joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67111710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6714fcb9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 8], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov ecx, sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov edx, 1
lock xadd dword [ecx], edx
mov ecx, dword [esp + 0x20]
push esi
push sym.QtCore4.dll_struct_QMetaObject_const_QSignalTransition::staticMetaObject
push eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
push eax
push ecx
mov dword [esp + 0x1c], 1
call sym.QtCore4.dll_void___cdecl_qt_qFindChildren_helper_class_QObject_const___class_QString_const___class_QRegExp_const___struct_QMetaObject_const___class_QList_void____
add esp, 0x14
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x67111790
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6714fcf9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 8], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov ecx, sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov edx, 1
lock xadd dword [ecx], edx
mov ecx, dword [esp + 0x20]
push esi
push sym.QtCore4.dll_struct_QMetaObject_const_QEventTransition::staticMetaObject
push eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
push eax
push ecx
mov dword [esp + 0x1c], 1
call sym.QtCore4.dll_void___cdecl_qt_qFindChildren_helper_class_QObject_const___class_QString_const___class_QRegExp_const___struct_QMetaObject_const___class_QList_void____
add esp, 0x14
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x67111950
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6714fd61
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call sym.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
xor eax, eax
cmp esi, eax
mov dword [esp + 0x1c], eax
je 0x671119c3
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
mov dword [esi + 8], ecx
mov eax, dword [edx]
lea ecx, [esi + 0xc]
mov dword [ecx], eax
add eax, 8
mov edx, 1
lock xadd dword [eax], edx
mov eax, dword [ecx]
test byte [eax + 0x1c], 1
jne 0x671119c1
call fcn.670f56c0
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
add dword [ecx + 0xc], 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10
Function at 0x67112730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6714ff91
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call sym.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
xor eax, eax
cmp esi, eax
mov dword [esp + 0x1c], eax
je 0x671127a4
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
mov dword [esi + 8], ecx
mov eax, dword [edx]
lea ecx, [esi + 0xc]
mov dword [ecx], eax
mov edx, 1
lock xadd dword [eax], edx
mov eax, dword [ecx]
test byte [eax + 0x10], 1
jne 0x671127a2
mov eax, dword [eax + 4]
push eax
call fcn.67003e30
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
add dword [ecx + 0xc], 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10

Function at 0x67112860
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6714fff1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call sym.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
xor eax, eax
cmp esi, eax
mov dword [esp + 0x1c], eax
je 0x671128d4
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
mov dword [esi + 8], ecx
mov eax, dword [edx]
lea ecx, [esi + 0xc]
mov dword [ecx], eax
mov edx, 1
lock xadd dword [eax], edx
mov eax, dword [ecx]
test byte [eax + 0x10], 1
jne 0x671128d2
mov eax, dword [eax + 4]
push eax
call fcn.6710f1f0
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
add dword [ecx + 0xc], 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10
Function at 0x6711d3b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x671513c3
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi], sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov eax, sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov ecx, 1
lock xadd dword [eax], ecx
xor ebp, ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
lea edi, [esi + 0xc]
mov dword [edi], eax
mov edx, eax
mov dword [esp + 0x28], ebp
mov eax, 1
lock xadd dword [edx], eax
mov dword [edi + 4], ebp
mov dword [edi + 8], ebp
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
mov dword [esp + 0x14], ecx
mov edx, 1
lock xadd dword [ecx], edx
mov eax, dword [eax]
mov dword [esp + 0x18], ebp
mov ecx, dword [eax + 8]
mov dword [esp + 0x1c], ecx
lea edx, [esp + 0x14]
push edx
mov ecx, esi
mov byte [esp + 0x2c], 2
call fcn.67058a30
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov byte [esp + 0x28], 1
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x6711d470
mov ecx, dword [esp + 0x14]
push ecx
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov dword [esp + 0x14], ecx
mov edx, 1
lock xadd dword [ecx], edx
mov eax, dword [eax]
mov dword [esp + 0x18], ebp
mov ecx, dword [eax + 8]
mov dword [esp + 0x1c], ecx
lea edx, [esp + 0x14]
push edx
mov ecx, edi
mov byte [esp + 0x2c], 3
call fcn.67058a30
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov byte [esp + 0x28], 1
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x6711d4ce
mov ecx, dword [esp + 0x14]
push ecx
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 8
Function at 0x6711d6a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67151474
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov ecx, sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov dword [esi], ecx
mov eax, ecx
mov edx, 1
lock xadd dword [eax], edx
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esp + 0x18], eax
mov dword [esi + 0xc], ecx
mov edx, ecx
mov edi, 1
lock xadd dword [edx], edi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov edi, 1
lock xadd dword [edx], edi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov edi, 1
lock xadd dword [edx], edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ecx
mov edx, 1
lock xadd dword [ecx], edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov eax, dword [esp + 0x20]
push eax
mov ecx, esi
mov byte [esp + 0x1c], 4
call sym.QtCore4.dll_public:_class_QXmlStreamEntityDeclaration____thiscall_QXmlStreamEntityDeclaration::operator_class_QXmlStreamEntityDeclaration_const__
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x6711d760
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x671514b9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esi + 0x30]
mov dword [esp + 0x14], 3
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x6711d7a8
mov edx, dword [esi + 0x30]
push edx
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov eax, dword [esi + 0x24]
mov byte [esp + 0x14], 2
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x6711d7c5
mov edx, dword [esi + 0x24]
push edx
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov eax, dword [esi + 0x18]
mov byte [esp + 0x14], 1
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x6711d7e2
mov edx, dword [esi + 0x18]
push edx
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov eax, dword [esi + 0xc]
mov byte [esp + 0x14], 0
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x6711d7ff
mov edx, dword [esi + 0xc]
push edx
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov eax, dword [esi]
mov dword [esp + 0x14], 0xffffffff
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x6711d81d
mov edx, dword [esi]
push edx
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x671203a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67151823
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, 1
test byte [esi + 0x30], al
mov dword [esp + 0x18], eax
je 0x671203e6
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x671203e6
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0xc]
call eax
mov edi, dword [esi + 0x58]
test edi, edi
je 0x671203fd
mov ecx, edi
call sym.QtCore4.dll_public:_void___thiscall_QTextDecoder::destructor_void_
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esi + 0x34]
mov byte [esp + 0x18], 0
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x6712041a
mov eax, dword [esi + 0x34]
push eax
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.6711c7d0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x67121fa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67151a83
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.671219e0
push 0x20
xor edi, edi
push 4
lea ecx, [esi + 0x34]
mov dword [esp + 0x20], edi
call sym.QtCore4.dll_public:_void___thiscall_QByteArray::constructor_int__char_
mov eax, dword [esp + 0x20]
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
and dword [esi + 0x30], 0xfffffffe
push 0x6a
mov byte [esp + 0x1c], 1
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
call sym.QtCore4.dll_public:_static_class_QTextCodec____cdecl_QTextCodec::codecForMib_int_
mov dword [esi + 0x54], eax
mov eax, esp
mov dword [eax], 1
mov ecx, dword [esi + 0x54]
mov dword [esp + 0x24], esp
call sym.QtCore4.dll_public:_class_QTextDecoder____thiscall_QTextCodec::makeDecoder_class_QFlags_enum_QTextCodec::ConversionFlag__const
and dword [esi + 0x30], 0xffffffc1
mov dword [esi + 0x58], eax
mov dword [esi + 0x50], 1
mov dword [esi + 0x5c], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x67123860
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67151c38
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [ecx]
mov dword [esp + 8], sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov eax, sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x1c], 0
call fcn.67122780
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], 0xffffffff
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x671238d5
mov eax, dword [esp + 8]
push eax
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
or dword [esi + 0x30], 4
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x67134048
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x67237378]
jne 0x67134052
repz ret
jmp fcn.671349e4

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x11694ff1
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6f2e3767
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40da10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x40da32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40da39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40da28
mov eax, 1
add ebx, ebx
jne 0x40da4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40da40
jne 0x40da5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40da40
xor ecx, ecx
sub eax, 3
jb 0x40da70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40dae2
mov ebp, eax
add ebx, ebx
jne 0x40da7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40da88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40daac
inc ecx
add ebx, ebx
jne 0x40da98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40da8d
jne 0x40daa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40da8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40dacc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40dabd
jmp 0x40da2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40dacc
add edi, ecx
jmp 0x40da2e
pop esi
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x40db2b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40dae9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd068]
or eax, eax
je 0x40db25
mov dword [ebx], eax
add ebx, 4
jmp 0x40db06
call dword [esi + 0xd078]
mov ebp, dword [esi + 0xd06c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40db5f
sub esp, 0xffffff80
jmp 0x40b1e6

Function at 0x40ae50
Capabilities:
Encode data using xor

Disassembly:
push ebp
outsd dx, dword [esi]
in al, dx
sub esp, 0xc
push ebx
push esi
mov edi, dword [edi]
adc byte [edi - 0x7d], dl
add byte ds:[edi + 0x11], dh
mov dword [esi], 0x72
pop edi
pop esi
xor eax, eax
pop ebx
leave
sbb ebx, dword [edx - 0x74ffe73e]
pop ebp
add dword [eax + 0x43], eax
xor eax, 0x7402c4f6
mov ecx, dword gs:[ecx + 0x75c0850c]
pop esi
mov ebx, esi
push 0x73
test eax, 0xd0e8ffb4
wait
dec dword cs:[ebp - 0x38]
aad 0x38
mov eax, 0x6c890478
or byte [ecx + 0x57700c78], cl
push edi
mov dword [eax + edx + 0x24], ebp
mov dword [0xa015ff0c], esp
rol byte [eax + 0x15], 0x8b
push ebx
or al, 0x89
inc edx
adc byte [ebx + 0x488b0c43], cl
adc byte [ebp - 0x74da8a37], al
jb 0x40ae58
rol byte [eax - 0x5c], 0xff
salc
test dword [esp + ecx*8], esi
or dword [edi - 0x21], ebx
mov cs, word [ebx + 0xc9b94e5]
add bh, bh
salc
rcr byte [esi + 5], cl
push ds
cld
or al, byte [eax]
pop ebx
mov esp, ebp
pop ebp
ret 0xab0c
Function at 0x10003a90
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x40
push esi
xor esi, esi
push edi
lea eax, [ebp + 0x10]
cmp ecx, esi
jle 0x10003ab9
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x30], edx
mov edx, dword [ebp + 0x14]
dec ecx
mov dword [ebp + 0xc], ecx
lea eax, [ebp + 0x18]
mov dword [ebp - 0x2c], edx
jmp 0x10003abf
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
cmp ecx, esi
jle 0x10003ad8
dec ecx
add eax, 8
mov dword [ebp + 0xc], ecx
mov edx, dword [eax - 8]
mov dword [ebp - 0x28], edx
mov edx, dword [eax - 4]
mov dword [ebp - 0x24], edx
jmp 0x10003ade
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
cmp ecx, esi
jle 0x10003af7
dec ecx
add eax, 8
mov dword [ebp + 0xc], ecx
mov edx, dword [eax - 8]
mov dword [ebp - 0x20], edx
mov edx, dword [eax - 4]
mov dword [ebp - 0x1c], edx
jmp 0x10003afd
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
cmp ecx, esi
jle 0x10003b16
dec ecx
add eax, 8
mov dword [ebp + 0xc], ecx
mov edx, dword [eax - 8]
mov dword [ebp - 0x18], edx
mov edx, dword [eax - 4]
mov dword [ebp - 0x14], edx
jmp 0x10003b1c
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
cdq
mov dword [ebp - 0x38], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 8], esp
and esp, 0xfffffff0
push 0x33
call fcn.10003b51
Function at 0x10004870
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push ebx
push esi
push edi
push 0x208
mov esi, eax
lea eax, [ebp - 0x210]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor ebx, ebx
test esi, esi
je 0x100048c1
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + esi]
test cl, cl
je 0x100048bb
movsx cx, cl
mov word [ebp + eax*2 - 0x210], cx
inc eax
cmp eax, 0x103
jb 0x100048a0
lea ebx, [ebp - 0x210]
push 0x208
lea edx, [ebp - 0x620]
push 0
push edx
call sub.msvcrt.dll_memset
xor ecx, ecx
add esp, 0xc
xor edi, edi
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x10004920
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100048e7
sub eax, edx
sar eax, 1
mov edi, eax
cmp edi, 0x104
jb 0x10004905
mov edi, 0x103
push edi
lea ecx, [ebp - 0x620]
lea eax, [edi + edi]
push ebx
push ecx
mov dword [ebp - 8], eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
mov ecx, dword [ebp - 8]
add esp, 0xc
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [ebp - 4], edx
jne 0x1000494c
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
je 0x100049c7
mov edx, eax
mov esi, dword [edx]
cmp esi, edx
je 0x100049c7
test esi, esi
je 0x100049c7
cmp word [esi + 0x24], 2
jbe 0x100049c1
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x100049c1
cmp dword [esi + 0x18], 0
je 0x100049c1
test ecx, ecx
je 0x10004974
cmp ecx, eax
jne 0x100049c1
push 0x208
lea ecx, [ebp - 0x418]
push 0
push ecx
call sub.msvcrt.dll_memset
mov edx, dword [esi + 0x30]
push edi
push edx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0x18
test ebx, ebx
je 0x100049d0
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x620]
push edx
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x100049d0
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov esi, dword [esi]
cmp esi, edx
jne 0x10004952
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100049e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call sub.msvcrt.dll_memset
xor ecx, ecx
add esp, 0xc
xor edi, edi
mov dword [ebp - 4], ecx
test ebx, ebx
je 0x10004a4d
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004a14
sub eax, edx
sar eax, 1
mov edi, eax
cmp edi, 0x104
jb 0x10004a32
mov edi, 0x103
push edi
lea edx, [ebp - 0x414]
lea ecx, [edi + edi]
push ebx
push edx
mov dword [ebp - 4], ecx
call dword [sym.imp.msvcrt.dll_wcsncpy]
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x30]
mov edx, dword [edx + 0xc]
add edx, 0xc
mov dword [ebp + 8], edx
jne 0x10004a7b
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x30]
mov eax, dword [edx + 0xc]
add eax, 0x14
mov dword [ebp + 8], eax
je 0x10004b09
mov edx, eax
push esi
mov esi, dword [edx]
cmp esi, edx
je 0x10004af7
test esi, esi
je 0x10004af7
cmp word [esi + 0x24], 2
jbe 0x10004af1
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x10004af1
cmp dword [esi + 0x18], 0
je 0x10004af1
test ecx, ecx
je 0x10004aa4
cmp ecx, eax
jne 0x10004af1
push 0x208
lea ecx, [ebp - 0x20c]
push 0
push ecx
call sub.msvcrt.dll_memset
mov edx, dword [esi + 0x30]
push edi
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0x18
test ebx, ebx
je 0x10004b00
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x10004b00
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
cmp esi, edx
jne 0x10004a82
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret