joyce8/EMBER2024-capa huggingface dataset:
Function at 0x597460
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
jne 0x597483
push 0x108
push 0x70c75c
call fcn.004e0811
test eax, eax
je 0x597483
int3
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x54], 0
je 0x597568
cmp dword [ebp + 0xc], 0
jne 0x5974ce
mov ecx, dword [ebp - 0x14]
call fcn.004e2db4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5974ae
xor eax, eax
jmp 0x5975c6
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x59755b
cmp dword [ebp + 0x10], 0
jne 0x59750d
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.004dd0f8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5974f0
xor eax, eax
jmp 0x5975c6
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x59755b
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.004dd0f8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x597529
xor eax, eax
jmp 0x5975c6
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
jmp 0x5975c6
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x68], 0
jne 0x597585
push 0x12a
push 0x70c794
call fcn.004e0811
test eax, eax
je 0x597585
int3
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xfff
jl 0x5975ad
push 0x12b
push 0x70c7cc
call fcn.004e0811
test eax, eax
je 0x5975ad
int3
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x68]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x59bec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x109
push 0x7104b4
mov eax, dword [ebp - 8]
push eax
call fcn.004e5ca8
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0xffffffff
jne 0x59bef9
push 0x10a
push 0x7104ec
call fcn.004e0811
test eax, eax
je 0x59bef9
int3
cmp dword [ebp + 0xc], 0
jne 0x59bf03
xor eax, eax
jmp 0x59bf7e
cmp dword [ebp + 8], 0
jne 0x59bf1d
push 0x10f
push 0x710524
call fcn.004e0811
test eax, eax
je 0x59bf1d
int3
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004e5609
test eax, eax
jne 0x59bf44
push 0x110
push 0x71055c
call fcn.004e0811
test eax, eax
je 0x59bf44
int3
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x59bf7b
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004db56e
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004dfd8f
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x59bf90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x11b
push 0x710594
mov eax, dword [ebp - 8]
push eax
call fcn.004e5ca8
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0xffffffff
jne 0x59bfc9
push 0x11c
push 0x7105cc
call fcn.004e0811
test eax, eax
je 0x59bfc9
int3
cmp dword [ebp + 0xc], 0
jne 0x59bfd4
jmp 0x59c069
cmp dword [ebp + 8], 0
jne 0x59bfee
push 0x121
push 0x710604
call fcn.004e0811
test eax, eax
je 0x59bfee
int3
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004e5609
test eax, eax
jne 0x59c015
push 0x122
push 0x71063c
call fcn.004e0811
test eax, eax
je 0x59c015
int3
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x59c04c
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004db56e
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004dfd8f
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x59c069
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004db56e
push eax
push 0xffffffffffffffff
push 0xd
call fcn.004e2463
mov esp, ebp
pop ebp
ret 8
Function at 0x59c450
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x19a
push 0x71094c
mov eax, dword [ebp - 4]
push eax
call fcn.004e5ca8
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0xffffffff
jne 0x59c487
push 0x19b
push 0x710984
call fcn.004e0811
test eax, eax
je 0x59c487
int3
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x30]
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x59c4c7
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.004db56e
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004dfd8f
mov esp, ebp
pop ebp
ret 8

Function at 0x59c4d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x1a5
push 0x7109bc
mov eax, dword [ebp - 0xc]
push eax
call fcn.004e5ca8
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x59c528
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x59c528
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
