joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e816
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x14], ebx
jne 0x44e836
push 6
call fcn.00449755
pop ecx
xor al, al
jmp 0x44ea11
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x18]
shr eax, 0xc
and eax, 0xffffff01
mov dword [ebp - 4], 0x20
push esi
mov dword [ebp - 8], eax
call fcn.0042717c
mov esi, dword [ebp + 8]
cmp byte [ebp - 8], bl
jne 0x44e875
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [edi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x44e8ab
push ebx
lea eax, [ebp - 0x18]
push eax
push closesocket
push esi
call fcn.0044a20b
add esp, 0x10
lea ecx, [ebp - 4]
cmp dword [ebp - 0x18], ebx
mov eax, 0x47e734
cmovne eax, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push eax
push dword [edi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], 0x100000
ja 0x44ea06
sub eax, ebx
je 0x44e972
dec eax
sub eax, 1
je 0x44e8d8
sub eax, 0xe8
je 0x44e8ef
sub eax, 0x308
jne 0x44ea06
test byte [ebp + 0x10], 2
je 0x44ea06
push esi
mov ecx, edi
call fcn.0044e251
jmp 0x44ea06
mov esi, dword [ebp + 0xc]
mov ecx, esi
cmp byte [ebp - 8], bl
je 0x44e900
call fcn.00459bf4
jmp 0x44e905
call fcn.00459b79
mov dword [ebp + 0xc], eax
cmp dword [ebp - 4], ebx
jg 0x44e914
mov bl, 1
jmp 0x44ea06
push dword [ebp - 4]
mov ecx, eax
call fcn.00422803
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, 0x47e730
cmp byte [ebp - 8], bl
jne 0x44e947
test ecx, ecx
cmovne eax, ecx
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push ebx
push dword [ebp + 8]
push dword [edi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x44e969
test ecx, ecx
lea edx, [ebp - 4]
push edx
cmovne eax, ecx
cmp dword [ebp - 0x18], ebx
push eax
push ebx
mov ecx, 0x47e734
cmovne ecx, dword [ebp - 0x18]
push ebx
push ecx
push dword [edi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x44e9cc
jmp 0x44ea06
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x44ea06
cmp eax, 3
jbe 0x44e98c
cmp eax, 4
je 0x44e9ab
cmp eax, 7
jne 0x44ea06
mov esi, dword [ebp + 0xc]
mov ecx, esi
cmp byte [ebp - 8], bl
je 0x44e9c0
call fcn.00459bf4
push dword [ebp - 4]
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, eax
call fcn.0042cf82
jmp 0x44e9cc
cmp dword [ebp - 4], 4
jne 0x44ea06
push dword [ebp - 0x3c]
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.00459b30
jmp 0x44e9cc
push dword [ebp - 4]
lea eax, [ebp - 0x3c]
push eax
call fcn.00459b51
cmp dword [ebp - 0xc], 1
je 0x44e9d8
cmp dword [ebp - 0xc], 2
jne 0x44ea03
test dword [ebp + 0x10], 0x2000
jne 0x44ea03
mov ecx, esi
call fcn.0045994c
mov ecx, eax
cmp byte [ebp - 8], bl
je 0x44e9fd
push 2
push 0x48d200
call fcn.004254a2
jmp 0x44ea03
push ebx
call fcn.00425480
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x18]
call fcn.00424b62
mov al, bl
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x44ea17
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
mov edi, ecx
cmp dword [edi + 0x14], 0
jne 0x44ea32
push 6
call fcn.00449755
pop ecx
xor al, al
jmp 0x44ea7b
push ebx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x20
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
cmp ecx, 0x100000
ja 0x44ea77
sub eax, 0
je 0x44eac6
dec eax
sub eax, 1
je 0x44ea77
sub eax, 0xe8
je 0x44ea80
sub eax, 0x308
xor al, al
pop esi
pop ebx
pop edi
leave
ret 0xc
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.00459bf4
cmp dword [ebp - 4], 0
mov ebx, eax
jle 0x44eb17
push dword [ebp - 4]
mov ecx, ebx
call fcn.00422803
cmp dword [ebx], 0
lea ecx, [ebp - 4]
push ecx
mov eax, 0x47e730
cmovne eax, dword [ebx]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [edi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x44eaed
jmp 0x44ea77
mov eax, dword [ebp - 8]
test eax, eax
je 0x44ea77
cmp eax, 3
jbe 0x44eadc
cmp eax, 4
je 0x44eb1e
cmp eax, 7
jne 0x44ea77
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
shr ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00459bba
cmp dword [ebp - 8], 1
je 0x44eaf9
cmp dword [ebp - 8], 2
jne 0x44eb17
test dword [ebp + 0x10], 0x2000
jne 0x44eb17
mov ecx, esi
call fcn.0045994c
push 2
push 0x48d200
mov ecx, eax
call fcn.004254a2
mov al, 1
jmp 0x44ea79
cmp ecx, 4
jne 0x44ea77
push dword [ebp - 0x2c]
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.00459b30
jmp 0x44eaed

Function at 0x44fb24
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
test byte [ebp + 0x10], 8
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
je 0x44fb4b
cmp dword [edi + 4], 0
jg 0x44fb4b
push dword [ebp + 8]
call fcn.0044e0bf
dec eax
neg eax
sbb al, al
inc al
jmp 0x44fbbc
test dword [ebp + 0x10], 0x8000
je 0x44fb64
push dword [ebp + 8]
call fcn.0044fddc
test al, al
je 0x44fb64
mov al, 1
jmp 0x44fbbc
xor ecx, ecx
inc ecx
test byte [ebp + 0x10], 0x80
je 0x44fb72
push 3
pop ecx
jmp 0x44fb7f
test dword [ebp + 0x10], 0x100
push 2
pop eax
cmovne ecx, eax
cmp dword [esi + 0x14], 0
jne 0x44fb90
push 6
call fcn.00449755
xor al, al
jmp 0x44fbbb
push dword [edi + 4]
cmp dword [edi], 0
mov eax, 0x47e734
cmovne eax, dword [edi]
push eax
push ecx
push 0
push dword [ebp + 8]
push dword [esi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push esi
call fcn.00449755
test esi, esi
sete al
pop ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x45112c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.0044974c
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
and eax, 1
push 0x10
pop esi
push 4
mov dword [ebp - 4], eax
pop eax
cmovne esi, eax
test edi, edi
je 0x4511ca
cmp edi, 1
je 0x4511c5
push 2
pop ebx
cmp edi, ebx
je 0x45117b
cmp edi, 3
je 0x4511cd
jle 0x4511be
cmp edi, 5
jle 0x45117f
cmp edi, 6
jne 0x4511be
call fcn.0044877e
push 0x40
test al, al
pop ecx
cmovne ebx, ecx
or esi, ebx
jmp 0x4511cd
call fcn.00450a5c
test al, al
jne 0x45118c
xor al, al
jmp 0x4511fd
mov ecx, dword [0x4ae57c]
test ecx, ecx
jne 0x4511a0
push 0x78
call fcn.00449755
pop ecx
jmp 0x451188
mov eax, dword [ebp + 0xc]
shr eax, 1
and eax, 1
push eax
push dword [ebp - 4]
xor eax, eax
cmp edi, 5
sete al
push eax
call ecx
test al, al
setne al
jmp 0x4511fd
call fcn.00449763
jmp 0x451188
or esi, 8
jmp 0x4511cd
or esi, 1
push 0
push 1
mov edi, str.SeShutdownPrivilege
push edi
call fcn.00450a95
add esp, 0xc
push dword [ebp + 0x10]
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
test eax, eax
push 0
push edi
setne bl
call fcn.00450a95
add esp, 0xc
mov al, bl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4525bc
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 0
je 0x452678
mov eax, dword [ebp + 0x10]
and eax, 2
mov dword [ebp - 8], eax
jne 0x4525e3
call fcn.00452586
test al, al
je 0x452678
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov esi, dword [esi + 4]
sub eax, 1
je 0x452602
sub eax, 6
je 0x452602
sub eax, 6
jne 0x452603
add esi, 2
jmp 0x452603
inc esi
and dword [ebp - 4], 0
push esi
call fcn.004482b9
mov edi, eax
pop ecx
test edi, edi
je 0x452659
push edi
call fcn.00448304
pop ecx
mov ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x452659
mov edx, dword [ebp + 8]
mov eax, 0x47e730
push esi
cmp dword [edx], 0
cmovne eax, dword [edx]
push eax
push ecx
call fcn.00461740
push edi
call fcn.00448312
add esp, 0x10
test byte [ebp + 0x10], 1
jne 0x45264f
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetClipboardData]
cmp dword [ebp - 8], 0
jne 0x452664
call sub.USER32.dll_CloseClipboard
test edi, edi
pop edi
pop esi
je 0x452674
cmp dword [ebp - 4], 0
je 0x452674
mov al, 1
leave
ret
xor eax, eax
leave
ret
xor al, al
leave
ret

Function at 0x453da7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.0042717c
cmp dword [ebp + 0xc], 0
je 0x453de0
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, eax
test ecx, ecx
jle 0x453de0
lea eax, [ecx + 1]
add ecx, ecx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00422803
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp + 8]
pop ebp
ret
Function at 0x4555fb
Capabilities:
Get common file path

Disassembly:
mov eax, 0x47cfcf
call fcn.0045a9c4
sub esp, 0x250
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x14]
or ecx, 0x100000
mov dword [ebx + 0x14], ecx
or edi, 0xffffffff
mov dword [ebp - 0x18], edi
movzx eax, cx
sub eax, 1
je 0x455640
sub eax, 1
je 0x45563c
sub eax, 1
jne 0x455646
push 0x17
jmp 0x455642
push 2
jmp 0x455642
push 0x11
pop edi
mov dword [ebp - 0x18], edi
and dword [ebp - 0x20], 0
test edi, edi
js 0x45565e
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebx]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [ebx + 0x14]
test ecx, 0x80000
je 0x4556a1
push edi
lea eax, [ebp - 0x2c]
push eax
call fcn.00455dbf
pop ecx
pop ecx
push 0
sub esp, 0xc
mov esi, esp
mov ecx, esi
call fcn.0042717c
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.0042cf64
lea esi, [ebx + 0x18]
push esi
call fcn.00441a52
add esp, 0x14
lea ecx, [ebp - 0x2c]
call fcn.00424b62
jmp 0x4556a4
lea esi, [ebx + 0x18]
push esi
call fcn.0043e000
push 0
push 0x20
lea eax, [ebp - 0x4c]
push eax
call fcn.004280f1
add esp, 0x10
mov eax, dword [ebx]
mov dword [ebp - 0x4c], eax
mov eax, 0x47e734
cmp dword [ebx + 8], 0
cmovne eax, dword [ebx + 8]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 0x4520e5
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
push 0x41
pop eax
test dword [ebx + 0x14], 0x20000
mov ecx, 0x8041
cmove eax, ecx
mov dword [ebp - 0x3c], eax
test dword [ebx + 0x14], 0x40000
je 0x455703
or eax, 0x10
mov dword [ebp - 0x3c], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
mov dword [ebp - 0x50], esi
test esi, esi
je 0x4557e9
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
setne byte [ebp - 0x11]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 2
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x455768
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x455768
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x14]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45576f
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
or dword [ebp - 4], 0xffffffff
jmp 0x455785
cmp byte [ebp - 0x11], 0
je 0x4557e9
push closesocket
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebx + 0x24]
call fcn.0042d49b
test dword [ebx + 0x14], 0x80000
je 0x4557db
push edi
lea eax, [ebp - 0x2c]
push eax
call fcn.00455dbf
push ecx
mov esi, esp
mov ecx, esi
call fcn.0042717c
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.0042cf64
lea eax, [ebx + 0x24]
push eax
call fcn.00440cae
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.00424b62
mov al, 1
jmp 0x4557eb
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x455b42
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.0042f66d
pop ecx
test al, al
je 0x455b5e
push 0x7b
call fcn.00449755
pop ecx
xor al, al
pop ebp
ret
call fcn.0044974c
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x14]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 5
jne 0x455bb1
cmp dword [ebp + 0x14], 0
je 0x455b98
push 0x47e754
push dword [ebp + 0x14]
call fcn.0042f732
pop ecx
pop ecx
test al, al
je 0x455b5a
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x455b5a
call fcn.0044974c
mov al, 1
pop ebp
ret

Function at 0x4574b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp word [ebp - 0x218], 0
je 0x4574fc
mov ecx, dword [ebp + 8]
call fcn.0042717c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push closesocket
push eax
call fcn.0042d49b
jmp 0x457542
call fcn.00448771
test al, al
lea eax, [ebp - 0xc]
push eax
je 0x457517
call fcn.00449a44
mov dword [esp], str.System32
jmp 0x457523
call fcn.00449a44
mov dword [esp], str.System
cmp dword [eax], 0
mov ecx, 0x47e734
cmovne ecx, dword [eax]
push ecx
push dword [ebp + 8]
call fcn.00440a72
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.00424b62
mov eax, dword [ebp + 8]
leave
ret

Function at 0x457aac
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.0042e596
pop ecx
test al, al
je 0x457ac8
call fcn.00449763
xor al, al
jmp 0x457b0b
push ebx
mov ecx, esi
call fcn.00457bf1
call fcn.0044974c
push dword [ebp + 8]
mov bl, byte [ebp + 0xc]
movzx eax, bl
push eax
push 0
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
test eax, eax
je 0x457b08
test bl, bl
je 0x457b01
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
je 0x457b08
mov byte [esi + 4], bl
mov al, 1
jmp 0x457b0a
xor al, al
pop ebx
pop esi
pop ebp
ret 8

Function at 0x45862a
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x458637
xor al, al
pop ebp
ret
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
setne al
pop ebp
ret

Function at 0x45869a
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x4586ac
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop ebp
ret
Function at 0x4586ae
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
mov eax, dword [ebp + 0x14]
and eax, 1
mov dword [ebp - 4], edi
shl eax, 2
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push edi
call fcn.0047061a
mov esi, eax
add esp, 0x18
test esi, esi
je 0x4586fb
cmp dword [ebp + 0x10], 3
je 0x4586ee
push dword [ebp + 0x10]
push esi
call fcn.00458649
pop ecx
pop ecx
push edi
push dword [ebp - 4]
call fcn.0045858c
pop ecx
pop ecx
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x45eb00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045edb0

Function at 0x460620
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00460630
Function at 0x41bf35
Capabilities:
Encode data using xor

Disassembly:
in al, dx
sub esi, 0xc1850114
out dx, al
adc al, 1
test ecx, eax
stc
pushal
dec esi
fdivr st(7), st(0)
pop ebp
pop eax
add al, 0xfc
fisttp dword [ecx]
add byte [ebp + 0x5fc78a14], al
xor al, 0x77
jno 0x41bf37
cmp eax, 0xd4ac8b46
xchg al, al
invalid

Function at 0x41cd11
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
enter 0xffffffffffffe35b, 0xffffffffffffffc8
mov ecx, 0x97b9483
add ecx, dword [edi]
push cs
xor byte [esi - 0x7e], 0x23
add byte [eax], al
add byte [ebx], al
pop esp
push ebp
cdq
jge 0x41cda6
pop eax
cld
dec edx
idiv dword [edx - 0x74]
dec ecx
inc edi
mov byte [0xc1ae8b00], al
push ebx
mov ecx, esi
add al, byte [ecx - 0x74a7afb5]
popfd
cmp dl, cl
or al, 0x8b
out dx, eax
mov esp, 0x7a33a68c
push ss
insb byte es:[edi], dx
jb 0x41cd81
pop esp
scasd eax, dword es:[edi]
cmp eax, 0x448820d6
scasd eax, dword es:[edi]
das
xchg ebp, eax
adc al, 0x8f
dec eax
mov ecx, 0x7f4fa350
sbb dword [ecx + ebx*4 - 0x38a2309e], 0xffffffcc
or al, 0xc6
add al, 0x74
sbb eax, 0x171e8c3c
push ds
pop ss
sahf
xor byte [eax - 0x16], bl
dec edi
jno 0x41cd12
sbb esp, dword [ebp + 0x39c803dc]
push eax
pushfd
xchg dword [eax], edx
mov esi, esi
inc esi
pop ecx
pop ebp
in al, dx
invalid
in al, dx
imul ebx, dword [eax - 0x27af13c4], 0x423687bb
call 0xebbc2f
scasb al, byte es:[edi]
cmp byte [esi + 0x46], ch
add dl, dl
xor eax, 0xff716527
sal byte [0xff716527], cl
ja 0x41cdce
lodsb al, byte [esi]
and dword [eax + 0x3c], 0xffffffa8
mov gs, esi
add bh, bh
pop ebp
jg 0x41cda1
pop esp
cmp cl, 0x52
push 0x458d11bf
test byte [ecx - 0x47], dh
push ebx
push 0xff51f46a
inc esi
psllq mm4, qword [esi - 0x3c73c001]
jge 0x41cddc
repe cmpsb byte [esi], byte es:[edi]
invalid
fcmovnb st(0), st(5)
fstp dword [edi]
mov ecx, 0x26ce3ff
mov eax, dword [ebp + 0x13]
cmc
loope 0x41ce5e
jecxz 0x41ce4a
add cl, byte [ebx - 0x1e0aecbb]
jns 0x41cdfd
pop ss
jl 0x41cd71
pop ebp
add edi, dword [0xbb778a75]
scasd eax, dword es:[edi]
daa
xor bh, cl
push ss
nop
fdiv dword [ebp + 0x53]
je 0x41ce6d
jae 0x41ce72
je 0x41ce19
sbb bh, byte [edx - 0x70]
jp 0x41cd91
sub cl, cl
sub eax, 0xebc5
push 0x7f
adc eax, 0x9fe0fd1b
inc ebp
add byte [ecx + 0x174f46e], dl
clc
mov dword [0xf3e9ef9], eax
and esi, eax
sahf
mov dr6, eax
jl 0x41ce4f
push 0x3a65328d
jmp 0x77403e02
test dword [eax + 0x6a901bff], 0xba0f8b01
scasb al, byte es:[edi]
pop esi
mov eax, dword [esi]
push 1
mov ecx, dword [edi]
mov edx, 0x68b5eae
push 0xffffffffffffff8a
invalid
out dx, al
invalid
invalid
sub dh, byte [esi - 4]
jge 0x41ce60
invalid
invalid
invalid
Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret

Function at 0x40ae20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x554811
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x63d20c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
xor eax, eax
mov dword [esp + 0x1c], eax
cmp esi, eax
je 0x40ae75
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 8]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
inc dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10
Function at 0x413d70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x555d13
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x63d20c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov ebp, dword [esp + 0x28]
push eax
mov ecx, ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
mov esi, dword [eax + 0xc]
mov edi, dword [eax + 8]
mov edx, esi
xor ecx, ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], 1
cmp edx, ebx
je 0x413de0
cmp edi, ebx
jbe 0x413de0
mov al, byte [edx]
inc edx
test al, al
je 0x413de0
inc ecx
cmp ecx, edi
jb 0x413dd4
push ecx
lea ecx, [esp + 0x34]
push esi
push ecx
call dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QString::fromAscii_char_const___int_]
add esp, 0xc
push eax
mov ecx, ebp
mov dword [esp + 0x24], 1
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::append_class_QString_const__]
mov edx, dword [esp + 0x30]
mov byte [esp + 0x20], bl
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x413e20
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x419ca0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push 0xffffffffffffffff
push 0x556789
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x63d20c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x28]
push eax
mov dword [esi], 0x12345678
mov dword [esi + 4], 0x23456789
mov dword [esi + 8], 0x34567890
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray___thiscall_QString::toLatin1_void_]
mov ecx, dword [esp + 0x28]
mov ebx, dword [ecx + 8]
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::detach_void_]
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
xor edx, edx
mov dword [esp + 0x24], eax
test ebx, ebx
jle 0x419d6d
mov ecx, dword [esp + 0x24]
movsx ecx, byte [edx + ecx]
mov eax, dword [esi]
mov ebp, eax
xor ebp, ecx
mov ecx, dword [edi + 0x80014]
shr eax, 8
and ebp, 0xff
mov ecx, dword [ecx + ebp*4]
xor ecx, eax
movzx eax, cl
add eax, dword [esi + 4]
mov dword [esi], ecx
mov ecx, dword [esi + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 4], eax
mov ebp, dword [edi + 0x80014]
sar eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [ebp + eax*4]
inc edx
cmp edx, ebx
mov dword [esi + 8], ecx
jl 0x419d17
mov edx, dword [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x419d90
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.QtCore4.dll_void___cdecl_qFree_void__]
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8