joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402b10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41fa00
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x428f60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0xf6
mov dword [ebp - 4], ebx
call fcn.00402f70
add esp, 4
push 0x105
mov edi, eax
call fcn.00402f70
add esp, 4
push 0xf6
push ebx
push edi
mov esi, eax
call fcn.00410810
push 0x105
push ebx
push esi
call fcn.00410810
add esp, 0x18
push edi
push 0xf5
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x402bad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Fatal:_Unable_to_get_path_to_temp_directory:__d._n
call fcn.0040edd7
add eax, 0x40
push eax
call fcn.0040f0ca
add esp, 0xc
jmp 0x402bff
push esi
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x402bcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_create_temp_file_name:__d_n
jmp 0x402b9a
push 0
push 0
push 4
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x402bf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_create_temporary_file:__d_n
jmp 0x402b9a
mov ecx, dword [ebp + 8]
push esi
call fcn.00401440
test edi, edi
je 0x402c0c
push edi
call fcn.00402f65
add esp, 4
test esi, esi
je 0x402c19
push esi
call fcn.00402f65
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ed6b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x428f60]
jne 0x40ed75
repz ret
jmp fcn.004128ff
Function at 0x41b940
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00413658
and dword [ebp - 4], 0
cmp dword [0x42c774], 0
mov ebx, eax
jne 0x41b9f1
push 0x423780
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41baa2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x423774
push edi
call esi
test eax, eax
je 0x41baa2
push eax
call fcn.004135e6
mov dword [esp], 0x423764
push edi
mov dword [0x42c774], eax
call esi
push eax
call fcn.004135e6
mov dword [esp], 0x423750
push edi
mov dword [0x42c778], eax
call esi
push eax
call fcn.004135e6
mov dword [esp], 0x423734
push edi
mov dword [0x42c77c], eax
call esi
push eax
call fcn.004135e6
pop ecx
mov dword [0x42c784], eax
test eax, eax
je 0x41b9f1
push 0x42371c
push edi
call esi
push eax
call fcn.004135e6
pop ecx
mov dword [0x42c780], eax
mov eax, dword [0x42c780]
cmp eax, ebx
je 0x41ba49
cmp dword [0x42c784], ebx
je 0x41ba49
push eax
call fcn.00413661
push dword [0x42c784]
mov esi, eax
call fcn.00413661
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41ba49
test edi, edi
je 0x41ba49
call esi
test eax, eax
je 0x41ba40
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41ba40
test byte [ebp - 0xc], 1
jne 0x41ba49
or dword [ebp + 0x10], 0x200000
jmp 0x41ba82
mov eax, dword [0x42c778]
cmp eax, ebx
je 0x41ba82
push eax
call fcn.00413661
pop ecx
test eax, eax
je 0x41ba82
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41ba82
mov eax, dword [0x42c77c]
cmp eax, ebx
je 0x41ba82
push eax
call fcn.00413661
pop ecx
test eax, eax
je 0x41ba82
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42c774]
call fcn.00413661
pop ecx
test eax, eax
je 0x41baa2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41baa4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x3eed309b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x2b97c7a
nop
nop
nop
nop
test eax, eax
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x402e36
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402e75
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402e75
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402e75
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402e75
cmp dword [ecx + 0x74], 0xe
jbe 0x402e75
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40d6d0
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
sub esp, 0x438
push ebx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push edi
call fcn.00401f80
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
test eax, eax
jne 0x431a9d
mov eax, dword [0x4a7cfc]
test eax, eax
je 0x431ab6
mov byte [esp + 0xf], 0
mov esi, 0x4a8e80
cmp eax, 1
je 0x431aca
push 0x4a7cfc
lea ecx, [esp + 0x13]
mov eax, 0x4a7d14
call fcn.0040f3b0
test al, al
je 0x431aeb
mov dl, byte [0x4a8e80]
mov bl, byte [0x4a8e81]
push 0x4a7cf8
lea eax, [esp + 0x234]
push eax
push 0x104
push 0x4a7d14
mov byte [0x4a7d00], dl
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
mov ecx, dword [0x4a7cfc]
push ecx
push 0x4a7d14
call fcn.00401440
test eax, eax
jne 0x431aff
cmp bl, 1
je 0x431b23
call fcn.004101f0
call fcn.004103e0
cmp byte [0x4a7d00], 0
jne 0x40d7a8
mov esi, 0x4a84b8
call fcn.0040e1e0
push 1
mov ecx, 0x4a7f20
call fcn.00409560
cmp byte [0x4a7d00], 0
jne 0x40d7c7
mov ecx, 0x4a84b8
call fcn.00401000
mov ebx, 0x4a8e80
call fcn.0040ebc0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
add esp, 0x438
ret
push 0x10
push 0x4846d6
push 0x4846d8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40d7dc
lea ecx, [esp + 0x20]
mov dword [0x49729c], 0xffffffff
push ecx
jmp 0x40d7d6
mov edx, dword [0x4a7d04]
push 0xffffffffffffffff
push edx
push 1
xor bl, bl
call fcn.00403e90
mov al, byte [0x497290]
mov byte [0x4a8e83], al
jmp 0x40d769
lea ecx, [esp + 0x20]
mov dword [0x49729c], 1
push ecx
jmp 0x40d7d6
mov ebx, 0x4a8e80
call fcn.0040ebc0
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov dword [0x49729c], 1
jmp 0x40d7dc
call fcn.0043604b
test al, al
jne 0x40d78b
push 0x104
lea eax, [esp + 0x234]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
cmp byte [esp + 0xf], 0
je 0x431ba4
mov edi, 0x484740
lea esi, [esp + 0x10]
call fcn.00401b70
mov edi, 0x4a7d14
mov eax, esi
call fcn.0040d330
mov edi, 0x484740
mov eax, esi
call fcn.0040d330
mov edx, dword [esp + 0x10]
push 1
lea ecx, [esp + 0x24]
push ecx
push edx
lea eax, [esp + 0x23c]
push eax
push 0x484744
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, esi
call fcn.00402620
jmp 0x40d7c7
push 1
lea ecx, [esp + 0x24]
push ecx
push edi
lea edx, [esp + 0x23c]
push edx
push 0x484744
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40d7c7
Function at 0x40f450
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10020
call fcn.00425210
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x492380]
mov dl, byte [eax + 0x492378]
mov byte [esp + eax + 0xc], cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 8
jl 0x40f460
lea eax, [esp]
push 0x4876e8
push eax
call fcn.00413990
push 4
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00410f70
add esp, 0x14
push ebx
push ebp
push esi
mov dword [esp + 0x14], 0
push edi
jmp 0x40f4b0
mov eax, dword [esp + 0x10034]
mov ecx, dword [eax]
push ecx
push 0x10000
lea edx, [esp + 0x38]
push 1
push edx
call fcn.004151b0
add esp, 0x10
cmp eax, 0x18
jl 0x40f531
mov ebp, eax
lea edi, [ebp - 0x14]
test edi, edi
jle 0x40f4fd
xor edx, edx
mov edi, edi
xor ecx, ecx
lea esi, [esp + edx + 0x30]
mov al, byte [esp + ecx + 0x1c]
cmp al, byte [esi + ecx]
je 0x40f521
cmp ecx, 0x14
je 0x42937a
inc edx
cmp edx, edi
jl 0x40f4e0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10034]
lea edx, [ecx + ebp - 0x14]
mov ecx, dword [eax]
push 1
push 0xffffffffffffffec
push ecx
mov dword [esp + 0x24], edx
call fcn.0041557c
add esp, 0xc
jmp 0x40f4b0
mov bl, byte [esp + ecx + 0x1d]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x31]
je 0x40f543
inc ecx
jmp 0x40f4ef
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10020
ret 4
mov bl, byte [esp + ecx + 0x1e]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x32]
je 0x40f555
add ecx, 2
jmp 0x40f4ef
mov bl, byte [esp + ecx + 0x1f]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x33]
jne 0x429372
mov bl, byte [esp + ecx + 0x20]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x34]
je 0x429361
add ecx, 4
jmp 0x40f4ef
add ecx, 5
cmp ecx, 0x14
jl 0x40f4e6
jmp 0x40f4ef
add ecx, 3
jmp 0x40f4ef
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x10034]
lea ecx, [eax + edx + 0x14]
mov edx, dword [esi]
push 0
push ecx
push edx
call fcn.0041557c
mov eax, dword [esi]
push eax
push 4
lea ecx, [esp + 0x24]
push 1
push ecx
call fcn.004151b0
lea edx, [esp + 0x2c]
push str..Tg
push edx
mov byte [esp + 0x38], 0
call fcn.004151d0
add esp, 0x24
neg eax
sbb eax, eax
and eax, 4
jmp 0x40f536
Function at 0x40f5e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
push ebx
push esi
mov ebx, 0x4848e8
call fcn.0040f580
mov esi, eax
lea eax, [esp + 0xa8]
push esi
push eax
call fcn.00413990
push esi
call fcn.004112ef
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.0040f6a0
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.0040f6d0
xor ebx, ebx
mov dword [edi + 8], ebx
xor ecx, ecx
mov eax, ebx
movzx edx, byte [esp + ecx + 0x18]
add eax, edx
movzx edx, byte [esp + ecx + 0x19]
add eax, edx
movzx edx, byte [esp + ecx + 0x1a]
add eax, edx
movzx edx, byte [esp + ecx + 0x1b]
add ecx, 4
add eax, edx
cmp ecx, 0x10
jl 0x40f631
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push 0x4876c8
push eax
call fcn.00414e06
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x42b2ee
push edi
call fcn.0040f450
cmp eax, ebx
je 0x42b2f8
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.00414e94
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x40f690
mov edx, dword [edi]
push edx
push 0x10
lea eax, [esp + 0x10]
push 1
push eax
call fcn.004151b0
add esp, 0x10
push 0x3f124996
push 0x10
lea ecx, [esp + 0x10]
push ecx
call fcn.0044afdc
xor eax, eax
mov dword [edi + 8], ebx
xor ecx, ecx
movzx edx, byte [esp + eax + 8]
inc eax
imul ecx, edx
cmp eax, 0x10
jl 0x42b324
mov eax, dword [edi]
push eax
mov dword [edi + 8], ecx
call fcn.00415484
add esp, 4
mov dword [edi + 4], eax
xor eax, eax
jmp 0x40f690

Function at 0x40f6a0
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.004131f0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x4103e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4972c8]
push esi
push 0
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push 0
push 0
push 0x64
push 0x12c
push SysReAllocString
push SysReAllocString
push 0xcf0000
push str.AutoIt_v3
push str.AutoIt_v3
push 0
call esi
mov ecx, dword [0x4972c8]
push 0
push ecx
push 1
push eax
push 0
push 0
push 0
push 0
push 0x50b008c4
push 0
push str.edit
push 0
mov dword [0x4972c0], eax
call esi
mov edx, dword [0x4972c0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [0x4972bc], eax
call esi
mov eax, dword [0x4972c0]
push 0
push eax
call esi
pop esi
ret

Function at 0x421fa7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x490e80]
jne 0x421fb1
repz ret
jmp fcn.00426243
Function at 0x4351d9
Capabilities:
Write file on windows

Disassembly:
mov dl, byte [esp + 8]
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x458]
mov ecx, dword [esi + 0x460]
mov byte [eax + ecx], dl
inc dword [esi + 0x460]
mov eax, dword [esi + 0x460]
cmp eax, 0x10000
jne 0x435228
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x458]
push eax
push 0x10000
push 1
push ecx
call fcn.004146ce
add esp, 0x10
mov dword [esi + 0x460], 0
pop esi
ret 8

Function at 0x4352d1
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
cmp dword [esi + 0x14], 1
jne 0x4352f7
mov eax, dword [esi + 0xc]
add eax, dword [esi + 4]
push 8
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00410f70
add esp, 0xc
jmp 0x43530c
mov edx, dword [esi + 0x1c]
push edx
push 8
lea eax, [esp + 0xc]
push 1
push eax
call fcn.004151b0
add esp, 0x10
movzx ecx, byte [esp + 8]
movzx edx, byte [esp + 9]
movzx eax, byte [esp + 0xa]
add dword [esi + 0xc], 8
shl ecx, 8
or ecx, edx
movzx edx, byte [esp + 0xb]
shl ecx, 8
or ecx, eax
mov eax, dword [esp + 0x14]
shl ecx, 8
or ecx, edx
mov dword [eax], ecx
lea ecx, [esp + 4]
push str..Tg
push ecx
mov byte [esp + 0x10], 0
call fcn.004151d0
add esp, 8
neg eax
sbb eax, eax
neg eax
pop esi
add esp, 8
ret 8

Function at 0x4353b4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x4a72e8], eax
mov edx, 1
mov eax, 0x4a72e8
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x4a7ca4
jl 0x4353c8
mov dword [0x49223c], 1
mov dword [0x4a7cb8], 1
pop edi
ret

Function at 0x436272
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [esp + 0x30]
push edi
test esi, esi
jl 0x436322
jne 0x436293
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
pop edi
pop esi
add esp, 0x28
ret
cmp esi, 0xf
jae 0x43631b
mov edi, dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
lea eax, [esp + 0x18]
push eax
call edi
test eax, eax
je 0x43631b
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceFrequency]
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea edx, [esp + 0x10]
push edx
call edi
fnstcw word [esp + 0x34]
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
sbb ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
fild qword [esp + 0x20]
movzx eax, word [esp + 0x34]
fild qword [esp + 0x28]
or eax, 0xc00
mov dword [esp + 8], eax
fdivp st(1)
fmul qword [0x48c548]
fldcw word [esp + 8]
fistp qword [esp + 8]
mov edx, dword [esp + 8]
fldcw word [esp + 0x34]
cmp edx, esi
jb 0x4362b8
pop edi
pop esi
add esp, 0x28
ret
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
pop edi
pop esi
add esp, 0x28
ret
Function at 0x4523ce
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x430
push ebx
push ebp
push esi
mov esi, dword [esp + 0x440]
push edi
xor ebp, ebp
mov eax, dword [esi]
push eax
push 4
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.004151b0
add esp, 0x10
push 0x8ab5826c
push 4
lea edx, [esp + 0x1c]
push edx
call fcn.0044afdc
lea eax, [esp + 0x14]
push 0x487704
push eax
mov byte [esp + 0x20], 0
call fcn.004151d0
add esp, 8
test eax, eax
jne 0x452562
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x18]
push 4
push edx
inc ebp
call fcn.004151b0
mov edi, dword [esp + 0x20]
mov eax, dword [esi]
push eax
xor edi, 0x64b6027e
lea ebx, [edi + edi]
push ebx
lea ecx, [esp + 0x38]
push 1
push ecx
call fcn.004151b0
add esp, 0x20
add edi, 0xbac99da3
push edi
push ebx
lea edx, [esp + 0x28]
push edx
call fcn.0044afdc
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x234]
xor eax, eax
push edx
mov word [esp + ebx + 0x28], ax
call fcn.00411691
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x20]
push 4
push ecx
call fcn.004151b0
mov edi, dword [esp + 0x28]
mov edx, dword [esi]
push edx
xor edi, 0x3a812161
lea ebx, [edi + edi]
push ebx
lea eax, [esp + 0x40]
push 1
push eax
call fcn.004151b0
add esp, 0x28
add edi, 0xa4c53cf
push edi
push ebx
lea ecx, [esp + 0x28]
push ecx
call fcn.0044afdc
mov ecx, dword [esp + 0x44c]
lea eax, [esp + 0x20]
push eax
xor edx, edx
push ecx
mov word [esp + ebx + 0x28], dx
call fcn.00411691
mov edi, dword [esp + 0x450]
lea edx, [esp + 0x238]
push edi
push edx
call fcn.004133e4
add esp, 0x10
test eax, eax
je 0x452553
push 0x4876f8
push edi
call fcn.004133e4
add esp, 8
test eax, eax
jne 0x452510
test ebp, ebp
je 0x452553
mov eax, dword [esi]
push 1
push 1
push eax
call fcn.0041557c
mov ecx, dword [esi]
add esp, 0xc
push ecx
push 1
lea edx, [esp + 0x24]
push 4
push edx
call fcn.004151b0
mov eax, dword [esp + 0x2c]
xor eax, 0x87bc
mov dword [esp + 0x2c], eax
add eax, 0x18
push 1
push eax
mov eax, dword [esi]
push eax
call fcn.0041557c
add esp, 0x1c
jmp 0x4523e1
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 0x430
ret 0xc
Function at 0x452574
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x694
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x6ac]
push esi
mov esi, dword [esp + 0x6a4]
mov edx, dword [esi + 4]
push edi
xor eax, eax
push ebx
mov word [esp + 0x50], ax
mov eax, dword [esi]
push edx
xor ecx, ecx
push eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov word [esp + 0x262], cx
mov dword [esp + 0x488], ebx
mov dword [esp + 0x2c], 1
call fcn.0041557c
mov edx, dword [esp + 0x6b8]
add esp, 0xc
lea ecx, [esp + 0x490]
push ecx
push edx
push esi
call fcn.004523ce
test eax, eax
je 0x45260c
lea eax, [ebx + 6]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x694
ret 0x10
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x1f]
push 1
push ecx
call fcn.004151b0
mov edx, dword [esi]
push edx
push 1
lea eax, [esp + 0x30]
push 4
push eax
call fcn.004151b0
mov ecx, dword [esi]
mov edi, dword [esp + 0x38]
push ecx
push 1
lea edx, [esp + 0x40]
push 4
push edx
xor edi, 0x87bc
call fcn.004151b0
mov ecx, dword [esi]
mov eax, dword [esp + 0x48]
push ecx
push 1
lea edx, [esp + 0x50]
xor eax, 0x87bc
push 4
push edx
mov dword [ebp], eax
call fcn.004151b0
mov eax, dword [esp + 0x58]
add esp, 0x40
xor eax, 0xa685
push 1
mov dword [esp + 0x28], eax
mov eax, dword [esi]
push 0x10
push eax
call fcn.0041557c
mov ecx, dword [ebp]
add esp, 0xc
push ecx
call fcn.004138ba
add esp, 4
push edi
mov dword [esp + 0x20], eax
call fcn.004138ba
mov edx, dword [esi]
add esp, 4
push edx
push 1
mov ebp, eax
push edi
push ebp
call fcn.004151b0
mov eax, dword [esi + 8]
add esp, 0x10
add eax, 0x365a8a67
push eax
push edi
push ebp
call fcn.0044afdc
push edi
push ebp
lea ecx, [esp + 0x28]
push ecx
call fcn.0043535d
mov edx, dword [esp + 0x24]
cmp edx, dword [esp + 0x20]
je 0x4526fd
mov eax, dword [esp + 0x1c]
push eax
call fcn.00413a88
add esp, 4
push ebp
call fcn.00413a88
add esp, 4
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x694
ret 0x10
cmp byte [esp + 0x17], 1
jne 0x45275b
xor ecx, ecx
mov eax, 1
mov word [esp + 0x4c], cx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
xor edx, edx
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov word [esp + 0x25a], dx
mov dword [esp + 0x480], ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], eax
call fcn.0044b195
push ebp
call fcn.00413a88
jmp 0x452769
mov edx, dword [esp + 0x1c]
push edx
call fcn.00413a88
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x6b4]
mov ecx, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebp
mov dword [eax], ecx
xor eax, eax
pop ebx
add esp, 0x694
ret 0x10
Function at 0x1000bbb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100103d3
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push edi
mov eax, dword [0x10017188]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0
call dword [sym.imp.QtCoreADSK4.dll_public:_void___thiscall_QBuffer::constructor_class_QObject__]
push ecx
mov eax, esp
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 1
mov dword [eax], 3
call dword [sym.imp.QtCoreADSK4.dll_public_virtual:_bool___thiscall_QBuffer::open_class_QFlags_enum_QIODevice::OpenModeFlag__]
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
cdq
push edx
push eax
push dword [ecx + 0xc]
lea ecx, [esp + 0x1c]
call dword [sym.imp.QtCoreADSK4.dll_public:_long_long___int64____thiscall_QIODevice::write_char_const___long_long___int64__]
lea ecx, [esp + 0x10]
push 0
push 0
call dword [sym.imp.QtCoreADSK4.dll_public_virtual:_bool___thiscall_QBuffer::seek_long_long___int64__]
push dword [esp + 0x30]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x30]
mov ecx, edi
call sym.qjson0.dll_public:_class_QVariant___thiscall_QJson::Parser::parse_class_QIODevice___bool__
lea ecx, [esp + 0x10]
mov dword [esp + 8], 1
mov byte [esp + 0x20], 0
call dword [sym.imp.QtCoreADSK4.dll_public_virtual:_void___thiscall_QBuffer::destructor_void_]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x1c
ret 0xc