call fcn.004db56e
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004dfd8f
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5ce670
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x24
call fcn.004db56e
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 1
je 0x5ce6e1
push 1
push 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0xa0]
call eax
test eax, eax
jne 0x5ce6df
push str.Warning:_File_save_with_new_name_failed._n
push 0
mov ecx, 0x7978b0
call fcn.004e2823
push eax
push 0x110
push 0x725a94
lea ecx, [ebp - 0xc]
call fcn.004e515e
push eax
call fcn.004e64a5
add esp, 0x10
xor eax, eax
jmp 0x5ce739
jmp 0x5ce734
push 1
mov ecx, dword [ebp - 0x18]
add ecx, 0x24
call fcn.004db56e
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0xa0]
call eax
test eax, eax
jne 0x5ce734
push str.Warning:_File_save_failed._n
push 0
mov ecx, 0x7978b0
call fcn.004e2823
push eax
push 0x118
push 0x725af8
lea ecx, [ebp - 0x14]
call fcn.004e515e
push eax
call fcn.004e64a5
add esp, 0x10
xor eax, eax
jmp 0x5ce739
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x5fbc80
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
push 0x4e
push 0x747e5c
mov eax, dword [ebp - 0x24]
push eax
call fcn.004e5ca8
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x3c], 0
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x5fbce6
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x3c]
or eax, 1
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x3c], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x38]
or eax, 2
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x38], eax
jmp 0x5fbd13
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x5fbd13
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x3c]
or ecx, 2
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x3c], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x38]
or ecx, 1
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x38], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
call fcn.004dfdc1
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x34], 0
jne 0x5fbdef
call fcn.004dcf31
cmp eax, dword [ebp + 8]
je 0x5fbd40
jmp 0x5fbdef
push 1
push 0x209
push 0x200
push 0
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x5fbd78
push 1
push 0x109
push 0x100
push 0
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x5fbdcf
cmp dword [ebp - 0x1c], 0x202
je 0x5fbd9c
cmp dword [ebp - 0x1c], 0x205
je 0x5fbd9c
cmp dword [ebp - 0x1c], 0x201
je 0x5fbd9c
cmp dword [ebp - 0x1c], 0x204
jne 0x5fbd9e
jmp 0x5fbdef
cmp dword [ebp - 0x1c], 0x100
jne 0x5fbdaf
cmp dword [ebp - 0x18], 0x1b
jne 0x5fbdaf
jmp 0x5fbdef
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0x24
call fcn.004e2db9
neg eax
sbb eax, eax
add eax, 1
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [0x797eb4]
jbe 0x5fbdea
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x34], 1
jmp 0x5fbd24
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 0x34]
mov esp, ebp
pop ebp
ret 4

Function at 0x407f16
Capabilities:
Encode data using xor

Disassembly:
push edi
fnstsw ax
mov dword [ebp - 4], esi
mov dword [ecx], esi
test ah, 5
mov edi, ebx
invalid
Function at 0x84d160
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x429000]
push edi
or ebp, 0xffffffff
jmp 0x84d182
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x84d189
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84d178
mov eax, 1
add ebx, ebx
jne 0x84d19b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x84d1ac
jne 0x84d1cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84d1cb
dec eax
add ebx, ebx
jne 0x84d1b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x84d190
add ebx, ebx
jne 0x84d1c7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x84d21d
xor ecx, ecx
sub eax, 3
jb 0x84d1e3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x84d252
sar eax, 1
mov ebp, eax
jmp 0x84d1ee
add ebx, ebx
jne 0x84d1ee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84d1bc
inc ecx
add ebx, ebx
jne 0x84d1fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84d1bc
add ebx, ebx
jne 0x84d209
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x84d1fe
jne 0x84d21a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x84d1fe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x84d23c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x84d22e
jmp 0x84d17e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x84d23c
add edi, ecx
jmp 0x84d17e
pop esi
mov edi, esi
mov ecx, 0xc4c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x84d25a
cmp byte [edi], 6
jne 0x84d25a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x84d25f
lea edi, [esi + 0x44b000]
mov eax, dword [edi]
or eax, eax
je 0x84d2ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x450040]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4500a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x84d28c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4500a8]
or eax, eax
je 0x84d2c8
mov dword [ebx], eax
add ebx, 4
jmp 0x84d2a9
call dword [esi + 0x4500a4]
mov ebp, dword [esi + 0x4500ac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x84d302
sub esp, 0xffffff80
jmp 0x40adc0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x408bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x8004667e
mov esi, 0xef45c7
add ah, ah
add bh, bh
cmp al, 0xdc
rol dword [eax], 0x83
dec edx
push dword [ebp + 0x1e]
push esi
cmpsd dword [esi], dword es:[edi]
xor eax, 0x1f40c1d8
call esi
test eax, eax
jne 0x408bd7
pop esi
mov esp, ebp
pop ebp
and edi, edi
salc
add eax, 0x4e0afc80
pop esi
das
in eax, 0x5d
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x5ed450
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x164000]
push edi
jmp 0x5ed46a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5ed471
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5ed460
mov eax, 1
add ebx, ebx
jne 0x5ed483
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5ed494
jne 0x5ed4b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5ed4b3
dec eax
add ebx, ebx
jne 0x5ed4a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5ed478
add ebx, ebx
jne 0x5ed4af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5ed505
xor ecx, ecx
sub eax, 3
jb 0x5ed4cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5ed53a
sar eax, 1
mov ebp, eax
jmp 0x5ed4d6
add ebx, ebx
jne 0x5ed4d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5ed4a4
inc ecx
add ebx, ebx
jne 0x5ed4e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5ed4a4
add ebx, ebx
jne 0x5ed4f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5ed4e6
jne 0x5ed502
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5ed4e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5ed524
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5ed516
jmp 0x5ed466
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5ed524
add edi, ecx
jmp 0x5ed466
pop esi
mov edi, esi
mov ecx, 0x6221
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5ed542
cmp byte [edi], 0x13
jne 0x5ed542
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5ed547
lea edi, [esi + 0x1ea000]
mov eax, dword [edi]
or eax, eax
je 0x5ed5bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x218a9c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x218c44]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5ed574
mov ecx, edi
jns 0x5ed5a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x218c4c]
or eax, eax
je 0x5ed5b9
mov dword [ebx], eax
add ebx, 4
jmp 0x5ed591
call dword [esi + 0x218c48]
mov ebp, dword [esi + 0x218c50]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x277]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5ed5f3
sub esp, 0xffffff80
jmp 0x425285
Function at 0x900bf19
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x900bf28
pop dword [ebp - 0x20]
mov eax, 0x9f9aad1d
sub eax, 0x9699edf5
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xb9bfbe29
add dword [ebp - 0x30], 0x94928722
mov dword [ebp - 0x2c], 0x45aa2061
add dword [ebp - 0x2c], 0xec892be4
mov dword [ebp - 0x28], 0x539feded
sub dword [ebp - 0x28], 0x753a9bf
mov dword [ebp - 0x24], 0x80a98213
add dword [ebp - 0x24], 0x7f567ded
lea eax, [ebp - 0x30]
push eax
mov eax, 0x716fc0c1
add eax, 0x979b1f77
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xb61db703
add dword [ebp - 0x30], 0xbe54b253
mov dword [ebp - 0x2c], 0x8e53e772
sub dword [ebp - 0x2c], 0x4ce785fd
mov dword [ebp - 0x28], 0xed92c521
add dword [ebp - 0x28], 0x75dca74b
mov dword [ebp - 0x24], 0x15f963f7
sub dword [ebp - 0x24], 0x15f963f7
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x633d2
push 0
call eax
mov ecx, 0x576678e2
add ecx, 0xa899d256
xor esi, esi
add esi, eax
mov edx, 0xf22d8084
add edx, 0x16e1bf7c
add edx, dword [ebp - 0x20]
mov edi, 0xe3bbf0ee
add edi, 0xdf653b0f
xor dword [ebp - 0x10], edx
mov ebx, dword [edx]
sub dword [ebp - 0x1c], 0xa72ca0a5
xor ebx, edi
mov dword [esi], ebx
xor dword [ebp - 8], 0xc5269512
add esi, 0x5d73a3f5
sub esi, 0x5d73a3f1
add edx, 0xbe736b44
sub edx, 0xbe736b40
loop 0x900c047
add eax, 0x11fb3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xcf377968
add ecx, 0x39c88698
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x900c236
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90a819f
call fcn.09007445
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900c292
xor al, al
jmp 0x900c2e2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900cf2c
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900d7af
test al, al
je 0x900c2d5
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.0900bf19
mov ecx, edi
call fcn.0900e6d7
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.0900bf19
mov al, bl
call fcn.090091e6
ret
Function at 0x903d7c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x1f8
mov eax, 0x90a9b67
call fcn.09007445
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1fc]
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
push 0x80
push 0
push eax
mov dword [ebp - 0x200], ebx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 0xc]
mov ecx, 0x41444245
and dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1e8], eax
lea eax, [ebp - 0x1e4]
push 1
push eax
mov dword [ebp - 0x1f8], ecx
mov dword [ebp - 0x1f4], 0x4000000
mov dword [ebp - 0x1f0], 0x6c696e6b
mov dword [ebp - 0x1d8], 0x61637370
mov dword [ebp - 0x1b8], 0xf6d6
mov dword [ebp - 0x1b4], 0x10000
mov dword [ebp - 0x1b0], 0xd32d
mov dword [ebp - 0x1ac], ecx
call fcn.09007585
add esp, 0x14
lea eax, [ebp - 0x1fc]
lea ecx, [ebp - 0x17c]
push eax
push ebx
call fcn.0900bf19
push str.ACE_Device_Link
push ebx
lea ecx, [ebp - 0x74]
call fcn.0903a1fe
and dword [ebp - 4], 0
lea eax, [ebp - 0x74]
test esi, esi
lea ecx, [ebp - 0x17c]
cmovne eax, esi
push eax
call fcn.0900bf19
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x4c]
push ebx
call fcn.09039fb0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x17c]
call fcn.0900bf19
lea ecx, [ebp - 0x24]
call fcn.0900bf19
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x17c]
call fcn.0900bf19
push edi
lea ecx, [ebp - 0x17c]
call fcn.0900bf19
lea ecx, [ebp - 0x17c]
call fcn.0900955c
mov ecx, dword [ebp - 0x200]
mov edi, eax
mov ebx, dword [edi + 0x28]
push ebx
call fcn.0900bf19
mov ecx, dword [edi]
push eax
push ebx
push 0
mov esi, dword [ecx + 0x18]
mov ecx, esi
mov dword [ebp - 0x204], eax
call dword [0x90ae2d0]
mov ecx, edi
call esi
mov ecx, edi
call fcn.0900642e
mov edi, dword [ebp - 0x204]
push ebx
push edi
call fcn.0900bf19
push ebx
mov ebx, dword [ebp - 0x200]
push edi
push ebx
call fcn.0900bf19
add esp, 0x14
mov ecx, ebx
mov esi, eax
push edi
call fcn.0900bf19
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x24], vtable.CProfileTag.0
mov byte [ebp - 4], 0
call fcn.0903ab60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0903ac7e
mov eax, esi
call fcn.090091e6
ret
Function at 0x90500f8
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90aab4f
call fcn.0900578b
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
sub eax, dword [ebp - 0x20]
sub eax, dword [esi + 8]
sbb ecx, dword [esi + 0xc]
js 0x9050163
jg 0x905012d
test eax, eax
jb 0x9050163
mov edx, dword [esi + 4]
imul edi, edx, 3
test ecx, ecx
jg 0x9050163
jl 0x905013d
cmp eax, edi
ja 0x9050163
cmp eax, edx
jbe 0x9050157
mov ecx, dword [esi]
sub eax, edx
and dword [ebp - 4], 0
push eax
call fcn.0900bf19
jmp 0x9050163
jae 0x9050163
mov ecx, dword [esi]
sub edx, eax
push edx
call fcn.0900bf19
call fcn.0900625f
ret