joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c763
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push 0x14
mov eax, 0x434b9f
call fcn.0041e952
mov edi, ecx
xor ebx, ebx
cmp byte [edi + 0x46], bl
jne 0x41c77e
cmp word [edi + 0x36], bx
jbe 0x41c7cc
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x20]
call fcn.0040fbda
mov esi, eax
test esi, esi
je 0x41c7a1
push ecx
push esi
push ecx
lea ecx, [edi + 0x28]
call fcn.0041ccd2
mov eax, esi
jmp 0x41c8c9
lea esi, [edi + 0x48]
push esi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x41c7bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x41c78f
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x41c7b3
lea eax, [edi + 0x36]
cmp word [eax], bx
jbe 0x41c7ff
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x41c7b3
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
js 0x41c7ff
mov eax, 0xe0000013
jmp 0x41c8c9
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.00404554
add eax, 0x10
mov dword [ebp - 0x14], eax
push str..part
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.004036da
push ebx
xor dl, dl
lea ecx, [ebp - 0x14]
call fcn.004072a3
mov esi, dword [ebp - 0x14]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x41c857
cmp byte [edi + 0x34], 0
je 0x41c864
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41c864
lea eax, [ebp - 0x14]
push eax
call fcn.0041c8d1
mov ebx, eax
test ebx, ebx
je 0x41c864
push ecx
push ebx
push ecx
lea ecx, [edi + 0x28]
call fcn.0041ccd2
jmp 0x41c8bf
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.0041cb5d
mov ebx, eax
test ebx, ebx
jne 0x41c8bf
mov ebx, dword [ebp + 0xc]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor ebx, ebx
test eax, eax
jne 0x41c8b4
mov eax, dword [ebp + 0xc]
push ebx
push dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x41c8ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x41c857
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
push 1
lea ecx, [edi + 0x28]
call fcn.0041ccad
lea ecx, [esi - 0x10]
call fcn.004045ed
mov eax, ebx
call fcn.0041e92c
ret 8
Function at 0x41cb5d
Capabilities:
Copy file

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
mov edi, ecx
mov esi, dword [eax]
mov eax, dword [esp + 0xc]
push 2
pop ecx
mov edx, dword [eax]
xor eax, eax
cmp byte [edi + 0x24], al
cmovne eax, ecx
push eax
push 0
push edi
push 0x41cbc7
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x41cba9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [edi + 0x1e], 0
mov esi, eax
je 0x41cba5
push ecx
push esi
push ecx
mov ecx, edi
call fcn.0041ccd2
mov eax, esi
jmp 0x41cbc2
cmp byte [edi + 0x1c], 0
je 0x41cbc0
cmp byte [edi + 0x1d], 0
je 0x41cbc0
push ecx
push dword [edi + 0x20]
mov ecx, edi
call fcn.0041ccad
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x1001fe7
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x1007050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 0x2a8]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x1001528
push 0x80000001
mov dword [ebp - 0x2a8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
call fcn.01001952
push dword [0x1007f3c]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x100206d
lea eax, [ebp - 0x2bc]
push eax
push dword [0x1007f3c]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 8
lea eax, [ebp - 0x2bc]
push eax
push 3
push esi
push 0x10014f8
push dword [ebp - 0x2a8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push esi
push esi
push 0x146
mov ebx, 0xc9
push ebx
push dword [0x1007f3c]
call edi
movzx eax, ax
movzx eax, ax
xor esi, esi
inc esi
mov dword [ebp - 0x2ac], eax
cmp esi, dword [ebp - 0x2ac]
ja 0x10020ba
lea eax, [ebp - 0xa4]
push eax
lea eax, [esi - 1]
push eax
push 0x148
push ebx
push dword [0x1007f3c]
call edi
jmp 0x10020c2
and word [ebp - 0xa4], 0
push esi
push 0x10014d8
lea eax, [ebp - 0x2a4]
push 0x200
push eax
call fcn.01001f85
add esp, 0x10
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xa4]
push eax
push 1
push 0
lea eax, [ebp - 0x2a4]
push eax
push dword [ebp - 0x2a8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
inc esi
cmp esi, 0x14
jbe 0x1002097
push dword [ebp - 0x2a8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 2
push str.DIALER.HLP
push dword [0x1007f3c]
call dword [sym.imp.USER32.dll_WinHelpW]
push dword [0x1007f3c]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp - 4]
and dword [0x1007f3c], 0
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100589d
leave
ret
Function at 0x100451f
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x1007d2c]
test eax, eax
je 0x1004547
push eax
call sub.TAPI32.dll_lineClose
test eax, eax
je 0x1004540
push 0x10
push eax
push dword [0x1007f3c]
call fcn.01001b33
and dword [0x1007d2c], 0
cmp dword [0x1007120], 0
je 0x100459b
call fcn.01001952
call fcn.010040a7
test eax, eax
je 0x1004571
push 0x30
push eax
push dword [0x1007f3c]
call fcn.01001b33
jmp fcn.01001fe7
push 1
push 1
push 0
push dword [0x1007110]
call sub.TAPI32.dll_lineRegisterRequestRecipient
test eax, eax
je 0x1004594
push 0x30
push eax
push dword [0x1007f3c]
call fcn.01001b33
and dword [0x1007120], 0
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x403e32
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x64
push sym.ZSSENTSCHL.exe_procGetList
xor esi, esi
xor edi, edi
mov ecx, 0x52
push esi
dec ecx
jne 0x403e49
mov ebx, dword [ebp + 8]
mov eax, 2
call fcn.004235e0
mov ebx, dword [ebp + 8]
push 0
push 0
push 0x128
push 0x1280008
push 0
call fcn.004232a2
mov dword [ebp - 0x88], 0
mov dword [0x428550], 0
push 0
push 0xf
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
call fcn.004271a4
mov edi, eax
mov eax, 0x128
mov dword [ebp - 0x1bc], eax
lea ebx, [ebp - 0x1bc]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
call fcn.004271a4
mov esi, eax
cmp esi, 0
je 0x403f2e
inc dword [0x428550]
mov ebx, dword [ebp + 8]
push 0
mov eax, dword [0x428550]
push eax
push 0x128
push 0x1280008
push 0
call fcn.004233cc
lea ebx, [ebp - 0x1bc]
mov ecx, 0x128
call fcn.0042766e
mov ebx, dword [ebp + 8]
mov eax, dword [0x428550]
sub eax, dword [ebx + 0x18]
imul eax, eax, 0x128
add eax, dword [ebx]
mov ebx, eax
mov ecx, 0x128
call fcn.00427695
lea ebx, [ebp - 0x1bc]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
call fcn.004271a4
mov esi, eax
jmp 0x403eb9
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call fcn.004271a4
mov dword [ebp - 0x88], 0xffffffff
mov eax, dword [ebp - 0x88]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x403f6b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x64
push fcn.00403f6b
xor esi, esi
xor edi, edi
mov ecx, 0x54
push esi
dec ecx
jne 0x403f82
push 0
push 2
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
call fcn.004271a4
mov edi, eax
cmp edi, 0xffffffff
je 0x40409d
mov edx, dword [ebp + 8]
call fcn.00427847
call fcn.00424641
call fcn.00425be0
call fcn.00425c31
lea ebx, [ebp + 8]
call fcn.00426e62
mov eax, 0x128
mov dword [ebp - 0x1bc], eax
lea ebx, [ebp - 0x1bc]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
call fcn.004271a4
mov esi, eax
cmp esi, 0
je 0x40408f
lea ebx, [ebp - 0x198]
call fcn.004276e1
call fcn.00424641
call fcn.00425be0
call fcn.00425c31
lea ebx, [ebp - 0x1c4]
call fcn.00426e62
mov edx, dword [ebp - 0x1c4]
call fcn.00427847
mov edx, 0x42ecac
call fcn.0042785b
call fcn.0042631d
mov dword [ebp - 0x1c0], eax
mov edx, dword [ebp - 0x1c4]
call fcn.00427847
mov edx, 0x42ecac
call fcn.0042785b
mov eax, dword [ebp - 0x1c0]
call fcn.004263a4
mov edx, dword [ebp + 8]
call fcn.00427847
call fcn.00427102
jne 0x404073
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x88], eax
jmp 0x40408f
lea ebx, [ebp - 0x1bc]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
call fcn.004271a4
mov esi, eax
jmp 0x403fe1
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call fcn.004271a4
call fcn.00427777
mov eax, dword [ebp - 0x88]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4040bf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x64
push fcn.004040bf
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
call fcn.004271a4
mov esi, eax
mov eax, esi
test eax, eax
je 0x40411b
push 0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
call fcn.004271a4
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call fcn.004271a4
mov dword [ebp - 0x88], 0xffffffff
mov eax, dword [ebp - 0x88]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4229e4
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..data
test word cs:[0x422df6], 4
jne 0x422a00
jmp 0x422e14
jmp fcn.00422c1e
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.00422b1a
mov dword [ebx + 0x2ac], 1
lea eax, [ebx + 0x470]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x422e65
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0x2a0], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00422bc0
mov dword [ebx + 0x29c], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebx + 0x2a8], eax
call fcn.00422a05
push 0xff
jb 0x422ecf
pop eax
call fcn.00422a73
push eax
mov ebx, section..data
mov ecx, dword [ebx + 0xd8]
call fcn.00422edb
mov ecx, dword [ebx + 0xb0]
jecxz 0x422ebf
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov edi, dword [ebx + 0x2d8]
call fcn.00422a78
call fcn.00422a5f
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x422a05
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x422a5e
mov dword [ebx + 0x28c], eax
mov dword [ebx + 0x294], 0
mov dword [ebx + 0x290], 0
call fcn.00422cb1
jb 0x422a5e
mov dword [ebx + 0x290], eax
mov dword [eax + 0x58], 8
call fcn.00422a52
dec ebp
push ebx
and byte [ebx + 0x61], dl
outsb dx, byte [esi]
jae 0x422a6c
push ebx
jb 0x422ab9
add byte [esi - 4], bl
call dword [sym.imp.KERNEL32.DLL_TlsFree]
ret
or bl, ch
mov esp, 0x8d02e6c1
or al, 0x33
Function at 0x41b430
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov edx, dword [ebp + 0xc]
lea eax, [edx + 5]
push esi
cmp eax, 4
ja case.0x41b447.2
jmp dword [eax*4 + 0x41b524]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x5c]
or dword [esi + 0x68], 4
test eax, eax
je 0x41b478
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
jne 0x41b478
mov eax, dword [esi + 0x5c]
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, dword [ebp + 8]
xor eax, eax
add ecx, 0xffffffbc
cmp edx, 0xfffffffc
sete al
push eax
call fcn.0041bbd0
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x18]
lea eax, [esi + 8]
push eax
call edx
test byte [esi + 0x68], 4
je 0x41b4d8
mov eax, dword [esi + 0x5c]
and dword [esi + 0x68], 0xfffffffb
test eax, eax
je 0x41b4d8
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
je 0x41b4d8
mov eax, dword [esi + 0x5c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, str.FAIL
test edx, edx
jle 0x41b505
push 0x30e
push 0x4b12cc
call fcn.0041a980
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
push 0x31a
push str.Unrecognized_Negative_verb_in_DoVerb__.__bad.
call fcn.0041a980
add esp, 8
mov eax, 0x80004001
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x420db0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4af9fc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x420da0
call fcn.00470e57
add esp, 4
call fcn.00420c60
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x420e3e
lea ecx, [ebp - 0x20]
push ecx
push 0x499ebc
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x420e04
mov edx, dword [ebp - 0x18]
push edx
jmp 0x420e38
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0044ad30
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d6a1
mov esp, ebp
pop ebp
ret
Function at 0x4032d3
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x4032d5
ret

Function at 0x406840
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb70247
sahf
push ebx
pop ebp
or byte [edi + edx*2 - 0x7c50bc75], bl
clc
dec dword [edi]
test byte [ecx + eax + 0x4b8b0000], dl
adc byte [ebp - 0x767bf022], al
add dword [eax], eax
add byte [ebx + 0x4e8b0c74], cl
invalid

Function at 0x40a2d0
Capabilities:
Encode data using xor

Disassembly:
add byte [edx - 0x7b], ch
adc al, 0
mov esi, ebp
add al, 0xc0
adc eax, 0x8640c044
push ss
aad 0xa4
or byte [ebx + 0x57206836], cl
inc eax
add byte [eax - 0x80], ch
mov byte [0x8bae5640], al
push es
push eax
add dword [edi + edx*2 + 0x335fffff], edx
inc edi
pop esi
xor eax, edx
sahf
add bh, ch
nop
nop
cmp dword [eax - 0x6f796f70], edx
nop
nop
nop
push ebp
mov dword [0x8d39f60], eax
dec eax
mov byte [0x159dc985], al
mov dword [eax + 4], 0xffff79ff
adc dword [edx + eax*8 - 0x54ea00b0], 0xffffffc0
rol byte [eax], 0x33
rcr byte [ebx + eax*8], cl
mov eax, dword [eax + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40a26e
add ecx, dword [0x40c09835]
add bh, bh
cwde
rol byte [eax], 0xff
pop ebp
test ebp, eax
jne 0x40a244
and ch, al
ret
mov byte [ebx + 0x2945f4d1], cl
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x40a2ed
invalid

Function at 0x40123a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e8
push edi
and dword [ebp - 0xc], 0
mov byte [ebp - 0x110], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
call sub.iphlpapi.DLL_GetAdaptersInfo
mov dword [ebp - 8], eax
push 0
call sub.KERNEL32.dll_DeleteFileA
cmp dword [ebp - 4], 0
jne 0x4013f1
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp - 8]
Function at 0x401840
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa56c
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4dac40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x10]
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
lea eax, [esi + 0x14]
push eax
lea ecx, [edi + 0x14]
mov dword [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
mov eax, dword [esi + 0x6c]
mov dword [edi + 0x6c], eax
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
mov eax, dword [esi + 0x78]
mov dword [edi + 0x78], eax
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x7c], eax
mov eax, dword [esi + 0x80]
mov dword [edi + 0x80], eax
mov eax, dword [esi + 0x84]
mov dword [edi + 0x84], eax
mov eax, dword [esi + 0x88]
mov dword [edi + 0x88], eax
mov eax, dword [esi + 0x8c]
mov dword [edi + 0x8c], eax
mov eax, dword [esi + 0x90]
mov dword [edi + 0x90], eax
mov eax, dword [esi + 0x94]
mov dword [edi + 0x94], eax
mov eax, dword [esi + 0x98]
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x9c]
mov dword [edi + 0x9c], eax
mov eax, dword [esi + 0xa0]
mov dword [edi + 0xa0], eax
mov eax, dword [esi + 0xa4]
mov dword [edi + 0xa4], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4019d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa5a8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4dac40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
lea ecx, [ebx + 0x10]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [ebx + 0x14]
mov dword [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
push 0x4aeafc
lea ecx, [ebx + 0x10]
mov byte [ebp - 4], 1
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
call dword [sym.imp.Qt5Core.dll_public:_class_QString____thiscall_QString::operator_char_const__]
push 0x4aeafc
lea ecx, [ebx + 0x14]
call dword [sym.imp.Qt5Core.dll_public:_class_QString____thiscall_QString::operator_char_const__]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x84], 0
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], 0
mov dword [ebx + 0x90], 0
mov dword [ebx + 0x94], 0
mov dword [ebx + 0x98], 0
mov dword [ebx + 0x9c], 0
mov dword [ebx + 0xa0], 0
mov dword [ebx + 0xa4], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x40990f
mov eax, dword [ebp + 0x10]
cmp eax, 0xa
ja case.default.0x40988a
jmp dword [eax*4 + 0x409938]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.00409760
mov ecx, dword [ebp + 8]
pop ebp
jmp 0x4a2af0
mov ecx, dword [ebp + 8]
pop ebp
jmp 0x4a2ac0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
push dword [eax]
call fcn.004a3d20
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
push dword [eax]
call fcn.004a3da0
pop ebp
ret
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.004a2a80
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
push dword [eax]
call fcn.004a37e0
pop ebp
ret
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.004a5150
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.004a5710
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.004a5e10
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.004a3960
cmp eax, 0xa
jne case.default.0x40988a
mov eax, dword [ebp + 0x14]
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [eax]
cmp ecx, fcn.00409760
jne case.default.0x40988a
test ecx, ecx
je 0x409930
cmp dword [eax + 4], 0
jne case.default.0x40988a
mov dword [edx], 0
pop ebp
ret
push esi
mov esi, ecx
mov ecx, dword [esi + 0x44]
call dword [sym.imp.Qt5Widgets.dll_public:_bool___thiscall_QAbstractButton::isChecked_void_const]
mov ecx, dword [esi + 0x3c]
mov byte [esi + 0xc2], al
test al, al
je 0x4a2ae3
push 0
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QWidget::setEnabled_bool_]
pop esi
ret
push 1
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QWidget::setEnabled_bool_]
pop esi
ret
push esi
mov esi, ecx
mov ecx, dword [esi + 0x28]
call dword [sym.imp.Qt5Widgets.dll_public:_bool___thiscall_QAbstractButton::isChecked_void_const]
mov ecx, dword [esi + 0x34]
mov byte [esi + 0xc1], al
test al, al
je 0x4a2b13
push 0
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QWidget::setEnabled_bool_]
pop esi
ret
push 1
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QWidget::setEnabled_bool_]
pop esi
ret