joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67059900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6713cc61
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov eax, sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [esp + 0x28]
push edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call sym.QtCore4.dll_public:_class_QString____thiscall_QString::operator_class_QChar_
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
push eax
push ecx
lea edx, [esp + 0x14]
push edx
push edi
mov ecx, esi
call sym.QtCore4.dll_public:_class_QString___thiscall_QString::arg_class_QString_const___int__class_QChar_const__
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], 1
mov byte [esp + 0x1c], 0
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x670599b9
mov eax, dword [esp + 0xc]
test byte [eax + 0x10], 8
mov esi, eax
je 0x670599b0
mov ecx, dword [0x672374d0]
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], eax
call fcn.670586e0
push esi
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10

Function at 0x670599d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6713cca1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov eax, sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov ecx, 1
lock xadd dword [eax], ecx
movzx dx, byte [esp + 0x2c]
push ecx
mov eax, esp
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 1
mov dword [esp + 0x18], esp
mov word [eax], dx
call sym.QtCore4.dll_public:_class_QString____thiscall_QString::operator_class_QChar_
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
push eax
push ecx
lea edx, [esp + 0x14]
push edx
push edi
mov ecx, esi
call sym.QtCore4.dll_public:_class_QString___thiscall_QString::arg_class_QString_const___int__class_QChar_const__
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], 1
mov byte [esp + 0x20], 0
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x67059a94
mov eax, dword [esp + 0xc]
test byte [eax + 0x10], 8
mov esi, eax
je 0x67059a8b
mov ecx, dword [0x672374d0]
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], eax
call fcn.670586e0
push esi
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0x10
Function at 0x670606d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6713d5b9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, ecx
xor edi, edi
mov dword [esp + 0x1c], edi
mov ebx, dword [esp + 0x30]
mov dword [ebx], sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov eax, sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov ecx, 1
lock xadd dword [eax], ecx
mov ecx, dword [ebp]
mov esi, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov edx, dword [esp + 0x34]
mov eax, dword [edx]
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x3c]
push ecx
push edx
mov edx, dword [esp + 0x1c]
push eax
push edi
push esi
push edx
mov dword [esp + 0x40], edi
mov dword [esp + 0x34], 1
call fcn.67057450
mov esi, eax
add esp, 0x18
cmp esi, 0xffffffff
je 0x67060814
lea ecx, [ecx]
cmp edi, esi
jne 0x6706076b
cmp dword [esp + 0x38], 0
jne 0x670607c8
mov eax, esi
sub eax, edi
push eax
push edi
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebp
call sym.QtCore4.dll_public:_class_QString___thiscall_QString::mid_int__int_
push eax
mov ecx, ebx
mov dword [esp + 0x2c], 1
call fcn.670302f0
mov edx, dword [esp + 0x18]
mov byte [esp + 0x28], 0
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x670607c8
mov eax, dword [esp + 0x18]
test byte [eax + 0x10], 8
mov edi, eax
je 0x670607bf
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [0x672374d0]
mov dword [esp + 0x18], eax
call fcn.670586e0
push edi
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov edx, dword [esp + 0x34]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
lea edi, [ecx + esi]
xor edx, edx
test ecx, ecx
mov esi, ecx
mov ecx, dword [ebp]
mov ebx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
sete dl
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x3c]
push ecx
push esi
push eax
add edx, edi
push edx
mov edx, dword [esp + 0x24]
push ebx
push edx
call fcn.67057450
mov ebx, dword [esp + 0x48]
mov esi, eax
add esp, 0x18
cmp esi, 0xffffffff
jne 0x67060760
mov eax, dword [ebp]
cmp edi, dword [eax + 8]
jne 0x67060823
cmp dword [esp + 0x38], 0
jne 0x6706087d
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x3c]
push ecx
mov ecx, ebp
call sym.QtCore4.dll_public:_class_QString___thiscall_QString::mid_int__int_
push eax
mov ecx, ebx
mov dword [esp + 0x2c], 2
call fcn.670302f0
mov edx, dword [esp + 0x34]
mov byte [esp + 0x28], 0
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x6706087d
mov eax, dword [esp + 0x34]
test byte [eax + 0x10], 8
mov esi, eax
je 0x67060874
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [0x672374d0]
mov dword [esp + 0x40], eax
call fcn.670586e0
push esi
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x670608a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6713d609
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, ecx
xor edi, edi
mov dword [esp + 0x18], edi
mov ebx, dword [esp + 0x30]
mov dword [ebx], sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov eax, sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [esp + 0x3c]
mov eax, dword [ebp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
push edx
mov edx, dword [esp + 0x38]
movzx edx, word [edx]
push edx
push eax
xor eax, eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x24], 1
call fcn.67057200
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x670609b7
nop
cmp edi, esi
jne 0x6706092b
cmp dword [esp + 0x38], 0
jne 0x67060988
mov eax, esi
sub eax, edi
push eax
push edi
lea ecx, [esp + 0x1c]
push ecx
mov ecx, ebp
call sym.QtCore4.dll_public:_class_QString___thiscall_QString::mid_int__int_
push eax
mov ecx, ebx
mov dword [esp + 0x2c], 1
call fcn.670302f0
mov edx, dword [esp + 0x14]
mov byte [esp + 0x28], 0
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x67060988
mov eax, dword [esp + 0x14]
test byte [eax + 0x10], 8
mov edi, eax
je 0x6706097f
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [0x672374d0]
mov dword [esp + 0x20], eax
call fcn.670586e0
push edi
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov edx, dword [esp + 0x3c]
mov eax, dword [ebp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
push edx
mov edx, dword [esp + 0x38]
movzx edx, word [edx]
push edx
lea edi, [esi + 1]
push eax
mov eax, edi
call fcn.67057200
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x67060920
mov eax, dword [ebp]
cmp edi, dword [eax + 8]
jne 0x670609c6
cmp dword [esp + 0x38], 0
jne 0x67060a20
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x44]
push ecx
mov ecx, ebp
call sym.QtCore4.dll_public:_class_QString___thiscall_QString::mid_int__int_
push eax
mov ecx, ebx
mov dword [esp + 0x2c], 2
call fcn.670302f0
mov edx, dword [esp + 0x3c]
mov byte [esp + 0x28], 0
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x67060a20
mov eax, dword [esp + 0x3c]
test byte [eax + 0x10], 8
mov esi, eax
je 0x67060a17
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [0x672374d0]
mov dword [esp + 0x38], eax
call fcn.670586e0
push esi
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x670624e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6713d8cb
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x24]
mov dword [esi], eax
mov dword [esi + 4], sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov ecx, sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov edx, 1
lock xadd dword [ecx], edx
mov eax, dword [esp + 0x30]
test eax, eax
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0
mov dword [esi + 8], ebp
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 0
je 0x67062559
cmp dword [esp + 0x34], edi
jb 0x67062559
and dword [esi + 0x14], 0xfffffffe
mov dword [esi + 0x18], eax
jmp 0x67062573
push edi
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
mov dword [esi + 0x18], eax
jne 0x6706256f
call sym.QtCore4.dll_void___cdecl_qBadAlloc_void_
or dword [esi + 0x14], 1
mov eax, dword [esi + 0x18]
mov ecx, dword [esi]
push eax
push edi
push ebp
push ecx
call fcn.67062220
add esp, 0x10
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 0x14

Function at 0x67063130
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 8
jle 0x67063142
mov dword [esp + 8], eax
jmp sym.QtCore4.dll_void____cdecl_qMallocAligned_unsigned_int__unsigned_int_
mov ecx, dword [esp + 4]
push ecx
call sym.QtCore4.dll_void____cdecl_qMalloc_unsigned_int_
add esp, 4
ret
Function at 0x67063a30
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, ebx
je 0x67063b24
mov esi, dword [ecx + 0x1c]
test esi, esi
je 0x67063b24
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x67063b24
mov eax, dword [esi + 0x18]
cmp eax, 2
je 0x67063b24
cmp eax, 1
jne 0x67063a78
cmp dword [esi + 4], 0x2a
jne 0x67063b24
test eax, eax
je 0x67063a91
mov eax, dword [ecx + 0x30]
push ebx
push ebp
push eax
call sym.QtCore4.dll_adler32
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov dword [ecx + 0x30], eax
cmp ebx, 3
jb 0x67063b1d
mov eax, dword [esi + 0x2c]
add eax, 0xfffffefa
cmp ebx, eax
jbe 0x67063aac
mov edi, eax
sub ebx, edi
add ebp, ebx
mov edx, dword [esi + 0x38]
push edi
push ebp
push edx
call fcn.67134076
mov edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x6c], edi
mov dword [esi + 0x5c], edi
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
add esp, 0xc
xor edx, edx
mov dword [esi + 0x48], eax
add edi, 0xfffffffd
nop
mov ebx, dword [esi + 0x48]
mov ecx, dword [esi + 0x58]
mov eax, dword [esi + 0x38]
movzx eax, byte [eax + edx + 2]
mov ebp, dword [esi + 0x40]
shl ebx, cl
mov ecx, dword [esi + 0x44]
xor eax, ebx
and eax, dword [esi + 0x54]
mov ebx, dword [esi + 0x34]
mov dword [esi + 0x48], eax
mov ax, word [ecx + eax*2]
and ebx, edx
mov word [ebp + ebx*2], ax
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2], dx
add edx, 1
cmp edx, edi
jbe 0x67063ae0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
ret

Function at 0x670657d0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x6706582a
cmp byte [esi + 0x5c], 0x77
jne 0x6706582a
cmp dword [esi + 0x10], 0
jne 0x67065815
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
cmp eax, 0x4000
je 0x6706580e
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x10], 0x4000
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
push esi
call sym.QtCore4.dll_deflateParams
add esp, 0xc
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x67065840
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
jne 0x67065896
cmp dword [esi + 4], 0
jne 0x6706589f
call dword [sym.imp.MSVCR80.dll__errno]
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
test eax, eax
mov dword [esi + 4], eax
jne 0x6706589a
mov edx, dword [esi + 0x40]
push edx
mov dword [esi + 0x3c], 1
call dword [sym.imp.MSVCR80.dll_ferror]
add esp, 4
test eax, eax
je 0x67065896
mov dword [esi + 0x38], 0xffffffff
or eax, 0xffffffff
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
add dword [esi + 4], 0xffffffff
mov cl, byte [eax]
add eax, 1
mov dword [esi], eax
movzx eax, cl
ret
Function at 0x670658b0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, eax
push edi
mov edi, dword [esi + 4]
cmp edi, 2
jae 0x67065928
test edi, edi
je 0x670658c9
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov dl, byte [eax]
mov byte [ecx], dl
call dword [sym.imp.MSVCR80.dll__errno]
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, edi
push eax
mov eax, dword [esi + 0x44]
mov edx, 0x4000
sar edx, cl
add eax, edi
push edx
push 1
push eax
call dword [sym.imp.MSVCR80.dll_fread]
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x67065912
mov ecx, dword [esi + 0x40]
push ecx
call dword [sym.imp.MSVCR80.dll_ferror]
add esp, 4
test eax, eax
je 0x67065912
mov dword [esi + 0x38], 0xffffffff
add dword [esi + 4], edi
mov eax, dword [esi + 4]
cmp eax, 2
mov edx, dword [esi + 0x44]
mov dword [esi], edx
jae 0x67065928
pop edi
mov dword [esi + 0x58], eax
pop esi
ret
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x670659fe
cmp byte [eax + 1], 0x8b
jne 0x670659fe
add dword [esi + 4], 0xfffffffe
add eax, 2
push ebx
mov dword [esi], eax
call fcn.67065840
mov edi, eax
call fcn.67065840
cmp edi, 8
mov ebx, eax
jne 0x670659f3
test bl, 0xe0
jne 0x670659f3
mov edi, 6
lea esp, [esp]
call fcn.67065840
sub edi, 1
jne 0x67065970
test bl, 4
je 0x670659a3
call fcn.67065840
mov edi, eax
call fcn.67065840
shl eax, 8
add edi, eax
mov eax, edi
sub edi, 1
test eax, eax
je 0x670659a3
call fcn.67065840
cmp eax, 0xffffffff
jne 0x67065990
test bl, 8
je 0x670659b6
call fcn.67065840
test eax, eax
je 0x670659b6
cmp eax, 0xffffffff
jne 0x670659a8
test bl, 0x10
je 0x670659ce
jmp 0x670659c0
call fcn.67065840
test eax, eax
je 0x670659ce
cmp eax, 0xffffffff
jne 0x670659c0
test bl, 2
je 0x670659e2
mov edi, 2
call fcn.67065840
sub edi, 1
jne 0x670659d8
mov ecx, dword [esi + 0x3c]
neg ecx
sbb ecx, ecx
pop ebx
and ecx, 0xfffffffd
pop edi
mov dword [esi + 0x38], ecx
pop esi
ret
pop ebx
pop edi
mov dword [esi + 0x38], 0xfffffffd
pop esi
ret
pop edi
mov dword [esi + 0x58], 1
pop esi
ret
Function at 0x67065ac0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x67065b6c
cmp byte [esi + 0x5c], 0x77
jne 0x67065b6c
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], ebx
je 0x67065b4f
push edi
mov edi, dword [sym.imp.MSVCR80.dll_fwrite]
cmp dword [esi + 0x10], 0
jne 0x67065b17
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call edi
add esp, 0x10
cmp eax, 0x4000
jne 0x67065b47
mov dword [esi + 0x10], eax
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x10]
add dword [esi + 0x64], edx
add dword [esi + 0x68], eax
push 0
push esi
call sym.QtCore4.dll_deflate
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x10]
sub dword [esi + 0x64], ecx
sub dword [esi + 0x68], edx
add esp, 8
test eax, eax
mov dword [esi + 0x38], eax
jne 0x67065b4e
test ecx, ecx
jne 0x67065af0
jmp 0x67065b4e
mov dword [esi + 0x38], 0xffffffff
pop edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x4c]
push ebx
push eax
push ecx
call sym.QtCore4.dll_crc32
add esp, 0xc
mov dword [esi + 0x4c], eax
mov eax, ebx
sub eax, dword [esi + 4]
pop ebx
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x67065c80
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x67065d37
cmp byte [esi + 0x5c], 0x77
jne 0x67065d37
mov dword [esi + 4], ebx
push edi
lea esp, [esp]
mov edi, 0x4000
sub edi, dword [esi + 0x10]
je 0x67065ccf
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
push eax
push edi
push 1
push ecx
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
cmp eax, edi
jne 0x67065d2d
mov edx, dword [esi + 0x48]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x4000
test ebx, ebx
jne 0x67065d1b
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push ecx
push esi
call sym.QtCore4.dll_deflate
mov ecx, dword [esi + 0x10]
sub dword [esi + 0x68], ecx
add esp, 8
test edi, edi
mov dword [esi + 0x38], eax
jne 0x67065cfc
cmp eax, 0xfffffffb
jne 0x67065cfc
mov dword [esi + 0x38], edi
test ecx, ecx
jne 0x67065d0a
cmp dword [esi + 0x38], 1
je 0x67065d0a
xor ebx, ebx
jmp 0x67065d0f
mov ebx, 1
mov eax, dword [esi + 0x38]
test eax, eax
je 0x67065ca0
cmp eax, 1
je 0x67065ca0
mov esi, dword [esi + 0x38]
mov eax, esi
sub eax, 1
neg eax
sbb eax, eax
pop edi
and eax, esi
pop esi
pop ebx
ret
or eax, 0xffffffff
pop edi
mov dword [esi + 0x38], eax
pop esi
pop ebx
ret
pop esi
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x67071260
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x28]
add ebx, 1
cmp ebx, 0x64
mov dword [esp + 0x28], ebx
jle 0x67071286
push 0xffff
call fcn.67079630
add esp, 4
pop ebx
add esp, 0x10
ret
mov ax, word [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
cmp ax, word [ebp + 0x2e]
jb 0x670712a1
pop ebp
mov eax, 0xffff
pop ebx
add esp, 0x10
ret
mov ecx, dword [ebp + 0x26]
movzx eax, ax
lea eax, [eax + eax*4]
lea edx, [ecx + eax*2]
movzx eax, word [edx + 4]
push esi
push edi
movzx edi, word [edx + 6]
xor esi, esi
cmp word [edx + 8], si
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], esi
jbe 0x670713bb
add eax, 0xffffffff
mov dword [esp + 0x18], eax
movzx ecx, si
imul ecx, ecx, 0x32
add ecx, dword [edx]
cmp eax, 7
ja case.0x670712e7.6
jmp dword [eax*4 + 0x670713c8]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
push ebx
mov edx, ecx
push edi
mov ecx, ebp
call fcn.6706c1a0
add esp, 8
jmp 0x67071397
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push edi
push ecx
mov ecx, ebp
call fcn.6706c4c0
add esp, 8
jmp 0x67071397
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
push ebx
push ecx
mov ecx, edi
mov ebx, ebp
call fcn.6706c910
add esp, 8
jmp 0x67071393
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
push edx
push edi
mov eax, ebp
call fcn.6706cef0
add esp, 8
jmp 0x67071397
mov eax, dword [esp + 0x30]
push ecx
mov esi, ebx
mov ebx, dword [esp + 0x30]
push ebp
call fcn.6706e840
add esp, 8
jmp 0x6707138f
mov eax, dword [esp + 0x30]
push ecx
mov esi, ebx
mov ebx, dword [esp + 0x30]
push ebp
call fcn.670708f0
add esp, 8
jmp 0x6707138f
mov eax, dword [esp + 0x30]
push ebx
push eax
push edi
mov edi, dword [esp + 0x38]
push ecx
mov eax, ebp
call fcn.67070e50
add esp, 0x10
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x34]
cmp eax, 0xffff
jne 0x670713c0
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
add esi, 1
cmp si, word [edx + 8]
mov dword [esp + 0x14], esi
jb 0x670712d6
mov eax, 0xffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x6707b220
Capabilities:
Encrypt data using speck

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x18], 0
je 0x6707b464
push ebx
mov ebx, dword [esp + 0x18]
movzx edx, word [ebx]
push ebp
push esi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.67080a50
mov ecx, dword [esp + 0x18]
add esp, 0xc
cmp ecx, 0x1e
jne 0x6707b365
mov ecx, 0x1f
mov dword [esp + 0xc], ecx
mov al, 1
mov dl, byte [edi]
and al, 1
or al, 2
add al, al
add al, al
and dl, 0xfb
or al, dl
mov byte [edi], al
mov eax, dword [esp + 0x24]
mov esi, 1
cmp eax, esi
mov ebp, ecx
jbe 0x6707b45c
movzx eax, byte [esi + edi]
and al, 0xfb
or al, 8
lea ecx, [esp + 0x10]
mov byte [esi + edi], al
movzx eax, word [ebx + esi*2]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
call fcn.67080a50
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [eax + eax*4]
movzx eax, byte [edx + ecx*2 + 0x671a9788]
mov edx, dword [esp + 0x1c]
add al, al
add al, al
add al, al
xor al, byte [esi + edi]
add esp, 0xc
and al, 8
xor byte [esi + edi], al
cmp edx, 0x1b
jne 0x6707b34a
movzx ecx, word [ebx + esi*2]
mov eax, ecx
and eax, 0xfc00
cmp ax, 0xd800
jne 0x6707b304
mov edx, dword [esp + 0x24]
add edx, 0xffffffff
cmp esi, edx
jae 0x6707b304
mov dx, word [ebx + esi*2 + 2]
and dx, 0xfc00
cmp dx, 0xdc00
je 0x6707b44b
cmp ax, 0xdc00
jne 0x6707b37e
movzx eax, word [ebx + esi*2 - 2]
mov edx, eax
and edx, 0xfc00
cmp edx, 0xd800
jne 0x6707b37e
lea edx, [esp + 0x10]
push edx
movzx eax, ax
movzx ecx, cx
lea edx, [esp + 0x18]
push edx
shl eax, 0xa
lea edx, [eax + ecx - 0x35fdc00]
push edx
call fcn.67080a50
mov edx, dword [esp + 0x1c]
add esp, 0xc
and byte [esi + edi], 0xf7
cmp edx, 0x1c
jl 0x6707b353
or byte [esi + edi], 4
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, 0x1e
jl 0x6707b389
mov eax, 3
jmp 0x6707b39a
cmp ecx, 0x1c
je 0x6707b261
cmp ecx, 0x1f
je 0x6707b261
xor al, al
jmp 0x6707b263
mov edx, 0xb
mov dword [esp + 0x10], edx
jmp 0x6707b353
cmp ecx, 0x1d
jne 0x6707b39a
mov eax, edx
sub eax, 0x1e
neg eax
sbb eax, eax
and eax, 3
cmp edx, 0x1c
je 0x6707b430
cmp edx, 0x1d
jge case.default.0x6707b3d9
cmp edx, 0x1a
mov ebx, edx
jl 0x6707b3b8
mov ebx, 0xb
cmp ecx, 0x1a
jl 0x6707b3c6
mov ecx, 0xb
mov dword [esp + 0xc], ecx
imul ecx, ecx, 0x1a
movzx ecx, byte [ecx + ebx + 0x671a94d8]
add ecx, 0xffffffff
cmp ecx, 3
ja case.default.0x6707b3d9
jmp dword [ecx*4 + 0x6707b468]
mov ecx, dword [esp + 0x20]
cmp word [ecx + esi*2 - 2], 0xad
mov eax, 2
jne case.default.0x6707b3d9
mov eax, 1
jmp case.default.0x6707b3d9
xor eax, eax
cmp ebp, 0x1c
setne al
sub eax, 1
and eax, 2
jmp case.default.0x6707b3d9
xor eax, eax
cmp ebp, 0x1c
jne 0x6707b430
cmp esi, 1
jbe case.default.0x6707b3d9
mov cl, byte [esi + edi - 2]
and cl, 0xfe
or cl, 2
mov byte [esi + edi - 2], cl
jmp case.default.0x6707b3d9
xor eax, eax
cmp ebp, 0x1c
jne 0x6707b430
mov dword [esp + 0xc], edx
mov cl, byte [esi + edi - 1]
mov ebx, dword [esp + 0x20]
xor cl, al
mov ebp, edx
mov edx, dword [esp + 0x14]
and cl, 3
xor byte [esi + edi - 1], cl
mov dword [esp + 0x18], edx
add esi, 1
cmp esi, dword [esp + 0x24]
jb 0x6707b287
mov eax, dword [esp + 0x24]
or byte [eax + edi - 1], 3
pop esi
pop ebp
pop ebx
add esp, 0x10
ret