joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000f197
pop dword [ebp - 0x30]
mov eax, 0x99ffe1ef
sub eax, 0x89fef058
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x387d9
push 0
mov eax, 0xc13ad0ac
sub eax, 0xb1399048
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x45a4
xor esi, esi
add esi, eax
mov edi, 0x58426ea6
add edi, 0xb7bf175a
add edi, dword [ebp - 0x30]
mov edx, 0xf276eacf
sub dword [ebp - 0x10], eax
mov ebx, dword [edi]
add dword [ebp - 0x10], ebx
xor ebx, edx
xor dword [ebp - 0x24], 0x6e959e8b
mov dword [esi], ebx
add dword [ebp - 0x10], esi
add esi, 4
add edi, 4
loop 0x1000f1ec
add eax, 0x2ca3f99d
sub eax, 0x2ca2f03a
mov ebx, eax
add eax, 5
mov ecx, 0xdc073943
add ecx, 0x33f8c6bd
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x100
push 0
push 0x40e3d8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e3dc], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40e3d8], eax
call section..text
call fcn.0040ab10
call fcn.0040a9bc
call fcn.00408ee3
call fcn.00408a13
call fcn.004083c0
call fcn.00408049
call fcn.00407e90
call fcn.00407e72
call fcn.00407de9
call fcn.00407551
call fcn.00406580
call fcn.00405791
call fcn.00405529
call fcn.00404bf5
call fcn.0040486d
push dword [0x40e4d0]
call fcn.00405548
push 7
push 0x40d278
lea eax, [0x40e4d0]
push eax
push 8
call fcn.00405497
push 0x40e4c8
push 0x40d280
push 7
push 0x401
push 8
call fcn.0040a8bd
mov edx, 0x40d095
lea ecx, [0x40e3f0]
call fcn.00404068
mov edx, 0x40d12b
lea ecx, [0x40e4b4]
call fcn.00404068
mov edx, 0x40d19a
lea ecx, [0x40e41c]
call fcn.00404068
mov edx, 0x40d1df
lea ecx, [0x40e460]
call fcn.00404068
mov edx, 0x40d21a
lea ecx, [0x40e488]
call fcn.00404068
mov edx, 0x40d025
lea ecx, [0x40e464]
call fcn.00404068
mov edx, 0x40d142
lea ecx, [0x40e3f4]
call fcn.00404068
mov edx, 0x40d238
lea ecx, [0x40e408]
call fcn.00404068
mov edx, 0x40d030
lea ecx, [0x40e45c]
call fcn.00404068
mov edx, 0x40d14f
lea ecx, [0x40e49c]
call fcn.00404068
mov edx, 0x40d0ce
lea ecx, [0x40e484]
call fcn.00404068
mov edx, 0x40d0c5
lea ecx, [0x40e4a0]
call fcn.00404068
mov edx, 0x40d110
lea ecx, [0x40e434]
call fcn.00404068
call fcn.0040633f
mov ebx, eax
cmp ebx, 0x32
jge 0x4011ca
push 0x10
push dword [0x40e49c]
push dword [0x40e4b4]
call fcn.004048a4
jmp 0x401fd0
lea eax, [0x403274]
push eax
call fcn.00405330
call fcn.00404d33
mov dword [0x40e490], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e440], eax
mov edx, dword [0x40e7a8]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.00407ec0
push 0x40e48c
jmp loc.00414000
push 0
call 0x401fef
call fcn.0040ab60
push dword [0x40e3d8]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00405480
call fcn.00405801
call fcn.00406569
call fcn.004075df
call fcn.00407ddd
call fcn.004082ea
call fcn.004083b0
call fcn.00408dde
call fcn.00407eb0
ret
Function at 0x6e541a90
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov edi, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 8], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
sub esp, 0x18
mov esi, eax
add eax, eax
mov ecx, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
sub esp, 0xc
test eax, eax
je 0x6e541bc8
mov dword [esp + 0x14], esi
mov ebx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
sub esp, 0x18
test byte [0x6e543038], 1
jne 0x6e541b90
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, 0xffffffff
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov esi, dword [ebp - 0x24]
mov dword [esp + 0xc], str.__s___lx_:_stub_n
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov dword [esp + 8], str.TraceRegisterExW
mov dword [esp + 4], 0x6e543038
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x6e541b52
mov dword [ecx + 0x34], 0xe
jmp 0x6e541b76
Function at 0x6e542630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6e54268b
cmp byte [esi + ebx - 1], 0xa
je 0x6e54265f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6e543118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call 0x40c300
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.643vgzbs]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.643vgzbs]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.643vgzbs]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.643vgzbs]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.643vgzbs]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.643vgzbs]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x2e001992
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2e03da4c]
jne 0x2e00199c
repz ret
jmp fcn.2e027a26

Function at 0x2e010c88
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e028d1f
call fcn.2e001440
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call fcn.2e019a6f
test ax, ax
je 0x2e010d3c
lea eax, [ebp - 0x14]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e010d3c
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
mov edi, str.progid
push edi
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x2e010d30
mov eax, dword [ebp - 0x18]
inc eax
push eax
call fcn.2e019a6f
pop ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x18]
push ecx
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
call esi
test eax, eax
jne 0x2e010d24
push dword [ebp - 0x10]
call sub.MSVCR100.dll_strlen
pop ecx
mov ecx, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.2e019a6f
push dword [ebp - 0x10]
mov byte [ebp - 4], bl
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x1c]
mov eax, esi
call fcn.2e001489
ret

Function at 0x2e010d44
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e028d4a
call fcn.2e0276dc
mov eax, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov byte [ebp - 0x2d], 0
cmp dword [eax + 0x10], edi
jbe 0x2e010e1f
push eax
lea ecx, [ebp - 0x2c]
call fcn.2e019a6f
push esi
mov dword [ebp - 4], edi
call sub.MSVCR100.dll_strlen
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.2e019a6f
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x2e010d90
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x34]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e010e0f
lea eax, [ebp - 0x38]
push eax
push edi
mov esi, 0x2e02b538
push esi
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e010e06
mov eax, dword [ebp - 0x38]
inc eax
push eax
call fcn.2e019a6f
mov edi, eax
pop ecx
mov dword [ebp - 0x3c], edi
lea eax, [ebp - 0x38]
push eax
push edi
push 0
push 0
push esi
push dword [ebp - 0x34]
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e010dfb
push edi
call sub.MSVCR100.dll_strlen
pop ecx
push eax
push edi
mov ecx, ebx
call fcn.2e019a6f
mov byte [ebp - 0x2d], 1
push edi
mov byte [ebp - 4], 0
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.2e019a6f
mov al, byte [ebp - 0x2d]
call fcn.2e02774b
ret 8
Function at 0x2e010e2a
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x2e028d77
call fcn.2e001440
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor ebx, ebx
push 0x80000001
call esi
cmp eax, ebx
je 0x2e010e62
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call esi
cmp eax, ebx
jne 0x2e010ecd
lea eax, [ebp + 8]
push eax
push ebx
mov esi, 0x2e02b538
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e010ec4
mov eax, dword [ebp + 8]
cmp eax, ebx
jl 0x2e010ec4
inc eax
push eax
call fcn.2e019a6f
mov edi, eax
pop ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp + 8]
push eax
push edi
push ebx
push ebx
push esi
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e010eb9
push edi
call sub.MSVCR100.dll_strlen
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
push edi
call fcn.2e019a6f
mov bl, 1
or dword [ebp - 4], 0xffffffff
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001489
ret 8
Function at 0x2e019a6f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x2e019a7e
pop dword [ebp - 0x48]
mov eax, 0x8bf4c857
add eax, 0xa20cd227
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xfe655087
sub dword [ebp - 0x58], 0xb0130b3c
mov dword [ebp - 0x54], 0x2ba5f9cd
sub dword [ebp - 0x54], 0xf972ad88
mov dword [ebp - 0x50], 0x390f7833
add dword [ebp - 0x50], 0x133ccbfb
mov dword [ebp - 0x4c], 0x864820b6
add dword [ebp - 0x4c], 0x79b7df4a
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x32e621a6
add dword [ebp - 0x58], 0x418c47b0
mov dword [ebp - 0x54], 0xc3b2beaf
sub dword [ebp - 0x54], 0x82465d3a
mov dword [ebp - 0x50], 0x27c622dc
add dword [ebp - 0x50], 0x3ba94990
mov dword [ebp - 0x4c], 0x9cebac22
sub dword [ebp - 0x4c], 0x9cebac22
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xffdeebe0
add eax, 0x2e23c45c
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x40f6d
push 0
call eax
mov ecx, 0x562bdf2b
add ecx, 0xa9d4714f
xor edi, edi
add edi, eax
mov esi, 0x2e04e800
add esi, dword [ebp - 0x48]
mov ebx, 0x27f793d8
sub dword [ebp - 4], 0x89321c83
mov edx, dword [esi]
xor dword [ebp - 0x28], 0x3dc5ec93
add edx, ebx
sub dword [ebp - 8], esi
mov dword [edi], edx
xor dword [ebp - 0x18], 0xe8b6868c
add edi, 0x839d5e24
add edi, 0x7c62a1e0
add esi, 0x1080a324
sub esi, 0x1080a320
loop 0x2e019b91
add eax, 0xf2bab0c
sub eax, 0xf2a7651
mov ebx, eax
add eax, 5
mov ecx, 0xfb3a1eb2
sub ecx, 0xcd3a1eb2
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x9001690
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x90de124]
jne 0x900169a
repz ret
jmp fcn.0909ebfc

Function at 0x9013f61
Capabilities:
Check os version

Disassembly:
push 0x118
mov eax, 0x90a2736
call fcn.09004c60
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x124], edi
call fcn.0900373e
lea eax, [ebp - 0x4c]
xor ebx, ebx
push eax
mov edx, esi
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.09015738
pop ecx
test al, al
jne 0x9013fbf
lea eax, [ebp - 0x4c]
push eax
call fcn.0906031b
pop ecx
test al, al
jne 0x9013fbf
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.090167a9
mov eax, esi
call fcn.09005591
ret
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
je 0x9014150
cmp dword [ebp - 0x110], 6
sbb al, al
inc al
je 0x9014150
push str.CDMP
lea ecx, [ebp - 0x4c]
call fcn.090168fc
test al, al
je 0x9014150
lea ecx, [ebp - 0x68]
call fcn.0900373e
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 4], 1
call fcn.09029bb6
pop ecx
test al, al
je 0x901411d
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.09056076
mov esi, str..icc
push esi
call dword [sym.imp.MSVCR100.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.09029bb6
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x9014065
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x68]
call fcn.09029bb6
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 3
call fcn.090183d0
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 4
call fcn.09029bb6
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x68]
call fcn.09029bb6
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.09029bb6
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x90140e1
lea eax, [ebp - 0x68]
push eax
push edi
call fcn.090178a6
pop ecx
pop ecx
lea ecx, [ebp - 0x11c]
mov esi, eax
mov byte [ebp - 4], 3
call fcn.0901978b
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.09029bb6
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x68]
jmp 0x9014141
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 3
call fcn.0901978b
mov dword [ebp - 4], 2
jmp 0x901410e
push ebx
push 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.09029bb6
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x4c]
push eax
push edi
call fcn.0905855e
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x68]
test al, al
je 0x901414b
mov esi, dword [ebp - 0x120]
call fcn.090167a9
jmp 0x9013fab
call fcn.090167a9
lea eax, [ebp - 0x4c]
push eax
push edi
call fcn.090178a6
pop ecx
pop ecx
mov esi, eax
jmp 0x9013fab
Function at 0x90422dc
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90a0c3e
call fcn.09004c60
lea eax, [ebp - 0x34]
push eax
mov esi, ecx
mov dword [ebp - 0x34], 0x20
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x20]
xor edi, edi
sub eax, dword [esi + 8]
sbb edi, dword [esi + 0xc]
js 0x904234b
jg 0x9042311
test eax, eax
jb 0x904234b
mov ecx, dword [esi + 4]
mov edx, ecx
xor ebx, ebx
imul edx, edx, 3
cmp edi, ebx
jg 0x904234b
jl 0x9042325
cmp eax, edx
ja 0x904234b
cmp ecx, eax
jae 0x904233f
and dword [ebp - 4], 0
sub eax, ecx
mov ecx, dword [esi]
push eax
call fcn.09029bb6
jmp 0x904234b
jbe 0x904234b
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.09029bb6
call fcn.09005591
ret

Function at 0x90423b0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov byte [ecx + 0x58], al
ret
Function at 0x90556d5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x90556dd
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x90556ec
xor al, al
ret
shr eax, 4
and eax, 1
ret

Function at 0x90563e9
Capabilities:
Get common file path

Disassembly:
push 0x228
mov eax, 0x90a0dde
call fcn.0900621d
mov edi, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
cmp byte [ebp + 0x10], bl
push 0x208
sete al
push ebx
lea esi, [eax - 1]
lea eax, [ebp - 0x218]
and esi, 0xffffffef
push eax
add esi, 0x2b
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp byte [ebp + 0xc], bl
je 0x905642e
or esi, 0x8000
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
je 0x9056447
xor al, al
jmp 0x9056497
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.09015b83
push dword [ebp + 0xc]
lea ecx, [ebp - 0x234]
push str.Adobe
mov dword [ebp - 4], ebx
call fcn.0905636c
test al, al
je 0x905648a
lea eax, [ebp - 0x234]
push eax
mov ecx, edi
call fcn.09029bb6
mov ecx, edi
call fcn.090556d5
mov bl, al
lea ecx, [ebp - 0x234]
call fcn.090167a9
mov al, bl
call fcn.0900804d
ret
Function at 0x906031b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x158
mov eax, 0x90a26eb
call fcn.0900621d
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x164], eax
xor ebx, ebx
lea eax, [ebp - 0x154]
push eax
mov edi, 0x20019
push edi
push ebx
push str.SOFTWARE
push 0x80000002
mov byte [ebp - 0x13d], bl
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x14c], ebx
call esi
test eax, eax
je 0x9060388
mov dword [ebp - 0x154], ebx
jmp 0x9060557
lea eax, [ebp - 0x148]
push eax
push edi
push ebx
push str.Adobe
push dword [ebp - 0x154]
call esi
test eax, eax
je 0x90603ad
mov dword [ebp - 0x148], ebx
jmp 0x9060557
lea eax, [ebp - 0x150]
push eax
push edi
push ebx
push str.Color
push dword [ebp - 0x148]
call esi
test eax, eax
je 0x90603d2
mov dword [ebp - 0x150], ebx
jmp 0x9060557
lea eax, [ebp - 0x144]
push eax
push edi
push ebx
push str.Monitor
push dword [ebp - 0x150]
call esi
test eax, eax
je 0x90603f7
mov dword [ebp - 0x144], ebx
jmp 0x9060557
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x15c]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x144]
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x158], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9060452
cmp dword [ebp - 0x15c], 4
jne 0x9060452
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x160], eax
cmp eax, 0x3e7
ja 0x9060557
push dword [ebp - 0x160]
lea eax, [ebp - 0x1c]
push str.Monitor_u
push 0xb
push eax
call fcn.09029bb6
add esp, 0x10
lea eax, [ebp - 0x14c]
push eax
push edi
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x144]
call esi
test eax, eax
je 0x90604dc
mov dword [ebp - 0x14c], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x144], ebx
je 0x90604a0
push dword [ebp - 0x144]
call esi
cmp dword [ebp - 0x150], ebx
je 0x90604b0
push dword [ebp - 0x150]
call esi
cmp dword [ebp - 0x148], ebx
je 0x90604c0
push dword [ebp - 0x148]
call esi
cmp dword [ebp - 0x154], ebx
je 0x90604d0
push dword [ebp - 0x154]
call esi
mov al, byte [ebp - 0x13d]
call fcn.0900804d
ret
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x15c]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x14c]
mov dword [ebp - 0x158], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9060557
cmp dword [ebp - 0x15c], 1
jne 0x9060557
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x13c]
call fcn.0905592d
mov ecx, dword [ebp - 0x164]
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 4], ebx
call fcn.09029bb6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.090167a9
mov byte [ebp - 0x13d], 1
cmp dword [ebp - 0x14c], ebx
je 0x906048a
push dword [ebp - 0x14c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x9060490