joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
cmp ecx, eax
mov eax, dword [0x410245]
jns 0x401de1
jl 0x401dd5
mov esp, dword [edx]
mov al, byte [0xba3e410b]
dec ebp
in al, dx
cmp edx, ecx
jae 0x401de1
cmp eax, dword [0x40d010]
mov eax, dword [0xffa31242]
adc dword [ebx + 0x40d0140d], ecx
add byte [ebp - 0x3d8f8b37], al
mov eax, dword [0x40c061]
add eax, 0x40
push 0x3cd262
push eax
call dword [0xa59c180]
sbb edx, 0xffffff88
jmp 0x401e13
mov ecx, dword [0x40d014]
test ecx, ecx
je 0x401e5b
ret 0x61a1
add cl, 0x59
or al, byte [ebx + 0xeeb88da]
jp 0x401dc8
adc al, byte [eax]
call dword [0xea40c179]
mov al, 0xc4
add al, 0xa1
bound edx, qword [eax + 0x41]
add byte [ebx - 0x40], dl
je 0x401dbd
mov eax, dword [0x415062]
push ebx
sal byte [ecx - 0x18], 0x53
adc eax, dword [ecx]
add byte [edi + 0x5e], bl
call 0x413174
pop edi
pop esi
pop ebx
mov esp, ebp
and dword [edx + ebp*2], esp
in eax, 0x21
push 0
push ebx
jecxz 0x401e2f
add byte [eax], al
add esp, 0x24
and al, 0x5e
pop ebx
mov esp, ebp
jmp 0x401dfc
ror dword [ebx + 0x78ec83ec], cl
sub esp, 0x78
push esi
mov esi, dword [ebp + 0xc]
jno 0x401e43
inc ebp
mov byte [edx + 0x43], ch
push eax
push esi
call 0xa186e0
mov edi, dword [ecx + 8]
mov edx, dword [0xa40c0c8]
adc eax, 0xa40c0c8
push eax
cmp byte [ebx - 0x5397bf3e], al
aam 0x40
add byte [edx - 1], dl
cld
popal
rol dword [eax], 0x7a
lodsb al, byte [esi]
add al, byte [ecx]
inc eax
les edx, [eax*4 + 0x501774d7]
push 0xc3d254
call dword [0xccc127]
add esp, 8
push esi
call dword [sym.imp.MSVCRT.dll_exit]
loopne 0x401e25
inc ebx
aas
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov esi, dword [ebp + 0x5314ec83]
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi - 0x51]
mov dword [ebp + 7], eax
call fcn.00406a00
mov dword [0x4186a0], eax
mov dword [ebx + 0x4100a4], eax
mov ebx, eax
mov bl, ch
adc al, 0x85
rol byte [eax], 0xfa
iretd

Function at 0x40b07e
Capabilities:
Encode data using xor

Disassembly:
call fcn.0040af97
mov ecx, 0x1d3
call 0x40b07e
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x40b081
sub cl, bl
sub ch, 0x94
out dx, al
clc
div esi
cmc
retf
Function at 0x646812f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x64681325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x64681325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x6468132c
mov eax, 1
jmp 0x64681331
mov eax, 0
leave
ret

Function at 0x64681333
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x114]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp + 4], 0x5c
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0xc], eax
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x218]
mov dword [esp], eax
call sym._strcpy
lea eax, [ebp - 0x114]
mov dword [esp + 4], eax
lea eax, [ebp - 0x31c]
mov dword [esp], eax
call sym._strcpy
mov dword [esp + 4], 0x5c
lea eax, [ebp - 0x31c]
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x420]
mov dword [eax], 0x74666f53
mov dword [eax + 4], 0x65726177
mov dword [eax + 8], 0x63694d5c
mov dword [eax + 0xc], 0x6f736f72
mov dword [eax + 0x10], 0x575c7466
mov dword [eax + 0x14], 0x6f646e69
mov dword [eax + 0x18], 0x435c7377
mov dword [eax + 0x1c], 0x65727275
mov dword [eax + 0x20], 0x6556746e
mov dword [eax + 0x24], 0x6f697372
mov dword [eax + 0x28], 0x75525c6e
mov word [eax + 0x2c], 0x6e
lea eax, [ebp - 0x424]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
lea eax, [ebp - 0x420]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x64681468
mov dword [esp], str.Error:_Can_not_open_the_registry_key.
call sym._puts
jmp 0x646814d9
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x424]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x114]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
lea edx, [ebp - 0x218]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x646814c8
mov dword [esp], str.Error:_Can_not_add_the_value_to_the_registry_key.
call sym._puts
jmp 0x646814d9
mov eax, dword [ebp - 0x424]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
leave
ret
Function at 0x64681569
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [esp + 0xc], 0x8000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x646816b9
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x646816ff
mov dword [esp], str.malloc_failed
call sym._puts
mov eax, 0
jmp 0x64681748
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
je 0x64681745
mov dword [esp], str.ReadFile_failed
call sym._puts
mov eax, 0
jmp 0x64681748
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x64681844
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret

Function at 0x646818a8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret

Function at 0x64681c30
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6468603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x64686034]
sub esp, 4
test ebx, ebx
je 0x64681c7b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x64681c74
test esi, esi
je 0x64681c74
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x64681c50
mov dword [esp], 0x6468603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x64681e60
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x64684198
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x64681eb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x64681f88
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x64681eee
cmp eax, 4
jne 0x64681f10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x64681efe
cmp edx, 4
je 0x64681efe
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.64681e60
Function at 0x2d817083
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2d8e2e01
call fcn.2d805d6a
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
push str.SoftwareMicrosoftInternet_Explorer
xor ebx, ebx
push 0x80000002
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x2d8170b6
xor al, al
jmp 0x2d81717e
push ebx
mov byte [ebp - 0x2c], bl
lea ecx, [ebp - 0x28]
push dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], ebx
push 0x100
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.2d8c3128
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
xor edi, edi
mov dword [ebp - 0x38], eax
inc edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push eax
push ebx
push str.Version
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test eax, eax
jne 0x2d81712f
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x2d81712f
cmp dword [ebp - 0x14], 8
mov ecx, esi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.2d8c3128
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x2d81717c
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], edi
cmp eax, 0x1000
jb 0x2d817173
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.2d8c3128
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.2d8c3128
pop ecx
pop ecx
mov al, bl
call fcn.2d807648
ret
Function at 0x2d8357c4
Capabilities:
Get disk information

Disassembly:
push 0x3c
mov eax, 0x2d8e5ab1
call fcn.2d805d6a
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
call fcn.2d8c3128
pop ecx
test al, al
je 0x2d83591e
lea eax, [ebp - 0x44]
push eax
push ebx
push esi
call fcn.2d8354bd
add esp, 0xc
test eax, eax
jne 0x2d835926
push dword [ebp - 0x44]
push 1
call fcn.2d8c3128
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x2d835926
lea eax, [ebp - 0x44]
push eax
push edi
push esi
call fcn.2d8354bd
add esp, 0xc
test eax, eax
jne 0x2d835926
mov byte [edi + 3], bl
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
call fcn.2d82c3ac
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.2d8361de
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], bl
pop ecx
pop ecx
cmp eax, 0x10
jb 0x2d8358a4
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 2
cmp eax, 0x1000
jb 0x2d835898
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.2d8c3128
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.2d8c3128
pop ecx
pop ecx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
cmp eax, 2
je 0x2d8358c0
cmp eax, 5
jne 0x2d8358c2
mov bl, 1
mov eax, dword [0x2d96a8d4]
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2d8fb384]
call esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 8
jb 0x2d83591e
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x2d835915
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.2d8c3128
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.2d8c3128
pop ecx
pop ecx
mov al, bl
call fcn.2d807648
ret
xor al, al
jmp 0x2d835920
Function at 0x2d8c3128
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x2d8c3137
pop dword [ebp - 0x2c]
mov eax, 0x2d8c3137
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xd03d1e98
sub dword [ebp - 0x3c], 0x81ead94d
mov dword [ebp - 0x38], 0x8b9d2353
add dword [ebp - 0x38], 0xa69628f2
mov dword [ebp - 0x34], 0x8efa6b38
add dword [ebp - 0x34], 0xbd51d8f6
mov dword [ebp - 0x30], 0xcc21cd6b
sub dword [ebp - 0x30], 0xcc21cd6b
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xc9dbc37d
add eax, 0x63b3ed0b
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x6007cced
sub dword [ebp - 0x3c], 0xeb956397
mov dword [ebp - 0x38], 0x9989ff82
add dword [ebp - 0x38], 0xa7e261f3
mov dword [ebp - 0x34], 0x5598141c
add dword [ebp - 0x34], 0xdd75850
mov dword [ebp - 0x30], 0x5a915242
add dword [ebp - 0x30], 0xa56eadbe
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xc88d29f7
sub eax, 0x9afd7967
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x6d900
push 0
call eax
mov ecx, 0xbe65aa00
sub ecx, 0xbe655857
mov edx, eax
mov esi, 0xc864316e
add esi, 0x6536ae92
add esi, dword [ebp - 0x2c]
mov ebx, 0x36872dcb
sub dword [ebp - 0x28], esi
mov edi, dword [esi]
sub edi, ebx
xor dword [ebp - 0x18], edx
mov dword [edx], edi
xor dword [ebp - 0x14], ebx
add edx, 4
add esi, 4
loop 0x2d8c324e
add eax, 0x3bb476ae
sub eax, 0x3bb33d37
xor ebx, ebx
add ebx, eax
add eax, 0xbc248cca
sub eax, 0xbc248cc5
mov ecx, 0x2d800000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x872058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008721a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x87207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x87206a
add dl, dl
jne 0x872089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8720dc
xor eax, eax
add dl, dl
jne 0x872096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x87217d
add dl, dl
jne 0x8720a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8720b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8720bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8720c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8720d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x872075
mov eax, 1
add dl, dl
jne 0x8720ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8720f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8720e1
sub eax, ebx
mov ebx, 1
jne 0x872128
mov ecx, 1
add dl, dl
jne 0x87210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x872119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x872105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x872075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x87213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x87214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x872136
cmp eax, 0x7d00
jae 0x87216d
cmp eax, 0x500
jb 0x872168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x872075
cmp eax, 0x7f
ja 0x872170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x872075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x87219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x872075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x900baef
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90a5e6b
call fcn.09007236
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900bb4b
xor al, al
jmp 0x900bb9b
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900bf5b
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900cfd5
test al, al
je 0x900bb8e
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.090954a5
mov ecx, edi
call fcn.0900e38a
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.0900e401
mov al, bl
call fcn.09008fc6
ret
Function at 0x906b1a2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x148
mov eax, 0x90a974c
call fcn.09007236
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
xor ebx, ebx
mov esi, 0x20019
push esi
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906b201
mov dword [ebp - 0x14c], ebx
jmp 0x906b37c
lea eax, [ebp - 0x148]
push eax
push esi
push ebx
push str.Adobe
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906b22a
mov dword [ebp - 0x148], ebx
jmp 0x906b37c
lea eax, [ebp - 0x144]
push eax
push esi
push ebx
push str.Color
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906b253
mov dword [ebp - 0x144], ebx
jmp 0x906b37c
lea eax, [ebp - 0x13c]
push eax
push esi
push ebx
push str.Monitor
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906b27c
mov dword [ebp - 0x13c], ebx
jmp 0x906b37c
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
mov esi, ebx
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x906b2ce
cmp dword [ebp - 0x154], 4
jne 0x906b2ce
mov esi, dword [ebp - 0x120]
cmp esi, 0x3e7
ja 0x906b37c
push esi
push str.Monitor_u
lea eax, [ebp - 0x1c]
push 0xb
push eax
call fcn.090954a5
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906b30e
mov dword [ebp - 0x140], ebx
jmp 0x906b391
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x906b37c
cmp dword [ebp - 0x154], 1
jne 0x906b37c
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.0901651a
lea eax, [ebp - 0x138]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.090954a5
lea ecx, [ebp - 0x138]
call fcn.0900e401
mov bl, 1
cmp dword [ebp - 0x140], 0
je 0x906b391
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x13c], 0
je 0x906b3a6
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x144], 0
je 0x906b3bb
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x148], 0
je 0x906b3d0
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14c], 0
je 0x906b3e5
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.09008fc6
ret