joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52c340
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd8000]
push edi
or ebp, 0xffffffff
jmp 0x52c362
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52c369
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52c358
mov eax, 1
add ebx, ebx
jne 0x52c37b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52c38c
jne 0x52c3ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52c3ab
dec eax
add ebx, ebx
jne 0x52c398
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x52c370
add ebx, ebx
jne 0x52c3a7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52c3fd
xor ecx, ecx
sub eax, 3
jb 0x52c3c3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52c432
sar eax, 1
mov ebp, eax
jmp 0x52c3ce
add ebx, ebx
jne 0x52c3ce
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52c39c
inc ecx
add ebx, ebx
jne 0x52c3dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52c39c
add ebx, ebx
jne 0x52c3e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52c3de
jne 0x52c3fa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52c3de
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52c41c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52c40e
jmp 0x52c35e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52c41c
add edi, ecx
jmp 0x52c35e
pop esi
mov edi, esi
mov ecx, 0x31fa
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52c43a
cmp byte [edi], 0x1e
jne 0x52c43a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52c43f
lea edi, [esi + 0x129000]
mov eax, dword [edi]
or eax, eax
je 0x52c4b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16efe4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16f108]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52c46c
mov ecx, edi
jns 0x52c49b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16f110]
or eax, eax
je 0x52c4b1
mov dword [ebx], eax
add ebx, 4
jmp 0x52c489
call dword [esi + 0x16f10c]
mov ebp, dword [esi + 0x16f114]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52c4eb
sub esp, 0xffffff80
jmp 0x474435
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401c66
pop dword [ebp - 0x40]
mov eax, 0xf62f13d0
sub eax, 0xf5eef76a
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x6f858ec6
add dword [ebp - 0x50], 0xdeccb685
mov dword [ebp - 0x4c], 0x7abb07d4
add dword [ebp - 0x4c], 0xb7784471
mov dword [ebp - 0x48], 0x411bfb16
add dword [ebp - 0x48], 0xb304918
mov dword [ebp - 0x44], 0xb082a7af
add dword [ebp - 0x44], 0x4f7d5851
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x8db118e7
add dword [ebp - 0x50], 0xe6c1506f
mov dword [ebp - 0x4c], 0xfa5040e5
add dword [ebp - 0x4c], 0x471c2090
mov dword [ebp - 0x48], 0xd9d88314
sub dword [ebp - 0x48], 0x766916a8
mov dword [ebp - 0x44], 0xb455592d
add dword [ebp - 0x44], 0x4baaa6d3
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xf5dfbe2c
sub eax, 0xf59f8e00
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x36dce
push 0
call eax
mov ecx, 0x6f8c5041
sub ecx, 0x6f8c06ba
mov edi, eax
mov ebx, 0xe9a95fd0
add ebx, 0x16971030
add ebx, dword [ebp - 0x40]
mov edx, 0x29d009b7
sub dword [ebp - 0x10], 0x22c336b
mov esi, dword [ebx]
xor esi, edx
sub dword [ebp - 8], 0x25321f8c
mov dword [edi], esi
add dword [ebp - 0x28], edi
add edi, 4
add ebx, 0x1f572175
sub ebx, 0x1f572171
loop 0x401d7d
add eax, 0x42b26ea5
sub eax, 0x42b155b6
mov ebx, eax
add eax, 5
mov ecx, 0x96fe5b65
add ecx, 0x6941a49b
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x13106f88
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x54410f8f
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401040
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
xor eax, eax
mov dword [eax*4 + 0x417658], eax
inc eax
cmp eax, 0x100
jne 0x401042
push esi
xor esi, esi
xor ecx, ecx
xor edx, edx
mov eax, ecx
div edi
inc ecx
movsx eax, byte [edx + str._H_.]
add eax, dword [ecx*4 + 0x417654]
add eax, esi
and eax, 0xff
mov esi, eax
mov al, byte [ecx*4 + 0x417654]
mov edx, dword [esi*4 + 0x417658]
mov dword [ecx*4 + 0x417654], edx
movzx eax, al
mov dword [esi*4 + 0x417658], eax
cmp ecx, 0x100
jne 0x401056
mov dword [0x417a5c], 0
mov dword [0x417a60], 0
pop esi
ret

Function at 0x4010c0
Capabilities:
Encode data using xor
Hide graphical window

Disassembly:
push ebp
mov ebp, dword [0x417654]
push esi
push edi
push str._H_.
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
call fcn.00401040
sub esi, 1
js 0x401147
mov ecx, dword [0x417a60]
mov eax, dword [0x417a5c]
lea ecx, [ecx]
inc ecx
and ecx, 0xff
mov edi, dword [ecx*4 + 0x417658]
add eax, edi
and eax, 0xff
mov dl, byte [eax*4 + 0x417658]
mov dword [eax*4 + 0x417658], edi
movzx edx, dl
mov dword [ecx*4 + 0x417658], edx
mov edi, dword [eax*4 + 0x417658]
add edi, edx
and edi, 0xff
movzx edx, byte [edi*4 + 0x417658]
xor byte [esi + ebp], dl
sub esi, 1
jns 0x4010f0
mov dword [0x417a5c], eax
mov dword [0x417a60], ecx
pop edi
cmp esi, 0x34adb9
pop esi
pop ebp
jle 0x40118e
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
push 0
push 0
call dword [sym.imp.SHELL32.dll_DragQueryPoint]
push 0
push 0
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
push 0
call dword [sym.imp.SHELL32.dll_DragFinish]
push 0
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.USER32.dll_UpdateWindow]
ret
Function at 0x401250
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hide graphical window

Disassembly:
sub esp, 0x74
mov eax, dword [0x413030]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetCaretPos]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCPInfo]
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov dword [0x417650], esi
mov dword [0x417a58], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov byte [esp + 0x13], 1
nop
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x2c]
push edx
call edi
lea eax, [esp + 0x68]
push eax
push 0
call ebp
lea ecx, [esp + 0x30]
push ecx
call ebx
lea edx, [esp + 0x40]
push edx
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoA]
cmp esi, 0x1301e5
jle 0x401309
cmp dword [esp + 0x24], 0x2b85403
je 0x401309
cmp byte [esp + 0x6e], 0xea
je 0x401309
cmp dword [esp + 0x30], 0x342e968c
je 0x401309
cmp dword [esp + 0x4c], 0x979c0c0
je 0x401309
cmp dword [0x417a64], 0
mov byte [esp + 0x13], 0
jne 0x401309
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x417a64], eax
inc esi
cmp byte [esp + 0x13], 0
jne 0x401290
mov ax, word [esp + 0x34]
mov ecx, 0x165daba
jmp 0x401339
cmp dword [esp + 0x18], 0x5462d
jbe 0x401339
mov edx, 0x15a
cmp ax, dx
je 0x401339
mov dword [esp + 0x1c], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x1c], ecx
jne 0x401321
mov dword [esp + 0x14], 0
mov dword [esp + 0x14], 0x99ba
mov eax, dword [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [esp + 0x14]
mov dword [0x417654], eax
xor eax, eax
test ecx, ecx
jbe 0x401387
mov cl, byte [eax + resource.0]
mov edx, dword [0x417654]
mov byte [edx + eax], cl
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
jb 0x40136f
lea eax, [esp + 0x20]
push eax
push 0x40
push ecx
mov ecx, dword [0x417654]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x14]
call fcn.004010c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_LocalCompact]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalShrink]
push 0
call dword [sym.imp.USER32.dll_WindowFromDC]
push 0
call dword [sym.imp.USER32.dll_GetDC]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040159b
add esp, 0x74
ret

Function at 0x40159b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x413030]
jne 0x4015a5
repz ret
jmp fcn.00402131
Function at 0x4066ce
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404cf8
and dword [ebp - 4], 0
cmp dword [0x414ce8], 0
mov ebx, eax
jne 0x40677f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406830
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406830
push eax
call fcn.00404c86
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x414ce8], eax
call esi
push eax
call fcn.00404c86
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x414cec], eax
call esi
push eax
call fcn.00404c86
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x414cf0], eax
call esi
push eax
call fcn.00404c86
pop ecx
mov dword [0x414cf8], eax
test eax, eax
je 0x40677f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404c86
pop ecx
mov dword [0x414cf4], eax
mov eax, dword [0x414cf4]
cmp eax, ebx
je 0x4067d7
cmp dword [0x414cf8], ebx
je 0x4067d7
push eax
call fcn.00404d01
push dword [0x414cf8]
mov esi, eax
call fcn.00404d01
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4067d7
test edi, edi
je 0x4067d7
call esi
test eax, eax
je 0x4067ce
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4067ce
test byte [ebp - 0xc], 1
jne 0x4067d7
or dword [ebp + 0x10], 0x200000
jmp 0x406810
mov eax, dword [0x414cec]
cmp eax, ebx
je 0x406810
push eax
call fcn.00404d01
pop ecx
test eax, eax
je 0x406810
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406810
mov eax, dword [0x414cf0]
cmp eax, ebx
je 0x406810
push eax
call fcn.00404d01
pop ecx
test eax, eax
je 0x406810
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x414ce8]
call fcn.00404d01
pop ecx
test eax, eax
je 0x406830
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406832
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x900e460
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90cf2a5
call fcn.09006dd9
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900e4bc
xor al, al
jmp 0x900e50c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900e8b2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900f2c5
test al, al
je 0x900e4ff
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.0905e040
mov ecx, edi
call fcn.09011cd1
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.0905e040
mov al, bl
call fcn.09006f96
ret

Function at 0x9011cd1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x9011cd9
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9011ce8
xor al, al
ret
shr eax, 4
and al, 1
ret

Function at 0x901e790
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov byte [ecx + 0x58], 0
ret
Function at 0x90582d8
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90d2348
call fcn.0900620a
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
xor edx, edx
sub eax, dword [ebp - 0x20]
sub eax, dword [esi + 8]
sbb edx, dword [esi + 0xc]
js 0x9058343
jg 0x905830d
test eax, eax
jb 0x9058343
mov ecx, dword [esi + 4]
imul edi, ecx, 3
test edx, edx
jg 0x9058343
jl 0x905831d
cmp eax, edi
ja 0x9058343
cmp eax, ecx
jbe 0x9058337
and dword [ebp - 4], 0
sub eax, ecx
mov ecx, dword [esi]
push eax
call fcn.0905e040
jmp 0x9058343
jae 0x9058343
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.0905e040
call fcn.09006fcf
ret
Function at 0x9079b47
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x148
mov eax, 0x90d3869
call fcn.09006dd9
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
xor ebx, ebx
mov esi, 0x20019
push esi
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079ba6
mov dword [ebp - 0x14c], ebx
jmp 0x9079d25
lea eax, [ebp - 0x148]
push eax
push esi
push ebx
push str.Adobe
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079bcf
mov dword [ebp - 0x148], ebx
jmp 0x9079d25
lea eax, [ebp - 0x144]
push eax
push esi
push ebx
push str.Color
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079bf8
mov dword [ebp - 0x144], ebx
jmp 0x9079d25
lea eax, [ebp - 0x13c]
push eax
push esi
push ebx
push str.Monitor
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079c21
mov dword [ebp - 0x13c], ebx
jmp 0x9079d25
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
mov esi, ebx
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9079c73
cmp dword [ebp - 0x154], 4
jne 0x9079c73
mov esi, dword [ebp - 0x120]
cmp esi, 0x3e7
ja 0x9079d25
push esi
push str.Monitor_u
lea eax, [ebp - 0x1c]
push 0xb
push eax
call fcn.0905e040
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079cb3
mov dword [ebp - 0x140], ebx
jmp 0x9079d3a
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9079d25
cmp dword [ebp - 0x154], 1
jne 0x9079d25
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.0901904e
lea eax, [ebp - 0x138]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.0905e040
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.0905e040
mov bl, 1
cmp dword [ebp - 0x140], 0
je 0x9079d3a
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x13c], 0
je 0x9079d4f
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x144], 0
je 0x9079d64
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x148], 0
je 0x9079d79
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14c], 0
je 0x9079d8e
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.09006f96
ret
Function at 0x907c6ab
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3926
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1430
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x1424], edi
mov dword [ebp - 0x1430], eax
mov dword [ebp - 0x1428], eax
mov dword [ebp - 0x143c], edi
call fcn.09018f87
xor ecx, ecx
push 0xf
mov eax, ecx
mov dword [ebp - 4], ecx
pop esi
mov dword [ebp - 0x142c], eax
mov dword [ebp - 0x1420], esi
xor edx, edx
mov edi, ecx
div esi
mov dword [ebp - 0x141c], edi
lea esi, [ebp - 0x416]
mov dword [ebp - 0x1434], eax
mov eax, edi
xor edx, edx
div dword [ebp - 0x1420]
mov edi, ecx
mov dword [ebp - 0x1438], eax
mov edx, dword [ebp - 0x1434]
mov byte [esi - 1], dl
xor edx, edx
mov byte [esi], al
mov eax, edi
div dword [ebp - 0x1420]
mov edx, 0xff
mov byte [esi + 1], al
add edi, edx
mov eax, dword [ebp - 0x1438]
add esi, 4
cmp edi, 0xff0
jb 0x907c753
mov edi, dword [ebp - 0x141c]
add edi, edx
mov dword [ebp - 0x141c], edi
cmp edi, 0xff0
jb 0x907c741
push ecx
mov ecx, dword [ebp - 0x1424]
lea esi, [edx + 1]
push 0x5058595a
push 0x706c6162
push esi
lea eax, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.0905e040
push esi
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.0905e040
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x141c], esi
movzx eax, word [ebp + esi - 0xc16]
movzx ecx, word [ebp + esi - 0x1416]
sub ecx, eax
mov eax, ecx
movzx ecx, word [ebp + esi - 0x1414]
cdq
mov edi, eax
movzx eax, word [ebp + esi - 0xc14]
sub ecx, eax
xor edi, edx
mov eax, ecx
sub edi, edx
mov ecx, dword [ebp - 0x141c]
cdq
mov esi, eax
xor esi, edx
movzx eax, word [ebp + ecx - 0xc12]
sub esi, edx
movzx ecx, word [ebp + ecx - 0x1412]
sub ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 0x1428]
cdq
xor eax, edx
sub eax, edx
cmp ecx, edi
cmovl ecx, edi
cmp ecx, esi
cmovl ecx, esi
mov esi, dword [ebp - 0x141c]
cmp ecx, eax
cmovl ecx, eax
add esi, 8
mov dword [ebp - 0x1428], ecx
mov dword [ebp - 0x141c], esi
cmp esi, 0x800
jb 0x907c7e0
cmp ecx, 0xa
ja 0x907c89c
mov eax, dword [ebp - 0x142c]
mov esi, dword [ebp - 0x1420]
add eax, 0xff
mov dword [ebp - 0x142c], eax
push 0
pop ecx
cmp eax, 0xff0
jb 0x907c729
mov byte [ebp - 0x1430], 1
mov ecx, dword [ebp - 0x1424]
or dword [ebp - 4], 0xffffffff
call fcn.090190fb
mov al, byte [ebp - 0x1430]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x90a249d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3fd3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0xa0
push eax
call fcn.0905e040
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90a2522
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.0905e040
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09018f87
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90a2539
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x90a2595
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x90a2588
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x504c4142
push 0x271
push eax
push eax
call fcn.0905e040
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.0905e040
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.090067dd
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x90a2631
sub dword [ebp - 0x13d8], 1
jne 0x90a2627
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.090068a7
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x90a2571
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.090190fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4