joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10022caf
pop dword [ebp - 0x24]
mov eax, 0xdf9752cf
add eax, 0x306ad9e0
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x85d85976
add dword [ebp - 0x34], 0xc879ebd5
mov dword [ebp - 0x30], 0x47b75f6b
add dword [ebp - 0x30], 0xea7becda
mov dword [ebp - 0x2c], 0x9c9abf52
add dword [ebp - 0x2c], 0xafb184dc
mov dword [ebp - 0x28], 0x10f011e0
sub dword [ebp - 0x28], 0x10f011e0
lea eax, [ebp - 0x34]
push eax
mov eax, 0x7a2a6cfe
sub eax, 0x6a25fc36
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xb45e7366
add dword [ebp - 0x34], 0xc013f5f0
mov dword [ebp - 0x30], 0xdbae8887
add dword [ebp - 0x30], 0x65bdd8ee
mov dword [ebp - 0x2c], 0x659dc015
add dword [ebp - 0x2c], 0xfdd1ac57
mov dword [ebp - 0x28], 0xcd75b4c
sub dword [ebp - 0x28], 0xcd75b4c
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3fa9f
push 0
call eax
mov ecx, 0x3d1e
mov ebx, eax
mov esi, 0xb24d48d9
sub esi, 0xa24718d9
add esi, dword [ebp - 0x24]
mov edx, 0xb2839a3
sub edx, 0x6afef3a9
xor dword [ebp - 0x14], 0x730c2472
mov edi, dword [esi]
add dword [ebp - 0x14], 0x775df02f
add edi, edx
mov dword [ebp - 0xc], 0x96e2cd5f
mov dword [ebx], edi
add ebx, 0x5ec68513
add ebx, 0xa1397af1
add esi, 0x17b35bb9
sub esi, 0x17b35bb5
loop 0x10022dc6
add eax, 0x9622b95
add eax, 0xf69ebbb6
mov ebx, eax
add eax, 0x267e6fc8
sub eax, 0x267e6fc3
mov ecx, 0x2d72c85f
add ecx, 0xe28d37a1
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401119
Capabilities:
Encode data using xor

Disassembly:
push 1
pop ecx
cmp dword [esp + 8], ecx
jl 0x401139
mov eax, dword [esp + 4]
mov edx, ecx
and edx, 3
mov dl, byte [esp + edx + 0xc]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, dword [esp + 8]
jle 0x401126
ret

Function at 0x403861
Capabilities:
Encode data using xor

Disassembly:
jmp 0x403871
push 0x93919
imul esi, edi
movsx edi, al
cmp ebx, 0x324e
mov edi, edx
xor bh, 0x57
mov cl, 0x66
call 0x40388f
pop ebx
mov cl, bl
test bl, al
test dl, 2
cmp edi, ebx
movd mm0, ebx
or bl, 0x59
movsx eax, dx
cmp esi, 0x67bb
jb 0x4038b0
movzx ebx, dh
imul ebx, eax
test dl, ch
imul eax, eax, 0xf7380d1a
not eax
bswap eax
lea eax, [0x33dbd]
xchg edi, eax
cmp al, 0x4d
sub edi, 0xaf69
test ebp, 0xafeed20c
xchg edi, ebx
xchg al, ah
add ebx, 0xfcce
cmp ecx, edi
ja 0x4038e8
test eax, 0xf1843741
xchg ah, al
dec eax
mov ecx, ebx
mov ah, 0xd6
cmp ecx, 0xdd4
js 0x4038fc
not edi
movsx eax, si
not bh
bswap ebx
mov ebx, 0x149914b
lea ebx, [0xaa1]
sub ebx, 0x140
push ebx
or edi, eax
pop edi
add edi, 0x5b1
mov bh, 0x7e
mov eax, edi
adc bh, dl
xchg edi, edi
movsx ebx, cx
push eax
mov ebx, ebx
pop ebx
lea edi, [ebx]
jmp 0x403931
imul ebx, ebp
ja 0x403938
inc ebx
mov ebx, 0xfff317de
xor ebx, 0xceebe
mov esi, 0xd
sub esi, 0xd
xor esi, ebx
add esi, 0x6a0
invalid

Function at 0x404de5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408688
cmp edx, dword [eax]
je 0x404e07
add eax, 8
inc ecx
cmp eax, 0x408718
jl 0x404df8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408688]
jne 0x404f35
mov eax, dword [0x408a48]
cmp eax, 1
je 0x404f0f
test eax, eax
jne 0x404e38
cmp dword [0x4085d4], 1
je 0x404f0f
cmp edx, 0xfc
je 0x404f35
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404e6f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004032f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004033f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404eb2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004033f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4065d0
push edi
call fcn.00405720
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004032f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403300
lea eax, [ebp - 0xa0]
push 0x4065b0
push eax
call fcn.00403300
push dword [esi + 0x40868c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403300
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405697
add esp, 0x2c
pop edi
jmp 0x404f35
lea eax, [ebp + 8]
lea esi, [esi + 0x40868c]
push 0
push eax
push dword [esi]
call fcn.004033f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4032f3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ecx + 0x10]
push edi
cmp esi, 0x40
jb 0x403351
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x403351
mov edx, dword [ecx + 0x3c]
lea eax, [edx + 0xf8]
cmp esi, eax
jb 0x403351
cmp dword [edx + ecx], 0x4550
jne 0x403351
movzx eax, word [edx + ecx + 4]
mov edi, 0x14c
cmp ax, di
je 0x40333c
mov edi, 0x8664
cmp ax, di
je 0x403351
lea eax, [ecx + 0x98]
add eax, edx
mov ecx, dword [eax]
test ecx, ecx
je 0x403351
add ecx, 0xc
cmp esi, ecx
jae 0x403353
xor eax, eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x418427
Capabilities:
Encode data using xor

Disassembly:
dec ecx
in eax, dx
push es
mov dword [ebp + 0x645598dc], esp
leave
xor cl, byte [ebx - 0x53]
stosb byte es:[edi], al
pop esi
dec esp
mov esp, 0x2f0a6c37
cmp al, byte [ecx - 0x5c]
add ebx, dword [ebp + 0xa]
invalid

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x670082c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67269e00
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x674c412c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
push 0
call sym.Qt5Core.dll_public:_void___thiscall_QObject::constructor_class_QObject__
lea esi, [edi + 0xc]
mov dword [ebp - 4], 0
push 0
mov ecx, esi
mov dword [edi], vtable.QUnifiedTimer.0
mov dword [ebp - 0x1c], esi
call sym.Qt5Core.dll_public:_void___thiscall_QAnimationDriver::constructor_class_QObject__
mov dword [esi], vtable.QDefaultAnimationDriver.0
mov dword [esi + 8], 0
push 0
push str.1startTimer__
push esi
push str.2started__
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push esi
push eax
mov dword [esi + 0xc], edi
call sym.Qt5Core.dll_public:_static_class_QMetaObject::Connection___cdecl_QObject::connect_class_QObject_const___char_const___class_QObject_const___char_const___enum_Qt::ConnectionType_
add esp, 0x18
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_void___thiscall_QMetaObject::Connection::destructor_void_
push 0
push str.1stopTimer__
push esi
push str.2stopped__
lea eax, [ebp - 0x14]
push esi
push eax
call sym.Qt5Core.dll_public:_static_class_QMetaObject::Connection___cdecl_QObject::connect_class_QObject_const___char_const___class_QObject_const___char_const___enum_Qt::ConnectionType_
add esp, 0x18
lea ecx, [ebp - 0x14]
call sym.Qt5Core.dll_public:_void___thiscall_QMetaObject::Connection::destructor_void_
movsd xmm0, qword [0x6728ef20]
lea ecx, [edi + 0x20]
mov dword [edi + 0x1c], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0x80000000
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0x80000000
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0x10
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov word [edi + 0x44], 0
movsd qword [edi + 0x48], xmm0
mov dword [edi + 0x50], sym.Qt5Core.dll_struct_QListData::Data_const_QListData::shared_null
mov dword [edi + 0x54], sym.Qt5Core.dll_struct_QListData::Data_const_QListData::shared_null
mov dword [edi + 0x58], sym.Qt5Core.dll_struct_QListData::Data_const_QListData::shared_null
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
call sym.Qt5Core.dll_public:_void___thiscall_QElapsedTimer::invalidate_void_
mov dword [edi + 8], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x67014c10
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6726a664
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x674c412c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x64
call fcn.67267bfd
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
push 0x50f07
mov ecx, esi
mov dword [ebp - 4], 0
call sym.Qt5Core.dll_public:_void___thiscall_QObjectPrivate::constructor_int_
push dword [ebp + 8]
mov dword [esi + 0x30], 0
mov ecx, edi
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 1
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0x1000000
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], sym.Qt5Core.dll_struct_QListData::Data_const_QListData::shared_null
mov dword [esi], vtable.QSequentialAnimationGroupPrivate.0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x5c], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
push esi
mov dword [esi + 0x60], 0
mov dword [ebp - 4], 0xffffffff
call sym.Qt5Core.dll_protected:_void___thiscall_QAnimationGroup::constructor_class_QAnimationGroupPrivate___class_QObject__
mov dword [edi], vtable.QSequentialAnimationGroup.0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x67017090
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x14]
xor eax, eax
cmp edi, 0x20
jb 0x67017105
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], edx
sub dword [esp + 0x14], ecx
mov dword [esp + 8], 0x10
lea esi, [ecx + 0x10]
sub dword [esp + 8], ecx
nop dword [eax]
movups xmm1, xmmword [eax + edx]
mov ecx, dword [esp + 0x14]
add eax, 0x20
movaps xmm0, xmm1
psrlw xmm1, 8
psllw xmm0, 8
movups xmm2, xmmword [ecx + esi]
mov ecx, dword [esp + 8]
pxor xmm0, xmm1
movups xmmword [esi - 0x10], xmm0
movaps xmm0, xmm2
psrlw xmm2, 8
psllw xmm0, 8
pxor xmm0, xmm2
movups xmmword [esi], xmm0
add esi, 0x20
add ecx, esi
cmp ecx, edi
jbe 0x670170c0
mov ecx, dword [esp + 0x10]
lea esi, [eax + 0x10]
mov edx, dword [esp + 0x18]
cmp esi, edi
ja 0x6701712f
movups xmm1, xmmword [eax + ecx]
movaps xmm0, xmm1
psrlw xmm1, 8
psllw xmm0, 8
pxor xmm0, xmm1
movups xmmword [eax + edx], xmm0
mov eax, esi
xor esi, esi
cmp eax, edi
jae 0x67017161
add edx, eax
sub ecx, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
nop
cmp esi, 0x10
jae 0x67017161
mov cx, word [edx + ecx]
add eax, 2
rol cx, 8
add esi, 2
mov word [edx], cx
add edx, 2
mov ecx, dword [esp + 0x10]
cmp eax, edi
jb 0x67017140
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x67018240
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x58
mov eax, dword [0x674c412c]
xor eax, esp
mov dword [esp + 0x54], eax
push edi
mov edi, dword [esp + 0x60]
lea eax, [esp + 4]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftCryptography
mov dword [esp + 0x18], edi
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x670182de
push esi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x4a
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push str.MachineGuid
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x670182de
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
dec eax
push ecx
shr eax, 1
push eax
push edi
call sym.Qt5Core.dll_class_QByteArray___cdecl_QtPrivate::convertToLatin1_class_QStringView_
add esp, 0xc
mov eax, edi
pop edi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.67267c3b
add esp, 0x58
ret
mov ecx, dword [esp + 0x58]
mov eax, edi
mov dword [edi], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
pop edi
xor ecx, esp
call fcn.67267c3b
add esp, 0x58
ret
Function at 0x67020370
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6726b68d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x674c412c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0x674c64d4
