joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005cd2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10005ce1
pop dword [ebp - 0x48]
mov eax, 0x8d64630f
sub eax, 0x7d64062e
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xd2caf768
sub dword [ebp - 0x58], 0x8478b21d
mov dword [ebp - 0x54], 0x70a6c27d
sub dword [ebp - 0x54], 0x3e737638
mov dword [ebp - 0x50], 0x58e5ef94
sub dword [ebp - 0x50], 0xc99ab66
mov dword [ebp - 0x4c], 0x248a14e1
sub dword [ebp - 0x4c], 0x248a14e1
lea eax, [ebp - 0x58]
push eax
mov eax, 0x31e93684
add eax, 0xde16dafc
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x63fef29f
sub dword [ebp - 0x58], 0xef8c8949
mov dword [ebp - 0x54], 0x4ebcb4d0
sub dword [ebp - 0x54], 0xd50535b
mov dword [ebp - 0x50], 0x6802b1b8
sub dword [ebp - 0x50], 0x493454c
mov dword [ebp - 0x4c], 0xba58b822
sub dword [ebp - 0x4c], 0xba58b822
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x6806f827
sub eax, 0x5806e6af
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3df3b
push 0
call eax
mov ecx, 0xfc6fcbed
add ecx, 0x3907e05
mov edx, eax
mov ebx, 0xbc46e908
add ebx, 0x53bae4f8
add ebx, dword [ebp - 0x48]
mov edi, 0x55d62f36
add edi, 0xcf79654f
mov esi, dword [ebx]
add dword [ebp - 0x34], 0xef183f6e
sub esi, edi
mov dword [edx], esi
xor dword [ebp - 0x28], eax
add edx, 4
add ebx, 4
loop 0x10005e03
add eax, 0x11a9b
xor ebx, ebx
add ebx, eax
add eax, 0x85893b7
sub eax, 0x85893b2
mov ecx, 0x66cb2e02
sub ecx, 0x56cb2e02
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1000efb0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000efc0]
jne 0x10017eea
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x1001a2f0], eax
mov dword [0x1001a2ec], ecx
mov dword [0x1001a2e8], edx
mov dword [0x1001a2e4], ebx
mov dword [0x1001a2e0], esi
mov dword [0x1001a2dc], edi
mov word [0x1001a308], ss
mov word [0x1001a2fc], cs
mov word [0x1001a2d8], ds
mov word [0x1001a2d4], es
mov word [0x1001a2d0], fs
mov word [0x1001a2cc], gs
pushfd
pop dword [0x1001a300]
mov eax, dword [ebp]
mov dword [0x1001a2f4], eax
mov eax, dword [ebp + 4]
mov dword [0x1001a2f8], eax
lea eax, [ebp + 8]
mov dword [0x1001a304], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1001a240], 0x10001
mov eax, dword [0x1001a2f8]
mov dword [0x1001a1f4], eax
mov dword [0x1001a1e8], 0xc0000409
mov dword [0x1001a1ec], 1
mov eax, dword [0x1000efc0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1001a044]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1001a238], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10017fec
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1001a238], 0
jne 0x10017fd6
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x818058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8181a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x81807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x81806a
add dl, dl
jne 0x818089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8180dc
xor eax, eax
add dl, dl
jne 0x818096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x81817d
add dl, dl
jne 0x8180a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8180b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8180bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8180c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8180d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x818075
mov eax, 1
add dl, dl
jne 0x8180ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8180f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8180e1
sub eax, ebx
mov ebx, 1
jne 0x818128
mov ecx, 1
add dl, dl
jne 0x81810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x818119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x818105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x818075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x81813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x81814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x818136
cmp eax, 0x7d00
jae 0x81816d
cmp eax, 0x500
jb 0x818168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x818075
cmp eax, 0x7f
ja 0x818170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x818075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x81819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x818075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x419830
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0x124
push ebx
push ebp
push esi
push edi
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x3c]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov ecx, 0xa
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x138]
lea eax, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x18], ebx
call fcn.00418f20
add eax, 4
movsx edx, word [esp + 0x50]
jo 0x41995e
add eax, 0x14
jo 0x41995e
add eax, edx
jo 0x41995e
mov edi, eax
mov ax, word [esp + 0x42]
sub ax, 1
jo 0x41995e
movsx ebp, ax
cmp ebp, ebx
jl 0x41994f
lea ecx, [esp + 0x14]
push ecx
call fcn.0041a410
push 0x28
push edi
push eax
call fcn.0041a360
mov eax, dword [esp + 0x38]
test eax, 0x20000000
je 0x4198ec
test eax, 0x40000000
je 0x4198db
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x20
add eax, 0x20
jmp 0x419911
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x70
add eax, 0x10
jmp 0x419911
test eax, 0x40000000
je 0x419904
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 2
add eax, 2
jmp 0x419911
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 7
inc eax
lea edx, [esp + 0x10]
mov esi, eax
push edx
call fcn.0041a410
push eax
push esi
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x140]
mov eax, dword [esp + 0x24]
add ecx, esi
push eax
jo 0x41995e
push ecx
call fcn.0041a340
test eax, eax
je 0x41994f
add edi, 0x28
jo 0x41995e
add ebx, 1
jo 0x41995e
cmp ebx, ebp
jle 0x4198a5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x124
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x41b780
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x401fb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x401748
xor edi, edi
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x44], 0x40eca0
mov dword [ebp - 0x4c], 8
call dword [sym.imp.MSVBVM60.DLL___vbaVarDup]
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x3c]
push eax
mov cx, word [ebx]
sub cx, 1
jo 0x41b8e1
movsx edx, cx
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcStringBstr]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x28]
call esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x5c]
push ecx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x5c], 0x4003
call dword [sym.imp.MSVBVM60.DLL_rtcHexBstrFromVar]
mov edx, eax
lea ecx, [ebp - 0x2c]
call esi
movsx ecx, word [ebx]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x2c], edi
call esi
mov edx, dword [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x20]
call esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x24]
call esi
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcRightCharBstr]
mov edx, eax
lea ecx, [ebp - 0x18]
call esi
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x24]
push eax
lea edx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x1c]
push edx
push eax
push 5
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x18
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
push 0x41b8cb
jmp 0x41b8ca
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x41b8f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401fb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401758
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov edi, dword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
lea ecx, [ebp - 0x40]
push 1
push ecx
push esi
mov dword [ebp - 0x40], 0xe9
call edi
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x44]
sub edx, esi
push 4
jo 0x41b994
sub edx, 5
push eax
jo 0x41b994
add esi, 1
mov dword [ebp - 0x44], edx
jo 0x41b994
push esi
call edi
push 0x41b97e
lea ecx, [ebp - 0x20]
push ecx
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
Function at 0x10055b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
dec eax
cmp dword [esi + 0x58], eax
jne 0x10055b8b
mov eax, dword [esi + 0x54]
dec eax
cmp dword [esi + 0x5c], eax
jne 0x10055b8b
pop esi
jmp sym.Qt5Quick.dll_public_virtual:_void___thiscall_QSGPlainTexture::bind_void_
lea eax, [esi + 8]
push eax
call sym.Qt5Quick.dll_public:_void___thiscall_QSGPlainTexture::setImage_class_QImage_const__
mov ecx, esi
call sym.Qt5Quick.dll_public_virtual:_void___thiscall_QSGPlainTexture::bind_void_
movdqa xmm0, xmmword [0x1016a6d0]
movdqu xmmword [esi + 0x50], xmm0
pop esi
ret
Function at 0x10060530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x184]
push esi
lea esi, [ebx + 0x184]
push edi
cmp dword [eax + 0xc], 0
je 0x100605f1
mov edi, edi
mov ecx, dword [esi]
mov eax, dword [ecx + 8]
cmp eax, 1
je 0x1006056f
test eax, eax
je 0x1006056f
push ecx
mov eax, esp
mov dword [eax], ecx
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.10060320
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
mov edi, dword [eax + 8]
mov eax, dword [ecx + 8]
cmp eax, 1
je 0x10060594
test eax, eax
je 0x10060594
push ecx
mov eax, esp
mov dword [eax], ecx
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.10060320
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
cmp ecx, 1
je 0x100605b8
test ecx, ecx
je 0x100605b8
push ecx
mov ecx, esp
mov dword [ecx], eax
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.10060320
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x100605d9
mov edx, dword [eax]
mov ecx, dword [eax + 4]
push eax
mov dword [edx + 4], ecx
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [edx], ecx
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi]
add esp, 4
dec dword [eax + 0xc]
test edi, edi
je 0x100605e5
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov eax, dword [esi]
cmp dword [eax + 0xc], 0
jne 0x10060550
mov ecx, dword [ebx + 0xd4]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebx + 0xd4]
call sym.Qt5Quick.dll_public:_void___thiscall_QSGDistanceFieldGlyphCache::update_void_
test byte [ebx + 0x18c], 1
je 0x1006061d
mov ecx, ebx
pop edi
pop esi
pop ebx
add esp, 0xc
jmp fcn.10060c90
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x10063670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test byte [ecx + 0x114], 4
jne sym.Qt5Quick.dll_private:_void___thiscall_QSGDefaultImageNode::updateGeometry_void_
ret
Function at 0x1008a8a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, dword [0x10200d30]
xor eax, esp
mov dword [esp + 0xec], eax
push ebx
mov ebx, dword [esp + 0xfc]
lea ecx, [esp + 0xac]
push ebp
push edi
mov edi, dword [esp + 0x100]
push ebx
call dword [sym.imp.Qt5Gui.dll_public:_void___thiscall_QMatrix4x4::constructor_class_QTransform_const__]
mov eax, dword [edi]
xor ebp, ebp
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 8]
test ecx, ecx
jle 0x1008a9d0
push esi
mov ecx, dword [edi]
mov eax, dword [ecx]
cmp eax, 1
je 0x1008a8fd
test eax, eax
je 0x1008a8fd
push dword [ecx + 4]
mov ecx, edi
call fcn.10087130
mov ecx, dword [edi]
mov eax, dword [ecx + 8]
add ecx, 0x10
add eax, ebp
lea esi, [ecx + eax*4]
lea eax, [esp + 0x78]
mov ecx, esi
push eax
call dword [sym.imp.Qt5Gui.dll_public:_class_QRectF___thiscall_QTouchEvent::TouchPoint::sceneRect_void_]
push eax
lea eax, [esp + 0x9c]
mov ecx, ebx
push eax
call dword [sym.imp.Qt5Gui.dll_public:_class_QRectF___thiscall_QTransform::mapRect_class_QRectF_const__]
push eax
mov ecx, esi
call dword [sym.imp.Qt5Gui.dll_public:_void___thiscall_QTouchEvent::TouchPoint::setRect_class_QRectF_const__]
lea eax, [esp + 0x68]
mov ecx, esi
push eax
call dword [sym.imp.Qt5Gui.dll_public:_class_QPointF___thiscall_QTouchEvent::TouchPoint::startScenePos_void_]
push eax
lea eax, [esp + 0x3c]
mov ecx, ebx
push eax
call dword [sym.imp.Qt5Gui.dll_public:_class_QPointF___thiscall_QTransform::map_class_QPointF_const__]
push eax
mov ecx, esi
call dword [sym.imp.Qt5Gui.dll_public:_void___thiscall_QTouchEvent::TouchPoint::setStartPos_class_QPointF_const__]
lea eax, [esp + 0x58]
mov ecx, esi
push eax
call dword [sym.imp.Qt5Gui.dll_public:_class_QPointF___thiscall_QTouchEvent::TouchPoint::lastScenePos_void_]
push eax
lea eax, [esp + 0x4c]
mov ecx, ebx
push eax
call dword [sym.imp.Qt5Gui.dll_public:_class_QPointF___thiscall_QTransform::map_class_QPointF_const__]
push eax
mov ecx, esi
call dword [sym.imp.Qt5Gui.dll_public:_void___thiscall_QTouchEvent::TouchPoint::setLastPos_class_QPointF_const__]
lea eax, [esp + 0x24]
mov ecx, esi
push eax
call dword [sym.imp.Qt5Gui.dll_public:_class_QVector2D___thiscall_QTouchEvent::TouchPoint::velocity_void_]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.Qt5Gui.dll_public:_void___thiscall_QVector3D::constructor_class_QVector2D_const__]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0xc4]
call dword [sym.imp.Qt5Gui.dll_public:_class_QVector3D___thiscall_QMatrix4x4::mapVector_class_QVector3D_const__]
mov ecx, eax
call dword [sym.imp.Qt5Gui.dll_public:_class_QVector2D___thiscall_QVector3D::toVector2D_void_]
push eax
mov ecx, esi
call dword [sym.imp.Qt5Gui.dll_public:_void___thiscall_QTouchEvent::TouchPoint::setVelocity_class_QVector2D_const__]
mov eax, dword [edi]
inc ebp
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 8]
cmp ebp, ecx
jl 0x1008a8e6
pop esi
mov ecx, dword [esp + 0xf8]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.10160156
add esp, 0xf0
ret
Function at 0x100dc220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x414]
call fcn.1010c1e0
test al, al
jne 0x100dc252
lea ecx, [esi + 0x434]
call fcn.1010c1e0
test al, al
jne 0x100dc252
test byte [esi + 0x4e9], 0x10
jne 0x100dc252
mov ecx, esi
pop esi
jmp fcn.1010e870
mov ecx, esi
pop esi
jmp fcn.1010c850
Function at 0x1010ab50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
call sym.Qt5Quick.dll_protected:_bool___thiscall_QQuickItem::isComponentComplete_void_const
test al, al
je 0x1010ab77
lea ecx, [esi + 0x41c]
call dword [sym.imp.Qt5Qml.dll_public:_bool___thiscall_QQmlChangeSet::isEmpty_void_const]
test al, al
jne 0x1010ab77
mov ecx, esi
pop esi
jmp fcn.1010c850
pop esi
ret
Function at 0x101109d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [ecx + 4]
call sym.Qt5Quick.dll_public_virtual:_void___thiscall_QSGMaterialShader::activate_void_
mov ecx, esi
pop esi
jmp fcn.1010c850
Function at 0x10122180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp ebx, dword [esp + 0xc]
je 0x101222e7
push ebp
mov ebp, dword [esp + 0x14]
add ebx, 0x5c
push esi
push edi
lea esp, [esp]
mov edi, ebp
add ebp, 0xc8
test edi, edi
je 0x101222d7
lea eax, [ebx - 0x5c]
mov ecx, edi
push eax
call dword [sym.imp.Qt5Gui.dll_public:_void___thiscall_QTransform::constructor_class_QTransform_const__]
lea esi, [ebx - 0xc]
push esi
lea ecx, [edi + 0x50]
call dword [sym.imp.Qt5Gui.dll_public:_void___thiscall_QPainterPath::constructor_class_QPainterPath_const__]
lea eax, [esi + 4]
push eax
lea ecx, [edi + 0x54]
call dword [sym.imp.Qt5Gui.dll_public:_void___thiscall_QBrush::constructor_class_QBrush_const__]
lea eax, [esi + 8]
push eax
lea ecx, [edi + 0x58]
call dword [sym.imp.Qt5Gui.dll_public:_void___thiscall_QBrush::constructor_class_QBrush_const__]
movzx eax, byte [ebx]
xor al, byte [edi + 0x5c]
and al, 1
xor byte [edi + 0x5c], al
mov cl, byte [ebx]
xor cl, byte [edi + 0x5c]
and cl, 2
xor cl, byte [edi + 0x5c]
mov byte [edi + 0x5c], cl
mov al, byte [ebx]
xor al, cl
and al, 4
xor al, cl
mov byte [edi + 0x5c], al
mov dl, byte [ebx]
xor dl, al
and dl, 8
xor dl, al
mov byte [edi + 0x5c], dl
mov cl, byte [ebx]
xor cl, dl
and cl, 0x10
xor cl, dl
mov byte [edi + 0x5c], cl
movzx eax, byte [ebx]
xor al, cl
and al, 0x20
xor al, cl
lea ecx, [edi + 0xb4]
mov byte [edi + 0x5c], al
mov eax, dword [ebx + 4]
mov dword [edi + 0x60], eax
movsd xmm0, qword [ebx + 0xc]
movsd qword [edi + 0x68], xmm0
movsd xmm0, qword [ebx + 0x14]
movsd qword [edi + 0x70], xmm0
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0x78], eax
mov eax, dword [ebx + 0x20]
mov dword [edi + 0x7c], eax
movsd xmm0, qword [ebx + 0x24]
movsd qword [edi + 0x80], xmm0
movsd xmm0, qword [ebx + 0x2c]
movsd qword [edi + 0x88], xmm0
movsd xmm0, qword [ebx + 0x34]
movsd qword [edi + 0x90], xmm0
movsd xmm0, qword [ebx + 0x3c]
movsd qword [edi + 0x98], xmm0
mov eax, dword [ebx + 0x44]
mov dword [edi + 0xa0], eax
movq xmm0, qword [esi + 0x54]
movq qword [edi + 0xa4], xmm0
mov ax, word [esi + 0x5c]
mov word [edi + 0xac], ax
mov eax, dword [ebx + 0x54]
mov dword [edi + 0xb0], eax
lea eax, [ebx + 0x58]
push eax
call dword [sym.imp.Qt5Gui.dll_public:_void___thiscall_QFont::constructor_class_QFont_const__]
mov eax, dword [ebx + 0x60]
mov dword [edi + 0xbc], eax
mov eax, dword [ebx + 0x64]
add ebx, 0xc8
mov dword [edi + 0xc0], eax
lea eax, [ebx - 0x5c]
cmp eax, dword [esp + 0x18]
jne 0x101221a0
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x31236917
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, str.hmy
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6d283ec9
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401710
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40172b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401762
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40175e
jmp 0x401750
cmp esi, eax
jae 0x401762
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401750
cmp esi, eax
jb 0x401769
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret