joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417ed7
Capabilities:
Encode data using xor

Disassembly:
push 0x48
mov eax, 0x46d09a
call fcn.0045182f
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], edi
lea eax, [ebp + 0xc]
push eax
xor ebx, ebx
lea eax, [ebp - 0x2c]
inc ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00417d04
pop ecx
pop ecx
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00417948
mov dword [ebp - 0x50], ebx
cmp dword [ebp - 0x18], edi
jbe 0x417f41
push edi
lea ecx, [ebp - 0x2c]
call fcn.00417609
mov cl, byte [0x49a29c]
xor byte [eax], cl
push edi
lea ecx, [ebp - 0x2c]
call fcn.00417609
movzx eax, byte [eax]
push eax
mov ecx, esi
call fcn.00417a0f
inc edi
cmp edi, dword [ebp - 0x18]
jb 0x417f16
push dword [esi]
lea ecx, [ebp - 0x48]
call fcn.004167c3
mov edi, dword [ebp + 0x28]
dec edi
mov byte [ebp - 4], 3
test edi, edi
jle 0x417f93
push dword [ebp + 0x2c]
lea eax, [ebp - 0x48]
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
push eax
call fcn.0041637f
lea eax, [ebp - 0x4c]
push eax
call fcn.00417ed7
add esp, 0x28
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.00417c14
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00415687
inc edi
cmp dword [ebp + 0x2c], edi
jne 0x417fc4
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
sub eax, dword [ebp + 0x2c]
mov ecx, esi
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00417ace
push eax
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00417c14
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.00415687
push 0
push ebx
lea ecx, [ebp - 0x48]
call fcn.00415ce1
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00415ce1
push 0
push ebx
lea ecx, [ebp + 0xc]
call fcn.00415ce1
mov eax, esi
call fcn.004518b2
ret
Function at 0x41b5ad
Capabilities:
Encode data using xor

Disassembly:
push 0xc8
mov eax, 0x46d5ba
call fcn.0045182f
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x50], edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], edi
call fcn.00417d04
pop ecx
pop ecx
mov byte [ebp - 4], 1
call fcn.0042f5fc
push eax
lea ecx, [ebp - 0x4c]
call fcn.00417796
xor esi, esi
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], edi
jbe 0x41b623
push esi
lea ecx, [ebp - 0x2c]
call fcn.00417609
mov cl, byte [0x49a29c]
xor byte [eax], cl
push esi
lea ecx, [ebp - 0x2c]
call fcn.00417609
movsx ax, byte [eax]
movzx eax, ax
push eax
lea ecx, [ebp - 0x4c]
call fcn.0041a541
inc esi
cmp esi, dword [ebp - 0x18]
jb 0x41b5f3
mov esi, dword [ebp + 0x28]
dec esi
cmp esi, edi
jle 0x41b6b1
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xd4]
call fcn.0041981e
push dword [eax]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 3
call fcn.004167c3
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 5
cmp dword [ebp - 0xd4], eax
je 0x41b669
push dword [ebp - 0xd4]
call fcn.00451343
pop ecx
push dword [ebp + 0x2c]
lea eax, [ebp - 0x48]
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x50], esp
push eax
call fcn.0041637f
lea eax, [ebp - 0x50]
push eax
call fcn.0041b5ad
add esp, 0x28
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 6
call fcn.0041a6b2
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.00415687
push edi
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00415ce1
inc esi
cmp dword [ebp + 0x2c], esi
jne 0x41b6e9
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax - 0xc]
sub eax, dword [ebp + 0x2c]
lea ecx, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.00419d87
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 7
call fcn.0041a6b2
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00415687
lea ecx, [ebp - 0x4c]
call fcn.0041a60e
mov ecx, eax
call fcn.0041a657
push eax
mov ecx, ebx
call fcn.004190d2
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.00415687
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00415ce1
push edi
push 1
lea ecx, [ebp + 0xc]
call fcn.00415ce1
mov eax, ebx
call fcn.004518b2
ret
Function at 0x41f539
Capabilities:
Create directory

Disassembly:
push 8
mov eax, 0x470b06
call fcn.004517c6
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [esi + 0x28], eax
lea eax, [esi + 0x20]
push eax
call fcn.00453048
pop ecx
call fcn.0042f5fc
push eax
lea ecx, [ebp + 8]
call fcn.00417796
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0xc]
xor ebx, ebx
cmp dword [ecx - 0xc], ebx
mov dword [ebp - 4], ebx
jg 0x41f5b7
push dword [eax + 4]
lea eax, [ebp - 0x14]
push eax
call fcn.00414501
mov eax, dword [eax]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 8]
push 0x5c
push eax
push ecx
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.0041467c
add esp, 0x18
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.00417c14
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00415687
jmp 0x41f5d7
mov eax, dword [eax + 8]
push 0x5c
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041467c
add esp, 0x10
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.00417c14
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.00415687
mov eax, dword [esi + 8]
mov eax, dword [eax + 8]
push ebx
push eax
call dword [0x476318]
mov eax, dword [esi + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x14]
call fcn.0041795c
mov edi, dword [ebp - 0x14]
push edi
mov byte [ebp - 4], 4
call dword [0x4766b8]
push esi
mov esi, dword [ebp + 8]
push ebx
push esi
push edi
push ebx
call fcn.0046a87e
cmp eax, ebx
jge 0x41f632
mov dword [ebp - 0x10], eax
push 0x49149c
lea eax, [ebp - 0x10]
push eax
call fcn.004512f7
lea ecx, [edi - 0x10]
call fcn.00415687
lea ecx, [esi - 0x10]
call fcn.00415687
call fcn.0045189e
ret 4
Function at 0x4202ba
Capabilities:
Delete file
Set environment variable

Disassembly:
push 0x38
mov eax, 0x470fbc
call fcn.004517c6
xor ebx, ebx
push 8
mov dword [ebp - 4], ebx
call fcn.0042d50e
pop ecx
cmp eax, ebx
je 0x4202e2
mov dword [eax + 4], ebx
mov dword [eax], 0x4776e0
jmp 0x4202e4
xor eax, eax
cmp dword [0x49a9a0], 0xfffffffe
mov dword [ebp - 0x14], eax
mov esi, 0x49d950
jne 0x42033e
push esi
push 2
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x47f254
call fcn.004167c3
lea eax, [ebp - 0x18]
push eax
call fcn.0041b5ad
add esp, 0x28
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00419804
push eax
call fcn.00420083
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov dword [0x49a9a0], eax
mov byte [ebp - 4], bl
call fcn.00415687
cmp dword [0x49a9a0], 0xffffffff
je 0x4204ab
lea ecx, [ebp + 8]
call fcn.00418c88
push eax
lea ecx, [ebp - 0x18]
call fcn.00420276
push ebx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00419804
push eax
call fcn.0041ffc3
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push 1
push ebx
mov dword [ebp - 0x24], edi
call dword [0x476724]
cmp edi, ebx
je 0x42048b
push ebx
push esi
push dword [ebp - 0x10]
mov ecx, edi
call fcn.0041ffe1
cmp eax, 0xffffffff
je 0x42048b
push ebx
call dword [0x4765cc]
push 0x10
mov dword [ebp - 0x14], eax
call fcn.0042d50e
pop ecx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x4203c8
mov ecx, eax
call fcn.00433db6
mov esi, eax
jmp 0x4203ca
xor esi, esi
push dword [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00434228
lea ecx, [ebp - 0x34]
call fcn.00433db6
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.00433db6
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 5
call fcn.0041ff5b
push esi
lea ecx, [ebp - 0x44]
call fcn.0041ff5b
push 8
call fcn.0042d50e
pop ecx
cmp eax, ebx
je 0x420419
mov dword [eax + 4], ebx
mov dword [eax], 0x4776e0
mov edi, eax
jmp 0x42041b
xor edi, edi
push ebx
push dword [ebp - 0x10]
call fcn.00420041
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
mov dword [ebp - 0x1c], ebx
call fcn.0042005f
push dword [ebp - 0x20]
mov ecx, edi
call fcn.004344f8
cmp edi, ebx
jne 0x42044a
xor eax, eax
jmp 0x42044d
mov eax, dword [edi + 4]
push eax
push dword [ebp - 0x30]
call fcn.004345d7
push dword [ebp - 0x14]
push ebx
call dword [0x4765d0]
cmp esi, ebx
je 0x42046d
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 4
call fcn.004342a5
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.004342a5
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, ebx
je 0x4204a0
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00415687
push dword [ebp + 8]
call dword [0x476354]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x4204be
mov ebx, dword [eax + 4]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00415687
mov eax, ebx
call fcn.0045189e
ret
Function at 0x424039
Capabilities:
Resume thread

Disassembly:
push 0
mov eax, 0x471b36
call fcn.004517c6
mov edi, ecx
push 0x20
mov dword [ebp - 4], 2
call fcn.0042d50e
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x424067
mov ecx, eax
call fcn.0042085f
mov esi, eax
jmp 0x424069
xor esi, esi
lea eax, [ebp + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00417c14
lea eax, [ebp + 0x10]
push eax
lea ecx, [esi + 0x10]
call fcn.00417c14
mov eax, dword [edi + 0x124]
mov dword [esi + 4], eax
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 8]
call fcn.00417c14
mov eax, dword [edi + 0x20]
push ebx
push 4
push ebx
push ebx
push esi
push 0x423d36
mov dword [esi], eax
mov byte [esi + 0x14], bl
mov byte [esi + 0x15], bl
call fcn.00431775
lea ecx, [edi + 0x148]
mov dword [ecx], eax
cmp eax, ebx
je 0x4240cd
mov dword [eax + 0x28], ebx
mov eax, dword [ecx]
push dword [eax + 0x2c]
call dword [0x47635c]
jmp 0x4240db
mov byte [edi + 0x14d], 1
mov byte [edi + 0x14e], 1
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00415687
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00415687
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00415687
call fcn.0045189e
ret 0xc

Function at 0x4280e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push 0x44
xor esi, esi
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.00451110
add esp, 0xc
push dword [ebp + 0xc]
lea eax, [ebp - 0x44]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x44], 0x44
push esi
call dword [0x4762e4]
test eax, eax
setne al
pop esi
leave
ret 8

Function at 0x42f6e0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov ecx, dword [esi + 0x24]
sub ecx, 0x10
mov dword [esi], 0x4833b8
call fcn.00416687
mov ecx, dword [esi + 0x20]
sub ecx, 0x10
call fcn.00416687
mov ecx, dword [esi + 0x1c]
sub ecx, 0x10
call fcn.00416687
mov ecx, dword [esi + 0x18]
sub ecx, 0x10
pop esi
jmp fcn.00416687

Function at 0x4517b7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49c1dc]
jne 0x4517c1
repz ret
jmp fcn.0045bbfc
Function at 0x45cbf2
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x496be0
call fcn.0045442c
mov eax, dword [ebp - 0x14]
sub esp, 0x328
mov dword [0x4ac7d0], eax
mov dword [0x4ac7cc], ecx
mov dword [0x4ac7c8], edx
mov dword [0x4ac7c4], ebx
mov dword [0x4ac7c0], esi
mov dword [0x4ac7bc], edi
mov word [0x4ac7e8], ss
mov word [0x4ac7dc], cs
mov word [0x4ac7b8], ds
mov word [0x4ac7b4], es
mov word [0x4ac7b0], fs
mov word [0x4ac7ac], gs
pushfd
pop dword [0x4ac7e0]
mov eax, dword [ebp]
mov dword [0x4ac7d4], eax
mov eax, dword [ebp + 4]
mov dword [0x4ac7d8], eax
lea eax, [ebp + 8]
mov dword [0x4ac7e4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4ac720], 0x10001
mov eax, dword [0x4ac7d8]
mov dword [0x4ac6d4], eax
mov dword [0x4ac6c8], 0xc0000409
mov dword [0x4ac6cc], 1
mov eax, dword [0x49c1dc]
mov dword [ebp - 0x328], eax
mov eax, dword [0x49c1e0]
mov dword [ebp - 0x324], eax
call dword [0x476178]
mov dword [0x4ac718], eax
push 1
call fcn.0045ab5a
pop ecx
push 0
call dword [0x476174]
push 0x486b1c
sbb al, 0x6b
dec eax
add bh, bh
adc eax, 0x476170
cmp dword [0x4ac718], 0
jne 0x45ccee
push 1
call fcn.0045ab5a
pop ecx
push 0xc0000409
call dword [0x476364]
push eax
call dword [0x47638c]
leave
ret

Function at 0x45ccd3
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x496be0
call fcn.0045442c
mov eax, dword [ebp - 0x14]
sub esp, 0x328
mov dword [0x4ac7d0], eax
mov dword [0x4ac7cc], ecx
mov dword [0x4ac7c8], edx
mov dword [0x4ac7c4], ebx
mov dword [0x4ac7c0], esi
mov dword [0x4ac7bc], edi
mov word [0x4ac7e8], ss
mov word [0x4ac7dc], cs
mov word [0x4ac7b8], ds
mov word [0x4ac7b4], es
mov word [0x4ac7b0], fs
mov word [0x4ac7ac], gs
pushfd
pop dword [0x4ac7e0]
mov eax, dword [ebp]
mov dword [0x4ac7d4], eax
mov eax, dword [ebp + 4]
mov dword [0x4ac7d8], eax
lea eax, [ebp + 8]
mov dword [0x4ac7e4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4ac720], 0x10001
mov eax, dword [0x4ac7d8]
mov dword [0x4ac6d4], eax
mov dword [0x4ac6c8], 0xc0000409
mov dword [0x4ac6cc], 1
mov eax, dword [0x49c1dc]
mov dword [ebp - 0x328], eax
mov eax, dword [0x49c1e0]
mov dword [ebp - 0x324], eax
call dword [0x476178]
mov dword [0x4ac718], eax
push 1
call fcn.0045ab5a
pop ecx
push 0
call dword [0x476174]
push 0x486b1c
sbb al, 0x6b
dec eax
add bh, bh
adc eax, 0x476170
cmp dword [0x4ac718], 0
jne 0x45ccee
push 1
call fcn.0045ab5a
pop ecx
push 0xc0000409
call dword [0x476364]
push eax
call dword [0x47638c]
leave
ret
Function at 0x467454
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00459bd4
and dword [ebp - 4], 0
cmp dword [0x4acf98], 0
mov ebx, eax
jne 0x467505
push str.USER32.DLL
call dword [0x476344]
mov edi, eax
test edi, edi
je 0x4675b6
mov esi, dword [0x476348]
push 0x488c74
push edi
call esi
test eax, eax
je 0x4675b6
push eax
call fcn.00459b62
mov dword [esp], 0x488c64
push edi
mov dword [0x4acf98], eax
call esi
push eax
call fcn.00459b62
mov dword [esp], 0x488c50
push edi
mov dword [0x4acf9c], eax
call esi
push eax
call fcn.00459b62
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4acfa0], eax
call esi
push eax
call fcn.00459b62
pop ecx
mov dword [0x4acfa8], eax
test eax, eax
je 0x467505
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00459b62
pop ecx
mov dword [0x4acfa4], eax
mov eax, dword [0x4acfa4]
cmp eax, ebx
je 0x46755d
cmp dword [0x4acfa8], ebx
je 0x46755d
push eax
call fcn.00459bdd
push dword [0x4acfa8]
mov esi, eax
call fcn.00459bdd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x46755d
test edi, edi
je 0x46755d
call esi
test eax, eax
je 0x467554
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x467554
test byte [ebp - 0xc], 1
jne 0x46755d
or dword [ebp + 0x10], 0x200000
jmp 0x467596
mov eax, dword [0x4acf9c]
cmp eax, ebx
je 0x467596
push eax
call fcn.00459bdd
pop ecx
test eax, eax
je 0x467596
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x467596
mov eax, dword [0x4acfa0]
cmp eax, ebx
je 0x467596
push eax
call fcn.00459bdd
pop ecx
test eax, eax
je 0x467596
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4acf98]
call fcn.00459bdd
pop ecx
test eax, eax
je 0x4675b6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4675b8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x351e1e66
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xd0532ef
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401151
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov esi, ecx
lea eax, [esi + 8]
xor ebx, ebx
cmp dword [eax + 0x14], 8
jb 0x401161
mov eax, dword [eax]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
cmp eax, ebx
je 0x4011a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401187
mov al, 1
mov byte [esi + 0x24], al
pop esi
pop ebx
ret
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], ebx
mov byte [esi + 0x24], bl
pop esi
mov al, bl
pop ebx
ret

Function at 0x404bc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
test esi, esi
je 0x404bd8
cmp dword [edi], 2
jae 0x404bd8
mov eax, 0x7a
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push esi
add eax, eax
lea edx, [ebp + 8]
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0
mov dword [edi], 0
mov ecx, dword [eax]
push str.PendingFileRenameOperations
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404c46
cmp dword [ebp + 8], 7
je 0x404c16
mov eax, 0xd
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
test esi, esi
je 0x404c40
test cl, 1
jne 0x404c0b
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x404c0b
cmp word [esi + eax*2 - 2], 0
jne 0x404c0b
cmp eax, 1
jbe 0x404c40
cmp word [esi + eax*2 - 4], 0
jne 0x404c0b
shr ecx, 1
mov dword [edi], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x407a90
Capabilities:
Delete directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
push edi
push str.cleanUSF:_Deleting_Path__s
call fcn.00415aa0
mov ebx, 0x576f68
call fcn.00416090
push 0x208
call fcn.00416703
add esp, 0xc
push edi
mov esi, eax
push 0x104
push esi
call fcn.0051641f
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x5c
push 0
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
push esi
test eax, eax
jne 0x407af4
call fcn.004166f8
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub eax, esi
sar eax, 1
xor ecx, ecx
push str.Setting_current_directory_to__s
mov word [esi + eax*2], cx
call fcn.00415aa0
mov ebx, 0x576f68
call fcn.00416090
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push edi
call fcn.00407730
add esp, 4
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x407b4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Error_in_deleting_folder__s._Error_Code:_d
call fcn.00415aa0
call fcn.004160f0
add esp, 0xc
push 0x208
call fcn.00416703
add esp, 4
push esi
mov ebx, eax
push 0x104
push ebx
call fcn.0051641f
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
add esp, 0xc
push 0x5c
push 0
push ebx
call edi
xor edx, edx
push 0x5c
sub eax, ebx
push edx
sar eax, 1
push ebx
mov word [ebx + eax*2], dx
call edi
sub eax, ebx
sar eax, 1
xor ecx, ecx
push ebx
mov word [ebx + eax*2], cx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ebx
call fcn.004166f8
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x407bcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Error_in_deleting_folder__s._Error_Code:_d
call fcn.00415aa0
mov ebx, 0x576f68
call fcn.004160f0
add esp, 0xc
push 0x5c
push 0
push esi
call edi
test eax, eax
je 0x407c0b
sub eax, esi
sar eax, 1
xor edx, edx
push esi
mov word [esi + eax*2], dx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x407c0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Error_in_deleting_folder__s._Error_Code:_d
call fcn.00415aa0
mov ebx, 0x576f68
call fcn.004160f0
add esp, 0xc
push esi
call fcn.004166f8
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408b60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x408b7b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x408bb2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x408bae
jmp 0x408ba0
cmp esi, eax
jae 0x408bb2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x408ba0
cmp esi, eax
jb 0x408bb9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40fdd0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5a10e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [esi + 0xf0], 0
push ebx
push edi
jne 0x40ff6d
mov edx, dword [esi + 0x2c]
mov eax, edx
lea edi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40fe00
sub eax, edi
push edx
sar eax, 1
add eax, 0x18
push str._s_resourcesAdobePIM.dll
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.005169e4
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0xf0], eax
test eax, eax
jne 0x40fe66
push str.Unable_to_load_pim.dll
mov eax, dword [esi + 0x50]
mov ebx, 0x576f68
call fcn.00416120
add esp, 4
xor al, al
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00515d64
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.pim_createLibraryRefWithType
push eax
call edi
mov dword [esi + 0x104], eax
test eax, eax
jne 0x40fe85
push str.Unable_to_locate_pim_createLibraryRefWithType_function
jmp 0x40fe44
mov edx, dword [esi + 0xf0]
push str.pim_freeLiraryRef
push edx
call edi
mov dword [esi + 0x108], eax
test eax, eax
jne 0x40fea4
push str.Unable_to_locate_pim_freeLiraryRef_function
jmp 0x40fe44
mov eax, dword [esi + 0xf0]
push str.pim_installPackage
push eax
call edi
mov dword [esi + 0x10c], eax
test eax, eax
jne 0x40fec3
push str.Unable_to_locate_pim_installPackage_function
jmp 0x40fe44
mov ecx, dword [esi + 0xf0]
push str.pim_haveEnoughDiskSpaceToInstallPackagesCInterface
push ecx
call edi
mov dword [esi + 0x110], eax
test eax, eax
jne 0x40fee5
push str.Unable_to_locate_pim_haveEnoughDiskSpaceToInstallPackagesCInterface_function
jmp 0x40fe44
mov edx, dword [esi + 0xf0]
push str.pim_registerProgressTicksCallback
push edx
call edi
mov dword [esi + 0x114], eax
test eax, eax
jne 0x40ff07
push str.Unable_to_locate_pim_registerProgressTicksCallback_function
jmp 0x40fe44
mov eax, dword [esi + 0xf0]
push str.pim_getCurrentPIMCFPath
push eax
call edi
mov dword [esi + 0x118], eax
test eax, eax
jne 0x40ff29
push str.Unable_to_locate_pim_getCurrentPIMCFPath_function
jmp 0x40fe44
mov ecx, dword [esi + 0xf0]
push str.pim_createOrUpdateAAMInventory
push ecx
call edi
mov dword [esi + 0x11c], eax
test eax, eax
jne 0x40ff4b
push str.Unable_to_locate_pim_createOrUpdateAAMInventory_function
jmp 0x40fe44
mov edx, dword [esi + 0xf0]
push str.pim_postInstallPackages
push edx
call edi
mov dword [esi + 0x120], eax
test eax, eax
jne 0x40ff6d
push str.Unable_to_locate_pim_postInstallPackages_function
jmp 0x40fe44
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00515d64
mov esp, ebp
pop ebp
ret