mov ecx, 1
mov esi, 0x674c64d4
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x670203ba
mov ecx, esi
call sym.Qt5Core.dll_private:_void___thiscall_QBasicMutex::lockInternal_void_
mov byte [ebp - 0x10], 1
cmp dword [ebp + 8], 0x7ffe
mov dword [ebp - 4], 0
jg 0x670203dc
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x67020493
push 0xfffe
call fcn.6726875f
mov ebx, dword [ebp + 8]
add esp, 4
mov edx, eax
xor edi, edi
mov dword [ebp - 0x10], edx
test ebx, ebx
jle 0x6702048a
mov ecx, 0x7ffe
mov esi, ebx
sub esi, edi
cmp esi, 0x7ffe
mov eax, esi
cmovg eax, ecx
cmp eax, 0xffffffff
je 0x67020436
lea edx, [eax + edi]
mov eax, edi
cmp ebx, edx
cmovl edx, ebx
cmp ebx, edi
cmovl eax, ebx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
xor esi, esi
test edx, edx
cmovg esi, edx
mov edx, dword [ebp - 0x10]
sub esi, ecx
cmp ebx, edi
mov eax, edi
cmovl eax, ebx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
mov eax, dword [ebp + 0xc]
lea ecx, [eax + ecx*2]
test ecx, ecx
je 0x6702045c
lea eax, [esi + esi]
push eax
push ecx
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push eax
mov word [eax + esi*2], cx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, dword [ebp + 8]
add edi, 0x7ffe
mov edx, dword [ebp - 0x10]
mov ecx, 0x7ffe
cmp edi, ebx
jl 0x67020400
mov esi, 0x674c64d4
push edx
call fcn.67268768
add esp, 4
xor edx, edx
mov eax, 1
lock cmpxchg dword [esi], edx
cmp eax, 1
je 0x670204aa
mov ecx, esi
call sym.Qt5Core.dll_private:_void___thiscall_QBasicMutex::unlockInternal_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x670204c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub esp, 0x9c4
mov eax, dword [0x674c412c]
xor eax, esp
mov dword [esp + 0x9c0], eax
push ebx
mov ebx, dword [esp + 0x9cc]
mov edx, 1
push ebp
push esi
push edi
mov edi, ecx
mov ecx, 0x1571
mov dword [edi + 0x1384], 0xffffffff
lea esi, [edi + 8]
mov dword [edi + 4], 0x1571
nop
mov eax, ecx
lea esi, [esi + 4]
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
inc edx
mov dword [esi - 4], ecx
cmp edx, 0x270
jb 0x67020500
lea eax, [esp + 0x9d0]
mov dword [edi], 0x270
push eax
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
call fcn.670206f0
xor edx, edx
lea ebx, [edi + 4]
xor esi, esi
nop
mov eax, dword [esp + esi*4 + 0x10]
lea ebx, [ebx + 4]
mov ecx, eax
mov dword [ebx - 4], eax
or ecx, edx
mov edx, eax
shr edx, 0x1f
test esi, esi
cmovne edx, ecx
inc esi
cmp esi, 0x270
jb 0x67020540
mov eax, edi
test edx, edx
jne 0x6702056e
mov dword [edi + 4], 0xffffffff
mov ecx, dword [esp + 0x9d0]
mov dword [edi], 0x270
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.67267c3b
add esp, 0x9c4
ret 4
Function at 0x670206f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
push ebp
mov ebp, dword [esp + 0x24]
mov eax, ecx
push esi
mov esi, dword [esp + 0x2c]
sub esi, ebp
mov dword [esp + 0x1c], eax
sar esi, 2
test esi, esi
je 0x670208da
push ebx
mov ebx, dword [eax + 4]
sub ebx, dword [eax]
sar ebx, 2
cmp esi, 0x26f
jb 0x67020728
mov eax, 0xb
jmp 0x67020751
cmp esi, 0x44
jb 0x67020734
mov eax, 7
jmp 0x67020751
cmp esi, 0x27
jb 0x67020740
mov eax, 5
jmp 0x67020751
cmp esi, 7
jb 0x6702074c
mov eax, 3
jmp 0x67020751
lea eax, [esi - 1]
shr eax, 1
mov edx, esi
sub edx, eax
shr edx, 1
add eax, edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
cmp esi, ebx
ja 0x6702076e
lea eax, [ebx + 1]
mov dword [esp + 0x30], eax
jmp 0x67020772
mov dword [esp + 0x30], esi
push edi
mov eax, 0x8b8b8b8b
mov ecx, esi
mov edi, ebp
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x34]
xor edi, edi
test eax, eax
je 0x6702083f
nop dword [eax]
lea eax, [edi + edx]
xor edx, edx
div esi
lea eax, [edx*4]
xor edx, edx
add eax, ebp
mov dword [esp + 0x28], eax
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov eax, edi
div esi
mov eax, edx
xor edx, edx
mov dword [esp + 0x10], eax
lea eax, [eax*4]
add eax, ebp
mov dword [esp + 0x18], eax
lea eax, [edi - 1]
div esi
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + edx*4]
xor ecx, dword [eax]
xor ecx, dword [esp + 0x14]
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul edx, eax, 0x19660d
test edi, edi
jne 0x670207ed
mov eax, ebx
jmp 0x67020805
cmp edi, ebx
ja 0x67020801
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov eax, dword [eax + edi*4 - 4]
add eax, dword [esp + 0x10]
jmp 0x67020805
mov eax, dword [esp + 0x10]
lea ecx, [eax + edx]
mov eax, dword [esp + 0x14]
add eax, edx
mov edx, dword [esp + 0x28]
mov dword [edx], eax
xor edx, edx
mov eax, dword [esp + 0x20]
add eax, edi
inc edi
div esi
lea eax, [edx*4]
mov edx, dword [esp + 0x1c]
add dword [eax + ebp], ecx
mov eax, dword [esp + 0x18]
mov dword [eax], ecx
mov eax, dword [esp + 0x34]
cmp edi, eax
jb 0x67020790
add eax, esi
mov dword [esp + 0x1c], eax
cmp edi, eax
jae 0x670208d8
mov eax, dword [esp + 0x20]
lea ecx, [edi - 1]
inc edx
mov dword [esp + 0x34], ecx
inc eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x28], eax
lea eax, [edx + ecx]
xor edx, edx
div esi
lea ebp, [ebp + edx*4]
xor edx, edx
lea eax, [ecx + 1]
mov ebx, dword [ebp]
mov dword [esp + 0x24], eax
div esi
mov eax, ecx
mov edi, edx
xor edx, edx
div esi
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + edx*4]
xor edx, edx
add ecx, ebx
add ecx, dword [eax + edi*4]
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul eax, eax, 0x5d588b65
xor ebx, eax
mov ecx, eax
mov eax, dword [esp + 0x34]
sub ecx, edi
add eax, dword [esp + 0x28]
div esi
mov dword [ebp], ebx
mov ebp, dword [esp + 0x30]
lea eax, [edx*4]
mov edx, dword [esp + 0x18]
xor dword [eax + ebp], ecx
mov dword [ebp + edi*4], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x34], ecx
lea eax, [ecx + 1]
cmp eax, dword [esp + 0x1c]
jb 0x67020862
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x1c
ret 8
Function at 0x67020d80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0x270
jne 0x67020dd0
lea edx, [edi + 8]
mov esi, eax
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x67020d92
mov eax, dword [edi]
jmp 0x67020eb7
cmp eax, 0x4e0
jb 0x67020eb7
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
push ebp
mov ebp, 0xe3
nop
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x67020df0
mov eax, dword [edi + 0xd50]
lea ebx, [edi + 0xd50]
mov ebp, 0x18c
nop word [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x67020e40
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
pop ebx
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret

Function at 0x67020ef0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x67020f6d
push ebp
mov ebp, 0x674c6500
cmp edi, 0x674c6540
jne 0x67020f1d
mov ecx, 1
xor eax, eax
lock cmpxchg dword [ebp], ecx
test eax, eax
je 0x67020f1d
mov ecx, ebp
call sym.Qt5Core.dll_private:_void___thiscall_QBasicMutex::lockInternal_void_
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x67020f46
nop dword [eax + eax]
lea ecx, [edi + 4]
call fcn.67020d80
mov dword [esi], eax
add esi, 4
cmp esi, ebx
jne 0x67020f30
mov ebp, 0x674c6500
pop esi
pop ebx
cmp edi, 0x674c6540
jne 0x67020f68
xor edx, edx
mov eax, 1
lock cmpxchg dword [ebp], edx
cmp eax, 1
je 0x67020f68
mov ecx, ebp
call sym.Qt5Core.dll_private:_void___thiscall_QBasicMutex::unlockInternal_void_
pop ebp
pop edi
ret 8
pop edi
mov ecx, 0x674c6508
jmp fcn.67021010