joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f789
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x1c]
mov esi, str.Gujarati
mov dword [ebp - 8], edx
xor eax, eax
mov edx, ebx
mov ecx, eax
mov dword [ebp - 4], eax
or edx, 0xbd3f2b16
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 8]
movzx eax, word [edi]
mov esi, eax
mov dword [ebp - 8], esi
cmp ax, word [ebp - 0x1c]
jne 0x1001f7f1
xor eax, eax
movzx esi, si
xor ebx, ebx
test si, si
je 0x1001f7e8
cmp word [ebp + eax - 0x1c], bx
je 0x1001f7e8
inc ecx
lea eax, [ecx + ecx]
movzx esi, word [eax + edi]
cmp si, word [ebp + eax - 0x1c]
je 0x1001f7cd
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [edi + ecx*2]
movzx eax, byte [ebp + eax*2 - 0x1c]
sub ecx, eax
cmp ecx, 0x870
jb 0x1001f80d
lea edx, [ebx + 0x6da425e6]
xor eax, eax
mov ecx, eax
test si, si
je 0x1001f844
mov esi, ebx
xor esi, 0xcc1edd4f
inc ecx
cmp word [edi + ecx*2], ax
jne 0x1001f81e
mov eax, dword [ebp + 8]
jmp 0x1001f840
cmp eax, 0x197a
jne 0x1001f837
imul esi, ebx, 0x5ef001ed
mov edx, esi
and edx, 0xb6e2b3ec
inc eax
cmp eax, ecx
jb 0x1001f82a
pop edi
lea eax, [ebx - 0x534249f3]
or edx, 0x63680532
pop esi
mov dword [0x1004119c], edx
mov dword [0x1004107c], eax
pop ebx
leave
ret
Function at 0x1001f860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 8], esi
mov edx, ebx
mov al, byte [esi]
mov byte [ebp - 1], al
test al, al
mov eax, dword [0x1004111c]
je 0x1001f8b8
or eax, 0xd045e90e
inc edx
cmp byte [edx + esi], bl
jne 0x1001f87f
mov ecx, dword [ebp - 8]
cmp ecx, edx
jae 0x1001f8b8
mov esi, dword [0x100410f4]
cmp ecx, 0xe80
jne 0x1001f8a5
sub esi, 0x524d18ea
mov eax, esi
xor eax, 0xab917884
inc ecx
cmp ecx, edx
jb 0x1001f897
mov esi, dword [ebp - 8]
mov edx, ebx
jmp 0x1001f8bf
mov edx, ebx
cmp byte [ebp - 1], dl
je 0x1001f8ec
mov ecx, eax
or ecx, 0x14daf2e0
inc edx
cmp byte [edx + esi], bl
jne 0x1001f8c7
mov esi, dword [ebp - 8]
jmp 0x1001f8e6
cmp esi, 0x5b3
jne 0x1001f8df
xor eax, 0x379e42a9
imul eax, eax, 0xa2d8812a
inc esi
cmp esi, edx
jb 0x1001f8d2
jmp 0x1001f8f2
mov ecx, dword [0x100410f4]
xor eax, 0x92e26a71
cmp byte [ebp - 1], bl
je 0x1001f902
imul ecx, eax, 0x6981da9f
and ecx, 0x951ba20
sub eax, 0x5288604
mov dword [0x100410f4], ecx
mov dword [0x1004111c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, dword [0x1004111c]
mov esi, ebx
mov ecx, eax
or ecx, 0x489d4ecd
xor ecx, 0x51b1de73
inc esi
cmp byte [esi + str.4_404P4X4_4h4p44], bl
jne 0x1001f92d
mov edx, dword [ebp - 8]
jmp 0x1001f959
cmp edx, 0x16b4
jne 0x1001f951
mov ecx, eax
xor ecx, 0xeb9b542b
mov eax, ecx
xor eax, 0xbfba3014
inc edx
cmp edx, esi
jb 0x1001f941
push edi
mov esi, str.0_0_0T0d0x0
lea edi, [ebp - 0x14]
or eax, 0xbe00ee2c
mov dword [0x100410f4], eax
movsd dword es:[edi], dword [esi]
lea edx, [eax + 0x60bd4014]
mov dword [0x1004111c], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
pop edi
mov cl, byte [esi]
cmp cl, byte [ebp - 0x14]
jne 0x1001f9c9
test cl, cl
je 0x1001f99f
cmp byte [ebp + ebx - 0x14], 0
je 0x1001f99f
inc ebx
mov cl, byte [esi + ebx]
cmp cl, byte [ebp + ebx - 0x14]
je 0x1001f98a
mov ecx, dword [ebp - 8]
cmp ecx, ebx
jae 0x1001f9c9
cmp ecx, 0x1f42
jne 0x1001f9b8
xor eax, 0xcb818075
mov dword [0x100410f4], eax
or edx, 0xec92e334
inc ecx
cmp ecx, ebx
jb 0x1001f9a6
mov dword [0x1004111c], edx
pop esi
mov eax, edx
pop ebx
leave
ret
Function at 0x1001f9cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x10041180]
sub esp, 0x28
mov eax, str.unable_to_use_function__s_in_the_requested_context
push ebx
imul ebx, ecx, 0x67d636bc
push esi
push edi
mov edx, ebx
xor edx, 0x49ccc4ff
xor ecx, 0x9330c502
inc eax
cmp byte [eax], 0
jne 0x1001f9f1
push 8
pop ecx
mov esi, 0x10039f7c
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
push 0x69
or edx, 0xd53a07ad
xor eax, eax
pop ecx
xor esi, esi
mov dword [ebp - 8], edx
cmp cx, word [ebp - 0x28]
jne 0x1001fa49
mov edx, eax
test cx, cx
je 0x1001fa40
cmp word [ebp + eax - 0x28], si
je 0x1001fa40
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.illegal_byte_sequence]
cmp cx, word [ebp + eax - 0x28]
je 0x1001fa22
mov dword [ebp - 4], edx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [eax*2 + str.illegal_byte_sequence]
movzx eax, byte [ebp + eax*2 - 0x28]
sub ecx, eax
cmp ecx, 0x190d
jne 0x1001fa66
sub ebx, 0x207b352b
lea ecx, [ebx - 0x38e74c3a]
mov eax, esi
inc eax
cmp word [eax*2 + str.invalid_bit_length], si
jne 0x1001fa6e
cmp dword [ebp - 8], eax
jae 0x1001fa84
imul edx, ecx, 0x26d6b8bf
and ecx, 0x3c947113
and ebx, 0x6bdc26ac
mov edi, ecx
mov dword [0x10041154], ebx
or edi, 0xc145755a
mov dword [0x10041194], ecx
mov dword [0x1004114c], edi
mov eax, str.illegal_byte_sequence
lea eax, [eax + 2]
xor edx, 0x555f0aeb
cmp word [eax], si
jne 0x1001faaf
mov dword [0x10041180], edx
xor eax, eax
inc esi
cmp word [esi*2 + str.invalid_bit_length], ax
jne 0x1001fac5
mov edx, dword [ebp - 8]
jmp 0x1001faea
cmp edx, 0xdc6
jne 0x1001fae9
or ecx, 0xbd1f4e1c
mov dword [0x10041194], ecx
inc edx
cmp edx, esi
jb 0x1001fad5
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10020426
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov ecx, dword [0x10041044]
push ebx
push esi
push edi
mov edi, dword [0x1004118c]
or ecx, 0x4df3cfde
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov eax, ebx
lea edx, [edi - 0x4906b494]
mov dword [ebp - 0xc], edx
inc eax
cmp word [eax*2 + str.._AV_RefCounter_details_Concurrency__], bx
jne 0x10020451
cmp dword [ebp - 0x10], eax
jae 0x1002046a
mov eax, ecx
and eax, 0x7e763501
jmp 0x1002046f
mov eax, dword [0x10041110]
mov edx, ecx
mov esi, str.585_5H5T5t55
or edx, 0xe6592714
inc esi
lea eax, [eax + 0x22d3440d]
cmp byte [esi], bl
jne 0x1002047c
or edi, 0x45ca0226
mov eax, ecx
xor eax, 0xa96c25e2
mov dword [ebp - 8], edi
mov esi, ebx
mov dword [0x10041110], eax
inc esi
cmp byte [esi + str.No_support_for_converting_user_data_format_to_LogLuv], bl
jne 0x1002049e
cmp esi, 0x1ff5
jne 0x100204bc
imul eax, eax, 0x1915f077
mov dword [0x10041110], eax
jmp 0x100204c4
mov edx, edi
and edx, 0x3ef72353
push 0xe
pop ecx
mov esi, str.._AVX509PublicKey_CryptoPP__
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
mov eax, edx
or eax, 0x7ff27f5d
push 0x2e
movsw word es:[edi], word [esi]
pop esi
mov dword [0x10041044], eax
mov eax, ebx
cmp si, word [ebp - 0x4c]
jne 0x10020539
mov ecx, ebx
test si, si
je 0x1002050a
cmp word [ebp + ecx - 0x4c], bx
je 0x1002050a
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.._AV_RefCounter_details_Concurrency__]
cmp si, word [ebp + ecx - 0x4c]
je 0x100204ec
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], eax
cmp ecx, eax
jae 0x10020539
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 4]
add eax, 0xb189f754
mov dword [0x10041110], eax
cmp ecx, 0x4de
jne 0x10020532
add edx, 0x13d746db
inc ecx
cmp ecx, esi
jb 0x10020524
jmp 0x1002053e
mov eax, dword [0x10041110]
mov esi, dword [ebp - 0xc]
lea edi, [eax - 0x2df02ca3]
xor esi, 0x498e16f0
inc ebx
cmp byte [ebx + str.3_3_3_3_3034383_3_3D3H3L3P3T3X33_3d3h3l3p3t3x33], 0
jne 0x10020547
mov eax, dword [ebp - 0x10]
mov dword [0x100410fc], esi
cmp eax, ebx
jae 0x10020581
mov ecx, dword [ebp - 0x10]
cmp eax, 0x1cb
jne 0x10020576
mov edi, ecx
xor edi, 0x9a2dfa12
imul ecx, edi, 0xc4a79cec
inc eax
cmp eax, ebx
jb 0x10020567
lea eax, [edx + 0x4e9f865a]
or edx, 0xcc3ee52d
or esi, 0x1120d469
mov dword [0x1004118c], eax
pop edi
mov dword [0x100410d0], esi
pop esi
mov dword [0x100411c0], edx
pop ebx
leave
ret
Function at 0x100247de
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x10041320]
sub esp, 0x14
mov eax, str.GetFocus
xor ecx, 0x43de97de
inc eax
cmp byte [eax], 0
jne 0x100247ef
push ebx
xor ebx, ebx
mov eax, ebx
inc eax
cmp byte [eax + str.ComponentsConfiguration], bl
jne 0x10024800
mov edx, dword [0x10041270]
cmp dword [ebp - 4], eax
jae 0x10024822
sub eax, dword [ebp - 4]
imul edx, edx, 0x2a9bdc13
sub eax, 1
jne 0x10024817
push esi
push edi
mov esi, str.ISO_8859_5
lea edi, [ebp - 0x10]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x10], 0x35
jne 0x10024852
mov cl, 0x35
test cl, cl
je 0x10024852
cmp byte [ebp + eax - 0x10], bl
je 0x10024852
mov cl, byte [eax + 0x1003ca11]
inc eax
cmp cl, byte [ebp + eax - 0x10]
je 0x1002483b
movzx ecx, byte [eax + str.56747K7Y7]
movzx eax, byte [ebp + eax - 0x10]
sub ecx, eax
cmp ecx, 0x311
jne 0x10024870
or edx, 0x89bb2f5b
jmp 0x10024876
imul edx, edx, 0xb80bae12
mov esi, dword [0x1004127c]
mov ecx, ebx
add esi, 0x66fc63ef
mov dword [0x10041320], edx
mov eax, esi
mov dword [ebp - 4], esi
and eax, 0x6e0dc7ff
xor eax, 0xe8642bc0
mov dword [0x100411e4], eax
inc ecx
cmp byte [ecx + str.V3C352B], bl
jne 0x1002489e
cmp ecx, 0x1491
jae 0x100248bd
imul edx, eax, 0xa828f7fe
mov dword [0x10041320], edx
jmp 0x100248c6
sub esi, 0x71c4fba1
mov dword [ebp - 4], esi
mov esi, str.mazowsze
imul eax, edx, 0x98866d5
lea edi, [ebp - 0x10]
mov ecx, ebx
movsd dword es:[edi], dword [esi]
mov dword [0x1004127c], eax
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x10], 0x52
jne 0x10024931
mov al, 0x52
test al, al
je 0x100248fd
cmp byte [ebp + ecx - 0x10], bl
je 0x100248fd
mov al, byte [ecx + 0x1003c9e5]
inc ecx
cmp al, byte [ebp + ecx - 0x10]
je 0x100248e6
mov esi, dword [ebp - 4]
cmp esi, ecx
jae 0x10024931
mov edx, dword [ebp - 4]
mov edi, dword [0x1004127c]
and edx, 0x79f1efac
mov dword [0x10041320], edx
cmp esi, 0x1716
jne 0x1002492c
lea eax, [edi - 0x4a5f32b2]
mov dword [0x100411e4], eax
inc esi
cmp esi, ecx
jb 0x10024919
mov esi, str.879C9H9M9W9e9n9
lea edi, [ebp - 0x14]
and edx, 0xafdc65ab
mov dword [0x10041270], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x14], 0x4c
pop edi
pop esi
jne 0x1002496b
mov al, 0x4c
test al, al
je 0x1002496b
cmp byte [ebp + ebx - 0x14], 0
je 0x1002496b
mov al, byte [ebx + 0x1003cca1]
inc ebx
cmp al, byte [ebp + ebx - 0x14]
je 0x10024953
movzx ecx, byte [ebx + str.ListView_SetItemState]
movzx eax, byte [ebp + ebx - 0x14]
sub ecx, eax
pop ebx
cmp ecx, 0x1514
jbe 0x1002498e
and dword [0x100411e4], 0xd57a4dd2
leave
ret
mov eax, dword [0x1004127c]
add eax, 0x69a97510
mov dword [0x10041320], eax
leave
ret
Function at 0x10024f01
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, dword [0x10041224]
mov eax, ebx
push edi
xor edi, edi
mov dword [ebp - 0xc], ebx
mov ecx, edi
and eax, 0x4fa6d2be
inc ecx
cmp byte [ecx + str.b.ssl.fastly], 0
jne 0x10024f1d
mov edx, dword [0x100412a4]
cmp ecx, 0x14df
jbe 0x10024f3d
lea eax, [edx + 0x1fa339f7]
jmp 0x10024f46
imul ebx, eax, 0xebf3480c
mov dword [ebp - 0xc], ebx
push esi
imul esi, ebx, 0x1fb6cafb
mov ecx, edi
mov dword [ebp - 0x10], esi
inc ecx
cmp word [ecx*2 + str.2_3_31363_3N3W3v3], di
jne 0x10024f52
cmp ecx, 0x1433
jne 0x10024f79
mov edx, dword [0x10041288]
xor edx, 0xfbc09f
mov dword [0x100412a4], edx
jmp 0x10024f7f
lea eax, [edx + 0x2e21d912]
add eax, 0xaf097254
mov ecx, edi
mov dword [ebp - 8], eax
inc ecx
cmp byte [ecx + str.GetWindowThreadProcessId], 0
jne 0x10024f89
cmp ecx, 0xedd
jae 0x10024fa4
or esi, 0xedea51fd
mov dword [ebp - 0x10], esi
push 7
mov eax, edi
mov esi, str.iptorrents.com
pop ecx
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
push 0x32
pop ecx
movsw word es:[edi], word [esi]
xor esi, esi
cmp cx, word [ebp - 0x30]
jne 0x10024fe9
mov ebx, eax
test cx, cx
je 0x10024fe0
cmp word [ebp + eax - 0x30], si
je 0x10024fe0
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + str.2_3_31363_3N3W3v3]
cmp cx, word [ebp + eax - 0x30]
je 0x10024fc2
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx ecx, byte [eax*2 + str.2_3_31363_3N3W3v3]
movzx eax, byte [ebp + eax*2 - 0x30]
sub ecx, eax
cmp ecx, 0x18ea
jbe 0x10025009
add dword [ebp - 8], 0x6d088c58
jmp 0x10025018
mov edx, dword [ebp - 0x10]
or edx, 0xf0af4af6
mov dword [0x100412a4], edx
push 0xd
mov eax, esi
lea edi, [ebp - 0x44]
pop ecx
mov esi, str.._AVwxVariantDataString__
rep movsd dword es:[edi], dword [esi]
push 0x54
pop esi
xor edi, edi
cmp si, word [ebp - 0x44]
jne 0x10025052
mov ecx, edi
test si, si
je 0x10025052
cmp word [ebp + ecx - 0x44], di
je 0x10025052
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.TreeView_DeleteAllItems]
cmp si, word [ebp + ecx - 0x44]
je 0x10025034
movzx ecx, byte [eax*2 + str.TreeView_DeleteAllItems]
movzx eax, byte [ebp + eax*2 - 0x44]
sub ecx, eax
cmp ecx, 0x230f
jb 0x10025072
mov ebx, dword [ebp - 8]
add ebx, 0xa209115d
lea ecx, [ebx - 0x5c76f7a2]
mov eax, edi
mov dword [0x100411f4], ecx
inc eax
cmp word [eax*2 + str.TreeView_DeleteAllItems], di
jne 0x10025080
cmp eax, 0x105c
jne 0x10025098
lea ebx, [edx + 0x6187ebf4]
add ebx, 0x1527e7
mov eax, edi
mov dword [0x10041288], ebx
inc eax
cmp word [eax*2 + str.tstock_font_not_found], di
jne 0x100250a6
cmp eax, 0x1f59
jbe 0x100250c6
add edx, 0x2955d3be
mov dword [0x100412a4], edx
jmp 0x100250d4
mov ecx, edx
or ecx, 0xa08b8460
mov dword [0x100411f4], ecx
lea eax, [ebx - 0x16c691cf]
mov esi, edi
mov dword [0x10041204], eax
mov eax, ecx
or eax, 0x8e97f2b0
mov dword [0x10041224], eax
inc esi
cmp word [esi*2 + str.BuildRemoteList], di
jne 0x100250ed
cmp esi, 0x1aeb
pop esi
jne 0x1002510e
lea eax, [ecx + 0x3463f6a9]
mov dword [0x10041224], eax
jmp 0x1002511a
lea edx, [ebx + 0x3cacb2d9]
mov dword [0x100412a4], edx
pop edi
mov eax, edx
pop ebx
leave
ret
Function at 0x1002553e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100412cc]
sub esp, 0x10
xor eax, 0x2539a6e4
mov edx, str.DeleteOrMove_:_deletion_renaming_failed
imul ecx, eax, 0x6d911565
push ebx
mov eax, ecx
or eax, 0x2d879105
xor ebx, ebx
lea edx, [edx + 2]
and eax, 0x9e55a26b
cmp word [edx], bx
jne 0x10025563
sub ecx, 0x31ca6532
mov edx, str.dCould_not_convert_to_a_bool
inc edx
lea ecx, [ecx - 0x4a6d4720]
cmp byte [edx], bl
jne 0x1002557b
push esi
push edi
mov esi, str.9_9X9j9v9
lea edi, [ebp - 0x10]
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x10], 0x47
pop edi
pop esi
jne 0x100255cf
mov dl, 0x47
test dl, dl
je 0x100255b7
cmp byte [ebp + ecx - 0x10], bl
je 0x100255b7
mov dl, byte [ecx + 0x1003d051]
inc ecx
cmp dl, byte [ebp + ecx - 0x10]
je 0x100255a0
mov edx, dword [ebp - 4]
jmp 0x100255cb
cmp edx, 0x1179
jne 0x100255ca
imul eax, eax, 0xc0f86198
inc edx
cmp edx, ecx
jb 0x100255bc
mov ecx, str.message_size
add eax, 0xaa9e54cb
inc ecx
cmp byte [ecx], bl
jne 0x100255d4
imul ecx, eax, 0xfce0b8b
mov edx, str.0_0_0_0_0004080_0_0D0H0L0P0T0X00_0h0l0t0x0
mov dword [0x100412cc], ecx
or eax, 0xc828d251
inc edx
cmp byte [edx], bl
jne 0x100255ef
mov edx, str.dCould_not_convert_to_a_bool
xor eax, 0xdd120e11
inc edx
cmp byte [edx], bl
jne 0x100255fe
mov dword [0x10041264], eax
inc ebx
cmp byte [ebx + str.message_size], 0
jne 0x1002560d
cmp ebx, 0xc57
pop ebx
jae 0x1002562c
and ecx, 0x99ef407a
mov dword [0x100412cc], ecx
lea eax, [ecx + 0x109798a0]
imul eax, eax, 0xd1d813a4
mov dword [0x10041264], eax
leave
ret
Function at 0x61f1ff
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
xchg di, bx
mov ebp, 0x94bc7c6e
mov edi, ecx
stc
jmp 0x61f204
mov ebp, dword [esp + 0x28]
lea edx, [esp + edx]
neg bh
jns 0x61f208
sub esp, 0x16
mov edx, dword [esp + 0xf]
jmp 0x61f20d
push word [esp + 5]
mov word [esp + 5], di
lea esp, [esp + 3]
mov dword [esp + 0x3c], edi
lea esp, [esp + 0x3c]
jmp 0x61f18f
pushal
push esp
push word [esp + 5]
push dword [esp + 0x22]
push word [esp + 0xd]
lea esp, [esp + 0x27]
jmp 0x61f1b9
mov byte [esp], ah
jmp 0x61f1da
jb 0x61f1a1
jae 0x61f1a1
call fcn.0061f255
lea esp, [esp + 2]
jmp 0x61f2d3
push edx
jmp 0x61f3dd
jae 0x61f216
push edx
jmp 0x61f3dd
lea edi, [esp + 0x14]
mov esi, dword [esp]
mov eax, dword [esp]
adc ax, 0x855c
jmp 0x61f299
pop word [esp + 0xb]
jmp 0x61ef48
call 0x61f362
cwde
add eax, 0xbb0ffc95
sub dh, byte [esi + 0x8be4324]
cmp byte [ebx + 0x6ead5e3b], ch
dec esi
invalid
mov eax, ecx
cpuid
mov ebx, ebp
mov al, ah
sub esp, 0x12
js 0x61f319
mov dx, bx
jmp 0x61f2fc
sub esp, 0xa8
mov esi, esp
not cx
setbe dh
jmp 0x61f332

Function at 0x620599
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebx + edi]
jmp 0x62041c
mov ax, word [esp]
lea edx, [edx + esi]
bswap edx
sub edi, 4
rdtsc
call fcn.006201ef
mov ax, word [esp]
mov ax, word [esp]
lea edx, [edx*4]
and ecx, 0x3c
lea eax, [eax*4]
jmp 0x620353
lea esp, [esp + 2]
lea esp, [esp + 0x30]
sub cl, 0x54
mov ax, 0x630b
jmp 0x6203e7
xchg dword [esp + 0x14], edx
neg dh
je 0x61fd8a
lea eax, [ebx + edi]
lea esp, [esp + 2]
jmp 0x620420

Function at 0x73ced8
Capabilities:
Check for peb beingdebugged flag
Parse pe header

Disassembly:
call fcn.0073b0cb
mov word [esp + 4], bx
mov byte [esp + 5], bh
jmp 0x73cfc4
mov eax, dword [eax + 8]
push eax
jmp 0x73b0c6
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x73cf34
pop word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 0x84], edi
lea esp, [esp + 0x84]
mov eax, dword fs:[0x30]
jmp 0x73cf74
Function at 0x433a50
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b4d6d
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push ebp
mov ebx, ecx
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x78], edi
jne 0x433abe
push 8
call fcn.004a6faa
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, edi
mov dword [esp + 0x154], edi
je 0x433a9a
mov ecx, eax
call fcn.004a5a00
jmp 0x433a9c
xor eax, eax
push 0xff00ff
push edi
push 0x10
push 0x407
mov ecx, eax
mov dword [esp + 0x164], 0xffffffff
mov dword [ebx + 0x78], eax
call fcn.004a5ac5
mov eax, dword [ebx + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0xffff0000
push edi
push 0x1101
push eax
mov dword [esp + 0x20], edi
call ebp
mov eax, dword [ebx + 0x40]
lea esi, [ebx + 0x40]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x433b0c
lea ecx, [esp + 0x48]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x433c1e
lea edx, [esp + 0x48]
mov ecx, esi
push edx
call fcn.004a73f2
jmp 0x433b33
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x48]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x10]
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x433b3d
mov eax, dword [eax + 4]
mov ecx, dword [ebx + 0x1c]
push eax
push 0
push 0x1109
push ecx
call ebp
push eax
call fcn.004a5a92
lea edx, [esp + 0x48]
push 0x669234
push edx
mov esi, 0xffff0000
call fcn.00496ff7
add esp, 8
test eax, eax
je 0x433bc0
mov ecx, dword [ebx + 0x1c]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esi
push eax
push 0
push 0x1100
push ecx
mov dword [esp + 0x28], 0xffff0002
mov dword [esp + 0x44], 2
mov dword [esp + 0x48], 3
mov dword [esp + 0x2c], 0x23
call ebp
push 0x669234
push 0
mov esi, eax
inc edi
call fcn.00496ff7
add esp, 8
test eax, eax
jne 0x433b6c
mov dword [esp + 0x10], edi
mov edx, dword [ebx + 0x1c]
xor edi, edi
push edi
push edi
push 0x110a
push edx
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x433c08
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x1c]
push esi
push 2
push 0x1102
push eax
mov edi, esi
call ebp
mov ecx, dword [ebx + 0x1c]
push esi
push 4
push 0x110a
push ecx
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x433bdd
mov edx, dword [ebx + 0x1c]
push edi
push 9
push 0x110b
push edx
call ebp
push edi
mov ecx, ebx
call fcn.00433c40
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret
Function at 0x433c40
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b4d8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004a6fde
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x433cc2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004a43b0
mov eax, dword [eax]
push 0x669234
push eax
call fcn.00495ed4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004a7269
test bl, bl
je 0x433cc2
push 0x669234
lea ecx, [esp + 0xc]
call fcn.004a7645
push 0x66cdbc
lea ecx, [esp + 0xc]
call fcn.004a7645
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x433cfe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004a7269
jmp 0x433dc9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x433d82
lea edx, [esp + 0x7c]
push 0x66cdb8
push edx
call fcn.00495ed4
add esp, 8
test eax, eax
je 0x433d82
lea eax, [esp + 0x7c]
push 0x66cdb4
push eax
call fcn.00495ed4
add esp, 8
test eax, eax
je 0x433d82
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x433d12
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004a7269
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x435040
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4350a2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc