joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8c9980
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov eax, 0x1004
call fcn.00858020
mov eax, dword [esp + 0x1008]
push ebp
push esi
mov esi, dword [esp + 0x1014]
test eax, eax
push edi
mov ebp, ecx
mov dword [esi], 0xffffffff
je 0x8c9a85
cmp byte [eax], 0
je 0x8c9a85
push 0
push 0x80
push 3
push 0
push 3
push closesocket
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x8c99ec
pop edi
mov dword [ebp + 0x400], 2
pop esi
xor al, al
pop ebp
add esp, 0x1004
ret 8
push ebx
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x1c]
push 0x1000
push ecx
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x8c9a5f
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x8c9a5b
lea ecx, [esp + ecx + 0x14]
lea edx, [esp + 0x14]
cmp edx, ecx
lea eax, [esp + 0x14]
jae 0x8c9a3d
xor edx, edx
xor ebx, ebx
mov dl, byte [esi]
mov bl, byte [eax]
xor edx, ebx
mov ebx, dword [esi]
shr ebx, 8
mov edx, dword [ebp + edx*4]
xor edx, ebx
inc eax
cmp eax, ecx
mov dword [esi], edx
jb 0x8c9a21
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x1c]
push 0x1000
push ecx
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x8c9a09
jmp 0x8c9a5f
test eax, eax
jne 0x8c9a69
mov dword [ebp + 0x400], 3
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edx, dword [esi]
pop ebx
not edx
mov dword [esi], edx
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x1004
ret 8
pop edi
mov dword [ebp + 0x400], 1
pop esi
xor al, al
pop ebp
add esp, 0x1004
ret 8

Function at 0x8cb285
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x8cb2a5
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.00859de8
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x8cb2c8
test byte [esp + 8], 2
je 0x8cb2c8
call fcn.00859dd6
mov dword [eax], 0xd
call fcn.00859ddf
mov dword [eax], 5
jmp 0x8cb2a1
xor eax, eax
ret
Function at 0x10008ffc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000900b
pop dword [ebp - 0x4c]
mov eax, 0xf7f20367
sub eax, 0xe7f1735c
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x75c8d903
add dword [ebp - 0x5c], 0xd8896c48
mov dword [ebp - 0x58], 0xd332a717
add dword [ebp - 0x58], 0x5f00a52e
mov dword [ebp - 0x54], 0xb4b6f3c1
sub dword [ebp - 0x54], 0x686aaf93
mov dword [ebp - 0x50], 0xf1a1f260
sub dword [ebp - 0x50], 0xf1a1f260
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x5792e932
sub eax, 0x479238b6
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xefb20212
add dword [ebp - 0x5c], 0x84c06744
mov dword [ebp - 0x58], 0xdee88853
sub dword [ebp - 0x58], 0x9d7c26de
mov dword [ebp - 0x54], 0x59e9b828
add dword [ebp - 0x54], 0x985b444
mov dword [ebp - 0x50], 0xffea9430
add dword [ebp - 0x50], 0x156bd0
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x3dc41c1a
add eax, 0xd23c947e
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x370b9
push 0
call eax
mov ecx, 0x8e5f8538
sub ecx, 0x8e5f404f
mov esi, eax
mov edx, 0x10019600
add edx, dword [ebp - 0x4c]
mov edi, 0x52dbe26
add edi, 0xcc8dc44b
xor dword [ebp - 0x44], ebx
mov ebx, dword [edx]
add dword [ebp - 0x1c], edx
add ebx, edi
add dword [ebp - 0x2c], 0xf987a3bd
mov dword [esi], ebx
sub dword [ebp - 0x30], edx
add esi, 0x197a5d36
sub esi, 0x197a5d32
add edx, 4
loop 0x10009127
add eax, 0x10677
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x22d83b5c
sub ecx, 0x12d83b5c
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x10009710
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10014d34]
jne 0x1000971a
repz ret
jmp fcn.10009ea3
Function at 0x412678
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x412687
pop dword [ebp - 0x30]
mov eax, 0x27c27c6e
sub eax, 0x278155e7
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x333d6
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x54a49cbc
sub ecx, 0x54a46344
xor ebx, ebx
add ebx, eax
mov edx, 0xa9d0a31b
add edx, 0x5673c4e5
add edx, dword [ebp - 0x30]
mov edi, 0xea926cd0
mov esi, dword [edx]
sub dword [ebp - 0x10], 0xd8bc012e
xor esi, edi
add dword [ebp - 0x28], 0x8a72f110
mov dword [ebx], esi
xor dword [ebp - 0x14], 0xd325fca3
add ebx, 4
add edx, 4
loop 0x4126dd
add eax, 0x4f769608
sub eax, 0x4f75bd55
mov ebx, eax
add eax, 5
mov ecx, 0xff34963a
add ecx, 0x10b69c6
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x1001a040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1001a04f
pop dword [ebp - 0x48]
mov eax, 0xc3a237d
add eax, 0x3c77cd2
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x329d0e1c
sub dword [ebp - 0x58], 0xe44ac8d1
mov dword [ebp - 0x54], 0x6f89c94e
add dword [ebp - 0x54], 0xc2a982f7
mov dword [ebp - 0x50], 0x1ef25516
add dword [ebp - 0x50], 0x2d59ef18
mov dword [ebp - 0x4c], 0xdd2e993e
add dword [ebp - 0x4c], 0x22d166c2
lea eax, [ebp - 0x58]
push eax
mov eax, 0xb01ef3a6
add eax, 0x5fe52c8e
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x6a843b91
sub dword [ebp - 0x58], 0xf611d23b
mov dword [ebp - 0x54], 0x80cdd8f6
add dword [ebp - 0x54], 0xc09e887f
mov dword [ebp - 0x50], 0x1ee38b14
sub dword [ebp - 0x50], 0xbb741ea8
mov dword [ebp - 0x4c], 0x875ca420
add dword [ebp - 0x4c], 0x78a35be0
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x5d33b9b7
add eax, 0xb2d06695
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x4b669
push 0
call eax
mov ecx, 0x8fdb46b7
add ecx, 0x7025102d
xor esi, esi
add esi, eax
mov edx, 0x10057e00
add edx, dword [ebp - 0x48]
mov ebx, 0xd6ffc07f
add ebx, 0x72efe84e
xor dword [ebp - 0x44], ecx
mov edi, dword [edx]
sub dword [ebp - 0x2c], edx
sub edi, ebx
add dword [ebp - 0x40], eax
mov dword [esi], edi
sub dword [ebp - 0x20], ecx
add esi, 4
add edx, 4
loop 0x1001a16d
add eax, 0xb0a87e2d
sub eax, 0xb0a72fca
xor ebx, ebx
add ebx, eax
add eax, 0xf035048
sub eax, 0xf035043
mov ecx, 0x2a589093
sub ecx, 0x1a589093
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x100346a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100346d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10034700
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10034700
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100347fa
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10034729
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1003475d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100347fa
cmp eax, 1
jle 0x100347bb
cmp eax, 3
jne 0x100347fa
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1001a040
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100347d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100347fa
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100347fa
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
Function at 0x100396b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100412f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100512d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1005128c]
cmp eax, 0xffffffff
jne 0x100396e6
xor ebx, ebx
jmp 0x100396ef
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003972f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003976e
test esi, esi
jne 0x10039772
push 0x10038230
push 0x10052ad8
call fcn.1001a040
mov eax, dword [0x1005128c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003972f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003975c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003975c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100397b4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003979d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10039772
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10039700
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100397d9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100397d9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.1001a040
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100397c0
jmp 0x10039700
Function at 0x900c236
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90a819f
call fcn.09007445
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900c292
xor al, al
jmp 0x900c2e2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900cf2c
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900d7af
test al, al
je 0x900c2d5
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.090604b2
mov ecx, edi
call fcn.0900e6d7
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.090604b2
mov al, bl
call fcn.090091e6
ret
Function at 0x903d7c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x1f8
mov eax, 0x90a9b67
call fcn.09007445
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1fc]
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
push 0x80
push 0
push eax
mov dword [ebp - 0x200], ebx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 0xc]
mov ecx, 0x41444245
and dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1e8], eax
lea eax, [ebp - 0x1e4]
push 1
push eax
mov dword [ebp - 0x1f8], ecx
mov dword [ebp - 0x1f4], 0x4000000
mov dword [ebp - 0x1f0], 0x6c696e6b
mov dword [ebp - 0x1d8], 0x61637370
mov dword [ebp - 0x1b8], 0xf6d6
mov dword [ebp - 0x1b4], 0x10000
mov dword [ebp - 0x1b0], 0xd32d
mov dword [ebp - 0x1ac], ecx
call fcn.09007585
add esp, 0x14
lea eax, [ebp - 0x1fc]
lea ecx, [ebp - 0x17c]
push eax
push ebx
call fcn.090604b2
push str.ACE_Device_Link
push ebx
lea ecx, [ebp - 0x74]
call fcn.0903a1fe
and dword [ebp - 4], 0
lea eax, [ebp - 0x74]
test esi, esi
lea ecx, [ebp - 0x17c]
cmovne eax, esi
push eax
call fcn.090604b2
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x4c]
push ebx
call fcn.09039fb0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x17c]
call fcn.090604b2
lea ecx, [ebp - 0x24]
call fcn.090604b2
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x17c]
call fcn.090604b2
push edi
lea ecx, [ebp - 0x17c]
call fcn.090604b2
lea ecx, [ebp - 0x17c]
call fcn.0900955c
mov ecx, dword [ebp - 0x200]
mov edi, eax
mov ebx, dword [edi + 0x28]
push ebx
call fcn.090604b2
mov ecx, dword [edi]
push eax
push ebx
push 0
mov esi, dword [ecx + 0x18]
mov ecx, esi
mov dword [ebp - 0x204], eax
call dword [0x90ae2d0]
mov ecx, edi
call esi
mov ecx, edi
call fcn.0900642e
mov edi, dword [ebp - 0x204]
push ebx
push edi
call fcn.090604b2
push ebx
mov ebx, dword [ebp - 0x200]
push edi
push ebx
call fcn.090604b2
add esp, 0x14
mov ecx, ebx
mov esi, eax
push edi
call fcn.090604b2
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x24], vtable.CProfileTag.0
mov byte [ebp - 4], 0
call fcn.0903ab60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0903ac7e
mov eax, esi
call fcn.090091e6
ret
Function at 0x90500f8
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90aab4f
call fcn.0900578b
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
sub eax, dword [ebp - 0x20]
sub eax, dword [esi + 8]
sbb ecx, dword [esi + 0xc]
js 0x9050163
jg 0x905012d
test eax, eax
jb 0x9050163
mov edx, dword [esi + 4]
imul edi, edx, 3
test ecx, ecx
jg 0x9050163
jl 0x905013d
cmp eax, edi
ja 0x9050163
cmp eax, edx
jbe 0x9050157
mov ecx, dword [esi]
sub eax, edx
and dword [ebp - 4], 0
push eax
call fcn.090604b2
jmp 0x9050163
jae 0x9050163
mov ecx, dword [esi]
sub edx, eax
push edx
call fcn.090604b2
call fcn.0900625f
ret
Function at 0x90604b2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x90604c1
pop dword [ebp - 0x34]
mov eax, 0x90604c1
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xa2d1db2d
sub dword [ebp - 0x44], 0x547f95e2
mov dword [ebp - 0x40], 0xa9f2b5f2
sub dword [ebp - 0x40], 0x77bf69ad
mov dword [ebp - 0x3c], 0xcfa006ba
sub dword [ebp - 0x3c], 0x8353c28c
mov dword [ebp - 0x38], 0xd748f381
add dword [ebp - 0x38], 0x28b70c7f
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xa9dfcb61
add dword [ebp - 0x44], 0xca929df5
mov dword [ebp - 0x40], 0xb2a04f9a
add dword [ebp - 0x40], 0x8ecc11db
mov dword [ebp - 0x3c], 0x1da25a16
add dword [ebp - 0x3c], 0x45cd1256
mov dword [ebp - 0x38], 0x1c95d741
sub dword [ebp - 0x38], 0x1c95d741
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x6047d
push 0
call eax
mov ecx, 0xf94e0ecf
add ecx, 0x6b23020
mov esi, eax
mov edi, 0xe21d5c43
add edi, 0x26f1e3bd
add edi, dword [ebp - 0x34]
mov ebx, 0x776d8f93
add dword [ebp - 0x18], ecx
mov edx, dword [edi]
mov dword [ebp - 0x20], 0x49201c24
xor edx, ebx
sub dword [ebp - 0x20], ecx
mov dword [esi], edx
sub dword [ebp - 0x18], ecx
add esi, 4
add edi, 0x955174e0
sub edi, 0x955174dc
loop 0x90605ce
add eax, 0x5244aa3c
sub eax, 0x5243bbad
xor ebx, ebx
add ebx, eax
add eax, 0x415ca3bd
add eax, 0xbea35c48
mov ecx, 0x3a35ead8
add ecx, 0xceca1528
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x906c6ef
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x148
mov eax, 0x90abd2c
call fcn.09007445
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
xor ebx, ebx
mov esi, 0x20019
push esi
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906c74e
mov dword [ebp - 0x14c], ebx
jmp 0x906c8cd
lea eax, [ebp - 0x148]
push eax
push esi
push ebx
push str.Adobe
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906c777
mov dword [ebp - 0x148], ebx
jmp 0x906c8cd
lea eax, [ebp - 0x144]
push eax
push esi
push ebx
push str.Color
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906c7a0
mov dword [ebp - 0x144], ebx
jmp 0x906c8cd
lea eax, [ebp - 0x13c]
push eax
push esi
push ebx
push str.Monitor
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906c7c9
mov dword [ebp - 0x13c], ebx
jmp 0x906c8cd
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
mov esi, ebx
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x906c81b
cmp dword [ebp - 0x154], 4
jne 0x906c81b
mov esi, dword [ebp - 0x120]
cmp esi, 0x3e7
ja 0x906c8cd
push esi
push str.Monitor_u
lea eax, [ebp - 0x1c]
push 0xb
push eax
call fcn.090604b2
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906c85b
mov dword [ebp - 0x140], ebx
jmp 0x906c8e2
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x906c8cd
cmp dword [ebp - 0x154], 1
jne 0x906c8cd
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.090169c5
lea eax, [ebp - 0x138]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.090604b2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.090604b2
mov bl, 1
cmp dword [ebp - 0x140], 0
je 0x906c8e2
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x13c], 0
je 0x906c8f7
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x144], 0
je 0x906c90c
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x148], 0
je 0x906c921
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14c], 0
je 0x906c936
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.090091e6
ret
Function at 0x906e3b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90abdd2
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1430
call fcn.090a6f20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x1424], edi
mov dword [ebp - 0x1430], eax
mov dword [ebp - 0x1428], eax
mov dword [ebp - 0x143c], edi
call fcn.090168fd
xor ecx, ecx
push 0xf
mov eax, ecx
mov dword [ebp - 4], ecx
pop esi
mov dword [ebp - 0x142c], eax
mov dword [ebp - 0x1420], esi
xor edx, edx
mov edi, ecx
div esi
mov dword [ebp - 0x141c], edi
lea esi, [ebp - 0x416]
mov dword [ebp - 0x1434], eax
mov eax, edi
xor edx, edx
div dword [ebp - 0x1420]
mov edi, ecx
mov dword [ebp - 0x1438], eax
mov edx, dword [ebp - 0x1434]
mov byte [esi - 1], dl
xor edx, edx
mov byte [esi], al
mov eax, edi
div dword [ebp - 0x1420]
mov edx, 0xff
mov byte [esi + 1], al
add edi, edx
mov eax, dword [ebp - 0x1438]
add esi, 4
cmp edi, 0xff0
jb 0x906e460
mov edi, dword [ebp - 0x141c]
add edi, edx
mov dword [ebp - 0x141c], edi
cmp edi, 0xff0
jb 0x906e44e
push ecx
mov ecx, dword [ebp - 0x1424]
lea esi, [edx + 1]
push 0x5058595a
push 0x706c6162
push esi
lea eax, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.090604b2
push esi
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.090604b2
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x141c], esi
movzx eax, word [ebp + esi - 0xc16]
movzx ecx, word [ebp + esi - 0x1416]
sub ecx, eax
mov eax, ecx
movzx ecx, word [ebp + esi - 0x1414]
cdq
mov edi, eax
movzx eax, word [ebp + esi - 0xc14]
sub ecx, eax
xor edi, edx
mov eax, ecx
sub edi, edx
mov ecx, dword [ebp - 0x141c]
cdq
mov esi, eax
xor esi, edx
movzx eax, word [ebp + ecx - 0xc12]
sub esi, edx
movzx ecx, word [ebp + ecx - 0x1412]
sub ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 0x1428]
cdq
xor eax, edx
sub eax, edx
cmp ecx, edi
cmovl ecx, edi
cmp ecx, esi
cmovl ecx, esi
mov esi, dword [ebp - 0x141c]
cmp ecx, eax
cmovl ecx, eax
add esi, 8
mov dword [ebp - 0x1428], ecx
mov dword [ebp - 0x141c], esi
cmp esi, 0x800
jb 0x906e4ed
cmp ecx, 0xa
ja 0x906e5a9
mov eax, dword [ebp - 0x142c]
mov esi, dword [ebp - 0x1420]
add eax, 0xff
mov dword [ebp - 0x142c], eax
push 0
pop ecx
cmp eax, 0xff0
jb 0x906e436
mov byte [ebp - 0x1430], 1
mov ecx, dword [ebp - 0x1424]
or dword [ebp - 4], 0xffffffff
call fcn.09016a6b
mov al, byte [ebp - 0x1430]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret