joyce8/EMBER2024-capa huggingface dataset:
Function at 0x906c6ef
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x148
mov eax, 0x90abd2c
call fcn.09007445
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
xor ebx, ebx
mov esi, 0x20019
push esi
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906c74e
mov dword [ebp - 0x14c], ebx
jmp 0x906c8cd
lea eax, [ebp - 0x148]
push eax
push esi
push ebx
push str.Adobe
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906c777
mov dword [ebp - 0x148], ebx
jmp 0x906c8cd
lea eax, [ebp - 0x144]
push eax
push esi
push ebx
push str.Color
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906c7a0
mov dword [ebp - 0x144], ebx
jmp 0x906c8cd
lea eax, [ebp - 0x13c]
push eax
push esi
push ebx
push str.Monitor
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906c7c9
mov dword [ebp - 0x13c], ebx
jmp 0x906c8cd
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
mov esi, ebx
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x906c81b
cmp dword [ebp - 0x154], 4
jne 0x906c81b
mov esi, dword [ebp - 0x120]
cmp esi, 0x3e7
ja 0x906c8cd
push esi
push str.Monitor_u
lea eax, [ebp - 0x1c]
push 0xb
push eax
call fcn.090362e3
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906c85b
mov dword [ebp - 0x140], ebx
jmp 0x906c8e2
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x906c8cd
cmp dword [ebp - 0x154], 1
jne 0x906c8cd
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.090169c5
lea eax, [ebp - 0x138]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.090362e3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.090362e3
mov bl, 1
cmp dword [ebp - 0x140], 0
je 0x906c8e2
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x13c], 0
je 0x906c8f7
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x144], 0
je 0x906c90c
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x148], 0
je 0x906c921
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14c], 0
je 0x906c936
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.090091e6
ret
Function at 0x906e3b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90abdd2
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1430
call fcn.090a6f20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x1424], edi
mov dword [ebp - 0x1430], eax
mov dword [ebp - 0x1428], eax
mov dword [ebp - 0x143c], edi
call fcn.090168fd
xor ecx, ecx
push 0xf
mov eax, ecx
mov dword [ebp - 4], ecx
pop esi
mov dword [ebp - 0x142c], eax
mov dword [ebp - 0x1420], esi
xor edx, edx
mov edi, ecx
div esi
mov dword [ebp - 0x141c], edi
lea esi, [ebp - 0x416]
mov dword [ebp - 0x1434], eax
mov eax, edi
xor edx, edx
div dword [ebp - 0x1420]
mov edi, ecx
mov dword [ebp - 0x1438], eax
mov edx, dword [ebp - 0x1434]
mov byte [esi - 1], dl
xor edx, edx
mov byte [esi], al
mov eax, edi
div dword [ebp - 0x1420]
mov edx, 0xff
mov byte [esi + 1], al
add edi, edx
mov eax, dword [ebp - 0x1438]
add esi, 4
cmp edi, 0xff0
jb 0x906e460
mov edi, dword [ebp - 0x141c]
add edi, edx
mov dword [ebp - 0x141c], edi
cmp edi, 0xff0
jb 0x906e44e
push ecx
mov ecx, dword [ebp - 0x1424]
lea esi, [edx + 1]
push 0x5058595a
push 0x706c6162
push esi
lea eax, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.090362e3
push esi
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.090362e3
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x141c], esi
movzx eax, word [ebp + esi - 0xc16]
movzx ecx, word [ebp + esi - 0x1416]
sub ecx, eax
mov eax, ecx
movzx ecx, word [ebp + esi - 0x1414]
cdq
mov edi, eax
movzx eax, word [ebp + esi - 0xc14]
sub ecx, eax
xor edi, edx
mov eax, ecx
sub edi, edx
mov ecx, dword [ebp - 0x141c]
cdq
mov esi, eax
xor esi, edx
movzx eax, word [ebp + ecx - 0xc12]
sub esi, edx
movzx ecx, word [ebp + ecx - 0x1412]
sub ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 0x1428]
cdq
xor eax, edx
sub eax, edx
cmp ecx, edi
cmovl ecx, edi
cmp ecx, esi
cmovl ecx, esi
mov esi, dword [ebp - 0x141c]
cmp ecx, eax
cmovl ecx, eax
add esi, 8
mov dword [ebp - 0x1428], ecx
mov dword [ebp - 0x141c], esi
cmp esi, 0x800
jb 0x906e4ed
cmp ecx, 0xa
ja 0x906e5a9
mov eax, dword [ebp - 0x142c]
