joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe4b120
Capabilities:
Hash data using crc32b

Disassembly:
cmp byte [0xeec83c], 0
jne 0xe4b272
push esi
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0xe4b13d
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0xe4b149
or eax, 0x40
shr ecx, 1
test cl, 1
je 0xe4b153
or eax, 0x20
shr ecx, 1
test cl, 1
je 0xe4b15d
or eax, 0x10
shr ecx, 1
test cl, 1
je 0xe4b167
or eax, 8
shr ecx, 1
test cl, 1
je 0xe4b171
or eax, 4
shr ecx, 1
test cl, 1
je 0xe4b17b
or eax, 2
test cl, 2
je 0xe4b183
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor esi, esi
mov dword [edx*4 + 0xeec840], ecx
mov eax, ecx
lea ecx, [esi + 0x1f]
lea esp, [esp]
test al, 1
je 0xe4b24d
mov edi, 1
shl edi, cl
or esi, edi
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0xe4b240
mov dword [edx*4 + 0xeec840], esi
inc edx
cmp edx, 0xff
jle 0xe4b131
pop edi
mov byte [0xeec83c], 1
pop esi
ret

Function at 0xe4bf60
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0xec3227
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0xee97a0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0xedde24
mov dword [edi + 0x54], 0xedaffc
lea esi, [edi + 4]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.00e10980
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], 0xedde20
call fcn.00e12900
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], 0xedc32c
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0xeecfe0]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0xe4dc50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0xec0da1
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0xee97a0]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
push edi
mov eax, dword [0xee97a0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
lea edi, [ebx + 4]
mov dword [ebx], 0xede2f8
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], 0
mov word [edi + 4], ax
mov eax, 1
add dword [0xeecc40], eax
mov dword [esp + 0x14], ebx
mov esi, ecx
xor ecx, ecx
push 0x3a
push ecx
lea edx, [esp + 0x42]
mov dword [esp + 0x88], 0
push edx
mov dword [esp + 0x1c], eax
mov word [esp + 0x44], cx
call fcn.00e733a0
movzx eax, byte [esi + 5]
movzx ecx, byte [esi + 4]
movzx edx, byte [esi + 3]
add esp, 0xc
push eax
movzx eax, byte [esi + 2]
push ecx
movzx ecx, byte [esi + 1]
push edx
movzx edx, byte [esi]
push eax
push ecx
push edx
lea eax, [esp + 0x50]
push 0xeddf48
push eax
call dword [0xec831c]
add esp, 0x20
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x3c]
call fcn.00e54260
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x24]
mov esi, 1
push edx
mov ecx, edi
mov dword [esp + 0x8c], esi
call fcn.00e02510
sub dword [0xeecc40], esi
cmp dword [esp + 0x34], 8
mov dword [esp + 0x18], 0xede2f8
jb 0xe4dd58
mov eax, dword [esp + 0x20]
push eax
call fcn.00e6b828
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00e6b567
add esp, 0x78
ret
Function at 0xe51da0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0xebf1eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0xee97a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0xec8744
call fcn.00e67c5a
push 4
mov dword [esp + 0x24], 0
call fcn.00e6b8b0
mov edi, eax
add esp, 4
test edi, edi
je 0xe51e22
call fcn.00e67acb
mov dword [edi], eax
call fcn.00e679a0
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00e67c1b
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0xe51e17
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00e67c43
jmp 0xe51e24
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0xe53e90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0xebf383
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xee97a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0xec85c8
push esi
mov dword [esp + 0x18], 1
call fcn.00e679d0
add esp, 4
cmp dword [esi + 0x30], 0x10
jb 0xe53ee1
mov eax, dword [esi + 0x1c]
push eax
call fcn.00e6b828
add esp, 4
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov dword [esi], 0xec85c0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0xe55290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xec1d60
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0xee97a0]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
mov eax, dword [0xee97a0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
push eax
lea eax, [esp + 0x30]
push eax
mov esi, ecx
call fcn.00e54770
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x5c], 0
call fcn.00e55110
push esi
lea edx, [esp + 0x10]
push edx
call fcn.00e54770
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x5c], 1
call fcn.00e55110
cmp dword [esp + 0x48], 8
mov edx, dword [esp + 0x34]
jae 0xe5530c
lea edx, [esp + 0x34]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xe55311
sub eax, esi
sar eax, 1
push edx
mov ebx, eax
mov eax, dword [esp + 0x68]
lea edx, [esp + 0x14]
call fcn.00e04670
dec dword [0xeecc40]
mov ebx, 8
mov esi, eax
mov dword [esp + 0xc], 0xede2f8
cmp dword [esp + 0x28], ebx
jb 0xe55358
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00e6b828
add esp, 4
dec dword [0xeecc40]
xor edx, edx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], dx
mov dword [esp + 0x2c], 0xede2f8
cmp dword [esp + 0x48], ebx
jb 0xe55390
mov eax, dword [esp + 0x34]
push eax
call fcn.00e6b828
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00e6b567
add esp, 0x50
ret 8
Function at 0xe63810
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0xeee240], ecx
inc edx
cmp edx, 0x100
jb 0xe63813
cmp edx, 0x800
jae 0xe638e9
lea ecx, [ecx]
mov eax, dword [edx*4 + 0xeede40]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0xeee240]
inc edx
mov dword [edx*4 + 0xeee23c], eax
cmp edx, 0x800
jb 0xe638c0
mov eax, 0xe63990
mov dword [0xeee228], eax
mov dword [0xef0240], eax
mov dword [0xeee224], 0xe63a40
call fcn.00e64840
test eax, eax
jne 0xe63915
mov dword [0xef0240], 0xe63a40
pop ecx
ret
Function at 0xe63920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x94
mov eax, dword [0xee97a0]
xor eax, esp
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0xa0]
push ebx
mov ebx, dword [esp + 0xb0]
push ebp
push esi
mov esi, dword [esp + 0xb0]
push edi
xor ebp, ebp
push ecx
lea edi, [esp + 0x2c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], ebp
call fcn.00e672a0
add esp, 4
cmp eax, ebp
jne 0xe63ab5
mov edx, dword [esp + 0xb8]
mov edi, dword [esp + 0xa8]
mov eax, 1
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x70], ebp
mov dword [esp + 0x80], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
mov ebp, dword [esp + 0xac]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x50], edx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
jmp 0xe639c0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], 0x40000
test ebp, ebp
ja 0xe639e2
jb 0xe639de
cmp edi, 0x40000
jae 0xe639e2
mov dword [esp + 0x10], edi
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
lea ecx, [esp + 0x20]
push ecx
push eax
call edx
mov esi, eax
add esp, 0xc
test esi, esi
jne 0xe63aa1
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x4c]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0xbc]
push 1
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x20]
push edx
push eax
push ecx
lea eax, [esp + 0x3c]
call fcn.00e66ef0
mov esi, eax
mov eax, dword [esp + 0x2c]
sub dword [esp + 0x24], eax
add esp, 0x14
sub edi, eax
sbb ebp, 0
test esi, esi
jne 0xe63aa1
mov ecx, dword [esp + 0x20]
cmp ecx, 1
je 0xe63a8b
mov edx, dword [esp + 0xb8]
cmp edx, dword [esp + 0x4c]
jne 0xe63a67
mov edx, edi
or edx, ebp
jne 0xe63a67
cmp ecx, 4
je 0xe63aa1
test eax, eax
jne 0xe63a71
cmp ebx, dword [esp + 0x4c]
je 0xe63a9c
push eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [eax + 4]
call eax
mov esi, eax
add esp, 8
test esi, esi
je 0xe639c0
jmp 0xe63aa1
mov ecx, dword [esp + 0xb8]
cmp ecx, dword [esp + 0x4c]
jne 0xe63a9c
or edi, ebp
je 0xe63aa1
mov esi, 1
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
push edx
push eax
mov eax, dword [eax + 4]
call eax
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00e6b567
add esp, 0x94
ret
Function at 0xe64fd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [ecx]
push edi
xor edi, edi
and esi, 7
cmp eax, 5
jae 0xe64fef
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
sub eax, 4
push ebp
lea ebp, [ebx + eax]
mov dword [esp + 0x10], ebp
lea ebx, [ebx]
lea edx, [edi + ebx]
cmp edx, ebp
jae 0xe65014
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0xe65014
inc edx
cmp edx, ebp
jb 0xe65007
mov ecx, edx
sub ecx, edi
mov eax, edx
sub eax, ebx
sub ecx, ebx
mov edi, eax
cmp edx, ebp
jae 0xe650e4
cmp ecx, 2
jbe 0xe650b3
xor esi, esi
movzx ecx, byte [edx + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0xe650d9
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
add edi, 5
mov eax, ecx
sub eax, edi
test esi, esi
je 0xe65091
and esi, 6
add esi, esi
add esi, esi
mov ebx, eax
mov ecx, esi
shr ebx, cl
inc ebx
test bl, 0xfe
jne 0xe65087
mov ebx, 0x100
shl ebx, cl
dec ebx
xor eax, ebx
sub eax, edi
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
xor esi, esi
mov ecx, eax
shr ecx, 8
mov byte [edx + 1], al
mov byte [edx + 2], cl
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
and al, 1
neg al
mov byte [edx + 3], cl
mov byte [edx + 4], al
jmp 0xe65000
shr esi, cl
test esi, esi
je 0xe65033
cmp esi, 4
ja 0xe650d9
cmp esi, 3
je 0xe650d9
mov ecx, esi
shr ecx, 1
movzx eax, byte [ecx + edx + 1]
inc eax
test al, 0xfe
jne 0xe65033
or esi, 8
shr esi, 1
inc edi
jmp 0xe65000
pop ebp
cmp ecx, 2
jbe 0xe650f9
mov edx, dword [esp + 0x18]
xor esi, esi
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x18]
shr esi, cl
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
pop ebx
pop ecx
ret
Function at 0xe690f2
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0xebf088
call fcn.00e71206
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0xe69204
cmp byte [esi + 0x42], bl
je 0xe69204
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0xe6912e
xor al, al
jmp 0xe69206
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.00e12870
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00e2f170
mov ecx, eax
call fcn.00e2f900
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00e2f170
mov ecx, eax
call fcn.00e2f900
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0xe6919e
dec eax
je 0xe691a2
dec eax
dec eax
je 0xe69200
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00e02390
mov al, bl
jmp 0xe69206
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00e2f170
mov ecx, eax
call fcn.00e2f900
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0xe691e2
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00e2f170
mov ecx, eax
call fcn.00e2f900
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00e6d164
add esp, 0x10
cmp edi, eax
jne 0xe6918c
cmp byte [esi + 0x42], 0
je 0xe69200
test edi, edi
jne 0xe6913c
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00e03900
jmp 0xe6913c
mov bl, 1
jmp 0xe6918e
mov al, 1
call fcn.00e71250
ret

Function at 0xe6a180
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0xe6a195
xor eax, eax
jmp 0xe6a20a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0xe6a1c2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0xe6a205
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0xe6a203
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0xe6a1ff
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0xe6a203
xor eax, eax
jmp 0xe6a20a
jmp 0xe6a1b9
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0xe93b80
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xa4
mov eax, dword [0xee97a0]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xb0]
push ebp
mov ebp, dword [esp + 0xb8]
push esi
mov esi, dword [esp + 0xb4]
cmp dword [esi + 0x2e8], 0
push edi
je 0xe93c52
test eax, eax
je 0xe93c52
mov eax, dword [eax + 0x9c]
test eax, eax
je 0xe93c52
lea edx, [ebx - 1]
mov ecx, 0xeccc78
cmp edx, 3
ja 0xe93c52
jmp dword [edx*4 + 0xe930fc]
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0xe93ca3
mov ecx, dword [esi + 0x134]
mov edx, dword [esp + 0xc4]
push ecx
push edx
push ebp
push ebx
push esi
call eax
add esp, 0x14
jmp 0xe93ce0
test ebx, ebx
jl 0xe93cde
cmp ebx, 2
jg 0xe93cde
mov eax, dword [esi + 0x130]
push eax
push 1
lea ecx, [ebx + ebx*2 + 0xeccc40]
push 2
push ecx
call fcn.00e6d164
mov edx, dword [esi + 0x130]
mov eax, dword [esp + 0xd4]
push edx
push 1
push eax
push ebp
call fcn.00e6d164
add esp, 0x20
xor eax, eax
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00e6b567
add esp, 0xa4
ret
Function at 0x421600
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, ecx
sub esp, 0x1c
mov eax, dword [ecx + 8]
mov dword [esp], eax
call fcn.00421430
lea edi, [eax*8]
or edi, dword [esp + 0x30]
mov ecx, 0xa
mov edx, edi
lea esi, [esi]
lea edi, [edi]
lea ebx, [edx + edx]
sar edx, 9
imul edx, edx, 0x537
xor edx, ebx
sub ecx, 1
jne 0x421630
shl edi, 0xa
or edi, edx
xor edi, 0x5412
mov eax, edi
sar eax, 0xf
test eax, eax
jne 0x4217c2
xor ebx, ebx
lea esi, [esi]
mov ecx, ebx
mov eax, edi
mov dword [esp + 4], ebx
sar eax, cl
mov dword [esp], 8
mov ecx, esi
and eax, 1
add ebx, 1
mov dword [esp + 8], eax
call fcn.00421510
sub esp, 0xc
cmp ebx, 6
jne 0x421660
mov eax, edi
mov ecx, esi
mov dword [esp + 4], 7
sar eax, 6
mov dword [esp], 8
mov ebx, 9
and eax, 1
mov ebp, 0xe
mov dword [esp + 8], eax
call fcn.00421510
mov eax, edi
sub esp, 0xc
mov ecx, esi
sar eax, 7
mov dword [esp + 4], 8
mov dword [esp], 8
and eax, 1
mov dword [esp + 8], eax
call fcn.00421510
mov eax, edi
sub esp, 0xc
mov ecx, esi
sar eax, 8
mov dword [esp + 4], 8
mov dword [esp], 7
and eax, 1
mov dword [esp + 8], eax
call fcn.00421510
sub esp, 0xc
mov ecx, ebx
mov eax, edi
mov dword [esp + 4], 8
sar eax, cl
mov ecx, esi
and eax, 1
mov dword [esp + 8], eax
mov eax, ebp
sub eax, ebx
add ebx, 1
mov dword [esp], eax
call fcn.00421510
sub esp, 0xc
cmp ebx, 0xf
jne 0x421703
xor ebx, ebx
mov ecx, ebx
mov eax, edi
mov dword [esp + 4], 8
sar eax, cl
mov ecx, esi
and eax, 1
mov dword [esp + 8], eax
mov eax, ebx
add ebx, 1
not eax
add eax, dword [esi + 4]
mov dword [esp], eax
call fcn.00421510
sub esp, 0xc
cmp ebx, 8
jne 0x421733
mov ecx, ebx
mov eax, edi
mov dword [esp], 8
sar eax, cl
mov ecx, esi
and eax, 1
mov dword [esp + 8], eax
mov eax, dword [esi + 4]
lea eax, [ebx + eax - 0xf]
add ebx, 1
mov dword [esp + 4], eax
call fcn.00421510
sub esp, 0xc
cmp ebx, 0xf
jne 0x421764
mov eax, dword [esi + 4]
mov ecx, esi
mov dword [esp + 8], 1
mov dword [esp], 8
sub eax, 8
mov dword [esp + 4], eax
call fcn.00421510
sub esp, 0xc
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [esp + 8], 0x1a7
mov dword [esp + 4], str...CADConverterqrcodegen.cpp
mov dword [esp], str.bits____15__0
call fcn.004e4040
jmp 0x42165b
Function at 0x4217f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ecx]
cmp ebx, 6
jle 0x42189e
mov ebp, ebx
mov eax, 0xc
lea esi, [esi]
lea edx, [ebp + ebp]
sar ebp, 0xb
imul ebp, ebp, 0x1f25
xor ebp, edx
sub eax, 1
jne 0x421810
shl ebx, 0xc
mov edi, ecx
or ebx, ebp
mov eax, ebx
mov dword [esp + 0x1c], ebx
sar eax, 0x12
test eax, eax
jne 0x4218b0
xor esi, esi
lea esi, [esi]
mov eax, 0xaaaaaaab
mov ecx, dword [edi + 4]
mul esi
shr edx, 1
lea eax, [edx + edx*2]
mov ebx, edx
mov edx, esi
mov dword [esp + 4], ebx
sub edx, eax
mov eax, dword [esp + 0x1c]
lea ebp, [ecx + edx - 0xb]
mov ecx, esi
add esi, 1
sar eax, cl
mov dword [esp], ebp
mov ecx, edi
and eax, 1
mov dword [esp + 8], eax
mov dword [esp + 0x18], eax
call fcn.00421510
sub esp, 0xc
mov ecx, edi
mov eax, dword [esp + 0x18]
mov dword [esp + 4], ebp
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00421510
sub esp, 0xc
cmp esi, 0x12
jne 0x421840
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x1c4
mov dword [esp + 4], str...CADConverterqrcodegen.cpp
mov dword [esp], str.bits____18__0
call fcn.004e4040
jmp 0x421838

Function at 0x4219a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, 0xfffffffe
sub esp, 0x2c
mov dword [esp + 0x18], ecx
mov eax, esi
mov edi, dword [esp + 0x44]
mov ebp, 0xfffffffe
sar eax, 0x1f
mov dword [esp + 0x1c], esi
mov ebx, eax
xor ebx, esi
add edi, esi
mov esi, ebp
mov ebp, dword [esp + 0x40]
sub ebx, eax
mov ecx, esi
mov dword [esp + 4], edi
sar ecx, 0x1f
mov eax, ecx
xor eax, esi
sub eax, ecx
mov ecx, dword [esp + 0x18]
cmp eax, ebx
cmovl eax, ebx
cmp eax, 1
setne al
movzx eax, al
mov dword [esp + 8], eax
lea eax, [esi + ebp]
add esi, 1
mov dword [esp], eax
call fcn.00421510
sub esp, 0xc
cmp esi, 3
jne 0x4219d0
mov esi, dword [esp + 0x1c]
add esi, 1
cmp esi, 3
jne 0x4219b0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x45cac0
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x20
mov eax, dword [sym.imp.Qt5Core.dll_QArrayData::shared_null]
lea edi, [esp + 0x14]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
lea eax, [ecx + 0x1c]
mov dword [esp + 4], eax
lea eax, [ecx + 0x18]
mov dword [esp], eax
call dword [method.QProcess.startDetached_QString_const__QStringList_const__QString_const__long_long_]
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
test edx, edx
je 0x45cb80
cmp edx, 0xffffffff
je 0x45cb20
lock sub dword [eax], 1
mov eax, dword [esp + 0x14]
je 0x45cb80
lea esi, [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 4], 1
mov dword [esp], 0x1f0fff
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x45cb6d
mov dword [esp + 4], 0xea60
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
mov dword [esp + 0x14], 0
je 0x45cbb4
cmp eax, 0x102
je 0x45cba0
mov dword [ebx + 0x28], 0xffffffff
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x45cb20
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
sub esp, 8
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x28], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
add esp, 0x20
pop ebx
pop esi
pop edi
ret