joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100060f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, ecx
mov dword [ebp - 4], eax
mov esi, edi
cmp dword [edi + 0x14], 0x10
jb 0x10006109
mov esi, dword [edi]
mov ebx, dword [edi + 0x10]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1000612b
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10006117
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [eax + ecx*8 + 4]
lea ebx, [eax + ecx*8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], eax
cmp esi, eax
jne 0x1000615c
xor esi, esi
test esi, esi
pop edi
cmove esi, eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebx]
lea eax, [esi + 8]
push eax
push edi
call fcn.10006dc0
test al, al
je 0x10006189
nop dword [eax]
cmp esi, ebx
je 0x10006187
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.10006dc0
test al, al
jne 0x10006170
jmp 0x10006189
xor esi, esi
mov eax, dword [ebp + 0xc]
test esi, esi
pop edi
cmove esi, eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10006c30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x14], ebx
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
jbe 0x10006c61
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
or eax, 1
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 8], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.10005fe0
lea eax, [esi - 1]
mov dword [ebx + 0x1c], esi
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x10006d90
nop dword [eax]
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
mov edi, dword [edi]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], ecx
jb 0x10006cb6
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov ecx, dword [ecx + 0x10]
xor edx, edx
mov dword [ebp - 0xc], ecx
mov ebx, 0x811c9dc5
test ecx, ecx
je 0x10006ce7
mov eax, dword [ebp - 4]
mov edi, ecx
nop dword [eax]
movzx ecx, byte [edx + eax]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x10006cd0
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
and edx, ebx
lea ecx, [ecx + edx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x10006d06
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x10006d82
mov ebx, dword [ecx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.10006dc0
test al, al
jne 0x10006d40
mov ebx, dword [ebx]
cmp ebx, esi
je 0x10006d38
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x10006d7f
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x10006d62
mov ebx, dword [ebx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.10006dc0
test al, al
je 0x10006d99
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x10006d47
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov esi, edi
cmp edi, eax
jne 0x10006ca0
nop dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x10006d7f
Function at 0x10006fe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
xor esi, esi
push edi
mov edi, 0x811c9dc5
test edx, edx
je 0x10007001
nop dword [eax]
movzx eax, byte [esi + ecx]
inc esi
xor eax, edi
imul edi, eax, 0x1000193
cmp esi, edx
jb 0x10006ff0
mov eax, edi
pop edi
pop esi
ret
Function at 0x40ffd9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40ffe8
pop dword [ebp - 0x18]
mov eax, 0x40ffe8
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3e460
push 0
mov eax, 0x6c0124c
add eax, 0xf9823fcc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x49bd
mov esi, eax
mov edi, 0x3e848603
add edi, 0xc1becdfd
add edi, dword [ebp - 0x18]
mov ebx, 0xaa611844
add ebx, 0xda53162a
add dword [ebp - 4], 0x183fdb05
mov edx, dword [edi]
xor dword [ebp - 8], edi
sub edx, ebx
mov dword [esi], edx
sub dword [ebp - 4], 0x7ac29361
add esi, 4
add edi, 0x24db8787
add edi, 0xdb24787d
loop 0x41003c
add eax, 0x119c7
mov ebx, eax
add eax, 0xaacdad40
add eax, 0x553252c5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0xab730d
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00ab730d
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x6d
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf4
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xdf
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc2
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x63
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb7
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb9
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x91
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x25
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x19
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x35
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x8a
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1e
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x62
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x401000
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 1
jne 0x401014
mov eax, dword [0x4390ec]
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
jmp 0x401026
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [0x4390f0]
shr edx, 1
cmp dword [ebp - 4], edx
jae 0x4010ab
mov eax, dword [ebp - 4]
mov ecx, dword [0x4390d4]
movzx edx, word [ecx + eax*2]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 0xc
cmp eax, 3
jne 0x4010a6
mov ecx, dword [ebp - 0xc]
and ecx, 0xfff
add ecx, 0x1474
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1474
mov dword [ebp - 8], edx
cmp dword [ebp - 4], 0
jne 0x401087
push 0x20e
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x401087
xor eax, eax
jmp 0x4010ab
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx]
add eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx], eax
jmp 0x40101d
mov esp, ebp
pop ebp
ret
Function at 0x401a30
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4390e0], 0x24e1
mov eax, dword [0x4390e0]
sub eax, 0x24e1
mov dword [0x4390e0], eax
mov ecx, 1
test ecx, ecx
je 0x401adb
mov edx, dword [0x4390e0]
cmp edx, dword [ebp + 0xc]
jb 0x401a67
jmp 0x401adb
cmp dword [0x4390e0], 0
jne 0x401a85
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401a85
xor eax, eax
jmp 0x401adb
mov eax, dword [ebp + 8]
add eax, dword [0x4390e0]
mov ecx, dword [eax]
add ecx, dword [0x4390e0]
mov edx, dword [ebp + 8]
add edx, dword [0x4390e0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x263fa
mov eax, dword [0x4390e0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4390e0]
push eax
call fcn.004011d0
add esp, 8
mov ecx, dword [0x4390e0]
add ecx, 4
mov dword [0x4390e0], ecx
jmp 0x401a4d
mov esp, ebp
pop ebp
ret

Function at 0x401ae0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str._ffffffffffffffff
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401b5a
cmp dword [ebp - 0x118], 0
je 0x401b5a
jmp 0x401bbc
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x401bbc
mov dword [ebp - 0x120], 0x7dc35
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4390d4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4390f0], edx
mov dword [ebp - 0x120], 0x7dc35
mov dword [ebp - 0x120], 0x7dc35
call fcn.004011c0
mov eax, dword [ebp + 8]
mov dword [0x4390ec], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.004019f0
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x401b5a
mov esp, ebp
pop ebp
ret

Function at 0x16a2b40
Capabilities:
Encode data using xor

Disassembly:
jmp 0x16a2b4a
pushal
call 0x16a2b50
pop ebp
sub ebp, 0x10
sub ebp, 0x12a2b40
jmp 0x16a2b66
mov eax, 0x12a2b40
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d3
mov edx, 0xc61409ca
xor byte [eax], dl
inc eax
dec ecx
jne 0x16a2b7d
jmp 0x16a2b90
inc ecx
pop es
inc ecx
inc ebx
test dl, 0xca
retf 0xb4b
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x523e1322
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x20e2495b
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x8601b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00860140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00860140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00860140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00860140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x860bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x860c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x87287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x860c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x860c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x409260
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._n____ERROR__QSPY_ASSERTION_failed_in_Module_s:_d_n
call fcn.0040a190
add esp, 0xc
call fcn.00409290
push 0xffffffffffffffff
call fcn.0042c47e
int3

Function at 0x40a080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409640
add esp, 8
cmp eax, 1
je 0x40a0a7
or esi, 0xffffffff
call fcn.00409290
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov bl, 1
xor esi, esi
nop dword [eax]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x2000
push eax
push 0x4a1300
call dword [0x4a54b0]
dec eax
add esp, 8
cmp eax, 4
ja case.default.0x40a0cf
jmp dword [eax*4 + 0x40a170]
mov eax, dword [ebp - 4]
test eax, eax
je 0x40a139
push eax
push 0x4a1300
call fcn.00401950
mov eax, dword [0x4a0ab4]
add esp, 8
test eax, eax
je 0x40a139
push eax
push dword [ebp - 4]
push 1
push 0x4a1300
call fcn.0042d32e
add esp, 0x10
jmp 0x40a139
cmp dword [0x4631f8], esi
je 0x40a15e
mov eax, dword [ebp - 4]
test eax, eax
je 0x40a139
push eax
push 0x4a1300
call fcn.00407430
jmp 0x40a136
movzx eax, byte [0x4a1300]
push 2
push eax
call fcn.00408a30
mov bl, al
add esp, 8
test bl, bl
jne case.default.0x40a0cf
pop ebx
call fcn.00409290
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
or esi, 0xffffffff
pop ebx
call fcn.00409290
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0xb7
push str.C:qp_devqtoolsqspy_sourceqspy_main.c
call fcn.00409260
nop dword [eax]
salc
mov al, byte [2701721664]
inc eax
add byte [0x510040a1], ah
mov eax, dword [0xa14e0040]
inc eax
add ah, cl
int3

Function at 0x40a330
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4a3340]
test eax, eax
je 0x40a345
push eax
call fcn.00429aa7
add esp, 4
mov eax, dword [ebp + 8]
mov dword [0x4a3340], eax
mov dword [0x4a3474], 0
pop ebp
jmp fcn.0040a540
Function at 0x40a3b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
mov eax, dword [0x463218]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4a3344], 0
push esi
mov esi, dword [ebp + 0x10]
je 0x40a529
cmp dword [0x4a3340], 0
je 0x40a529
mov ecx, dword [0x4a3474]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x64
sub ecx, eax
jne 0x40a404
call fcn.0040a540
push ebx
push edi
push dword [ebp + 8]
lea eax, [ebp - 0xf0]
push str._010u
push 0xffffffffffffffff
push 0xea
push eax
call fcn.004073c0
mov eax, dword [0x4a3344]
mov ecx, 0xa
add esp, 0x14
lea eax, [eax + eax*4]
lea edi, [eax*4 - 1]
cmp edi, ecx
jle 0x40a45d
mov ebx, 0x14
lea eax, [ecx - 0x13]
cdq
idiv ebx
neg edx
sbb dl, dl
and dl, 0xa4
add dl, 0x7c
mov byte [ebp + ecx - 0xf0], dl
inc ecx
cmp ecx, edi
jl 0x40a441
mov word [ebp + ecx - 0xf0], 0xa7c
lea edi, [ecx + 2]
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a470
sub ecx, edx
mov eax, 0xf
cmp ecx, eax
cmovg ecx, eax
lea eax, [ecx + 1]
mov ecx, dword [ebp + 0xc]
cdq
sub eax, edx
sar eax, 1
lea ecx, [ecx + ecx*4]
shl ecx, 2
sub ecx, eax
lea ebx, [ecx + 0x14]
mov byte [ebp + ecx - 0xdd], 0x28
lea edx, [ecx + 0x22]
mov eax, ebx
mov cl, byte [esi]
test cl, cl
je 0x40a4c3
sub esi, ebx
nop
cmp eax, edx
jg 0x40a4c3
mov byte [ebp + eax - 0xf0], cl
inc eax
mov cl, byte [esi + eax]
test cl, cl
jne 0x40a4b0
mov byte [ebp + eax - 0xf0], 0x29
inc eax
cmp edi, eax
ja 0x40a4db
mov byte [ebp + eax - 0xf0], 0xa
lea edi, [eax + 1]
mov eax, dword [0x4a36f8]
test eax, eax
js 0x40a4ef
lea eax, [eax + eax*4]
mov byte [ebp + eax*4 - 0xdd], 0x2f
cmp edi, 0xea
jbe 0x40a509
push 0x23c
push str.C:qp_devqtoolsqspy_sourceqspy_seq.c
call fcn.00409260
add esp, 8
push dword [0x4a3340]
lea eax, [ebp - 0xf0]
push edi
push 1
push eax
call fcn.0042d32e
add esp, 0x10
inc dword [0x4a3474]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040c824
mov esp, ebp
pop ebp
ret
Function at 0x40a540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [0x4a3344]
test ebx, ebx
je 0x40a744
mov ecx, dword [0x4a3340]
test ecx, ecx
je 0x40a744
mov eax, dword [0x4a3cc8]
test eax, eax
jne 0x40a706
push esi
mov esi, 0x29d
push esi
push 0x20
push 0x4a3a28
call fcn.0040e000
add esp, 0xc
test ebx, ebx
jle 0x40a5de
mov eax, 0xc
mov edx, ebx
lea ecx, [eax + 0xf]
mov byte [eax + 0x4a3a27], 0x2b
mov esi, eax
cmp eax, ecx
jge 0x40a5c7
mov esi, ecx
mov ecx, 0x2d2d2d2d
mov dword [eax + 0x4a3a28], ecx
mov dword [eax + 0x4a3a2c], ecx
mov dword [eax + 0x4a3a30], ecx
mov word [eax + 0x4a3a34], cx
mov byte [eax + 0x4a3a36], cl
mov byte [esi + 0x4a3a20], 0x2b
add eax, 0x14
mov byte [esi + 0x4a3a28], 0x2b
inc esi
sub edx, 1
jne 0x40a591
mov byte [esi + 0x4a3a28], 0xa
lea eax, [esi + 0x4a3a29]
mov dword [ebp - 0xc], eax
test ebx, ebx
jle 0x40a69a
lea ecx, [eax - 1]
mov ebx, 0x4a3478
mov dword [ebp - 0x10], ecx
lea ecx, [eax - 0x11]
mov eax, dword [0x4a3344]
push edi
mov edi, 0x1c
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], eax
nop dword [eax + eax]
mov edx, ebx
mov byte [ecx + edi], 0x7c
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x40a630
sub edx, ecx
lea ecx, [edi - 0x10]
cmp edx, 0xf
jge 0x40a64f
mov eax, 0xf
sub eax, edx
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov dl, byte [ebx]
test dl, dl
je 0x40a675
mov esi, ebx
mov ebx, dword [ebp - 0xc]
sub esi, ecx
nop dword [eax]
lea eax, [edi - 1]
cmp ecx, eax
jge 0x40a672
mov byte [ebx + ecx], dl
inc ecx
mov dl, byte [esi + ecx]
test dl, dl
jne 0x40a660
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov esi, edi
mov ecx, dword [ebp - 0x14]
add ebx, 0x40
mov dword [ebp - 4], ebx
mov byte [eax + edi], 0x7c
add edi, 0x14
sub dword [ebp - 8], 1
jne 0x40a620
mov ebx, dword [0x4a3344]
mov eax, dword [ebp - 0xc]
pop edi
lea edx, [esi + 1]
mov byte [eax + esi], 0xa
add edx, eax
test ebx, ebx
jle 0x40a6eb
mov eax, 0xc
nop dword [eax]
lea ecx, [eax + 0xf]
mov byte [eax + edx - 1], 0x2b
mov esi, eax
cmp eax, ecx
jge 0x40a6d9
mov esi, ecx
mov ecx, 0x2d2d2d2d
mov dword [eax + edx], ecx
mov dword [eax + edx + 4], ecx
mov dword [eax + edx + 8], ecx
mov word [eax + edx + 0xc], cx
mov byte [eax + edx + 0xe], cl
mov byte [edx + esi - 8], 0x2b
add eax, 0x14
mov byte [edx + esi], 0x2b
inc esi
sub ebx, 1
jne 0x40a6b0
mov ecx, dword [0x4a3340]
lea eax, [esi + 1]
mov byte [edx + esi], 0xa
sub edx, 0x4a3a28
add eax, edx
mov dword [0x4a3cc8], eax
pop esi
cmp dword [0x4a3474], 0
jne 0x40a727
push 0x4a3348
push str._g__s_n_n
push ecx
call fcn.00401010
mov eax, dword [0x4a3cc8]
add esp, 0xc
push dword [0x4a3340]
push eax
push 1
push 0x4a3a28
call fcn.0042d32e
add esp, 0x10
add dword [0x4a3474], 3
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40aaa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
mov eax, dword [0x463218]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4a3344], 0
push edi
mov edi, dword [ebp + 0xc]
je 0x40abfd
cmp dword [0x4a3340], 0
je 0x40abfd
mov ecx, dword [0x4a3474]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x64
sub ecx, eax
jne 0x40aaf4
call fcn.0040a540
push ebx
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xf0]
push str._010u
push 0xffffffffffffffff
push 0xea
push eax
call fcn.004073c0
mov eax, dword [0x4a3344]
mov ecx, 0xa
add esp, 0x14
lea eax, [eax + eax*4]
lea esi, [eax*4 - 1]
cmp esi, ecx
jle 0x40ab4d
mov ebx, 0x14
lea eax, [ecx - 0x13]
cdq
idiv ebx
neg edx
sbb dl, dl
and dl, 0xa4
add dl, 0x7c
mov byte [ebp + ecx - 0xf0], dl
inc ecx
cmp ecx, esi
jl 0x40ab31
mov edx, dword [ebp + 0x10]
lea esi, [ecx + 2]
mov word [ebp + ecx - 0xf0], 0xa7c
lea edi, [edi + edi*4]
lea eax, [edi*4 + 0x16]
lea ebx, [eax + 0xf]
mov cl, byte [edx]
test cl, cl
je 0x40ab85
sub edx, eax
cmp eax, ebx
jg 0x40ab85
mov byte [ebp + eax - 0xf0], cl
inc eax
mov cl, byte [edx + eax]
test cl, cl
jne 0x40ab72
mov byte [ebp + eax - 0xf0], 0x5d
inc eax
cmp esi, eax
ja 0x40ab9d
mov byte [ebp + eax - 0xf0], 0xa
lea esi, [eax + 1]
mov eax, dword [0x4a36f8]
mov word [ebp + edi*4 - 0xdc], 0x3d3c
test eax, eax
js 0x40abbb
lea eax, [eax + eax*4]
mov byte [ebp + eax*4 - 0xdd], 0x2f
mov byte [ebp + edi*4 - 0xdd], 0x2a
cmp esi, 0xea
jbe 0x40abdd
push 0x187
push str.C:qp_devqtoolsqspy_sourceqspy_seq.c
call fcn.00409260
add esp, 8
push dword [0x4a3340]
lea eax, [ebp - 0xf0]
push esi
push 1
push eax
call fcn.0042d32e
add esp, 0x10
inc dword [0x4a3474]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0040c824
mov esp, ebp
pop ebp
ret