mov esi, dword [ebp - 0x1420]
add eax, 0xff
mov dword [ebp - 0x142c], eax
push 0
pop ecx
cmp eax, 0xff0
jb 0x906e436
mov byte [ebp - 0x1430], 1
mov ecx, dword [ebp - 0x1424]
or dword [ebp - 4], 0xffffffff
call fcn.09016a6b
mov al, byte [ebp - 0x1430]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x907dd32
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ac387
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090a6f20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.090362e3
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x907ddb7
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.090362e3
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.090168fd
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x907ddce
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x907de2a
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x907de1d
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x504c4142
push 0x271
push eax
push eax
call fcn.090362e3
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.090362e3
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005d4d
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x907dec6
sub dword [ebp - 0x13d8], 1
jne 0x907debc
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09005e1d
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x907de06
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.09016a6b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x907df9b
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ac387
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090a6f20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.090362e3
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x907e020
push 0
push 0x753
push 0xb71b
push dword [esi + 4]
call fcn.090362e3
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.090168fd
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x907e037
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x907e093
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x907e086
mov ecx, dword [ebp - 0x13e4]
mov eax, 0x504c4142
push 0
push eax
push eax
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
call fcn.090362e3
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x753
push edi
push dword [eax]
call fcn.090362e3
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005d4d
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov eax, dword [esi]
mov edx, dword [esi + 4]
shr eax, 0x10
imul eax, eax, 0xff
movzx ecx, dx
add ecx, 0x40
shr ecx, 7
add eax, 0x4000
shr eax, 0xf
cmp ecx, 0xff
mov byte [edi - 2], al
movzx eax, cl
mov ecx, 0xff
cmova eax, ecx
shr edx, 0x10
add edx, 0x40
mov byte [edi - 1], al
shr edx, 7
cmp edx, ecx
movzx eax, dl
cmova eax, ecx
add esi, 8
mov byte [edi], al
add edi, 3
sub dword [ebp - 0x13d4], 1
jne 0x907e12c
sub dword [ebp - 0x13d8], 1
jne 0x907e122
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09005e1d
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x753
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xb71b
jb 0x907e06f
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.09016a6b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x907e5ad
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ac387
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090a6f20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.090362e3
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x907e632
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.090362e3
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.090168fd
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x907e649
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x907e6a5
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x907e698
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x50524742
push 0x271
push eax
push eax
call fcn.090362e3
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.090362e3
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005d4d
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x907e741
sub dword [ebp - 0x13d8], 1
jne 0x907e737
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09005e1d
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x907e681
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.09016a6b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x909f010
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ace1d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb2c], eax
call fcn.090362e3
add esp, 4
lea ecx, [ebp - 0xb24]
push eax
call fcn.090362e3
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push dword [ebp - 0xb24]
mov dword [ebp - 4], 0
push esi
call fcn.09008247
add esp, 0x3c
lea ecx, [ebp - 0xb20]
push eax
call fcn.090362e3
mov byte [ebp - 4], 1
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x909f0c0
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0x918]
push 0
push 0x5058595a
push 0x67386b30
push 0x100
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.090362e3
movzx ecx, word [ebp - 0x11c]
movzx edi, word [ebp - 0x914]
mov dword [ebp - 0xb28], ecx
cmp ecx, edi
jbe 0x909f23a
mov edx, ecx
sub edx, edi
xor esi, esi
mov dword [ebp - 0xb1c], edx
movzx eax, word [ebp + esi*8 - 0x914]
cmp eax, edi
ja 0x909f131
xor eax, eax
jmp 0x909f15e
cmp eax, ecx
jb 0x909f13c
mov eax, 0x8000
jmp 0x909f15e
sub eax, edi
mov ecx, edx
shl eax, 0xf
xor edx, edx
shr ecx, 1
add eax, ecx
mov ecx, dword [ebp - 0xb28]
div dword [ebp - 0xb1c]
mov edx, dword [ebp - 0xb1c]
movzx eax, ax
mov word [ebp + esi*2 - 0xb18], ax
inc esi
cmp esi, 0x100
jb 0x909f121
lea ecx, [ebp - 0xb20]
mov byte [ebp - 4], 0
call fcn.09017177
lea ecx, [ebp - 0xb24]
mov dword [ebp - 4], 0xffffffff
call fcn.0901b295
mov esi, dword [ebp - 0xb2c]
lea eax, [esi + 8]
push eax
push 0x278
mov dword [ebp - 0xb2c], eax
call fcn.090362e3
add esp, 8
mov dword [ebp - 0xb28], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x909f1ca
push esi
mov ecx, eax
call fcn.090362e3
mov edx, eax
jmp 0x909f1cc
xor edx, edx
mov ecx, dword [ebx + 0xc]
xorps xmm0, xmm0
movsd xmm1, qword [ebx + 0x10]
mulsd xmm1, qword [0x90bee38]
mov eax, dword [ecx]
mov dword [edx + 0x68], eax
mov eax, dword [ecx + 4]
comisd xmm0, xmm1
mov dword [edx + 0x6c], eax
jbe 0x909f1fa
subsd xmm1, qword [0x90b4780]
jmp 0x909f202
addsd xmm1, qword [0x90b4780]
cvttsd2si eax, xmm1
lea edi, [edx + 0x72]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x70], ax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x6250726f
call fcn.090362e3
int3
Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
pop ebp
ret 0x8830
push ebp
mov ebp, esp
sub esp, 0x14
cwde
jge 0x407f09
dec edi
mov eax, dword [0x1045c707]
jge 0x407f01
add byte [eax], al
fld qword [ebp + 8]
fcomp qword [0xf140c230]
mov ebx, esi
sbb byte [ebx - 0x75], dl
pop ebp
and byte [esi + 0x33], dl
mul byte [ecx - 0xa]
ret 0xf140
loopne 0x407ea3
jne 0x407f18
mov dword [ecx], esi
inc eax
les eax, [0xe7a6a8b]
fld qword [ebp + 8]
fchs
ffree st(5)
or bh, al
add dword [ecx], eax
add byte [eax], al
adc ecx, dword [ebx + 0x45cad4d]
push 0x50ec458d
push ecx
push edx
push dword [sym.imp.MSVCRT.dll_modf]
fstp qword [ebp + 8]
fst st(7)
in al, dx
xchg ecx, eax
sbb eax, 0xa440c230
add esp, 0xc
fnstsw ax
test ah, 0x44
jnp 0x407fcd
lea ebp, [edi + 0x55743bc8]
pop eax
fld qword [ebp - 0x14]
in al, dx
fdiv st(4), st(0)
xor dl, al
add dword [eax], 0xffffffdf
loopne 0x407f64
les esp, [edx]
dec dword [eax + 0x31]
mov ecx, 0x100ddcec
ret
fld qword [ebp - 0x44]
fcomp qword [0x40c230]
fistp word [ebp + 0x25]
outsb dx, byte [esi]
inc ecx
add byte [eax], al
jne 0x40801d
fstp qword [edx - 0x7f2b088]
ret 0x40
mov eax, dword [ebp + 0x10]
lea esi, [eax + ebx]
mov esi, dword [eax + 0x1c]
test eax, eax
jne 0x40802d
add esi, dword [ebp - 0x2d]
mov ecx, dword [ebp - 0x1e]
mov ch, 0xf3
pushfd
adc ecx, dword [ebx - 0x8a0efbb]
fadd dword [0x3c601]
mov eax, ebx
pop esi
pop ebx
stosd dword es:[edi], eax
mov dl, 0x5d
xor ah, byte [edx + 0x55]
cld
cmp ebx, dword [edi]
mov dword [ecx], edx
xchg edx, eax
cmp al, 0xdd
pop ds
or byte [ebp - 0x7c406bd], cl
jae 0x40808a
fmul qword [0x40c2f8]
lea eax, [ebp - 0xc]
push eax
sub esp, 0xffffff99
mov byte [esp], bl
call dword [sym.imp.MSVCRT.dll_modf]
call 0xc53774ba
or al, 0xe8
add eax, 0xc3000035
dec ebp
ret 0x40
xor eax, 0x4dc30000
adc al, 0x8b
pop ebp
and byte [eax + esi], al
jle 0x40808c
mov edx, 0xc976fe3b
fstp st(0)
lea edx, [ebx + 0x50]
cmp esi, edx
jb 0x4080b6
pop edi
mov byte [ebx + 0x4f], 0
jo 0x40805d
pop esi
and cl, byte [ebx - 0x363caf55]
push ss
mov ebx, dword [edi]
add dl, 5
cmp dl, 0x39
mov byte [esi], dl
invalid
jbe 0x4080bd
dec edx
inc byte [esi]
jmp 0x4080d1
invalid
lahf
jmp 0x40810d
js 0x408078
outsb dx, byte [esi]
nop
mov edx, 0x90ef9090
nop
push ebp
mov ebp, esp
push ds
sbb al, 0xc
mov dh, 0x4d
or byte [ebx - 4], dl
push edi
cmp dword [ebp + 0x14], 0xffffff8a
ror byte [ebx - 0x74f47909], 0xde
adc bh, al
add byte [eax + eax], bl
add bl, ch
adc cl, byte [ebx - 0x3fcca7ab]
test ecx, ecx
setl al
test dword [0xe774023f], esp
neg ecx
mov eax, 0xcccccccd
jno 0x4080e6
mul ecx
shr edx, 3
mov al, dl
dec esi
test al, 0xa5
enter 0xffffffffffffc159, 0x30
mov byte [esi], cl
pop ds
retf 0xd285
Function at 0x4098e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x1c]
sub esp, 0xc
test eax, eax
je 0x4099bf
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push str.Version
push eax
mov dword [ebp - 4], 2
call edi
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0xb0]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.MinVidMemory
push ecx
mov dword [ebp - 8], edx
call edi
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0xb4]
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push str.RecVidMemory
push ecx
mov dword [ebp - 0xc], edx
call edi
mov eax, dword [esi + 0x1c]
push 0x10
lea edx, [esi + 0x20]
push edx
push 3
push 0
push str.DisplayGUID
push eax
call edi
mov eax, dword [esi + 0x8c]
add eax, 1
cmp dword [esi + 0x90], 0x10
jb 0x409979
mov ecx, dword [esi + 0x7c]
jmp 0x40997c
lea ecx, [esi + 0x7c]
push eax
push ecx
mov ecx, dword [esi + 0x1c]
push 1
push 0
push str.FailureReason
push ecx
call edi
mov eax, dword [esi + 0xa8]
add eax, 1
cmp dword [esi + 0xac], 0x10
jb 0x4099a7
mov ecx, dword [esi + 0x98]
jmp 0x4099ad
lea ecx, [esi + 0x98]
mov edx, dword [esi + 0x1c]
push eax
push ecx
push 1
push 0
push str.Warning
push edx
call edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4257c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x590abb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5d5de8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
lea ecx, [esi + 0x30]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00404980
mov dword [esi], vtable.Sexy::Graphics.0
call fcn.0043c040
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], ebx
mov eax, dword [ebp + 8]
cmp eax, ebx
mov dword [ebp - 4], ebx
fldz
fst dword [esi + 8]
mov dword [esi + 0x40], ebx
fst dword [esi + 0xc]
mov dword [esi + 4], eax
fld1
mov dword [esi + 0x44], ebx
fst dword [esi + 0x10]
mov byte [esi + 0x48], bl
fstp dword [esi + 0x14]
mov byte [esi + 0x49], bl
mov byte [esi + 0x4a], 1
mov byte [esi + 0x4b], bl
fst dword [esi + 0x18]
fstp dword [esi + 0x1c]
jne 0x425854
mov dword [esi + 4], 0x5dd050
mov byte [esi + 0x4c], bl
jmp 0x42585c
call fcn.0040b830
mov byte [esi + 0x4c], al
mov ecx, dword [esi + 4]
xor edx, edx
call fcn.00427cd0
mov edi, eax
call fcn.00427ce0
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x427b20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x593ce6
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5d5de8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [esi], vtable.Sexy::Image.0
xor ebx, ebx
mov dword [esi + 0x20], 0xf
mov dword [esi + 0x1c], ebx
mov byte [esi + 0xc], bl
mov dword [ebp - 4], ebx
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x28], ecx
mov edx, dword [edi + 0x2c]
mov dword [esi + 0x2c], edx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov byte [esi + 4], bl
cmp dword [edi + 0x34], ebx
je 0x427baf
push 0x30
call fcn.0056980a
add esp, 4
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x427ba8
mov edi, dword [edi + 0x34]
push eax
call fcn.00427bd0
mov dword [esi + 0x34], eax
jmp 0x427bb2
xor eax, eax
mov dword [esi + 0x34], eax
jmp 0x427bb2
mov dword [esi + 0x34], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4