joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423a30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x79ba30]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x423a6e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x423a6e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x423a70
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x423b30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x79ba30]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x423ec0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x79ba30]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x423f00
Capabilities:
Query environment variable

Disassembly:
push str.EXPAT_ENTROPY_DEBUG
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x423f64
mov ecx, 0x477b50
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x423f37
test dl, dl
je 0x423f33
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x423f37
add eax, 2
add ecx, 2
test dl, dl
jne 0x423f17
xor eax, eax
jmp 0x423f3c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x423f64
push 4
push dword [esp + 0xc]
push 8
push dword [esp + 0x10]
push str.Entropy:__s_____0x_0lx___lu_bytes__n
call dword [sym.imp.MSVCRT.dll___p__iob]
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0x18
mov eax, dword [esp + 8]
ret
Function at 0x4282d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub esp, 0xc
push esi
xor esi, esi
jmp 0x4282e0
push 4
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x428331
mov edx, dword [esp + 4]
xor ecx, ecx
mov edi, edi
cmp esi, 4
jae 0x42831b
mov eax, edx
shr eax, cl
add ecx, 8
mov byte [esp + esi + 8], al
inc esi
cmp ecx, 0x20
jb 0x428300
cmp esi, 4
jb 0x4282e0
push dword [esp + 8]
push str.rand_s
call fcn.00423f00
add esp, 8
pop esi
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [esp + 8]
xor esi, dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, esi
imul eax, eax, 0x7fffffff
push eax
push str.fallback_4_
call fcn.00423f00
add esp, 8
pop esi
add esp, 0xc
ret

Function at 0x42bb30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
cmp dword [esp + 0x10], 0
jle 0x42bc32
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push edi
jmp 0x42bb50
mov edi, dword [eax + 8]
add ecx, edi
mov esi, dword [eax + 0xc]
adc edx, esi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor ecx, ecx
mov edx, esi
shld esi, edi, 0xd
shr edx, 0x13
or ecx, esi
shl edi, 0xd
mov esi, dword [eax]
or edx, edi
mov edi, dword [eax + 0x18]
mov dword [eax + 8], edx
xor dword [eax + 8], esi
mov edx, dword [eax + 4]
mov dword [eax + 0xc], ecx
xor ecx, ecx
xor dword [eax + 0xc], edx
or ecx, esi
add dword [eax + 0x10], edi
mov esi, dword [eax + 0x1c]
adc dword [eax + 0x14], esi
mov ebp, dword [eax + 0x10]
mov ebx, dword [eax + 0x14]
mov dword [eax], edx
mov edx, esi
shld esi, edi, 0x10
mov dword [eax + 4], ecx
xor ecx, ecx
or ecx, esi
shr edx, 0x10
shl edi, 0x10
or edx, edi
mov dword [eax + 0x1c], ecx
xor dword [eax + 0x1c], ebx
mov esi, dword [eax + 0x1c]
mov dword [eax + 0x18], edx
mov edx, esi
xor dword [eax + 0x18], ebp
mov edi, dword [eax + 0x18]
add dword [eax], edi
adc dword [eax + 4], esi
xor ecx, ecx
shld esi, edi, 0x15
shr edx, 0xb
or ecx, esi
shl edi, 0x15
mov esi, dword [eax + 0xc]
or edx, edi
mov edi, dword [eax + 8]
mov dword [eax + 0x18], edx
mov edx, dword [eax + 4]
mov dword [eax + 0x1c], ecx
xor dword [eax + 0x1c], edx
mov edx, esi
mov ecx, dword [eax]
xor dword [eax + 0x18], ecx
add ebp, edi
adc ebx, esi
xor ecx, ecx
shld esi, edi, 0x11
shr edx, 0xf
or ecx, esi
shl edi, 0x11
or edx, edi
mov dword [eax + 0xc], ecx
xor ecx, ecx
mov dword [eax + 8], edx
mov esi, ebp
mov edx, ebx
xor dword [eax + 0xc], edx
or ecx, esi
xor dword [eax + 8], esi
dec dword [esp + 0x20]
mov dword [eax + 0x10], edx
mov edx, dword [eax + 4]
mov dword [eax + 0x14], ecx
mov ecx, dword [eax]
jne 0x42bb50
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x452b60
Capabilities:
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov dword [edi + 4], 0
call fcn.00454c80
push 0x54
push edi
mov dword [esp + 0x14], eax
call fcn.00454c50
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x452ba7
push edi
call fcn.00454c90
mov ecx, dword [edi]
push edi
mov dword [ecx + 0x14], 0x38
mov ecx, dword [edi]
mov dword [ecx + 0x18], esi
mov eax, dword [edi]
mov eax, dword [eax]
call eax
add esp, 8
mov dword [esi], fcn.004527f0
mov dword [esi + 4], fcn.00452680
mov dword [esi + 8], fcn.00452750
mov dword [esi + 0xc], fcn.004525d0
mov dword [esi + 0x10], 0x452ec0
mov dword [esi + 0x14], 0x452e50
mov dword [esi + 0x18], 0x452cb0
mov dword [esi + 0x1c], 0x452480
mov dword [esi + 0x20], 0x452330
mov dword [esi + 0x24], 0x452a60
mov dword [esi + 0x28], 0x452f30
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 8]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x452c8a
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], 0x78
push ecx
lea ecx, [esp + 0xc]
push ecx
push str._ld_c
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x452c8a
mov al, byte [esp + 0x10]
cmp al, 0x6d
je 0x452c79
cmp al, 0x4d
mov eax, dword [esp + 8]
jne 0x452c81
imul eax, dword [esp + 8], 0x3e8
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ecx
ret
Function at 0x4690a4
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x79fd90], 0
push ebx
push esi
mov esi, 0x79fd98
jne 0x4690d0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x79fdb0], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x79fd90], 1
push dword [0x79fdb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x46916d
push 0x14
push 8
push dword [0x79e8ec]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x469197
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x79fd94]
test eax, eax
je 0x469112
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x79fd94], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x46919c
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x79fdb0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x79e8ec]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x469197
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x469679
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x184
push 8
push dword [0x79e8ec]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x79fe70]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x79fe74], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.0046c275
mov dword [esi + 0x58], 0x46a28c
mov eax, esi
mov dword [esi + 0x5c], 0x46a2d8
mov dword [esi + 0x10], fcn.00469e2d
mov dword [esi + 0x30], 0x469d1f
mov dword [esi + 0x64], 0x46a362
mov dword [esi + 0x60], 0x46a31a
mov dword [esi + 0x34], 0x4699cf
mov dword [esi + 0x24], 0x4699a6
mov dword [esi + 0x28], 0x46997b
mov dword [esi + 0x2c], 0x4698cd
mov dword [esi + 0x44], 0x46a092
pop esi
ret 4
Function at 0x46f509
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xd4]
mov dword [esp + 4], eax
test edx, edx
je 0x46f5bf
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
neg eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
push edi
lea edi, [ecx + eax*4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xcc]
mov ebp, edi
imul ecx, ebx
add ecx, dword [esi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x46f59f
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, esi
dec edx
jne 0x46f57a
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec edx
inc ebx
cmp dword [esi + 0xe8], 0
mov dword [esp + 0x3c], edx
jne 0x46f5b4
add edi, dword [esp + 0x14]
jmp 0x46f5b8
add edi, dword [esp + 0x24]
test edx, edx
jne 0x46f558
pop edi
pop ebp
pop ebx
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x46f8ca
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
test ebx, ebx
je 0x46f9a4
imul eax, dword [esp + 0x1c], 3
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
neg ecx
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
push edi
imul edi, dword [esp + 0x30], 3
mov dword [esp + 0x10], ecx
add eax, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], edi
mov esi, dword [eax + 0xcc]
imul esi, ebp
mov dword [esp + 0x34], edi
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x28]
test edx, edx
jle 0x46f97a
mov ebp, dword [esp + 0x34]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov edi, edx
movzx eax, byte [esi]
movzx ecx, byte [ebp]
imul ecx, dword [esp + 0x40]
imul eax, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [esi], al
inc esi
dec edi
jne 0x46f942
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x46f991
add edi, ecx
jmp 0x46f995
add edi, dword [esp + 0x24]
mov dword [esp + 0x38], edi
test ebx, ebx
jne 0x46f918
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x46ffc4
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x470079
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x47005a
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x470035
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x47006f
add edx, dword [esp + 0x14]
jmp 0x470073
add edx, dword [esp + 0x24]
test esi, esi
jne 0x470013
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x10001520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push 0x289fbd13
call fcn.10002650
add esp, 4
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x90], 0x73
mov byte [ebp - 0x8f], 0x63
mov byte [ebp - 0x8e], 0x20
mov byte [ebp - 0x8d], 0x73
mov byte [ebp - 0x8c], 0x74
mov byte [ebp - 0x8b], 0x6f
mov byte [ebp - 0x8a], 0x70
mov byte [ebp - 0x89], 0x20
mov byte [ebp - 0x88], 0
mov byte [ebp - 0x9c], 0x73
mov byte [ebp - 0x9b], 0x63
mov byte [ebp - 0x9a], 0x20
mov byte [ebp - 0x99], 0x64
mov byte [ebp - 0x98], 0x65
mov byte [ebp - 0x97], 0x6c
mov byte [ebp - 0x96], 0x65
mov byte [ebp - 0x95], 0x74
mov byte [ebp - 0x94], 0x65
mov byte [ebp - 0x93], 0x20
mov byte [ebp - 0x92], 0
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x80]
push ecx
call dword [0x10008050]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x80]
push eax
call dword [0x10008080]
push 0
lea ecx, [ebp - 0x80]
push ecx
call dword [ebp - 0x84]
lea edx, [ebp - 0x9c]
push edx
lea eax, [ebp - 0x80]
push eax
call dword [0x10008050]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x80]
push edx
call dword [0x10008080]
push 0
lea eax, [ebp - 0x80]
push eax
call dword [ebp - 0x84]
mov esp, ebp
pop ebp
ret
Function at 0x3201a993
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x3201a9a2
pop dword [ebp - 0x4c]
mov eax, 0x146ded91
sub eax, 0xe26c43ef
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x326834fa
sub dword [ebp - 0x5c], 0xe415efaf
mov dword [ebp - 0x58], 0x8f857b4a
add dword [ebp - 0x58], 0xa2add0fb
mov dword [ebp - 0x54], 0x428c5db4
sub dword [ebp - 0x54], 0xf6401986
mov dword [ebp - 0x50], 0xff632d1c
add dword [ebp - 0x50], 0x9cd2e4
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x79687c50
add dword [ebp - 0x5c], 0xfb09ed06
mov dword [ebp - 0x58], 0xf8141bd2
sub dword [ebp - 0x58], 0xb6a7ba5d
mov dword [ebp - 0x54], 0x18800fbd
sub dword [ebp - 0x54], 0xb510a351
mov dword [ebp - 0x50], 0x1da69e1b
sub dword [ebp - 0x50], 0x1da69e1b
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xde5c25c5
add eax, 0x53a90ab7
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x4625d
push 0
call eax
mov ecx, 0x42b7
xor edx, edx
add edx, eax
mov edi, 0x1ed52a12
sub edi, 0xeccd8812
add edi, dword [ebp - 0x4c]
mov esi, 0x9fda4dd5
sub esi, 0xb20a6204
sub dword [ebp - 0x1c], 0xff43f2bd
mov ebx, dword [edi]
xor dword [ebp - 0x3c], ecx
add ebx, esi
add dword [ebp - 0x3c], eax
mov dword [edx], ebx
xor dword [ebp - 0x3c], edi
add edx, 0xb0f940b2
add edx, 0x4f06bf52
add edi, 0x6ca1bc44
sub edi, 0x6ca1bc40
loop 0x3201aabb
add eax, 0x20c3bb15
sub eax, 0x20c2bd66
mov ebx, eax
add eax, 0x82b40efb
add eax, 0x7d4bf10a
mov ecx, 0x32000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x10007baf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10007bbe
pop dword [ebp - 0xc]
mov eax, 0xc3bcd00f
sub eax, 0xb3bc5451
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xec889a73
add dword [ebp - 0x1c], 0x61c9aad8
mov dword [ebp - 0x18], 0xd852237
add dword [ebp - 0x18], 0x24ae2a0e
mov dword [ebp - 0x14], 0xfdfb01dc
sub dword [ebp - 0x14], 0xb1aebdae
mov dword [ebp - 0x10], 0xa6c51d3d
sub dword [ebp - 0x10], 0xa6c51d3d
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xac534017
add dword [ebp - 0x1c], 0xc81f293f
mov dword [ebp - 0x18], 0x73f3aad7
sub dword [ebp - 0x18], 0x32874962
mov dword [ebp - 0x14], 0x38fcb19c
add dword [ebp - 0x14], 0x2a72bad0
mov dword [ebp - 0x10], 0xd378d418
sub dword [ebp - 0x10], 0xd378d418
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xd94f9221
add eax, 0x36b0ee27
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x332ea
push 0
call eax
mov ecx, 0x851db977
sub ecx, 0x851d7f68
xor esi, esi
add esi, eax
mov edx, 0x1000fa00
add edx, dword [ebp - 0xc]
mov ebx, 0x392eb6ae
mov edi, dword [edx]
xor edi, ebx
sub dword [ebp - 8], edi
mov dword [esi], edi
mov dword [ebp - 8], 0x2c7a419c
add esi, 0x9ed25653
add esi, 0x612da9b1
add edx, 4
loop 0x10007cd1
add eax, 0x1eb1a7d6
sub eax, 0x1eb0ccc7
mov ebx, eax
add eax, 5
mov ecx, 0xe8b9fdc0
add ecx, 0x27460240
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x900c236
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90a819f
call fcn.09007445
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900c292
xor al, al
jmp 0x900c2e2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900cf2c
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900d7af
test al, al
je 0x900c2d5
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.09030fd1
mov ecx, edi
call fcn.0900e6d7
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.09030fd1
mov al, bl
call fcn.090091e6
ret
Function at 0x9030fd1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x9030fe0
pop dword [ebp - 0xc]
mov eax, 0x9030fe0
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xd6f65e4c
sub dword [ebp - 0x1c], 0x88a41901
mov dword [ebp - 0x18], 0xe33fcd01
add dword [ebp - 0x18], 0x4ef37f44
mov dword [ebp - 0x14], 0xfce99c70
sub dword [ebp - 0x14], 0xb09d5842
mov dword [ebp - 0x10], 0x46867f8b
add dword [ebp - 0x10], 0xb9798075
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xe67efef3
add eax, 0x228be145
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x1ed98723
sub dword [ebp - 0x1c], 0xaa671dcd
mov dword [ebp - 0x18], 0x219de594
add dword [ebp - 0x18], 0x1fce7be1
mov dword [ebp - 0x14], 0xaae377d4
add dword [ebp - 0x14], 0xb88bf498
mov dword [ebp - 0x10], 0x130f45c8
add dword [ebp - 0x10], 0xecf0ba38
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x60a7f
push 0
call eax
mov ecx, 0xbb3d4540
sub ecx, 0xbb3d0448
mov esi, eax
mov edi, 0x90f4000
add edi, dword [ebp - 0xc]
mov ebx, 0xe44a9955
sub ebx, 0xea8934c
sub dword [ebp - 8], ebx
mov edx, dword [edi]
xor dword [ebp - 8], 0xe444d54b
xor edx, ebx
add dword [ebp - 8], 0xae177049
mov dword [esi], edx
mov dword [ebp - 4], 0x12a5cb66
add esi, 4
add edi, 0xa8d79663
add edi, 0x572869a1
loop 0x90310f2
add eax, 0x1cce97ea
sub eax, 0x1ccda137
xor ebx, ebx
add ebx, eax
add eax, 0xc4e9c8a5
add eax, 0x3b163760
mov ecx, 0xc771ef13
sub ecx, 0xbe71ef13
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x903d7c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x1f8
mov eax, 0x90a9b67
call fcn.09007445
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1fc]
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
push 0x80
push 0
push eax
mov dword [ebp - 0x200], ebx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 0xc]
mov ecx, 0x41444245
and dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1e8], eax
lea eax, [ebp - 0x1e4]
push 1
push eax
mov dword [ebp - 0x1f8], ecx
mov dword [ebp - 0x1f4], 0x4000000
mov dword [ebp - 0x1f0], 0x6c696e6b
mov dword [ebp - 0x1d8], 0x61637370
mov dword [ebp - 0x1b8], 0xf6d6
mov dword [ebp - 0x1b4], 0x10000
mov dword [ebp - 0x1b0], 0xd32d
mov dword [ebp - 0x1ac], ecx
call fcn.09007585
add esp, 0x14
lea eax, [ebp - 0x1fc]
lea ecx, [ebp - 0x17c]
push eax
push ebx
call fcn.09030fd1
push str.ACE_Device_Link
push ebx
lea ecx, [ebp - 0x74]
call fcn.0903a1fe
and dword [ebp - 4], 0
lea eax, [ebp - 0x74]
test esi, esi
lea ecx, [ebp - 0x17c]
cmovne eax, esi
push eax
call fcn.09030fd1
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x4c]
push ebx
call fcn.09039fb0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x17c]
call fcn.09030fd1
lea ecx, [ebp - 0x24]
call fcn.09030fd1
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x17c]
call fcn.09030fd1
push edi
lea ecx, [ebp - 0x17c]
call fcn.09030fd1
lea ecx, [ebp - 0x17c]
call fcn.0900955c
mov ecx, dword [ebp - 0x200]
mov edi, eax
mov ebx, dword [edi + 0x28]
push ebx
call fcn.09030fd1
mov ecx, dword [edi]
push eax
push ebx
push 0
mov esi, dword [ecx + 0x18]
mov ecx, esi
mov dword [ebp - 0x204], eax
call dword [0x90ae2d0]
mov ecx, edi
call esi
mov ecx, edi
call fcn.0900642e
mov edi, dword [ebp - 0x204]
push ebx
push edi
call fcn.09030fd1
push ebx
mov ebx, dword [ebp - 0x200]
push edi
push ebx
call fcn.09030fd1
add esp, 0x14
mov ecx, ebx
mov esi, eax
push edi
call fcn.09030fd1
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x24], vtable.CProfileTag.0
mov byte [ebp - 4], 0
call fcn.0903ab60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0903ac7e
mov eax, esi
call fcn.090091e6
ret
Function at 0x90500f8
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90aab4f
call fcn.0900578b
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
sub eax, dword [ebp - 0x20]
sub eax, dword [esi + 8]
sbb ecx, dword [esi + 0xc]
js 0x9050163
jg 0x905012d
test eax, eax
jb 0x9050163
mov edx, dword [esi + 4]
imul edi, edx, 3
test ecx, ecx
jg 0x9050163
jl 0x905013d
cmp eax, edi
ja 0x9050163
cmp eax, edx
jbe 0x9050157
mov ecx, dword [esi]
sub eax, edx
and dword [ebp - 4], 0
push eax
call fcn.09030fd1
jmp 0x9050163
jae 0x9050163
mov ecx, dword [esi]
sub edx, eax
push edx
call fcn.09030fd1
call fcn.0900625f
ret