dword [ebp + 8], ebx
call fcn.0054a941
mov eax, dword [ebp + 8]
add eax, eax
cmp eax, 0x80000000
jb 0x459135
push str.._Not_enough_memory_to_complete_the_operation.
mov eax, esi
call fcn.00497951
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x45ad60
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
mov esi, eax
mov eax, dword [edi]
push str.Reading_File
mov ecx, edi
call dword [eax + 0x20]
mov eax, dword [esi]
test eax, eax
je 0x45ad90
and word [eax], 0
and dword [esi + 4], 0
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x50
je 0x45adbc
push dword [ebp + 0x14]
push str._s_is_not_a_vaild_file
mov esi, edi
call fcn.00539645
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
mov dword [eax], 2
jmp 0x45aec0
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
call fcn.00401b6e
lea eax, [ebp - 0x20c]
push 0x63c580
push eax
call fcn.00613e25
test eax, eax
pop ecx
pop ecx
je 0x45adeb
push dword [ebp + 0x14]
push str._s_is_not_a_PDF_file
jmp 0x45ada5
push dword [ebp + 0x18]
lea eax, [ebx + 0x19]
push 0x8000
push dword [ebp + 0x14]
lea ecx, [ebp + 8]
push edi
push ecx
mov edi, eax
call fcn.0050d29b
lea edi, [ebx + 0x25]
mov eax, edi
call fcn.00496a8a
test al, al
jne 0x45ae19
push edi
call fcn.00496af2
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x45ae2a
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x45aec0
mov edx, dword [ebp + 0x14]
mov edi, 0x104
push edi
lea esi, [ebx + 0x59]
call fcn.0053838b
mov edx, dword [ebp + 0x14]
push edi
lea esi, [ebx + 0x261]
call fcn.0053838b
lea eax, [ebx + 0x19]
call fcn.0040ae9b
test eax, eax
jbe 0x45ae83
mov edi, eax
push 0xb5
call fcn.00538281
test eax, eax
pop ecx
je 0x45ae70
mov esi, eax
call fcn.0047138d
jmp 0x45ae72
xor eax, eax
dec edi
mov ecx, dword [ebx + 0x469]
mov dword [eax], ecx
mov dword [ebx + 0x469], eax
jne 0x45ae58
push ebx
call fcn.00461298
mov esi, dword [ebp + 0x10]
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
call fcn.00461685
mov ecx, dword [eax]
test ecx, ecx
jne 0x45ae20
lea eax, [ebp + 0x15]
push eax
lea eax, [ebx + 0x695]
call fcn.0048a68a
fld1
mov eax, dword [esi]
push ecx
push ecx
mov ecx, esi
fstp qword [esp]
call dword [eax + 0x24]
mov eax, dword [ebp + 0xc]
and dword [eax], 0
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x45b7ef
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push str..ppad
lea eax, [ebp - 0x208]
push eax
call fcn.00401df5
push dword [ebp + 0x14]
lea eax, [ebp - 0x208]
push eax
mov eax, dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0045b583
cmp dword [esi], 0
jne 0x45b845
push 3
push dword [ebp + 0x10]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x45b840
mov dword [esi], 2
cmp dword [esi], 0
je 0x45b852
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
leave
ret 0x10
Function at 0x45e69b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0x618]
push eax
call fcn.0048a7e4
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x410]
call fcn.00401b1a
push 0x631a7c
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x208]
call fcn.0053768f
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x208]
push eax
lea edi, [ebx + 0x261]
push edi
call fcn.00401d61
test al, al
jne 0x45e714
mov eax, str.DOC_Backup
call fcn.005362d8
xor al, al
jmp 0x45e77e
mov eax, dword [ebx + 0x4d]
test eax, eax
je 0x45e731
mov esi, dword [eax + 8]
call fcn.00549962
mov eax, dword [esi]
lea ecx, [ebp - 0x208]
push ecx
mov ecx, esi
call dword [eax + 4]
movzx eax, word [ebp - 0x208]
xor ecx, ecx
cmp word [ebp - 0x208], cx
lea edx, [ebp - 0x206]
je 0x45e760
cmp ecx, 0x103
jae 0x45e760
mov word [edi + ecx*2], ax
movzx eax, word [edx]
inc ecx
inc edx
inc edx
test ax, ax
jne 0x45e749
and word [edi + ecx*2], 0
lea esi, [ebx + 0xb0e]
cmp byte [esi], 0
je 0x45e77c
add ebx, 0x59
push ebx
call fcn.00401d4e
mov byte [esi], 0
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x45e785
Capabilities:
Set file attributes

Disassembly:
push esi
push edi
mov esi, eax
call fcn.00401d4e
push edi
lea eax, [esi + 0x261]
push eax
mov eax, 0xbb8
call fcn.005366ba
test al, al
jne 0x45e7bf
add esi, 0x59
push esi
call fcn.005372a1
test al, al
jne 0x45e7bb
mov eax, str.DOC_Copy
call fcn.005362d8
xor al, al
pop esi
ret
push edi
call fcn.00401e52
test al, al
je 0x45e7d5
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov al, 1
pop esi
ret
Function at 0x46892d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
push ebx
push esi
push edi
mov esi, eax
push str..PNG
lea eax, [ebp - 0x324]
push eax
call fcn.00401df5
lea eax, [ebp - 0x324]
push eax
push dword [ebp + 0xc]
call fcn.0054be40
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp + 0xc]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 8], ebx
call fcn.004f2c7d
fld qword [0x6946d0]
mov eax, dword [esi]
push ecx
push ecx
mov ecx, esi
fstp qword [esp]
call dword [eax + 0x24]
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 0xc]
invalid
Function at 0x48a719
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
xor eax, eax
lea ecx, [ebp - 0x208]
push ecx
push eax
push eax
push 5
push eax
mov word [ebp - 0x208], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x631ae0
push 0x644a28
lea eax, [ebp - 0x208]
push eax
push 0x631a80
mov eax, 0x104
call fcn.005383cd
add esp, 0x10
leave
ret
Function at 0x49369b
Capabilities:
Get file attributes

Disassembly:
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and al, 0x50
neg al
sbb eax, eax
inc eax
ret
Function at 0x4a741d
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, eax
cmp byte [edi + 0x22], 0
je 0x4a745f
push ebx
push esi
mov esi, dword [edi + 0x1a]
push 0
mov ebx, 0x257f
push ebx
mov byte [edi + 0x22], 0
call fcn.005657de
mov eax, dword [edi + 0x1a]
push 0
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [edi + 0x1a]
lea edi, [esi + 0x3e]
call fcn.0040da9f
pop esi
pop ebx
pop edi
ret
Function at 0x4cb70a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3cc
push ebx
call fcn.00538682
xor ebx, ebx
test al, al
je 0x4cb759
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4cb725
sub eax, edx
mov ecx, 0x3ca
cmp eax, ecx
jb 0x4cb759
mov edx, dword [ebp + 8]
push esi
push ecx
lea esi, [ebp - 0x3cc]
call fcn.00538365
push 1
push ebx
push ebx
mov eax, esi
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop esi
jmp 0x4cb768
push 1
push ebx
push ebx
push dword [ebp + 8]
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebx
leave
ret 4

Function at 0x4cb76d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push esi
lea eax, [ebp + 8]
push eax
push esi
push 2
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallPicoPDF
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4cb7b0
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push str.EstimatedSize
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 8

Function at 0x4cb815
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp + 0xc]
push eax
push 2
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cb878
push esi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 0xc]
call esi
cmp eax, 2
jne 0x4cb86e
push edi
push dword [ebp + 0x10]
mov eax, 0x104
push 0x67b408
lea edi, [ebp - 0x208]
call fcn.005383cd
pop ecx
pop ecx
mov eax, edi
push eax
push dword [ebp + 0xc]
call esi
pop edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 0xc
Function at 0x4cb87c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
push ebx
push esi
push edi
push 0x44
pop edi
push edi
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.005fc0d0
mov ax, word [ebp + 8]
mov dword [ebp - 0x5c], edi
mov word [ebp - 0x2c], ax
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
movzx eax, word [esi]
mov dword [ebp - 0x30], 1
xor edx, edx
lea ecx, [esi + 2]
jmp 0x4cb8d8
cmp edx, 0x207
jae 0x4cb8dd
mov word [ebp + edx*2 - 0x46c], ax
movzx eax, word [ecx]
inc edx
inc ecx
inc ecx
cmp ax, bx
jne 0x4cb8c2
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
lea eax, [ebp - 0x46c]
push eax
push ebx
mov word [ebp + edx*2 - 0x46c], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4cb934
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0x4e20
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x14]
mov edi, eax
call esi
mov eax, edi
neg eax
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x20
jmp 0x4cb936
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4cc342
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._Ix__wt
mov eax, 0x104
lea edi, [ebp - 0x410]
call fcn.005383cd
pop ecx
pop ecx
mov eax, edi
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call fcn.00401f51
push 0x1388
push 2
push 0
push 0xc0000000
lea eax, [ebp - 0x208]
push eax
call fcn.005365d4
cmp eax, 0xffffffff
pop edi
je 0x4cc3b4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
jmp 0x4cc3b6
xor al, al
leave
ret 4

Function at 0x4cfb5b
Capabilities:
Encode data using xor

Disassembly:
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4cfb60
push 0
pop edx
sub eax, ecx
sar eax, 1
push edx
pop ecx
je 0x4cfb8f
push edi
movzx edi, word [esi + edx*2]
add edi, ecx
imul edi, edi, 0x401
mov ecx, edi
shr edi, 6
xor ecx, edi
inc edx
cmp edx, eax
jb 0x4cfb76
pop edi
imul ecx, ecx, 9
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret

Function at 0x4d12c2
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
cmp byte [0x6a9b5a], 0
jne 0x4d12e7
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov byte [0x6a9b5a], 1
add esp, 0x190
ret
Function at 0x4d12ee
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
mov esi, 0x104
lea edi, [ebp - 0x104]
call fcn.004cbc9e
mov eax, edi
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [ebx], eax
jne 0x4d1340
mov eax, edi
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4d133d
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x4d133d
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebx], eax
jmp 0x4d1340
and dword [ebx], 0
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x4df088
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
fldz
push ebx
mov ebx, dword [ebp + 0xc]
fstp qword [ebp - 0x18]
fld qword [0x694368]
push esi
push edi
fstp qword [ebp - 0x10]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
lea edi, [ebp + 0xc]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x646570
call fcn.004dbba1
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4df0ce
mov eax, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x4df1b8
movzx eax, word [esi]
xor ecx, ecx
test ax, ax
mov byte [ebp - 5], 1
je 0x4df0f5
movzx eax, ax
cmp ax, 0x80
jae 0x4df0f1
inc ecx
movzx eax, word [esi + ecx*2]
test ax, ax
jne 0x4df0df
jmp 0x4df0f5
mov byte [ebp - 5], 0
fld qword [0x6946d8]
mov eax, dword [ebx]
push ecx
push ecx
mov ecx, ebx
fstp qword [esp]
call dword [eax + 0x24]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
test al, al
je 0x4df11f
mov eax, dword [ebp + 8]
mov dword [eax], 1
jmp 0x4df1b8
mov edi, 0x6ac000
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [ebp - 5], 0
mov byte [ebp + 0xf], 0
je 0x4df143
push dword [ebp + 0x10]
push esi
call fcn.0058a897
mov byte [ebp + 0xf], al
jmp 0x4df184
push str..zip
lea eax, [ebp - 0x22c]
push eax
call fcn.00401df5
lea eax, [ebp - 0x22c]
push eax
push esi
call fcn.00401d61
test al, al
je 0x4df184
push dword [ebp + 0x10]
lea eax, [ebp - 0x22c]
push eax
call fcn.0058a897
mov byte [ebp + 0xf], al
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
fld1
mov eax, dword [ebx]
push ecx
push ecx
mov ecx, ebx
fstp qword [esp]
call dword [eax + 0x24]
cmp byte [ebp + 0xf], 0
lea eax, [ebp + 0x10]
je 0x4df1a1
and dword [ebp + 0x10], 0
jmp 0x4df1a8
mov dword [ebp + 0x10], 2
mov eax, dword [eax]
mov esi, dword [ebp + 8]
push edi
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4efefc
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push ebx
push esi
push edi
mov ebx, 0x104
mov esi, eax
push ebx
call fcn.0053838b
lea eax, [esi + 0x410]
xor ecx, ecx
lea edi, [esi + 0x41c]
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
call fcn.00496932
xor eax, eax
mov dword [esi + 0x420], eax
mov byte [esi + 0x424], al
mov dword [esi + 0x425], eax
mov dword [esi + 0x429], eax
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x63f728
lea eax, [esi + 0x208]
push eax
call fcn.00401df5
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x4f3e19
Capabilities:
Delete registry key

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [esp + 0x10]
push eax
mov ebp, 0xf003f
push ebp
push 0
mov edi, str.SoftwareMicrosoftWindowsCurrentVersion
push edi
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call esi
test eax, eax
jne 0x4f3e5c
push str.UninstallPicoPDF
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 0xf013f
push 0
push edi
push ebx
call esi
test eax, eax
mov ebx, str.UninstallPicoPDF
jne 0x4f3e8a
push ebx
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push ebp
push 0
push edi
mov ebp, SysReAllocString
push ebp
call esi
test eax, eax
jne 0x4f3eb4
push ebx
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 0xf013f
push 0
push edi
push ebp
call esi
test eax, eax
jne 0x4f3edd
push ebx
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4f3ee3
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
call fcn.004012d6
test al, al
je 0x4f3f30
push str._usermode
call fcn.005386c5
test al, al
je 0x4f3f30
call fcn.00538508
test al, al
je 0x4f3f30
cmp byte [ebp + 8], 0
mov eax, str._uninstall__quiet
jne 0x4f3f1c
mov eax, str._uninstall
push 1
push eax
mov eax, dword [0x6a9b2c]
push dword [eax]
call fcn.00547f65
jmp 0x4f4035
push esi
lea eax, [ebp - 0x244]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, 0x631a7c
push esi
push str.nchuninst
lea eax, [ebp - 0x244]
push eax
call fcn.0053768f
lea ecx, [ebp - 0x244]
call fcn.00537db1
lea ecx, [ebp - 0x244]
call fcn.00537bf5
push esi
push str.uninst.exe
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x44c]
call fcn.0053768f
lea eax, [ebp - 0x44c]
push eax
mov eax, dword [0x6a9b2c]
push dword [eax]
call fcn.00401d61
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.005fc0d0
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x2c], eax
add esp, 0xc
cmp byte [ebp + 8], 0
lea eax, [ebp - 0x244]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0x100
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], str._uninstall2__quiet
jne 0x4f3fdd
mov dword [ebp - 0x28], str._uninstall2
mov dword [ebp - 0x20], 1
call fcn.004012d6
test al, al
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
je 0x4f4027
mov eax, dword [0x6a9b2c]
mov ecx, dword [eax]
lea eax, [ebp - 0x654]
call fcn.00401ad4
lea eax, [ebp - 0x654]
push eax
call fcn.004cc342
test al, al
jne 0x4f4027
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x30], str.runas
call esi
cmp eax, 1
je 0x4f4034
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x30], 0x665b90
call esi
pop esi
leave
ret 4