joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412ee0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.00410700
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x412f02
call fcn.00410c10
test byte [ebx + 0x20], 0x30
je 0x412f79
mov eax, dword [0x4dd1e0]
mov edx, eax
test eax, eax
je 0x41301f
cmp dword [eax + 0x18], 0
jne 0x412f74
mov dword [eax + 0x18], 0x4d0030
mov eax, 0x4d0030
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x412f6b
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x412f8d
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x412f5e
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x412fdf
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [edx + 0x18]
jmp 0x412f29
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x412fa1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov dword [ebx + 0x18], 0
mov eax, ebx
mov esi, dword [ebx + 4]
call fcn.004106e0
mov eax, dword [0x4dd1e0]
test eax, eax
je 0x413061
cmp dword [eax + 0x18], 0
je 0x413011
mov eax, dword [eax + 0x18]
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x412f6b
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
push edx
mov dword [ebx + 0x14], 0
call fcn.004106e0
mov eax, dword [0x4dd1e0]
mov edx, eax
test eax, eax
je 0x413085
cmp dword [eax + 0x18], 0
jne 0x413059
mov dword [eax + 0x18], 0x4d0030
mov eax, 0x4d0030
jmp 0x412fc8
call fcn.00414e40
cmp dword [eax + 0x18], 0
jne 0x413034
mov eax, dword [0x4dd1e0]
jmp 0x412f1d
mov edx, dword [0x4dd1e0]
test edx, edx
jne 0x412f74
call fcn.00414e40
mov eax, dword [eax + 0x18]
jmp 0x412f29
mov edx, dword [0x4dd1e0]
test edx, edx
je 0x41307b
mov eax, dword [edx + 0x18]
jmp 0x412fc8
call fcn.00414e40
mov edx, eax
mov eax, dword [0x4dd1e0]
cmp dword [edx + 0x18], 0
je 0x413011
test eax, eax
jne 0x412fc5
call fcn.00414e40
jmp 0x412fc5
call fcn.00414e40
cmp dword [eax + 0x18], 0
jne 0x41304f
mov eax, dword [0x4dd1e0]
jmp 0x413011
Function at 0x414ca0
Capabilities:
Print debug messages

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x34
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x414cc0
add esp, 0x34
pop ebx
pop esi
ret
lea edx, [esp + 0x2c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
sub esp, 0x1c
test eax, eax
jne 0x414d10
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x414cb1
int3
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esp], eax
call esi
sub esp, 4
mov dword [esp], ebx
call esi
sub esp, 4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
jmp 0x414d00
Function at 0x414e40
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + edx + 0x1c]
mov ecx, eax
and eax, 0xf
shr cl, 4
add eax, 0x61
add ecx, 0x41
mov byte [edx + edx + 0x4dd241], al
mov byte [edx + edx + 0x4dd240], cl
add edx, 1
cmp edx, 4
jne 0x414e53
xor eax, eax
mov edx, 0x5f
jmp 0x414e8f
movzx edx, byte [eax + str.__shmem3_winpthreads_tdm_]
mov byte [eax + 0x4dd248], dl
add eax, 1
cmp eax, 0x1a
jne 0x414e88
xor eax, eax
mov edx, 0x5f
jmp 0x414eb7
movzx edx, byte [eax + str.__shmem3_winpthreads_tdm_]
mov byte [eax + 0x4dd280], dl
add eax, 1
cmp eax, 0x19
jne 0x414eb0
mov byte [0x4dd299], 0x2d
mov dword [0x4dd29a], 0x61616161
mov dword [0x4dd29e], 0x61616161
mov dword [0x4dd2a2], 0x61616161
mov dword [0x4dd2a6], 0x61616161
mov dword [0x4dd2aa], 0x61616161
mov dword [0x4dd2ae], 0x61616161
mov dword [0x4dd2b2], 0x61616161
mov dword [0x4dd2b6], 0x61616161
mov byte [0x4dd2ba], 0
mov dword [esp + 8], 0x4dd240
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov esi, eax
test eax, eax
jne 0x4150aa
mov dword [esp], 0x4dd280
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x415000
mov edx, 0x4dd1e0
mov eax, 0x20
lea esi, [esi]
lea esi, [esi]
bt edx, eax
jae 0x414fa0
mov ecx, eax
neg ecx
mov byte [ecx + 0x4dd2ba], 0x41
sub eax, 1
jne 0x414f90
mov dword [esp], 0x4dd280
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x415099
mov dword [esp], 0x414d40
mov dword [0x4dd1e0], 0x4dd1e0
call sub.msvcrt.dll__onexit
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4dd1e0]
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, ax
mov ebp, 0x20
mov edi, 1
mov dword [esp + 8], 0x3b
mov dword [esp + 4], 0x4dd280
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
mov edx, eax
sub esp, 0xc
xor eax, eax
test edx, edx
je 0x4150ca
lea esi, [esi]
cmp byte [eax + 0x4dd29a], 0x41
jne 0x41504b
mov ecx, ebp
mov edx, edi
sub ecx, eax
shl edx, cl
or esi, edx
add eax, 1
cmp eax, 0x20
jne 0x415038
mov eax, esi
mov dword [0x4dd1e0], eax
jmp 0x41506c
cmp edx, 0x4dd1e0
je 0x414fd4
mov edx, eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x415060
cmp edx, 0x4dd1e0
je 0x414fd4
mov dword [edx + 4], 0x4dd1e0
mov dword [esp], 0x414d40
call sub.msvcrt.dll__onexit
jmp 0x414fd4
mov eax, str.failed_to_add_string_to_atom_table_n
call fcn.00414ca0
xor eax, eax
jmp 0x414ff1
mov eax, str.failed_to_to_lock_creation_mutex_n
call fcn.00414ca0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, str.failed_to_get_string_from_atom_n
call fcn.00414ca0
xor eax, eax
jmp 0x415055
Function at 0x485010
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
jmp 0x485033
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x485051
mov ecx, ebx
call fcn.00484d40
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x485028
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x4b10e0
Capabilities:
Encode data using xor

Disassembly:
dec esp
pushal
mov eax, 0x45bf57b
insb byte es:[edi], dx
mov bh, byte [ebx - 0x1b9cc49]
imul ebx, dword [ecx - 6], 0x4da8eeae
mov eax, 0xc7b433b7
out 0x30, eax
invalid
Function at 0x10001000
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x10021454]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100227c0], eax
cmp dword [ebp + 0xc], 1
jne 0x1000123b
fldz
fstp dword [ebp - 0x3f8]
fldz
fstp dword [ebp - 0x400]
fldz
fstp dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x404], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
push eax
call fcn.10007a89
add esp, 4
mov dword [ebp - 0x40c], 0
jmp 0x10001082
mov ecx, dword [ebp - 0x40c]
add ecx, 1
mov dword [ebp - 0x40c], ecx
cmp dword [ebp - 0x40c], 0xf4240
jae 0x10001102
call fcn.10007a9b
mov dword [ebp - 0x414], eax
fild dword [ebp - 0x414]
fstp dword [ebp - 0x3f8]
call fcn.10007a9b
mov dword [ebp - 0x418], eax
fild dword [ebp - 0x418]
fstp dword [ebp - 0x400]
call fcn.10007a9b
mov dword [ebp - 0x41c], eax
fild dword [ebp - 0x41c]
fstp dword [ebp - 0x408]
fld dword [ebp - 0x400]
fmul dword [ebp - 0x3f8]
fmul dword [ebp - 0x408]
fmul dword [ebp - 0x3f8]
fmul dword [ebp - 0x408]
fsub dword [ebp - 0x400]
fstp dword [ebp - 0x408]
jmp 0x10001073
mov dword [ebp - 0x410], 0
jmp 0x1000111d
mov edx, dword [ebp - 0x410]
add edx, 1
mov dword [ebp - 0x410], edx
cmp dword [ebp - 0x410], 0xf4240
jae 0x10001205
call fcn.10007a9b
mov dword [ebp - 0x420], eax
fild dword [ebp - 0x420]
fstp dword [ebp - 0x3f8]
fld dword [ebp - 0x3f8]
fcomp qword [0x1001c1a8]
fnstsw ax
test ah, 0x44
jnp 0x10001176
call fcn.10007a9b
mov dword [ebp - 0x424], eax
fild dword [ebp - 0x424]
fdiv dword [ebp - 0x3f8]
fstp dword [ebp - 0x400]
jmp 0x1000118d
call fcn.10007a9b
mov dword [ebp - 0x428], eax
fild dword [ebp - 0x428]
fstp dword [ebp - 0x400]
fld dword [ebp - 0x400]
fcomp qword [0x1001c1a8]
fnstsw ax
test ah, 0x44
jnp 0x100011bf
call fcn.10007a9b
mov dword [ebp - 0x42c], eax
fild dword [ebp - 0x42c]
fdiv dword [ebp - 0x400]
fstp dword [ebp - 0x408]
jmp 0x100011d6
call fcn.10007a9b
mov dword [ebp - 0x430], eax
fild dword [ebp - 0x430]
fstp dword [ebp - 0x408]
fld dword [ebp - 0x400]
fmul dword [ebp - 0x3f8]
fmul dword [ebp - 0x408]
fmul dword [ebp - 0x3f8]
fmul dword [ebp - 0x408]
fsub dword [ebp - 0x400]
fstp dword [ebp - 0x408]
jmp 0x1000110e
mov dword [ebp - 0x3fc], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x3fc], eax
fld dword [ebp - 0x408]
fadd qword [0x1001c1a0]
fstp dword [ebp - 0x408]
mov eax, dword [ebp - 0x3fc]
cmp eax, dword [ebp - 0x3f4]
jbe 0x1000120f
mov ecx, dword [ebp + 8]
mov dword [0x100227c4], ecx
mov byte [ebp - 0x3f0], 0
push 0x3e7
push 0
lea edx, [ebp - 0x3ef]
push edx
call fcn.10007b50
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007b40
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100031e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001b218
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x10021454]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
je 0x10003220
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x1000322c
mov al, 1
jmp 0x100033cf
mov dword [ebp - 0x10], 8
call fcn.100027b0
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.100027b0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.10002740
add esp, 8
movzx eax, al
test eax, eax
je 0x1000326f
xor al, al
jmp 0x100033cf
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.100028d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.10002b10
mov ecx, eax
call fcn.100034b0
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.10001620
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.10002b10
mov ecx, eax
call fcn.100034b0
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0x3c]
call fcn.10003ba0
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x100032ea
cmp dword [ebp - 0x6c], 1
je 0x100032f1
cmp dword [ebp - 0x6c], 3
je 0x1000338b
jmp 0x100033a3
mov eax, dword [ebp - 0x68]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.10002b10
mov ecx, eax
call fcn.100034b0
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x10003354
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.10002b10
mov ecx, eax
call fcn.100034b0
push eax
call fcn.1000816e
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x10003354
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10004cc0
mov al, byte [ebp - 0x61]
jmp 0x100033cf
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x10003377
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10004cc0
mov al, byte [ebp - 0x62]
jmp 0x100033cf
cmp dword [ebp - 0x38], 0
jne 0x10003389
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.10002910
jmp 0x100033bb
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10004cc0
mov al, byte [ebp - 0x63]
jmp 0x100033cf
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10004cc0
mov al, byte [ebp - 0x64]
jmp 0x100033cf
jmp 0x10003282
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10007b40
mov esp, ebp
pop ebp
ret

Function at 0x10007b40
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10021454]
jne 0x10007b4a
repz ret
jmp fcn.1000d78d
Function at 0x10017e5e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000c666
and dword [ebp - 4], 0
cmp dword [0x10023c00], 0
mov ebx, eax
jne 0x10017f0f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10017fc0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10017fc0
push eax
call fcn.1000c5f4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10023c00], eax
call esi
push eax
call fcn.1000c5f4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10023c04], eax
call esi
push eax
call fcn.1000c5f4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10023c08], eax
call esi
push eax
call fcn.1000c5f4
pop ecx
mov dword [0x10023c10], eax
test eax, eax
je 0x10017f0f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000c5f4
pop ecx
mov dword [0x10023c0c], eax
mov eax, dword [0x10023c0c]
cmp eax, ebx
je 0x10017f67
cmp dword [0x10023c10], ebx
je 0x10017f67
push eax
call fcn.1000c66f
push dword [0x10023c10]
mov esi, eax
call fcn.1000c66f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10017f67
test edi, edi
je 0x10017f67
call esi
test eax, eax
je 0x10017f5e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10017f5e
test byte [ebp - 0xc], 1
jne 0x10017f67
or dword [ebp + 0x10], 0x200000
jmp 0x10017fa0
mov eax, dword [0x10023c04]
cmp eax, ebx
je 0x10017fa0
push eax
call fcn.1000c66f
pop ecx
test eax, eax
je 0x10017fa0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10017fa0
mov eax, dword [0x10023c08]
cmp eax, ebx
je 0x10017fa0
push eax
call fcn.1000c66f
pop ecx
test eax, eax
je 0x10017fa0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10023c00]
call fcn.1000c66f
pop ecx
test eax, eax
je 0x10017fc0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10017fc2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401c60
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4070ec]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push 0
push 0x17
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.Autodesk
lea eax, [esp + 8]
push eax
call esi
push str.Autodesk_Application_Manager
lea eax, [esp + 8]
push eax
call esi
push str.Autodesk_Application_Manager.lnk
lea eax, [esp + 8]
push eax
call esi
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop esi
test eax, eax
je 0x401cca
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004031ce
add esp, 0x20c
ret
Function at 0x403d20
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.QtCoreADSK4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_]
add esp, 0xc
mov ecx, eax
call dword [sym.imp.QtCoreADSK4.dll_public:_class_QByteArray___thiscall_QString::toLocal8Bit_void_]
lea ecx, [esp + 0xc]
call dword [sym.imp.QtCoreADSK4.dll_public:_void___thiscall_QString::destructor_void_]
push 8
lea ecx, [esp + 4]
mov dword [esp + 0xc], 0
call fcn.00403b00
lea ecx, [esp + 4]
call dword [sym.imp.QtCoreADSK4.dll_public:_void___thiscall_QByteArray::detach_void_]
lea eax, [esp]
push eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x28]
mov eax, dword [esp + 0x10]
push dword [eax + 0xc]
push dword [esp + 0x28]
push dword [esp + 0x28]
call sub.QtCoreADSK4.dll_void___cdecl_qWinMain_struct_HINSTANCE_____struct_HINSTANCE_____char___int__int___class_QVector_char____
mov eax, dword [esp + 0x18]
add esp, 0x18
cmp dword [eax], 1
je 0x403dac
mov eax, dword [esp]
lea ecx, [esp]
push dword [eax + 4]
push dword [eax + 8]
call fcn.00403b80
mov eax, dword [esp]
push esi
add eax, 0x10
push eax
push dword [esp + 0x10]
call fcn.00402ea0
mov ecx, dword [esp + 0xc]
add esp, 8
mov esi, eax
test ecx, ecx
je 0x403de2
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x403de2
push 4
push dword [esp + 8]
call dword [sym.imp.QtCoreADSK4.dll_public:_static_void___cdecl_QVectorData::free_struct_QVectorData___int_]
add esp, 8
lea ecx, [esp + 8]
call dword [sym.imp.QtCoreADSK4.dll_public:_void___thiscall_QByteArray::destructor_void_]
mov eax, esi
pop esi
add esp, 0x10
ret 0x10
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x406a7a
Capabilities:
Encode data using xor

Disassembly:
or al, 0xd7
shl byte [esi - 0x75], cl
push eax
push es
mov dword [ecx + 0x10], edx
xor edx, edx
mov dx, word [eax + 2]
dec edx
mov dword [ecx + 0x14], edx
xor edx, edx
mov dx, word [eax]
cmp dl, ch
insb byte es:[edi], dx
cmp byte [eax], al
add byte [ecx - 0x64cce7af], cl
mov dx, word [eax + 0x5b]
mov dword [eax + 0x1451051c], eax
invalid
Function at 0x51df1c6c
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x51e89718]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
xor esi, esi
cmp eax, ebx
push 2
pop ebp
jne 0x51df1d16
call edi
mov esi, eax
cmp esi, ebx
je 0x51e347a0
mov dword [0x51e89718], 1
cmp esi, ebx
je 0x51e347c1
cmp word [esi], bx
mov eax, esi
je 0x51df1cbf
add eax, ebp
cmp word [eax], bx
jne 0x51df1cb1
add eax, ebp
cmp word [eax], bx
jne 0x51df1cb1
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x51df1d06
push ebp
call fcn.51df1d21
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x51df1d06
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
je 0x51e347ce
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
cmp eax, 1
jne 0x51e347e1
jmp 0x51df1ca2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x51e347b7
mov eax, ebp
mov dword [0x51e89718], eax
jmp 0x51df1d16
mov eax, dword [0x51e89718]
jmp 0x51df1d16
call edi
mov esi, eax
cmp esi, ebx
je 0x51e347e9
jmp 0x51df1caa
push dword [esp + 0x10]
call fcn.51e03c37
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x51df1d02
cmp eax, ebp
je 0x51e347f0
cmp eax, ebx
je 0x51e347f0
xor eax, eax
jmp 0x51df1d0f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
je 0x51e347e9
cmp byte [esi], bl
je 0x51e3480a
inc eax
cmp byte [eax], bl
jne 0x51e34800
inc eax
cmp byte [eax], bl
jne 0x51e34800
sub eax, esi
inc eax
mov ebp, eax
push ebp
call fcn.51df1d21
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x51e34820
xor edi, edi
jmp 0x51e3482b
push ebp
push esi
push edi
call fcn.51e1b6b2
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, edi
jmp 0x51df1d0f