joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409500
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00409630
sub esp, 0x100
mov esi, esp
call fcn.004384d0
test al, 1
jne 0x40951f
jmp 0x4095fa
call fcn.00430850
jmp 0x409526
test al, 1
jne 0x40952f
jmp 0x4095f5
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, 0
setge al
jmp 0x409551
jmp 0x409553
test al, 1
jne 0x40955c
jmp 0x4095f3
xor eax, eax
sub esp, 0x24
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
jmp 0x4095b0
cmp eax, 0
setge al
jmp 0x4095b8
test al, 1
jne 0x4095be
jmp 0x4095ed
call fcn.0040a660
test al, 1
jne 0x4095c9
jmp 0x4095eb
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00409610
add esp, 8
call fcn.0040f1c0
call fcn.0040c590
jmp 0x4095ed
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4095f5
call fcn.00438830
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x4097ba
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x4096cd
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4096f1
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x4096c0
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x4096c0
lea esi, [ebx + 1]
push esi
call fcn.00408cc0
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x4097c8
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x409738
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x4097ca
movzx edx, word [edi]
test dx, dx
je 0x4097ca
cmp dx, 0x7f
jbe 0x409720
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp ecx, 2
jb 0x409780
cmp esi, 0x7ff
ja 0x409780
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x409727
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x409727
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x409727
push 1
call fcn.00408cc0
add esp, 4
mov ebp, eax
jmp 0x4097ca
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x4097e7
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x4097e2
test eax, eax
jne 0x4097e0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.004059b0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x416fb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x416fd0
sar esi, 1
lea edi, [esp + 0x84]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x4477dc]
mov ebx, dword [esp + 0x84]
test ebx, ebx
jns 0x417005
mov eax, 0xffffffff
jmp 0x417008
lea eax, [ebx + ebx]
push eax
call fcn.00408cc0
add esp, 4
push edi
push ebx
mov ebx, eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x4477dc]
mov dword [esp + 0x20], 0x7b2479ca
mov dword [esp + 0x24], 0x7fc97dd9
mov dword [esp + 0x28], 0x731071ca
mov dword [esp + 0x2c], 0x77d37524
mov dword [esp + 0x30], 0x4bfd49c4
mov dword [esp + 0x34], 0x4ffd4df1
mov dword [esp + 0x38], 0x434041f0
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov byte [esp + 0x44], 0
mov dword [esp + 0x98], 0
mov ecx, dword [esp + 0x98]
cmp ecx, 0x24
ja 0x417100
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x98]
movzx edx, byte [esp + edx + 0x20]
lea esi, [ecx + 0x69d3dd4f]
add ecx, 0x4f
and ecx, edx
or esi, edx
sub esi, ecx
mov dword [esp + 0xb4], esi
mov ecx, dword [esp + 0xb4]
mov edx, ecx
xor edx, 0xd6
and ecx, 0x56
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esp + 0x98]
mov byte [esp + edx + 0x20], cl
mov ecx, dword [esp + 0x98]
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov dword [esp + 0x98], ecx
mov ecx, dword [esp + 0x98]
cmp ecx, 0x25
jb 0x417090
lea edi, [esp + 0x98]
lea edx, [esp + 0x20]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xb4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x84]
mov ecx, eax
add ecx, 0xd
mov dword [esp + 0x1c], ebx
jns 0x41713d
mov eax, 0xffffffff
jmp 0x417142
add eax, eax
add eax, 0x1a
push eax
call fcn.00408cc0
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x417181
mov eax, dword [esp + 0x1c]
lea edx, [eax + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417170
mov word [eax], 0
movzx ecx, word [esp + 0x98]
test cx, cx
je 0x4171b1
lea edx, [esp + 0x9a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4171a0
mov word [eax], 0
lea eax, [esp + 0x54]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043aff0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4421cc]
Function at 0x4198a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edi, dword [ebp + 0xc]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x4198c0
sar ebx, 1
lea eax, [esp + 8]
push eax
push 0
push 0
push ebx
push edi
push 0
call dword [0x4477dc]
mov esi, dword [esp + 8]
test esi, esi
jns 0x4198ef
mov eax, 0xffffffff
jmp 0x4198f2
lea eax, [esi + esi]
push eax
call fcn.00408cc0
add esp, 4
lea ecx, [esp + 8]
push ecx
push esi
push eax
push ebx
mov ebx, eax
push edi
push 0
call dword [0x4477dc]
lea edi, [esp + 0x20]
push edi
push ebx
call fcn.0043b1d0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4424f4]
Function at 0x41eb00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0x73336d49
mov dword [esp + 0x14], 0x77067100
mov dword [esp + 0x18], 0x7b1b7530
mov dword [esp + 0x1c], 0x7f1f790c
mov dword [esp + 0x20], 0x83de7d59
mov dword [esp + 0x24], 0x87ee81d4
mov dword [esp + 0x28], 0x8bf885f1
mov dword [esp + 0x2c], 0x8feb89ec
mov dword [esp + 0x30], 0x93f48dfa
mov dword [esp + 0x34], 0x97e091f9
mov dword [esp + 0x38], 0x9bc695f0
mov dword [esp + 0x3c], 0x9fe899c8
mov dword [esp + 0x40], 0xa3c89def
mov dword [esp + 0x44], 0xa7caa1c9
mov dword [esp + 0x48], 0xabdda5c1
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0xa9a8
mov dword [esp + 0x4e], 0
mov dword [esp + 0x51], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x44
ja 0x41ec0d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
lea esi, [ecx + 0x6e]
and esi, edx
add ecx, edx
add esi, esi
sub ecx, esi
add ecx, 0x97da256e
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x5c]
add cl, 0xfe
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
mov ecx, dword [esp + 4]
mov edx, ecx
xor edx, 1
and ecx, 1
lea ecx, [edx + ecx*2]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
cmp ecx, 0x45
jb 0x41ebc0
lea ebx, [esp + 0x5c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x4477dc]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41ec56
mov eax, 0xffffffff
jmp 0x41ec59
lea eax, [edi + edi]
push eax
call fcn.00408cc0
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x1e
push ebx
push 0
call dword [0x4477dc]
mov dword [esp + 0x10], 0xb32cb55a
mov dword [esp + 0x14], 0xaf22b139
mov dword [esp + 0x18], 0xab37ad32
mov dword [esp + 0x1c], 0xa736a924
mov dword [esp + 0x20], 0xa32aa531
mov dword [esp + 0x24], 0x5fa0a13e
mov dword [esp + 0x28], 0
mov word [esp + 0x2c], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1d
ja 0x41ed1b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x8ac57669
add eax, 0x8ac57669
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
mov ecx, eax
xor ecx, 0x20
and eax, 0x20
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1e
jb 0x41ecd0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.004198a0
add esp, 0x14
mov ebx, eax
jmp dword [0x442f5c]
Function at 0x433780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
mov esi, esp
mov ebx, dword [ebp + 8]
push eax
mov dword [esi + 8], esp
push eax
mov dword [esi + 4], esp
mov dword [esi + 0x20], 0xabd5ad81
mov dword [esi + 0x24], 0xd749a931
mov dword [esi + 0x28], 0xd3bfd548
mov dword [esi + 0x2c], 0xdf92d145
mov dword [esi + 0x30], 0xdbb3dd42
mov dword [esi + 0x34], 0xc7abd942
mov dword [esi + 0x38], 0xc3c2c5e9
lea edx, [esi + 0x3c]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0x10]
cmp eax, 0x23
ja 0x433837
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x10]
movzx edi, byte [esi + ecx + 0x20]
lea ecx, [eax + edi]
add eax, 0xba
and eax, edi
add eax, eax
sub ecx, eax
add ecx, 0x8d968eba
mov dword [esi + 0x48], ecx
mov eax, dword [esi + 0x48]
mov ecx, eax
xor ecx, 0xe9
and eax, 0x69
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esi + 0x10]
mov byte [esi + ecx + 0x20], al
inc dword [esi + 0x10]
mov eax, dword [esi + 0x10]
cmp eax, 0x24
jb 0x4337f0
lea edi, [esi + 0x48]
lea eax, [esi + 0x20]
mov ecx, 7
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esi + 0x64]
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov ecx, dword [0x4477dc]
mov edx, dword [0x445174]
nop
nop
jmp edx

Function at 0x433f30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x43401e
mov ebp, dword [esp + 0x18]
xor esi, esi
xor edi, edi
jmp 0x433f6c
mov eax, edi
and eax, 4
xor edi, 4
lea edi, [edi + eax*2]
mov eax, dword [esp]
mov esi, eax
cmp edi, ecx
mov ebp, dword [esp + 0x18]
jae 0x434020
movzx eax, byte [ebp + edi]
push eax
call fcn.00419780
add esp, 4
mov ebx, eax
movzx eax, byte [ebp + edi + 1]
push eax
call fcn.00419780
mov ecx, dword [esp + 0x20]
add esp, 4
mov bh, al
shl bl, 2
shr al, 4
and al, 3
or al, bl
lea edx, [esi + 1]
mov dword [esp], edx
mov edx, dword [esp + 0x20]
mov byte [edx + esi], al
lea eax, [edi + 2]
cmp eax, ecx
jae 0x433f50
movzx eax, byte [ebp + eax]
push eax
call fcn.00419780
mov ecx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x433f50
mov bl, al
shl bh, 4
shr al, 2
and al, 0xf
or al, bh
lea edx, [esi + 2]
mov dword [esp], edx
mov edx, dword [esp + 0x20]
mov byte [edx + esi + 1], al
lea eax, [edi + 3]
cmp eax, ecx
jae 0x433f50
mov ecx, dword [esp + 0x18]
movzx eax, byte [ecx + eax]
push eax
call fcn.00419780
mov ecx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x433f50
shl bl, 6
add al, bl
mov edx, dword [esp + 0x20]
mov byte [edx + esi + 2], al
add esi, 3
mov dword [esp], esi
jmp 0x433f50
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, esp
push eax
sub esp, 0xc
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
xor ecx, ecx
cmp dword [ebp + 8], 0
setne cl
jmp dword [ecx*4 + 0x445614]
Function at 0x43a280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ecx, dword [ebp + 8]
mov dword [esp + 8], 0x6b6a6dbc
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x43a30f
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx esi, byte [esp + edx + 8]
lea edi, [eax + 0x62ec7292]
lea edx, [eax + esi]
add edx, 0x62ec7292
add eax, 0x92
or eax, edi
and edi, esi
and eax, esi
add eax, edi
mov esi, eax
xor esi, edx
not eax
and eax, edx
add eax, eax
sub eax, esi
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 2
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0x43a2c0
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x4462c8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x4462d0]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x4462d0]
mov eax, dword [esi + 0x30]
xor edi, edi
jmp dword [edi*4 + 0x4462e0]
mov esi, dword [esi]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x4462d0]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x4462d8]
mov edi, 1
jmp dword [edi*4 + 0x4462e0]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a500
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [esp + 8], 0xb3b21b0d
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 9
ja 0x43a587
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea esi, [ecx + 0x46a336c8]
lea edi, [ecx + 0xc8]
xor edi, esi
and esi, edx
and edi, edx
add ecx, edx
add ecx, 0x46a336c8
lea edx, [edi + esi*2]
sub ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x88
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xa
jb 0x43a540
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x446348]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x3c]
mov edx, dword [edx + ecx]
mov dword [esp + 8], 0x302c8fc
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 8
ja 0x43a616
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 8]
lea ebx, [esi - 0x43d35aa]
add esi, 0x56
or esi, ebx
and esi, edi
or ebx, edi
sub ebx, esi
mov dword [esp + 4], ebx
mov esi, dword [esp + 4]
mov edi, esi
xor edi, 0xa5
and esi, 0x25
lea ebx, [edi + esi*2]
inc bl
mov esi, dword [esp]
mov byte [esp + esi + 8], bl
inc dword [esp]
mov esi, dword [esp]
cmp esi, 9
jb 0x43a5d0
xor ebx, ebx
cmp edx, dword [esp + 8]
setne bl
jmp dword [ebx*4 + 0x446350]
mov esi, dword [ebp + 8]
mov edi, dword [esi + ecx + 0x7c]
xor edx, edx
test edi, edi
sete dl
jmp dword [edx*4 + 0x446358]
mov edx, dword [esi + ecx + 0x78]
xor ecx, ecx
test edx, edx
sete cl
jmp dword [ecx*4 + 0x446360]
mov dword [esp + 0x20], edi
mov eax, dword [esi + edx + 0x20]
add eax, esi
mov dword [esp + 0x40], eax
mov eax, dword [esi + edx + 0x24]
add eax, esi
mov dword [esp + 0x28], eax
mov eax, dword [esi + edx + 0x1c]
add eax, esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], edx
mov ecx, dword [esi + edx + 0x18]
xor edx, edx
xor eax, eax
mov dword [esp + 0x3c], ecx
cmp edx, ecx
setb al
mov ecx, dword [0x44638c]
mov edi, dword [0x4463b4]
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], ecx
jmp dword [eax*4 + 0x446378]
mov ecx, dword [case.0x43a61f.1]
nop
nop
nop
nop
jmp ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d830
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
sub esp, 0x88
push edi
mov edi, ecx
cmp dword [edi + 0x28], 0
je 0x43d849
mov al, 1
pop edi
add esp, 0x88
ret
push ebp
call fcn.0043d780
mov ebp, eax
test ebp, ebp
jne 0x43d860
pop ebp
xor al, al
pop edi
add esp, 0x88
ret
push ebx
push esi
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x44], eax
xorps xmm0, xmm0
lea eax, [edi + 0x38]
mov dword [esp + 0x40], 1
mov dword [esp + 0x4c], eax
lea eax, [edi + 0x3c]
mov dword [esp + 0x50], eax
lea eax, [edi + 0x40]
mov dword [esp + 0x54], eax
mov eax, dword [edi + 0x1c]
mov dword [esp + 0x58], eax
mov eax, dword [edi + 0x20]
push 0
mov dword [esp + 0x60], eax
lea eax, [esp + 0x14]
push eax
push 0x2c
lea eax, [esp + 0x20]
mov dword [esp + 0x54], esi
push eax
push 0x2c
lea eax, [esp + 0x54]
mov dword [esp + 0x74], 0
push eax
push ebp
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
movups xmmword [esp + 0x38], xmm0
mov dword [esp + 0x50], 0
movq qword [esp + 0x48], xmm0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x43d999
cmp dword [esp + 0x14], 2
jne 0x43d999
cmp dword [esp + 0x18], 0
je 0x43d999
cmp dword [esp + 0x34], 0
je 0x43d999
cmp dword [esp + 0x38], 0
je 0x43d999
cmp dword [esp + 0x3c], 0
je 0x43d999
lea ecx, [esp + 0x6c]
call fcn.0043d6f0
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x70], 3
push eax
push 0x2c
lea eax, [esp + 0x78]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43d999
mov eax, dword [esp + 0x34]
mov bl, 1
mov dword [edi + 0x28], eax
mov eax, dword [esp + 0x38]
mov dword [edi + 0x2c], eax
mov eax, dword [esp + 0x3c]
mov dword [edi + 0x30], eax
mov eax, dword [esp + 0x18]
push ebp
mov dword [edi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
pop edi
add esp, 0x88
ret
push ebp
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
pop edi
add esp, 0x88
ret
Function at 0x4400c0
Capabilities:
Create pipe

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x84], 0
jne 0x440164
push 0
push 1
push 0
mov dword [esi + 0x84], 2
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x440164
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x440164
push 4
push 0xffffffffffffffff
push esi
push 0x43fe40
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x440164
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x440129
mov eax, dword [eax]
push dword [esi + 0x38]
push 0
push 0x40
push 0x40
push 1
push 6
push 0x40080003
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x440164
push dword [esi + 0x9c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x440168
mov dword [esi + 0x84], 1
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
Function at 0x45f020
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d80c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5be410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0xd
push str.RFCalibration
mov dword [esi], vtable.CArgCommon.0
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
mov dword [esi], vtable.CArgCalibration.0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [esi + 0x10]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [esi + 0x14]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [esi + 0x18]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [esi + 0x1c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [esi + 0x20]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [esi + 0x24]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
mov ecx, esi
mov byte [ebp - 4], 7
push 0x5765b8
lea ecx, [ecx + 0xc]
call dword [0x5756d4]
mov ecx, esi
push 0x5765b8
lea ecx, [ecx + 0x10]
call dword [0x5756d4]
push 0x5765b8
lea ecx, [esi + 0x14]
call dword [0x5756d4]
mov edi, esi
lea ecx, [esi + 0x18]
push 0x57af50
mov byte [edi + 0x29], 1
call dword [0x5756d4]
push 0x5765b8
lea ecx, [edi + 0x1c]
mov dword [edi + 0x2c], 1
mov dword [edi + 0x30], 1
call dword [0x5756d4]
push 0x5765b8
lea ecx, [edi + 0x20]
call dword [0x5756d4]
push 0x5765b8
lea ecx, [esi + 0x24]
call dword [0x5756d4]
mov byte [edi + 0x28], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret