joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434d20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x41f015
lea edi, [esi - 0x1e015]
push edi
or ebp, 0xffffffff
jmp 0x434d42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x434d49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x434d38
mov eax, 1
add ebx, ebx
jne 0x434d5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x434d50
jne 0x434d6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x434d50
xor ecx, ecx
sub eax, 3
jb 0x434d80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x434df2
mov ebp, eax
add ebx, ebx
jne 0x434d8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x434d98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x434dbc
inc ecx
add ebx, ebx
jne 0x434da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x434d9d
jne 0x434db9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x434d9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x434ddc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x434dcd
jmp 0x434d3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x434ddc
add edi, ecx
jmp 0x434d3e
pop esi
mov edi, esi
mov ecx, 0x8c2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x434dfa
cmp byte [edi], 2
jne 0x434dfa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x434dff
lea edi, [esi + 0x32000]
mov eax, dword [edi]
or eax, eax
je 0x434e6e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x36668]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x36754]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x434e2c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3675c]
or eax, eax
je 0x434e68
mov dword [ebx], eax
add ebx, 4
jmp 0x434e49
call dword [esi + 0x36758]
mov ebp, dword [esi + 0x36760]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x434ea2
sub esp, 0xffffff80
jmp 0x401240

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x1058e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1058e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1058e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1058e06a
add dl, dl
jne 0x1058e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1058e0dc
xor eax, eax
add dl, dl
jne 0x1058e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1058e17d
add dl, dl
jne 0x1058e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1058e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1058e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1058e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1058e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1058e075
mov eax, 1
add dl, dl
jne 0x1058e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1058e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1058e0e1
sub eax, ebx
mov ebx, 1
jne 0x1058e128
mov ecx, 1
add dl, dl
jne 0x1058e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1058e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1058e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1058e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1058e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1058e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1058e136
cmp eax, 0x7d00
jae 0x1058e16d
cmp eax, 0x500
jb 0x1058e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1058e075
cmp eax, 0x7f
ja 0x1058e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1058e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1058e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1058e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4026af
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x754
xor eax, eax
push esi
push eax
push eax
push eax
lea ecx, [ebp - 8]
push eax
push ecx
push eax
mov byte [ebp - 1], al
push eax
lea eax, [ebp - 4]
push eax
mov byte [ebp - 4], 0x63
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea ecx, [ebp - 0x754]
call fcn.0040275e
lea eax, [ebp - 0x754]
push eax
call fcn.00402243
lea eax, [ebp - 0x344]
push eax
call sub.MSVCRT.dll_wcslen
shl eax, 1
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.004027d0
mov esi, eax
lea eax, [ebp - 0x54c]
push eax
call sub.MSVCRT.dll_wcslen
shl eax, 1
push eax
lea eax, [ebp - 0x54c]
push eax
jmp loc.0041b362

Function at 0x4027d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
or esi, 0xffffffff
cmp byte [0x4077bc], 0
jne 0x4027e9
jmp loc.0041b000
xor eax, eax
cmp dword [esp + 0xc], eax
jle 0x402816
mov ecx, dword [esp + 8]
mov edx, esi
and edx, 0xff
movzx ecx, byte [eax + ecx]
xor ecx, edx
shr esi, 8
mov ecx, dword [ecx*4 + 0x4073bc]
xor esi, ecx
inc eax
cmp eax, dword [esp + 0xc]
jl 0x4027f1
mov eax, esi
pop esi
not eax
ret

Function at 0x40281c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x4073bc
push 8
mov eax, edx
pop esi
test al, 1
je 0x402836
shr eax, 1
xor eax, 0xedb88320
jmp 0x402838
shr eax, 1
dec esi
jne 0x402829
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x4077bc
jl 0x402824
pop esi
ret

Function at 0x402865
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
lea eax, [ebp - 4]
push esi
push eax
push 0x20
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402944
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
lea eax, [ebp - 0x3c]
push eax
push esi
mov word [ebp - 0x3c], 0x53
mov word [ebp - 0x3a], 0x65
mov word [ebp - 0x38], 0x53
mov word [ebp - 0x36], 0x68
mov word [ebp - 0x34], 0x75
mov word [ebp - 0x32], 0x74
mov word [ebp - 0x30], 0x64
mov word [ebp - 0x2e], 0x6f
mov word [ebp - 0x2c], 0x77
mov word [ebp - 0x2a], 0x6e
mov word [ebp - 0x28], 0x50
mov word [ebp - 0x26], 0x72
mov word [ebp - 0x24], 0x69
mov word [ebp - 0x22], 0x76
mov word [ebp - 0x20], 0x69
mov word [ebp - 0x1e], 0x6c
mov word [ebp - 0x1c], 0x65
mov word [ebp - 0x1a], 0x67
mov word [ebp - 0x18], 0x65
mov word [ebp - 0x16], si
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret
Function at 0x4059a6
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
test edi, edi
pop ecx
mov esi, eax
jbe 0x4059d1
mov eax, dword [esp + 0xc]
push ebx
mov ecx, esi
sub eax, esi
mov edx, edi
mov bl, byte [eax + ecx]
xor bl, 0x42
mov byte [ecx], bl
inc ecx
dec edx
jne 0x4059c4
pop ebx
push 0x408230
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edi
push esi
call fcn.00404b97
push esi
mov edi, eax
call fcn.00405a0a
add esp, 0x18
mov eax, edi
pop edi
pop esi
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0

Function at 0x1004d145
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1004d154
pop dword [ebp - 0x34]
mov eax, 0x612847f1
add eax, 0xaedc8963
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x7b9d1ddc
sub dword [ebp - 0x44], 0x2d4ad891
mov dword [ebp - 0x40], 0x653fefd
sub dword [ebp - 0x40], 0xd420b2b8
mov dword [ebp - 0x3c], 0xba28224c
add dword [ebp - 0x3c], 0x922421e2
mov dword [ebp - 0x38], 0x66453216
sub dword [ebp - 0x38], 0x66453216
lea eax, [ebp - 0x44]
push eax
mov eax, 0x601dbcfd
add eax, 0xafe9440f
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x219d04f8
add dword [ebp - 0x44], 0x52d5645e
mov dword [ebp - 0x40], 0x65614fd0
add dword [ebp - 0x40], 0xdc0b11a5
mov dword [ebp - 0x3c], 0x895386e8
add dword [ebp - 0x3c], 0xda1be584
mov dword [ebp - 0x38], 0x44191969
sub dword [ebp - 0x38], 0x44191969
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xe2e1eb6c
add eax, 0x2d2514d4
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x688d1
push 0
call eax
mov ecx, 0xd27e7fc8
sub ecx, 0xd27e3305
xor edi, edi
add edi, eax
mov ebx, 0x14875a48
sub ebx, 0x47f0e48
add ebx, dword [ebp - 0x34]
mov esi, 0xdfed9c9f
sub esi, 0x89c502f4
mov edx, dword [ebx]
sub dword [ebp - 0x1c], edx
add edx, esi
mov dword [edi], edx
xor dword [ebp - 0x14], edx
add edi, 0xcfb808b8
add edi, 0x3047f74c
add ebx, 0x49c06685
add ebx, 0xb63f997f
loop 0x1004d278
add eax, 0xf4e34710
sub eax, 0xf4e22131
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x6ae46adb
add ecx, 0xa51b9525
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x408919
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, 0x4085d8
inc ecx
or esi, esi
call fcn.00408940
add esi, 1
xor dword [ebx], edx
sub esi, esi
inc ebx
cmp ebx, edi
jne fcn.00408919
sub esi, esi
ret
Function at 0x1000128f
Capabilities:
Query environment variable

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 8], ebx
je 0x100012b2
push 0x104
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x100012b2
mov bl, 1
mov al, bl
pop ebx
ret

Function at 0x100017d8
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x10011265
call fcn.10002bb0
mov eax, dword [ebp + 8]
push 0x104
push eax
xor edi, edi
push edi
push edi
xor ecx, ecx
push 0x10012858
mov word [eax], cx
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x1000184c
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__NULL__pPath__MAX_PATH_
call fcn.1000230d
pop ecx
pop ecx
push edi
push esi
call fcn.10005b84
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10002085
push eax
push esi
push 0x100124f4
call fcn.1000230d
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x10001845
ret
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100018fd
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x100018a9
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x10001810
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100018fd
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x100018fd
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x10001810
mov eax, esi
call fcn.10002be6
ret

Function at 0x10002390
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10016040]
jne 0x1000239a
repz ret
jmp fcn.100046fe
Function at 0x10005b84
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10005b93
pop dword [ebp - 0x48]
mov eax, 0xff2b1238
sub eax, 0xef2ab6a5
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xd5d2cbd4
sub dword [ebp - 0x58], 0x87808689
mov dword [ebp - 0x54], 0x13b9c7bb
sub dword [ebp - 0x54], 0xe1867b76
mov dword [ebp - 0x50], 0x5957c1af
sub dword [ebp - 0x50], 0xd0b7d81
mov dword [ebp - 0x4c], 0xe76f3021
sub dword [ebp - 0x4c], 0xe76f3021
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x9a1dbb98
sub dword [ebp - 0x58], 0x25ab5242
mov dword [ebp - 0x54], 0x62efc5c4
sub dword [ebp - 0x54], 0x2183644f
mov dword [ebp - 0x50], 0xab192b44
add dword [ebp - 0x50], 0xb8564128
mov dword [ebp - 0x4c], 0x63aafdca
add dword [ebp - 0x4c], 0x9c550236
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xb86b854b
sub eax, 0xa86a6517
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3b614
push 0
call eax
mov ecx, 0x48532458
sub ecx, 0x4852d5c6
mov edi, eax
mov esi, 0x76e2e6d1
add esi, 0x991f532f
add esi, dword [ebp - 0x48]
mov ebx, 0x85febad2
sub ebx, 0xb07288d
add dword [ebp - 0x34], 0xd0efec63
mov edx, dword [esi]
mov dword [ebp - 0x28], 0x26ef7b00
xor edx, ebx
sub dword [ebp - 0x2c], edx
mov dword [edi], edx
add edi, 0xfb585831
add edi, 0x4a7a7d3
add esi, 4
loop 0x10005cb0
add eax, 0x480315c6
sub eax, 0x4801e8ab
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x9001690
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x90de124]
jne 0x900169a
repz ret
jmp fcn.0909ebfc

Function at 0x9013f61
Capabilities:
Check os version

Disassembly:
push 0x118
mov eax, 0x90a2736
call fcn.09004c60
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x124], edi
call fcn.0900373e
lea eax, [ebp - 0x4c]
xor ebx, ebx
push eax
mov edx, esi
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.09015738
pop ecx
test al, al
jne 0x9013fbf
lea eax, [ebp - 0x4c]
push eax
call fcn.0906031b
pop ecx
test al, al
jne 0x9013fbf
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.090167a9
mov eax, esi
call fcn.09005591
ret
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
je 0x9014150
cmp dword [ebp - 0x110], 6
sbb al, al
inc al
je 0x9014150
push str.CDMP
lea ecx, [ebp - 0x4c]
call fcn.090168fc
test al, al
je 0x9014150
lea ecx, [ebp - 0x68]
call fcn.0900373e
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 4], 1
call fcn.0903b6c0
pop ecx
test al, al
je 0x901411d
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.09056076
mov esi, str..icc
push esi
call dword [sym.imp.MSVCR100.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.0903b6c0
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x9014065
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x68]
call fcn.0903b6c0
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 3
call fcn.090183d0
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 4
call fcn.0903b6c0
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x68]
call fcn.0903b6c0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0903b6c0
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x90140e1
lea eax, [ebp - 0x68]
push eax
push edi
call fcn.090178a6
pop ecx
pop ecx
lea ecx, [ebp - 0x11c]
mov esi, eax
mov byte [ebp - 4], 3
call fcn.0901978b
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.0903b6c0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x68]
jmp 0x9014141
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 3
call fcn.0901978b
mov dword [ebp - 4], 2
jmp 0x901410e
push ebx
push 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0903b6c0
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x4c]
push eax
push edi
call fcn.0905855e
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x68]
test al, al
je 0x901414b
mov esi, dword [ebp - 0x120]
call fcn.090167a9
jmp 0x9013fab
call fcn.090167a9
lea eax, [ebp - 0x4c]
push eax
push edi
call fcn.090178a6
pop ecx
pop ecx
mov esi, eax
jmp 0x9013fab
Function at 0x903b6c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x903b6cf
pop dword [ebp - 0x4c]
mov eax, 0x903b6cf
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xb2d57c92
sub dword [ebp - 0x5c], 0x64833747
mov dword [ebp - 0x58], 0x6bc4ae8e
add dword [ebp - 0x58], 0xc66e9db7
mov dword [ebp - 0x54], 0xad78bc33
sub dword [ebp - 0x54], 0x612c7805
mov dword [ebp - 0x50], 0x162103e7
add dword [ebp - 0x50], 0xe9defc19
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x8c846c09
add eax, 0x7c85f4bb
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x87d58e8
sub dword [ebp - 0x5c], 0x940aef92
mov dword [ebp - 0x58], 0xdabb6056
sub dword [ebp - 0x58], 0x994efee1
mov dword [ebp - 0x54], 0xdd367439
sub dword [ebp - 0x54], 0x79c707cd
mov dword [ebp - 0x50], 0xfb15a022
add dword [ebp - 0x50], 0x4ea5fde
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xe39c75b3
sub eax, 0xda92153f
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x5fb3a
push 0
call eax
mov ecx, 0x5394
xor edx, edx
add edx, eax
mov edi, 0xe3f7c0d6
sub edi, 0xdae92ed6
add edi, dword [ebp - 0x4c]
mov esi, 0x4350ce13
xor dword [ebp - 0x14], edx
mov ebx, dword [edi]
add dword [ebp - 0x1c], 0xbe4af03c
sub ebx, esi
sub dword [ebp - 8], 0xd5038eba
mov dword [edx], ebx
add dword [ebp - 0x44], 0x3cc600ed
add edx, 0x1e3870b0
add edx, 0xe1c78f54
add edi, 0x9601d5f
add edi, 0xf69fe2a5
loop 0x903b7e2
add eax, 0x6a5aa0e7
add eax, 0x95a6a03c
xor ebx, ebx
add ebx, eax
add eax, 0x2c5dcc9f
add eax, 0xd3a23366
mov ecx, 0x77fcaa56
sub ecx, 0x6efcaa56
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x90422dc
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90a0c3e
call fcn.09004c60
lea eax, [ebp - 0x34]
push eax
mov esi, ecx
mov dword [ebp - 0x34], 0x20
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x20]
xor edi, edi
sub eax, dword [esi + 8]
sbb edi, dword [esi + 0xc]
js 0x904234b
jg 0x9042311
test eax, eax
jb 0x904234b
mov ecx, dword [esi + 4]
mov edx, ecx
xor ebx, ebx
imul edx, edx, 3
cmp edi, ebx
jg 0x904234b
jl 0x9042325
cmp eax, edx
ja 0x904234b
cmp ecx, eax
jae 0x904233f
and dword [ebp - 4], 0
sub eax, ecx
mov ecx, dword [esi]
push eax
call fcn.0903b6c0
jmp 0x904234b
jbe 0x904234b
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.0903b6c0
call fcn.09005591
ret

Function at 0x90423b0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov byte [ecx + 0x58], al
ret
Function at 0x90556d5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x90556dd
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x90556ec
xor al, al
ret
shr eax, 4
and eax, 1
ret

Function at 0x90563e9
Capabilities:
Get common file path

Disassembly:
push 0x228
mov eax, 0x90a0dde
call fcn.0900621d
mov edi, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
cmp byte [ebp + 0x10], bl
push 0x208
sete al
push ebx
lea esi, [eax - 1]
lea eax, [ebp - 0x218]
and esi, 0xffffffef
push eax
add esi, 0x2b
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp byte [ebp + 0xc], bl
je 0x905642e
or esi, 0x8000
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
je 0x9056447
xor al, al
jmp 0x9056497
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.09015b83
push dword [ebp + 0xc]
lea ecx, [ebp - 0x234]
push str.Adobe
mov dword [ebp - 4], ebx
call fcn.0905636c
test al, al
je 0x905648a
lea eax, [ebp - 0x234]
push eax
mov ecx, edi
call fcn.0903b6c0
mov ecx, edi
call fcn.090556d5
mov bl, al
lea ecx, [ebp - 0x234]
call fcn.090167a9
mov al, bl
call fcn.0900804d
ret