joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67007060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x67006fb0
add byte [eax + 0x37], al
inc edi
dec edx
dec eax
inc ebp
xor al, 0x4e
xor al, byte [ebx + 0x7e804c4]
add byte [eax], al
add byte [eax], al
xor al, byte [edi + 0x38]
dec ecx
dec eax
inc edx
add esp, 4
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x26b0], eax
mov ecx, dword [ebp - 0x26b0]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x26d0], edx
mov eax, dword [ebp - 0x26d0]
mov dword [ebp - 0x1910], eax
push edi
push ecx
add esp, 4
sub edi, 0x10a12
out dx, eax
adc cl, byte [edx]
add dword [eax], eax
and edi, 0x118ab
jmp 0x67007002
sub edi, 0x126bf
pop edi
push edx
push edi
add esp, 4
jmp 0x67007015
add edx, 0xb320
pop edx
cmp dword [ebp - 0x1910], 0
jne 0x67007034
mov dword [ebp - 0x398], 0
jmp 0x670072f0
mov ecx, dword [ebp - 0x1910]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xeb4], eax
push eax
push esi
add esp, 4
and eax, 0x86a1
call 0x67007060
add byte [0x4e424e4d], dh
dec esp
inc edi
cmp eax, 0x4c4834e
or eax, 0x107a1
pop eax
push ebx
and ebx, 0x2922
add byte [ecx + 0x13600cb], al
add byte [ebx - 0x7d], bl
mov ebp, 0xfffff14c
add byte [ebp + 0xf], dh
mov dword [ebp - 0x398], 0
jmp 0x670072f0
push ecx
sub ecx, 0x17612
sub ecx, 0x10096
sub ecx, 0x1265c
xor ecx, 0xbfca
pop ecx
push eax
push ebx
add esp, 4
or eax, 0x7045
sub eax, 0x15b2d
sub eax, 0xd608
pop eax
mov eax, dword [ebp - 0x398]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x3ac], ecx
call dword [eax + 0x57]
add esp, 4
add eax, 0x16b87
sub eax, 0x130c6
jmp 0x67007348
pop eax
push eax
jmp 0x6700734f
pop eax
push edx
jmp 0x67007356
sub edx, 0x1518
or edx, 0xb035
add byte [eax], al
pop edx
mov dword [ebp - 0x890], 0
mov edx, dword [ebp - 0x3ac]
mov dword [ebp - 0x191c], edx
cmp dword [ebp - 0x191c], 0
jne 0x67007393
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0x5d0], eax
jmp 0x67007684
mov ecx, dword [ebp - 0x191c]
mov edx, dword [ebp - 0x3ac]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1920], edx
jne 0x670073bb
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0x5d0], eax
jmp 0x67007684
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x1920]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1924], ecx
cmp dword [ebp - 0x1924], 0
jne 0x670073ed
mov edx, dword [ebp - 0x890]
mov dword [ebp - 0x5d0], edx
jmp 0x67007684
mov eax, dword [ebp - 0x3ac]
add eax, dword [ebp - 0x1924]
mov dword [ebp - 0x884], eax
jne 0x67007412
mov ecx, dword [ebp - 0x890]
mov dword [ebp - 0x5d0], ecx
jmp 0x67007684
add byte [eax], al
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x8bc], eax

Function at 0x67007108
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edx, 0x185be
pop edx
push ecx
push esi
add esp, 4
jmp sym.Qt5Core.dll_public:_class_QPointF____thiscall_QVector_class_QPointF_::operator___int_
Function at 0x67007120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ecx, 0x13107
xor ecx, 0x54cf
pop ecx
mov ecx, dword [ebp - 0xeac]
mov dx, word [ecx]
mov word [ebp - 0x12b6], dx
mov eax, dword [ebp - 0xeac]
add eax, 2
mov dword [ebp - 0xeac], eax
mov cx, word [ebp - 0x12b6]
mov word [ebp - 0x26c], cx
mov edx, dword [ebp - 0xeb0]
mov ax, word [edx]
mov word [ebp - 0x12b8], ax
mov ecx, dword [ebp - 0xeb0]
add ecx, 2
mov dword [ebp - 0xeb0], ecx
mov dx, word [ebp - 0x12b8]
mov word [ebp - 0x140], dx
push edi
or edi, 0x163a
xor edi, 0x2524
and al, 0x25
add byte [eax], al
or edi, 0x11367
xor edi, 0x14320
pop edi
push eax
push esi
add esp, 4
add eax, 0x17c72
or eax, 0xb1c9
or eax, 0x1190d
pop eax
movzx eax, word [ebp - 0x140]
test eax, eax
jne 0x670071dc
movzx ecx, word [ebp - 0x26c]
movzx edx, word [ebp - 0x140]
sub ecx, edx
mov dword [ebp - 0x1918], ecx
jmp 0x6700723f
movzx eax, word [ebp - 0x26c]
movzx ecx, word [ebp - 0x140]
cmp eax, ecx
je 0x670070fb
movzx edx, word [ebp - 0x26c]
xor edx, 0x20
movzx eax, word [ebp - 0x140]
cmp edx, eax
je 0x670070fb
movzx ecx, word [ebp - 0x26c]
movzx edx, word [ebp - 0x140]
cmp ecx, edx
jge 0x67007229
mov dword [ebp - 0x1914], 0xffffffff
jmp 0x67007233
mov dword [ebp - 0x1914], 1
mov eax, dword [ebp - 0x1914]
mov dword [ebp - 0x1918], eax
cmp dword [ebp - 0x1918], 0
jne 0x67007288
push edi
push edi
add esp, 4
and edi, 0xc04b
add edi, 0x10533
pop edi
push eax
sub eax, 0x1730d
or eax, 0x11d88
pop eax
push esi
push eax
add esp, 4
add esi, 0x90f1
add byte [eax], al
add esi, 0x10779
pop esi
mov ecx, dword [ebp - 0x5cc]
mov dword [ebp - 0x398], ecx
jmp 0x670072f0
push edx
or edx, 0x6949
invalid
Function at 0x67007190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ecx, 0x13107
xor ecx, 0x54cf
pop ecx
mov ecx, dword [ebp - 0xeac]
mov dx, word [ecx]
mov word [ebp - 0x12b6], dx
mov eax, dword [ebp - 0xeac]
add eax, 2
mov dword [ebp - 0xeac], eax
mov cx, word [ebp - 0x12b6]
mov word [ebp - 0x26c], cx
mov edx, dword [ebp - 0xeb0]
mov ax, word [edx]
mov word [ebp - 0x12b8], ax
mov ecx, dword [ebp - 0xeb0]
add ecx, 2
mov dword [ebp - 0xeb0], ecx
mov dx, word [ebp - 0x12b8]
mov word [ebp - 0x140], dx
push edi
or edi, 0x163a
xor edi, 0x2524
and al, 0x25
add byte [eax], al
or edi, 0x11367
xor edi, 0x14320
pop edi
push eax
push esi
add esp, 4
add eax, 0x17c72
or eax, 0xb1c9
or eax, 0x1190d
pop eax
movzx eax, word [ebp - 0x140]
test eax, eax
jne 0x670071dc
movzx ecx, word [ebp - 0x26c]
movzx edx, word [ebp - 0x140]
sub ecx, edx
mov dword [ebp - 0x1918], ecx
jmp 0x6700723f
movzx eax, word [ebp - 0x26c]
movzx ecx, word [ebp - 0x140]
cmp eax, ecx
je 0x670070fb
movzx edx, word [ebp - 0x26c]
xor edx, 0x20
movzx eax, word [ebp - 0x140]
cmp edx, eax
je 0x670070fb
movzx ecx, word [ebp - 0x26c]
movzx edx, word [ebp - 0x140]
cmp ecx, edx
jge 0x67007229
mov dword [ebp - 0x1914], 0xffffffff
jmp 0x67007233
mov dword [ebp - 0x1914], 1
mov eax, dword [ebp - 0x1914]
mov dword [ebp - 0x1918], eax
cmp dword [ebp - 0x1918], 0
jne 0x67007288
push edi
push edi
add esp, 4
and edi, 0xc04b
add edi, 0x10533
pop edi
push eax
sub eax, 0x1730d
or eax, 0x11d88
pop eax
push esi
push eax
add esp, 4
add esi, 0x90f1
add byte [eax], al
add esi, 0x10779
pop esi
mov ecx, dword [ebp - 0x5cc]
mov dword [ebp - 0x398], ecx
jmp 0x670072f0
push edx
or edx, 0x6949
invalid
Function at 0x67007270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ecx, 0x13107
xor ecx, 0x54cf
pop ecx
mov ecx, dword [ebp - 0xeac]
mov dx, word [ecx]
mov word [ebp - 0x12b6], dx
mov eax, dword [ebp - 0xeac]
add eax, 2
mov dword [ebp - 0xeac], eax
mov cx, word [ebp - 0x12b6]
mov word [ebp - 0x26c], cx
mov edx, dword [ebp - 0xeb0]
mov ax, word [edx]
mov word [ebp - 0x12b8], ax
mov ecx, dword [ebp - 0xeb0]
add ecx, 2
mov dword [ebp - 0xeb0], ecx
mov dx, word [ebp - 0x12b8]
mov word [ebp - 0x140], dx
