joyce8/EMBER2024-capa huggingface dataset:
Function at 0x503b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0x503d3d
cmp eax, 3
jb 0x503b96
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x503bd3
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x503bd3
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x503bbd
mov dword [esi + 0x6afa0], eax
mov edx, ebx
mov ecx, esi
call fcn.00503ed0
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x503cbb
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
mov edx, ecx
mov ecx, esi
push eax
call fcn.005047d0
mov ecx, dword [esi + 0x6af90]
add esp, 4
sub ecx, edi
mov dword [ebp - 4], eax
mov dword [esi + 0x6af90], ecx
cmp edi, dword [esi + 0x6af98]
ja 0x503c79
cmp ecx, 3
jb 0x503c79
dec edi
nop word [eax + eax]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x503c20
jmp 0x503cd9
add dword [esi + 0x6af84], edi
mov dl, 1
mov eax, dword [esi + 0x6af84]
xor edi, edi
push 0x626e84
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
mov ecx, esi
mov dword [esi + 0x6af7c], eax
call fcn.00505950
add esp, 4
jmp 0x503cdf
movzx eax, byte [ecx + esi + 0x1af70]
xor edx, edx
push eax
mov ecx, esi
call fcn.005047d0
add esp, 4
mov dword [ebp - 4], eax
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
cmp dword [ebp - 4], 0
je 0x503d1c
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x503cf9
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x503cfb
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.005049e0
mov eax, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x503d2f
mov ecx, esi
call fcn.00503d70
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x503b45
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x503d51
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x503d53
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 1
push eax
call fcn.005049e0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50bdc0
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f266b
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x704200]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 0xc]
call fcn.00545180
cmp eax, 6
jle 0x50be05
lea ecx, [edi + 0xc]
call fcn.00544f70
push eax
lea ecx, [edi + 0x34]
call fcn.0053e5a0
mov eax, dword [edi + 0xa4]
test eax, eax
je 0x50be18
push eax
call fcn.00418d40
add esp, 4
lea ecx, [edi + 0xa0]
mov dword [edi + 0xa4], 0
call fcn.0050dca0
lea ecx, [edi + 0x9c]
call fcn.0050dca0
mov eax, dword [edi + 0x98]
test eax, eax
je 0x50be71
push fcn.00545210
lea esi, [eax - 4]
mov dword [ebp - 4], 0
push dword [esi]
push 0xc
push eax
call fcn.0041e708
mov eax, dword [esi]
lea eax, [eax + eax*2]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.0041e478
add esp, 8
lea ecx, [edi + 0x84]
call fcn.00545210
lea ecx, [edi + 0x78]
call fcn.00545210
mov eax, dword [edi + 0x70]
test eax, eax
je 0x50be94
push eax
call fcn.0041e473
add esp, 4
mov eax, dword [edi + 0x5c]
test eax, eax
je 0x50bea4
push eax
call fcn.0041e473
add esp, 4
mov eax, dword [edi + 0x48]
test eax, eax
je 0x50beb4
push eax
call fcn.0041e473
add esp, 4
lea ecx, [edi + 0x34]
call fcn.0053f820
lea ecx, [edi + 0x30]
call fcn.0053f820
lea ecx, [edi + 0xc]
call fcn.00545210
mov ecx, edi
call fcn.00545210
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50bef0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f2728
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x704200]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.005453c0
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
call fcn.005453c0
lea ecx, [esi + 0x30]
call fcn.0053f8e0
lea ecx, [esi + 0x34]
call fcn.0053f8e0
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 3
call fcn.0050c0d0
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 4
call fcn.0050c0d0
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 5
call fcn.0050c0d0
lea ecx, [esi + 0x78]
call fcn.005453c0
lea ecx, [esi + 0x84]
call fcn.005453c0
mov dword [esi + 0x98], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
lea ecx, [esi + 0x9c]
call fcn.0050dcc0
lea ecx, [esi + 0xa0]
call fcn.0050dcc0
mov dword [esi + 0xa4], 0
push ecx
mov ecx, esi
mov byte [ebp - 4], 0xc
call fcn.0050bd00
mov dword [esi + 0x1c], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x511770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x90
mov ebx, edx
mov edi, ecx
call fcn.0041e683
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
mov dword [esi], 0
lea ecx, [esi + 0x54]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov byte [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x4c], 0
call fcn.005453c0
lea ecx, [esi + 0x60]
call fcn.005453c0
lea ecx, [esi + 0x6c]
call fcn.005453c0
lea ecx, [esi + 0x78]
call fcn.005453c0
lea ecx, [esi + 0x84]
call fcn.005453c0
push 0x44
push 0
push esi
call fcn.004201d0
add esp, 0xc
lea ecx, [esi + 0x6c]
push edi
call fcn.005452f0
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x60]
push ebx
mov dword [esi + 0x24], eax
call fcn.005452f0
lea ecx, [esi + 0x60]
call fcn.00545180
test eax, eax
je 0x511872
lea ecx, [esi + 0x60]
call fcn.00542e90
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
push dword [ebp + 0x10]
mov dword [esi + 0x2c], ecx
lea ecx, [esi + 0x78]
mov dword [esi + 0x28], eax
call fcn.005452f0
push 0x622030
lea ecx, [esi + 0x84]
call fcn.005452f0
push 0
push 0
push esi
push 0x5109a0
push 0
push 0
call dword [0x5fd394]
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x511918
lea ecx, [esi + 0x84]
call fcn.00545210
lea ecx, [esi + 0x78]
call fcn.00545210
lea ecx, [esi + 0x6c]
call fcn.00545210
lea ecx, [esi + 0x60]
call fcn.00545210
lea ecx, [esi + 0x54]
call fcn.00545210
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x5118ef
push eax
call fcn.0041e473
add esp, 4
mov eax, dword [esi + 0x44]
test eax, eax
je 0x5118ff
push eax
call fcn.0041e473
add esp, 4
push 0x90
push esi
call fcn.0041ea6e
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
test byte [ebp + 8], 1
je 0x51194c
xor edx, edx
mov ecx, eax
call fcn.00529cd0
test al, al
je 0x51194c
mov edi, dword [0x5fd458]
call fcn.00541e50
test al, al
jne 0x51193e
push 5
call edi
mov ecx, dword [esi + 0x3c]
xor edx, edx
call fcn.00529cd0
test al, al
jne 0x511931
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x515990
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f31cc
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x704200]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
lea ecx, [esi + 0x30]
mov dword [esi], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xff000000
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x20], 0xfff0f0ff
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xc
mov dword [esi + 0x2c], 0
call fcn.00523620
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push dword [ebp + 0x18]
mov dword [ebp - 4], 0
mov ecx, esi
push dword [ebp + 0x14]
mov dword [esi + 0x298], 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00514f40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x20
Function at 0x53c790
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4f54
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x704200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
push 0xf01ff
call dword [0x5fd4f8]
push eax
call dword [0x5fd054]
test eax, eax
jne 0x53c7ec
xor esi, esi
jmp 0x53c92c
test edi, edi
mov dword [ebp - 0x14], 0
lea esi, [ebp - 0x14]
xorps xmm0, xmm0
cmovne esi, edi
movlpd qword [ebp - 0x20], xmm0
push 0x94
mov dword [ebp - 0x24], esi
mov dword [esi], 0x94
call fcn.0041ea7c
mov edi, eax
mov dword [ebp - 0x1c], 0x94
mov dword [ebp - 0x20], edi
mov byte [ebp - 4], 1
push dword [esi]
call fcn.0041ea7c
push dword [esi]
mov ebx, eax
push 0
push edi
call fcn.004201d0
mov esi, dword [0x5fd150]
lea eax, [edi + 4]
add esp, 0x14
mov dword [edi], 0xc
push eax
push str.SeRestorePrivilege
push 0
call esi
lea eax, [edi + 0x10]
push eax
push str.SeTakeOwnershipPrivilege
push 0
call esi
lea eax, [edi + 0x1c]
push eax
push str.SeDebugPrivilege
push 0
call esi
lea eax, [edi + 0x28]
push eax
push str.SeSecurityPrivilege
push 0
call esi
lea eax, [edi + 0x34]
push eax
push str.SeBackupPrivilege
push 0
call esi
lea eax, [edi + 0x40]
push eax
push str.SeImpersonatePrivilege
push 0
call esi
lea eax, [edi + 0x4c]
push eax
push str.SeSystemProfilePrivilege
push 0
call esi
lea eax, [edi + 0x58]
push eax
push str.SeAssignPrimaryTokenPrivilege
push 0
call esi
lea eax, [edi + 0x64]
push eax
push str.SeTrustedCredManAccessPrivilege
push 0
call esi
lea eax, [edi + 0x70]
push eax
push str.SeTcbPrivilege
push 0
call esi
lea eax, [edi + 0x7c]
push eax
push str.SeIncreaseQuotaPrivilege
push 0
call esi
lea eax, [edi + 0x88]
push eax
push str.SeShutdownPrivilege
push 0
call esi
lea eax, [edi + 0xc]
mov ecx, 0xc
nop
mov dword [eax], 2
lea eax, [eax + 0xc]
sub ecx, 1
jne 0x53c8f0
mov eax, dword [ebp - 0x24]
push eax
push ebx
push dword [eax]
push edi
push ecx
push dword [ebp - 0x18]
call dword [0x5fd14c]
test eax, eax
jne 0x53c921
push ebx
xor esi, esi
call fcn.0041e473
add esp, 4
jmp 0x53c923
mov esi, ebx
push edi
call fcn.0041e473
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xffffffff
je 0x53c93f
test ecx, ecx
je 0x53c93f
push ecx
call dword [0x5fd3a4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e465
mov esp, ebp
pop ebp
ret
Function at 0x900e460
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90cf2a5
call fcn.09006dd9
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900e4bc
xor al, al
jmp 0x900e50c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900e8b2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900f2c5
test al, al
je 0x900e4ff
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.090647b6
mov ecx, edi
call fcn.09011cd1
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.090647b6
mov al, bl
call fcn.09006f96
ret

Function at 0x9011cd1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x9011cd9
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9011ce8
xor al, al
ret
shr eax, 4
and al, 1
ret

Function at 0x901e790
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov byte [ecx + 0x58], 0
ret
Function at 0x90582d8
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90d2348
call fcn.0900620a
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
xor edx, edx
sub eax, dword [ebp - 0x20]
sub eax, dword [esi + 8]
sbb edx, dword [esi + 0xc]
js 0x9058343
jg 0x905830d
test eax, eax
jb 0x9058343
mov ecx, dword [esi + 4]
imul edi, ecx, 3
test edx, edx
jg 0x9058343
jl 0x905831d
cmp eax, edi
ja 0x9058343
cmp eax, ecx
jbe 0x9058337
and dword [ebp - 4], 0
sub eax, ecx
mov ecx, dword [esi]
push eax
call fcn.090647b6
jmp 0x9058343
jae 0x9058343
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.090647b6
call fcn.09006fcf
ret

Function at 0x90647b6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x90647c5
pop dword [ebp - 0x28]
mov eax, 0xd03b06a1
add eax, 0x38cb4124
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x5429af20
sub dword [ebp - 0x38], 0x5d769d5
mov dword [ebp - 0x34], 0x3613a019
sub dword [ebp - 0x34], 0x3e053d4
mov dword [ebp - 0x30], 0x2118a551
sub dword [ebp - 0x30], 0xd4cc6123
mov dword [ebp - 0x2c], 0x5032c3c7
add dword [ebp - 0x2c], 0xafcd3c39
lea eax, [ebp - 0x38]
push eax
mov eax, 0x47a3ec76
add eax, 0xc169744e
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xe277eae9
sub dword [ebp - 0x38], 0x6e058193
mov dword [ebp - 0x34], 0x1a48cac9
sub dword [ebp - 0x34], 0xd8dc6954
mov dword [ebp - 0x30], 0xab433672
sub dword [ebp - 0x30], 0x47d3ca06
mov dword [ebp - 0x2c], 0x1d0d02c6
sub dword [ebp - 0x2c], 0x1d0d02c6
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x787ee
push 0
call eax
mov ecx, 0xca3cff65
sub ecx, 0xca3cb57b
xor edi, edi
add edi, eax
mov edx, 0x3a6b48ce
add edx, 0xcea71332
add edx, dword [ebp - 0x28]
mov esi, 0x472b6e9b
xor dword [ebp - 0x1c], 0x236fbcf1
mov ebx, dword [edx]
mov dword [ebp - 0x1c], 0x1824aae0
add ebx, esi
sub dword [ebp - 0x24], esi
mov dword [edi], ebx
xor dword [ebp - 4], 0x4bf49806
add edi, 0x8b1640e1
sub edi, 0x8b1640dd
add edx, 0x3c5137e8
sub edx, 0x3c5137e4
loop 0x90648de
add eax, 0x11a7b
mov ebx, eax
add eax, 0xc8a48e9f
sub eax, 0xc8a48e9a
mov ecx, 0x9000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x9079b47
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x148
mov eax, 0x90d3869
call fcn.09006dd9
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
xor ebx, ebx
mov esi, 0x20019
push esi
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079ba6
mov dword [ebp - 0x14c], ebx
jmp 0x9079d25
lea eax, [ebp - 0x148]
push eax
push esi
push ebx
push str.Adobe
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079bcf
mov dword [ebp - 0x148], ebx
jmp 0x9079d25
lea eax, [ebp - 0x144]
push eax
push esi
push ebx
push str.Color
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079bf8
mov dword [ebp - 0x144], ebx
jmp 0x9079d25
lea eax, [ebp - 0x13c]
push eax
push esi
push ebx
push str.Monitor
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079c21
mov dword [ebp - 0x13c], ebx
jmp 0x9079d25
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
mov esi, ebx
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9079c73
cmp dword [ebp - 0x154], 4
jne 0x9079c73
mov esi, dword [ebp - 0x120]
cmp esi, 0x3e7
ja 0x9079d25
push esi
push str.Monitor_u
lea eax, [ebp - 0x1c]
push 0xb
push eax
call fcn.090647b6
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079cb3
mov dword [ebp - 0x140], ebx
jmp 0x9079d3a
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9079d25
cmp dword [ebp - 0x154], 1
jne 0x9079d25
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.0901904e
lea eax, [ebp - 0x138]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.090647b6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.090647b6
mov bl, 1
cmp dword [ebp - 0x140], 0
je 0x9079d3a
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x13c], 0
je 0x9079d4f
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x144], 0
je 0x9079d64
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x148], 0
je 0x9079d79
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14c], 0
je 0x9079d8e
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.09006f96
ret
Function at 0x907c6ab
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3926
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1430
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x1424], edi
mov dword [ebp - 0x1430], eax
mov dword [ebp - 0x1428], eax
mov dword [ebp - 0x143c], edi
call fcn.09018f87
xor ecx, ecx
push 0xf
mov eax, ecx
mov dword [ebp - 4], ecx
pop esi
mov dword [ebp - 0x142c], eax
mov dword [ebp - 0x1420], esi
xor edx, edx
mov edi, ecx
div esi
mov dword [ebp - 0x141c], edi
lea esi, [ebp - 0x416]
mov dword [ebp - 0x1434], eax
mov eax, edi
xor edx, edx
div dword [ebp - 0x1420]
mov edi, ecx
mov dword [ebp - 0x1438], eax
mov edx, dword [ebp - 0x1434]
mov byte [esi - 1], dl
xor edx, edx
mov byte [esi], al
mov eax, edi
div dword [ebp - 0x1420]
mov edx, 0xff
mov byte [esi + 1], al
add edi, edx
mov eax, dword [ebp - 0x1438]
add esi, 4
cmp edi, 0xff0
jb 0x907c753
mov edi, dword [ebp - 0x141c]
add edi, edx
mov dword [ebp - 0x141c], edi
cmp edi, 0xff0
jb 0x907c741
push ecx
mov ecx, dword [ebp - 0x1424]
lea esi, [edx + 1]
push 0x5058595a
push 0x706c6162
push esi
lea eax, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.090647b6
push esi
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.090647b6
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x141c], esi
movzx eax, word [ebp + esi - 0xc16]
movzx ecx, word [ebp + esi - 0x1416]
sub ecx, eax
mov eax, ecx
movzx ecx, word [ebp + esi - 0x1414]
cdq
mov edi, eax
movzx eax, word [ebp + esi - 0xc14]
sub ecx, eax
xor edi, edx
mov eax, ecx
sub edi, edx
mov ecx, dword [ebp - 0x141c]
cdq
mov esi, eax
xor esi, edx
movzx eax, word [ebp + ecx - 0xc12]
sub esi, edx
movzx ecx, word [ebp + ecx - 0x1412]
sub ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 0x1428]
cdq
xor eax, edx
sub eax, edx
cmp ecx, edi
cmovl ecx, edi
cmp ecx, esi
cmovl ecx, esi
mov esi, dword [ebp - 0x141c]
cmp ecx, eax
cmovl ecx, eax
add esi, 8
mov dword [ebp - 0x1428], ecx
mov dword [ebp - 0x141c], esi
cmp esi, 0x800
jb 0x907c7e0
cmp ecx, 0xa
ja 0x907c89c
mov eax, dword [ebp - 0x142c]
mov esi, dword [ebp - 0x1420]
add eax, 0xff
mov dword [ebp - 0x142c], eax
push 0
pop ecx
cmp eax, 0xff0
jb 0x907c729
mov byte [ebp - 0x1430], 1
mov ecx, dword [ebp - 0x1424]
or dword [ebp - 4], 0xffffffff
call fcn.090190fb
mov al, byte [ebp - 0x1430]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret