joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x42165e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x42166d
pop dword [ebp - 0x1c]
mov eax, 0x42166d
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x9eba51bb
add dword [ebp - 0x2c], 0xaf97f390
mov dword [ebp - 0x28], 0x4335f973
add dword [ebp - 0x28], 0xeefd52d2
mov dword [ebp - 0x24], 0x79086e39
sub dword [ebp - 0x24], 0x2cbc2a0b
mov dword [ebp - 0x20], 0xa5ddaf58
add dword [ebp - 0x20], 0x5a2250a8
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xb203c11d
sub eax, 0xb1c190a9
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x54a0ee62
add dword [ebp - 0x2c], 0x1fd17af4
mov dword [ebp - 0x28], 0xcc08bdb8
sub dword [ebp - 0x28], 0x8a9c5c43
mov dword [ebp - 0x24], 0x8a40124b
add dword [ebp - 0x24], 0xd92f5a21
mov dword [ebp - 0x20], 0x7b2795c8
add dword [ebp - 0x20], 0x84d86a38
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c27d
push 0
call eax
mov ecx, 0x41a8
mov esi, eax
mov edx, 0x7295e4e7
add edx, 0x8dad5f19
add edx, dword [ebp - 0x1c]
mov edi, 0x340bd86a
sub dword [ebp - 0x18], ebx
mov ebx, dword [edx]
add dword [ebp - 0xc], 0x5bb3bb1
sub ebx, edi
xor dword [ebp - 0x18], 0x54d362b3
mov dword [esi], ebx
mov dword [ebp - 8], 0x846538d9
add esi, 0x3ec62902
add esi, 0xc139d702
add edx, 0x4de0557a
sub edx, 0x4de05576
loop 0x421779
add eax, 0x76878750
add eax, 0x89797223
mov ebx, eax
add eax, 0x903a974e
add eax, 0x6fc568b7
mov ecx, 0xe12aba19
sub ecx, 0xe0eaba19
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x4012c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415792
mov eax, dword fs:[0]
push eax
sub esp, 0x840
mov eax, dword [0x41f04c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x834], edi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x84c], edi
push 0x820
mov dword [ebp - 0x838], eax
lea eax, [ebp - 0x830]
push 0
push eax
mov dword [ebp - 0x848], 0
call fcn.0040ace0
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
add esp, 0xc
mov word [edi], ax
xor esi, esi
mov dword [ebp - 0x83c], eax
xorps xmm0, xmm0
mov dword [ebp - 0x848], 1
movq qword [ebp - 0x844], xmm0
mov dword [ebp - 0x844], esi
mov dword [ebp - 0x840], esi
mov dword [ebp - 0x83c], esi
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x838]
cmp dword [eax + 0x14], 8
jb 0x40137f
mov eax, dword [eax]
lea ecx, [ebp - 0x838]
mov dword [ebp - 0x838], 0
push ecx
push 0x20219
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4013bd
mov esi, dword [ebp - 0x838]
mov dword [ebp - 0x844], esi
mov dword [ebp - 0x840], 0x200
mov byte [ebp - 4], 1
test eax, eax
jne 0x40145e
cmp dword [ebx + 0x14], 8
jb 0x4013d1
mov ebx, dword [ebx]
lea eax, [ebp - 0x838]
mov dword [ebp - 0x838], 0x820
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x834]
push eax
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40145e
mov eax, dword [ebp - 0x834]
cmp eax, 1
je 0x40140e
cmp eax, 2
jne 0x40145e
mov eax, dword [ebp - 0x838]
test eax, eax
je 0x40142b
test al, 1
jne 0x40145e
shr eax, 1
cmp word [ebp + eax*2 - 0x832], 0
je 0x401434
jmp 0x40145e
xor eax, eax
mov word [ebp - 0x830], ax
lea ecx, [ebp - 0x830]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401440
sub ecx, edx
lea eax, [ebp - 0x830]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.004032f0
test esi, esi
je 0x401469
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00408cc7
mov esp, ebp
pop ebp
ret
Function at 0x405d60
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x41f04c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [ebp - 0xc], 0
mov ecx, edx
mov dword [ebp - 8], 7
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405d96
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1c]
call fcn.004032f0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
je 0x405dc0
or esi, 0xffffffff
jmp 0x405ddb
lea eax, [ebp - 0x1c]
mov byte [0x420588], 1
push eax
call fcn.00403510
test al, al
je 0x405ddb
call fcn.00405810
mov esi, eax
cmp byte [0x420588], 0
je 0x405df1
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [0x420588], 0
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x405e27
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405e1d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405e3b
push edx
push ecx
call fcn.00408cd8
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00408cc7
mov esp, ebp
pop ebp
ret 0x10
call fcn.0040c73a
int3
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00409a27
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00409a27
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00409a27
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00409a27
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00409a27
mov dword [0x41203c], eax
call fcn.00409a27
test eax, eax
jge 0x402550
push 8
call fcn.00409a27
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00409a27
pop ecx
push 1
call fcn.00409a27
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00409a27
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00409a27
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00409a27
jmp 0x402495

Function at 0x409a27
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x409a36
pop dword [ebp - 0x2c]
mov eax, 0x6e446c74
add eax, 0x91fc2dc2
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x371d2
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x9d6ee0aa
sub ecx, 0x9d6ea12a
mov edi, eax
mov edx, 0x13913e7a
add edx, 0xecaffd4a
add edx, dword [ebp - 0x2c]
mov esi, 0x5841089
sub esi, 0x5bb3e19f
add dword [ebp - 0x14], 0xb4ef9a4f
mov ebx, dword [edx]
add dword [ebp - 8], edx
sub ebx, esi
xor dword [ebp - 0x24], esi
mov dword [edi], ebx
sub dword [ebp - 8], 0xaa79f0b4
add edi, 0x84ab8d48
add edi, 0x7b5472bc
add edx, 0x5e935726
add edx, 0xa16ca8de
loop 0x409a90
add eax, 0x13b351ea
add eax, 0xec4d9ee9
xor ebx, ebx
add ebx, eax
add eax, 0x9d37f0a7
sub eax, 0x9d37f0a2
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0xd7b054
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec edi
jmp 0xd144cc
je 0xcd2575
cmp eax, edx
jmp 0xe2e85b
jmp 0xe28d2d
ret
je 0xe0a674
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0xe0a660
mov edi, dword [edx + ecx + 0x18]
test edi, edi
jmp 0xd42548
call fcn.0143a1ff
add esp, 4
test eax, eax
jmp 0xd3d2e7
mov dword [ebp - 0xc], eax
jmp 0x129133f
jle 0x12691e4
jmp 0xd6635e
je 0xcd2575
lea eax, [eax + ecx]
cmc
cmp edi, 0x564d4a54
sub ebx, ebx
jmp 0xcbf89f
jns 0xe28d21
lea edi, [esi - 1]
jmp 0xcce080
je 0xd66363
mov eax, dword [edx + ecx + 0x20]
jmp 0xd3cf7d
cmp eax, esi
jae 0xdf8ab3
lea eax, [eax + ecx]
sbb cl, 0xbe
adc si, dx
mov cl, byte [eax]
mov esi, eax
test cl, cl
jmp 0xd236e4
mov eax, dword [ebp + 8]
bsf ecx, ebx
mov ecx, dword [ebp - 4]
bt dx, si
mov edx, dword [ecx + eax + 0x24]
xor cl, dh
lea ecx, [edx + esi*2]
and dx, sp
bswap edx
movzx edx, word [ecx + eax]
bsr cx, bp
mov dword [ebp - 8], edx
add dx, sp
rcr dl, 5
mov ecx, eax
btc ax, 0x74
sbb ah, dh
bts edx, ebx
mov edx, dword [ebp - 4]
xor ah, bh
mov eax, dword [ebp - 8]
cmp ecx, 0x404b311c
cmp eax, dword [edx + ecx + 0x14]
jmp 0xdc1f5c
ret
push ebp
mov ebp, esp
adc cx, 0x7bf6
sar ecx, 0x93
mov ecx, dword [ebp + 8]
lea esp, [esp - 0x114]
clc
cmp bp, 0x2007
cmc
push esi
test ecx, ecx
jmp 0xcdce3a
jae 0xcd2575
mov esi, dword [edx + ecx + 0x1c]
cmc
test esi, eax
lea eax, [esi + eax*4]
clc
test si, si
mov eax, dword [eax + ecx]
test eax, eax
jmp 0xcc5cdd
mov dword [ebp - 8], eax
jmp 0x128be73
pop edi
and si, cx
stc
cmp esp, 0x79a70fab
pop ebx
add esi, esp
add eax, ecx
jmp 0x1219e32
je 0xe0a674
mov eax, 0x5a4d
cmp word [ecx], ax
je 0xe0d5c7
xor eax, eax
pop esi
mov esp, ebp
movzx ebp, si
cmovle bp, sp
pop ebp
jmp 0xcdbe17
mov eax, dword [ecx + 0x3c]
cmp ebp, eax
cmp dword [eax + ecx], 0x4550
jne 0xe0a674
mov edx, dword [eax + ecx + 0x78]
mov dword [ebp - 4], edx
cmc
test edx, edx
je 0xe0a674
mov eax, dword [eax + ecx + 0x7c]
clc
test si, 0x6791
push ebx
jmp 0x126a3af
jle 0xd66326
lea ebx, [esi + 1]
rol cl, 0x71
mov ecx, dword [ebp + 8]
clc
test cl, 0xe1
cmp ebx, edi
jmp 0xd1da6b
jb 0xdf8ab3
mov esi, dword [ebp - 0x10]
stc
add esi, edx
stc
jmp 0xd43138
pop esi
jmp 0x125f13b
mov esp, ebp
cmovp ebp, edi
mov ebp, 0xa9d5345
pop ebp
jmp 0xd731af
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
lea esi, [edi + ebx]
cmc
sar esi, 1
jmp 0x1285310
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
cmp bp, si
cmc
cmp esi, 0xffff
ja 0xce54fa
mov eax, esi
clc
test ebx, 0x78b54d8
cmc
sub eax, dword [edx + ecx + 0x10]
jmp 0xdd6ad6
mov eax, dword [eax + esi*4]
push edx
add dl, 0x44
ror dl, cl
xor edx, esi
mov edx, dword [ebp + 0xc]
add eax, ecx
jmp 0xcf07dc
jmp 0xd66363
js 0xd66363
jmp 0x12691e7
Function at 0x41a141
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x41a150
pop dword [ebp - 0x10]
mov eax, 0x77866e0b
sub eax, 0x7744ccbb
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3e740
push 0
mov eax, 0xf9a6ea2b
sub eax, 0xf9649813
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x59f1eedd
sub ecx, 0x59f1a42b
mov ebx, eax
mov edi, 0x4a22e3e3
add edi, 0xb620701d
add edi, dword [ebp - 0x10]
mov edx, 0xf66892db
add edx, 0xb8ed50f3
xor dword [ebp - 8], 0xc0993070
mov esi, dword [edi]
sub dword [ebp - 4], 0x28559550
sub esi, edx
xor dword [ebp - 8], eax
mov dword [ebx], esi
xor dword [ebp - 8], edi
add ebx, 0xee60daa7
sub ebx, 0xee60daa3
add edi, 0x85081e00
sub edi, 0x85081dfc
loop 0x41a1af
add eax, 0x313f376
add eax, 0xfced2a25
xor ebx, ebx
add ebx, eax
add eax, 0x70ee83ae
sub eax, 0x70ee83a9
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80c004]
jne 0x40100a
repz ret
jmp fcn.00401641

Function at 0x407687
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x80c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004041e9
and dword [ebp - 0x14], 0
cmp dword [0x810f68], 0
mov dword [ebp - 0x18], eax
jne 0x40773a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4077e2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4077e2
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x810f68], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x810f6c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x810f70], eax
call edi
push eax
call esi
mov dword [0x810f78], eax
test eax, eax
je 0x40773a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x810f74], eax
mov eax, dword [0x810f74]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x407793
cmp dword [0x810f78], ecx
je 0x407793
push eax
call esi
push dword [0x810f78]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x407793
test ebx, ebx
je 0x407793
call edi
test eax, eax
je 0x40778a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40778a
test byte [ebp - 8], 1
jne 0x407793
or dword [ebp + 0x10], 0x200000
jmp 0x4077c6
mov eax, dword [0x810f6c]
cmp eax, dword [ebp - 0x18]
je 0x4077c6
push eax
call esi
test eax, eax
je 0x4077c6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4077c6
mov eax, dword [0x810f70]
cmp eax, dword [ebp - 0x18]
je 0x4077c6
push eax
call esi
test eax, eax
je 0x4077c6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x810f68]
call esi
test eax, eax
je 0x4077e2
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4077e4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x807ec0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x408
mov eax, dword [0x80c004]
xor eax, esp
mov dword [esp + 0x404], eax
cmp dword [0x26b3fac], 0xfc7
jne 0x807eef
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x81148c]
imul eax, eax, 0x343fd
cmp dword [0x26b3fac], 0x139e
mov dword [0x81148c], eax
jne 0x807f1e
mov ecx, dword [esp]
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x81148c]
add eax, 0x269ec3
push esi
mov dword [0x81148c], eax
movzx esi, word [0x81148e]
and esi, 0x7fff
cmp dword [0x26b3fac], 0x8e7
jne 0x807f53
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, dword [esp + 0x408]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x408
ret

Function at 0x808020
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x80c004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x80d300]
push ebx
mov ebx, dword [0x26b3a18]
push edi
mov edi, dword [0x26b3fac]
call fcn.00807f70
cmp dword [0x26b3fac], 0x2f
jne 0x808085
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.00807fa0
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401000
add esp, 0x24
ret
Function at 0x4087d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call fcn.00408570
add esp, 4
lea eax, [ebp - 0x210]
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x408868
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
je 0x408864
push 0
mov ecx, dword [ebp - 0x218]
push ecx
push str.Could_not_open_file_mapping_object
push str.ReleaseSharedMemory__
call fcn.004082b0
add esp, 0x10
xor eax, eax
jmp 0x40887a
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret

Function at 0x409a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
invalid
movsd dword es:[edi], dword [esi]
lodsb al, byte [esi]
stc
invalid
Function at 0x900e460
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90cf2a5
call fcn.09006dd9
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900e4bc
xor al, al
jmp 0x900e50c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900e8b2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900f2c5
test al, al
je 0x900e4ff
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.09012320
mov ecx, edi
call fcn.09011cd1
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.09012320
mov al, bl
call fcn.09006f96
ret

Function at 0x9011cd1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x9011cd9
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9011ce8
xor al, al
ret
shr eax, 4
and al, 1
ret

Function at 0x9012320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x901232f
pop dword [ebp - 0x10]
mov eax, 0x6e82994d
add eax, 0x9a7e89e2
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x400a165b
add dword [ebp - 0x20], 0xe482ef0
mov dword [ebp - 0x1c], 0x7a512323
add dword [ebp - 0x1c], 0xb7e22922
mov dword [ebp - 0x18], 0xb2f9516e
add dword [ebp - 0x18], 0x9952f2c0
mov dword [ebp - 0x14], 0xa04c3301
sub dword [ebp - 0x14], 0xa04c3301
lea eax, [ebp - 0x20]
push eax
mov eax, 0x5edc7b8b
sub eax, 0x55cf1ac7
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xd87c314d
add dword [ebp - 0x20], 0x9bf63809
mov dword [ebp - 0x1c], 0x5d78751a
add dword [ebp - 0x1c], 0xe3f3ec5b
mov dword [ebp - 0x18], 0x7356bda7
sub dword [ebp - 0x18], 0xfe7513b
mov dword [ebp - 0x14], 0xdab2d163
sub dword [ebp - 0x14], 0xdab2d163
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x4438379d
sub eax, 0x3b2ad6dd
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x75a7a
push 0
call eax
mov ecx, 0x416e6161
sub ecx, 0x416e22f3
mov edx, eax
mov ebx, 0x9125c00
add ebx, dword [ebp - 0x10]
mov esi, 0x6097023
sub esi, 0x268430a8
sub dword [ebp - 8], eax
mov edi, dword [ebx]
add dword [ebp - 8], 0x8d28fc3e
add edi, esi
xor dword [ebp - 0xc], 0xae54c9e6
mov dword [edx], edi
add dword [ebp - 8], 0x18c70e13
add edx, 0xbaaaf9c9
sub edx, 0xbaaaf9c5
add ebx, 4
loop 0x901244b
add eax, 0x17dc8f6c
add eax, 0xe8245d1f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1076e46a
sub ecx, 0x776e46a
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x901e790
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov byte [ecx + 0x58], 0
ret
Function at 0x90582d8
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90d2348
call fcn.0900620a
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
xor edx, edx
sub eax, dword [ebp - 0x20]
sub eax, dword [esi + 8]
sbb edx, dword [esi + 0xc]
js 0x9058343
jg 0x905830d
test eax, eax
jb 0x9058343
mov ecx, dword [esi + 4]
imul edi, ecx, 3
test edx, edx
jg 0x9058343
jl 0x905831d
cmp eax, edi
ja 0x9058343
cmp eax, ecx
jbe 0x9058337
and dword [ebp - 4], 0
sub eax, ecx
mov ecx, dword [esi]
push eax
call fcn.09012320
jmp 0x9058343
jae 0x9058343
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.09012320
call fcn.09006fcf
ret
Function at 0x9079b47
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x148
mov eax, 0x90d3869
call fcn.09006dd9
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
xor ebx, ebx
mov esi, 0x20019
push esi
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079ba6
mov dword [ebp - 0x14c], ebx
jmp 0x9079d25
lea eax, [ebp - 0x148]
push eax
push esi
push ebx
push str.Adobe
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079bcf
mov dword [ebp - 0x148], ebx
jmp 0x9079d25
lea eax, [ebp - 0x144]
push eax
push esi
push ebx
push str.Color
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079bf8
mov dword [ebp - 0x144], ebx
jmp 0x9079d25
lea eax, [ebp - 0x13c]
push eax
push esi
push ebx
push str.Monitor
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079c21
mov dword [ebp - 0x13c], ebx
jmp 0x9079d25
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
mov esi, ebx
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9079c73
cmp dword [ebp - 0x154], 4
jne 0x9079c73
mov esi, dword [ebp - 0x120]
cmp esi, 0x3e7
ja 0x9079d25
push esi
push str.Monitor_u
lea eax, [ebp - 0x1c]
push 0xb
push eax
call fcn.09012320
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079cb3
mov dword [ebp - 0x140], ebx
jmp 0x9079d3a
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9079d25
cmp dword [ebp - 0x154], 1
jne 0x9079d25
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.0901904e
lea eax, [ebp - 0x138]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.09012320
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.09012320
mov bl, 1
cmp dword [ebp - 0x140], 0
je 0x9079d3a
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x13c], 0
je 0x9079d4f
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x144], 0
je 0x9079d64
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x148], 0
je 0x9079d79
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14c], 0
je 0x9079d8e
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.09006f96
ret