push edi
or edi, 0x163a
xor edi, 0x2524
and al, 0x25
add byte [eax], al
or edi, 0x11367
xor edi, 0x14320
pop edi
push eax
push esi
add esp, 4
add eax, 0x17c72
or eax, 0xb1c9
or eax, 0x1190d
pop eax
movzx eax, word [ebp - 0x140]
test eax, eax
jne 0x670071dc
movzx ecx, word [ebp - 0x26c]
movzx edx, word [ebp - 0x140]
sub ecx, edx
mov dword [ebp - 0x1918], ecx
jmp 0x6700723f
movzx eax, word [ebp - 0x26c]
movzx ecx, word [ebp - 0x140]
cmp eax, ecx
je 0x670070fb
movzx edx, word [ebp - 0x26c]
xor edx, 0x20
movzx eax, word [ebp - 0x140]
cmp edx, eax
je 0x670070fb
movzx ecx, word [ebp - 0x26c]
movzx edx, word [ebp - 0x140]
cmp ecx, edx
jge 0x67007229
mov dword [ebp - 0x1914], 0xffffffff
jmp 0x67007233
mov dword [ebp - 0x1914], 1
mov eax, dword [ebp - 0x1914]
mov dword [ebp - 0x1918], eax
cmp dword [ebp - 0x1918], 0
jne 0x67007288
push edi
push edi
add esp, 4
and edi, 0xc04b
add edi, 0x10533
pop edi
push eax
sub eax, 0x1730d
or eax, 0x11d88
pop eax
push esi
push eax
add esp, 4
add esi, 0x90f1
add byte [eax], al
add esi, 0x10779
pop esi
mov ecx, dword [ebp - 0x5cc]
mov dword [ebp - 0x398], ecx
jmp 0x670072f0
push edx
or edx, 0x6949
invalid
Function at 0x67007330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x67006fb0
add byte [eax + 0x37], al
inc edi
dec edx
dec eax
inc ebp
xor al, 0x4e
xor al, byte [ebx + 0x7e804c4]
add byte [eax], al
add byte [eax], al
xor al, byte [edi + 0x38]
dec ecx
dec eax
inc edx
add esp, 4
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x26b0], eax
mov ecx, dword [ebp - 0x26b0]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x26d0], edx
mov eax, dword [ebp - 0x26d0]
mov dword [ebp - 0x1910], eax
push edi
push ecx
add esp, 4
sub edi, 0x10a12
out dx, eax
adc cl, byte [edx]
add dword [eax], eax
and edi, 0x118ab
jmp 0x67007002
sub edi, 0x126bf
pop edi
push edx
push edi
add esp, 4
jmp 0x67007015
add edx, 0xb320
pop edx
cmp dword [ebp - 0x1910], 0
jne 0x67007034
mov dword [ebp - 0x398], 0
jmp 0x670072f0
mov ecx, dword [ebp - 0x1910]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xeb4], eax
push eax
push esi
add esp, 4
and eax, 0x86a1
call 0x67007060
add byte [0x4e424e4d], dh
dec esp
inc edi
cmp eax, 0x4c4834e
or eax, 0x107a1
pop eax
push ebx
and ebx, 0x2922
add byte [ecx + 0x13600cb], al
add byte [ebx - 0x7d], bl
mov ebp, 0xfffff14c
add byte [ebp + 0xf], dh
mov dword [ebp - 0x398], 0
jmp 0x670072f0
push ecx
sub ecx, 0x17612
sub ecx, 0x10096
sub ecx, 0x1265c
xor ecx, 0xbfca
pop ecx
push eax
push ebx
add esp, 4
or eax, 0x7045
sub eax, 0x15b2d
sub eax, 0xd608
pop eax
mov eax, dword [ebp - 0x398]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x3ac], ecx
call dword [eax + 0x57]
add esp, 4
add eax, 0x16b87
sub eax, 0x130c6
jmp 0x67007348
pop eax
push eax
jmp 0x6700734f
pop eax
push edx
jmp 0x67007356
sub edx, 0x1518
or edx, 0xb035
add byte [eax], al
pop edx
mov dword [ebp - 0x890], 0
mov edx, dword [ebp - 0x3ac]
mov dword [ebp - 0x191c], edx
cmp dword [ebp - 0x191c], 0
jne 0x67007393
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0x5d0], eax
jmp 0x67007684
mov ecx, dword [ebp - 0x191c]
mov edx, dword [ebp - 0x3ac]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1920], edx
jne 0x670073bb
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0x5d0], eax
jmp 0x67007684
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x1920]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1924], ecx
cmp dword [ebp - 0x1924], 0
jne 0x670073ed
mov edx, dword [ebp - 0x890]
mov dword [ebp - 0x5d0], edx
jmp 0x67007684
mov eax, dword [ebp - 0x3ac]
add eax, dword [ebp - 0x1924]
mov dword [ebp - 0x884], eax
jne 0x67007412
mov ecx, dword [ebp - 0x890]
mov dword [ebp - 0x5d0], ecx
jmp 0x67007684
add byte [eax], al
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x8bc], eax
Function at 0x670077f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x446], cl
mov edx, dword [ebp - 0xbfc]
sub edx, dword [ebp - 0x494]
mov dword [ebp - 0x19a8], edx
mov dword [ebp - 0xee8], 0
push edx
call 0x670077d3
add byte [esi + 0x3b], cl
dec esi
dec ebp
xor eax, 0x34403c49
inc edi
add esp, 4
sub edx, 0x18612
pop edx
push ecx
or ecx, 0x11609
call 0x670077f0
add byte [ebp + 0x37], al
xor eax, dword [edi + 0x39]
dec edi
add esp, 4
pop ecx
mov byte [ebp - 0xb5c], 0x56
mov byte [ebp - 0xb5b], 0x69
mov byte [ebp - 0xb5a], 0x72
mov byte [ebp - 0xb59], 0x74
mov byte [ebp - 0xb58], 0x75
mov byte [ebp - 0xb57], 0x61
mov byte [ebp - 0xb56], 0x6c
mov byte [ebp - 0xb55], 0x50
mov byte [ebp - 0xb54], 0x72
mov byte [ebp - 0xb53], 0x6f
mov byte [ebp - 0xb52], 0x74
mov byte [ebp - 0xb51], 0x65
mov byte [ebp - 0xb50], 0x63
mov byte [ebp - 0xb4f], 0x74
test dword [ecx + 0x74fffff4], esi
mov byte [ebp - 0xb4e], 0
push eax
jmp 0x67007863
add eax, 0x178d2
pop eax
push ebx
push edx
add esp, 4
xor ebx, 0x1674b
pop ebx
push ecx
xor ecx, 0x126c5
xor ecx, 0xdf46
pop ecx
push edx
push edx
add esp, 4
jmp 0x6700788e
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1f48], eax
mov ecx, dword [ebp - 0x1f48]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1f4c], edx
mov eax, dword [ebp - 0x1f4c]
mov dword [ebp - 0x1928], eax
push esi
push edx
add esp, 4
or esi, 0x1595e
add byte [ecx + 0x15ee9c6], al
add byte [ecx + 0x78e3c6], al
add byte [esi + 0x56], bl
or esi, 0x12a3e
sub esi, 0xd53c
add esi, 0xfef4
or esi, 0x829e
pop esi
cmp dword [ebp - 0x1928], 0
jne 0x67007900
mov ecx, dword [ebp - 0x1928]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xec4], eax
push ecx
or ecx, 0x11209
sub ecx, 0x10b5b
or ecx, 0xcc09
pop ecx
push esi
push eax
add esp, 4
or esi, 0x8055
add esi, 0x60c9
xor esi, 0x10012
jmp 0x67007943
pop esi
cmp dword [ebp - 0xec4], 0
jne 0x6700795c
mov dword [ebp - 0x394], 0
jmp 0x67007ba7
mov ecx, dword [ebp - 0xec4]
mov dword [ebp - 0x5d4], ecx
push esi
xor esi, 0x11ca2
add esi, 0xe37f
and esi, 0xe5a1
pop esi
push esi
or esi, 0xff95
inc dword [eax]
add byte [ecx + 0x7e4ef6], al
add byte [esi + 0x50], bl

Function at 0x67007bc0
Capabilities:
Get number of processors

Disassembly:
dec edx
inc ecx
inc esp
xor eax, 0x8104c483
add esp, 4
xor edi, 0x110ee
pop edi
push eax

Function at 0x67007bc7
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
add esp, 4
xor edi, 0x110ee
pop edi
push eax
or eax, 0x98cf
pop eax
cmp dword [ebp - 0x394], 0
jne 0x670084de
mov eax, 0x6b
mov word [ebp - 0x1ae4], ax
mov ecx, 0x65
mov word [ebp - 0x1ae2], cx
mov edx, 0x72
mov word [ebp - 0x1ae0], dx
mov eax, 0x6e
mov word [ebp - 0x1ade], ax
mov ecx, 0x65
mov word [ebp - 0x1adc], cx
mov edx, 0x6c
mov word [ebp - 0x1ada], dx
invalid
invalid

Function at 0x67007c70
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov dword [ebp - 0x1ace], edx
xor eax, eax
mov word [ebp - 0x1acc], ax
push esi
xor esi, 0x2903
pop esi
push edi
push edi
add esp, 4
xor edi, 0x108b9
sub edi, 0xe563
and edi, 0x11c64
or edi, 0x71b4
pop edi
push edi
push edx
add esp, 4
or edi, 0x3c4a
Function at 0x67007cb0
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
pop edi
mov byte [ebp - 0xafc], 0x4c
mov byte [ebp - 0xafb], 0x6f
mov byte [ebp - 0xafa], 0x61
mov byte [ebp - 0xaf9], 0x64
mov byte [ebp - 0xaf8], 0x4c
mov byte [ebp - 0xaf7], 0x69
mov byte [ebp - 0xaf6], 0x62
mov byte [ebp - 0xaf5], 0x72
mov byte [ebp - 0xaf4], 0x61

Function at 0x67008041
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [ebp - 0xaf3], 0x72
mov byte [ebp - 0xaf2], 0x79
mov byte [ebp - 0xaf1], 0x57
mov byte [ebp - 0xaf0], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1f50], ecx
mov edx, dword [ebp - 0x1f50]
mov eax, dword [edx + 0x30]
inc edx
xor byte [ecx - 0x1f537b], cl
dec dword [ebx - 0x1f5373]
dec dword [ecx - 0x193373]
call dword [eax - 0x7f]
shr ch, 0xfb
add byte [eax], al
xor eax, 0x6654
call 0x67007d4e
add byte [edi], bh
dec edx
dec esp
cmp al, 0x47
inc edi
add esp, 4
pop eax
push esi
sub esi, 0x15dc6
jmp 0x67007d5f
sub esi, 0x80ec
pop esi
cmp dword [ebp - 0x1934], 0
jne 0x67007d7e
mov dword [ebp - 0x894], 0
jmp 0x67008025
mov edx, dword [ebp - 0x1934]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xed0], ecx
push ecx
xor ecx, 0x179d6
or ecx, 0xa8ef
pop ecx
push esi
call 0x67008041
add byte [esi + 0x4e], al
inc edx
dec esi
aaa
add esp, 4
or esi, 0x15ced
xor esi, 0xc9d1
xor esi, 0x10afa
pop esi
cmp dword [ebp - 0x894], 0
jne 0x670080a1
push esi
push eax
add esp, 4
add esi, 0x15916
add esi, 0xcf69
call 0x67008080
add byte [eax], bh
dec edx
cmp edi, dword [esi]
dec edi
cmp dh, byte [ebx]
cmp al, 0x4b
add esp, 4
sub esi, 0xe322
pop esi
push edi
sub edi, 0x16a29
pop edi
mov dword [ebp - 0xbf8], 0
jmp 0x67008bc9
push eax
jmp 0x670080a7
xor eax, 0xc9f4
pop eax
push esi
push eax
add esp, 4
sub esi, 0x17c56
pop esi
push ecx
push edx
add esp, 4
add ecx, 0x10cba
jmp 0x670080cc
or ecx, 0xf156
pop ecx
mov ecx, dword [ebp - 0x894]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3d0], edx
mov dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x3d0]
dec dword [ecx - 0x197f7b]
inc dword [ebx - 0x197f43]
inc dword [eax]
invalid
Function at 0x6700887a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dword [esp + edi*8 - 1], ebp
inc dword [eax]
add byte [eax], al
add byte [edi + 0x57], dl
add esp, 4
and edi, 0x9594
call 0x67008843
add byte [esi], bh
dec ebp
dec eax
cmp dh, byte [0x3c3c3d45]
add esp, 4
pop edi
push ebx
and ebx, 0xf02c
and ebx, 0xe915
or ebx, 0x13d36
pop ebx
mov ecx, dword [ebp - 0x394]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3cc], edx
push ecx
call 0x6700887a
add byte [ecx + 0x40], cl
dec ecx
xor eax, 0x4d363d3b
dec edi
add esp, 4
add ecx, 0x4d1d
dec ebp
add byte [eax], al
and ecx, 0xce63
pop ecx
push eax
push esi
add esp, 4
add eax, 0x2b30
add eax, 0xb5f9
pop eax
mov dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x199c], eax
cmp dword [ebp - 0x199c], 0
jne 0x670088cc
mov ecx, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], ecx
jmp 0x67008bbd
mov edx, dword [ebp - 0x199c]
mov eax, dword [ebp - 0x3cc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x19a0], eax
jne 0x670088f4
mov ecx, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], ecx
jmp 0x67008bbd
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x19a0]
dec dword [ebx - 0x7687feac]
xchg ebp, eax
pop esp
out 0xff, al
inc dword [ebx - 0x19a343]
inc dword [eax]
jne 0x67008926
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], eax
jmp 0x67008bbd
mov ecx, dword [ebp - 0x3cc]
add ecx, dword [ebp - 0x19a4]
mov dword [ebp - 0x8a8], ecx
jne 0x6700894b
mov edx, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], edx
jmp 0x67008bbd
mov eax, dword [ebp - 0x8a8]
mov ecx, dword [ebp - 0x3cc]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x1f74], ecx
mov edx, dword [ebp - 0x8a8]
mov eax, dword [ebp - 0x3cc]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1f78], eax
mov ecx, dword [ebp - 0x8a8]
mov edx, dword [ebp - 0x3cc]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1f7c], edx
mov dword [ebp - 0x8ac], 0
jmp 0x670089a5
mov ecx, dword [ebp - 0x8a8]
mov edx, dword [ebp - 0x8ac]
cmp edx, dword [ecx + 0x18]
jae 0x67008bb1
mov eax, dword [ebp - 0x8ac]
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], eax
invalid
lea esp, [eax]
Function at 0x67008880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dword [esp + edi*8 - 1], ebp
inc dword [eax]
add byte [eax], al
add byte [edi + 0x57], dl
add esp, 4
and edi, 0x9594
call 0x67008843
add byte [esi], bh
dec ebp
dec eax
cmp dh, byte [0x3c3c3d45]
add esp, 4
pop edi
push ebx
and ebx, 0xf02c
and ebx, 0xe915
or ebx, 0x13d36
pop ebx
mov ecx, dword [ebp - 0x394]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3cc], edx
push ecx
call 0x6700887a
add byte [ecx + 0x40], cl
dec ecx
xor eax, 0x4d363d3b
dec edi
add esp, 4
add ecx, 0x4d1d
dec ebp
add byte [eax], al
and ecx, 0xce63
pop ecx
push eax
push esi
add esp, 4
add eax, 0x2b30
add eax, 0xb5f9
pop eax
mov dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x199c], eax
cmp dword [ebp - 0x199c], 0
jne 0x670088cc
mov ecx, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], ecx
jmp 0x67008bbd
mov edx, dword [ebp - 0x199c]
mov eax, dword [ebp - 0x3cc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x19a0], eax
jne 0x670088f4
mov ecx, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], ecx
jmp 0x67008bbd
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x19a0]
dec dword [ebx - 0x7687feac]
xchg ebp, eax
pop esp
out 0xff, al
inc dword [ebx - 0x19a343]
inc dword [eax]
jne 0x67008926
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], eax
jmp 0x67008bbd
mov ecx, dword [ebp - 0x3cc]
add ecx, dword [ebp - 0x19a4]
mov dword [ebp - 0x8a8], ecx
jne 0x6700894b
mov edx, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], edx
jmp 0x67008bbd
mov eax, dword [ebp - 0x8a8]
mov ecx, dword [ebp - 0x3cc]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x1f74], ecx
mov edx, dword [ebp - 0x8a8]
mov eax, dword [ebp - 0x3cc]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1f78], eax
mov ecx, dword [ebp - 0x8a8]
mov edx, dword [ebp - 0x3cc]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1f7c], edx
mov dword [ebp - 0x8ac], 0
jmp 0x670089a5
mov ecx, dword [ebp - 0x8a8]
mov edx, dword [ebp - 0x8ac]
cmp edx, dword [ecx + 0x18]
jae 0x67008bb1
mov eax, dword [ebp - 0x8ac]
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], eax
invalid
lea esp, [eax]

Function at 0x6700d320
Capabilities:
Encode data using xor

Disassembly:
or dword [ebx], edi
pop ecx
inc esp
push esi
cmp al, 0x47
cmp al, 0x59
push ecx
mov ebp, cs
or eax, 0x9dc68c67
stc
or byte [eax], cl
or dword [esi + 0x18], edi
ror byte [esi + 0x8080581], 1
or dword [ecx], ecx
or dword [ecx], ecx
push esp
or ecx, dword [ecx]
or dword [esi + ebx*4 + 0x808f99d], edx
xchg edx, eax
sahf
add dword [edx], eax
or byte [eax], cl
pop edx
mov cl, dl
xor al, 0x89
or cl, byte [ecx]
mov dl, dl
nop
invalid

Function at 0x6701b760
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov gs, word [ebp - 0xe]
or byte [eax], cl
pop ebx
mov cl, bl
adc eax, 0xf40909d5
invalid
Function at 0x67026ae0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x67229e23
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x67463180]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
mov dword [esi], eax
mov dword [esi + 4], 0
mov dword [esi + 8], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
lea ecx, [esi + 0xc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], ecx
mov dword [ecx], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
add ecx, 0x10
push 0
mov byte [esp + 0x18], 1
call sym.Qt5Core.dll_public:_void___thiscall_QMutex::constructor_enum_QMutex::RecursionMode_
mov dword [esi + 0x20], 0
xorps xmm0, xmm0
mov dword [esi + 0x24], 0
mov eax, esi
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [esi + 0x30], 0
movq qword [esi + 0x34], xmm0
mov dword [esi + 0x3c], 0x1000100
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x67039280
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6722b3c8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x67463180]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QCoreApplication::applicationVersion_void_
mov esi, eax
lea eax, [esp + 0x14]
mov dword [esp + 0x3c], 0
push eax
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QCoreApplication::applicationName_void_
add esp, 8
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0xa]
mov byte [esp + 0x38], 1
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x28], eax
lea eax, [esp + 0xb]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0xf], 0xa
mov byte [esp + 0xe], 0x20
mov dword [esp + 0x28], esi
call fcn.670355f0
lea eax, [esp + 0xc]
mov byte [esp + 0x38], 2
push 0
push eax
call fcn.67039040
mov eax, dword [esp + 0x14]
add esp, 8
or esi, 0xffffffff
mov ecx, dword [eax]
test ecx, ecx
je 0x67039340
cmp ecx, esi
je 0x6703934d
mov ecx, esi
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x6703934d
mov eax, dword [esp + 0xc]
push 4
push 2
push eax
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData___unsigned_int__unsigned_int_
add esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
test ecx, ecx
je 0x6703936d
cmp ecx, 0xffffffff
je 0x6703937a
mov ecx, esi
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x6703937a
mov eax, dword [esp + 0x10]
push 4
push 2
push eax
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData___unsigned_int__unsigned_int_
add esp, 0xc
mov eax, dword [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [eax]
test ecx, ecx
je 0x670393a1
cmp ecx, 0xffffffff
je 0x670393ae
lock xadd dword [eax], esi
dec esi
setne al
test al, al
jne 0x670393ae
mov eax, dword [esp + 0x14]
push 4
push 2
push eax
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData___unsigned_int__unsigned_int_
add esp, 0xc
call sym.Qt5Core.dll_void___cdecl_qt_call_post_routines_void_
push 0
call dword [0x67248344]
int3