joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e7488
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4e75b0
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004e7374
mov eax, dword [esi]
call fcn.00408338
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x416740]
call fcn.00408500
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.00404564
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.00404564
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00408338
mov dword [ebp - 0xc], eax
mov eax, dword [0x59ad30]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.004d6dd8
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.004048ec
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00408338
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.004d6db4
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.004d6b6c
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004d6dd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e75b7
lea eax, [ebp - 4]
mov edx, dword [0x416740]
call fcn.00408624
ret

Function at 0x5120e0
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
mov edx, 0x10
call fcn.004074ec
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x512105
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
push esp
mov eax, dword [ebx]
call fcn.00407360
push eax
call sub.KERNEL32.DLL_GetComputerNameW
test eax, eax
je 0x512124
mov eax, ebx
mov edx, dword [esp]
call fcn.004074ec
pop ecx
pop edx
pop ebx
ret
Function at 0x5510bc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x55110d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x5510f4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x5510e4
jmp 0x55110d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x5510f5
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56d67c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5a0490
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x56d69e
shr eax, 1
xor eax, 0xedb88320
jmp 0x56d6a0
shr eax, 1
dec edx
jne 0x56d68c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x56d685
mov byte [0x5a0890], 1
pop esi
pop ebx
ret

Function at 0x56d6bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5a0890], 0
jne 0x56d6d3
call fcn.0056d67c
mov eax, edi
dec eax
test eax, eax
jl 0x56d6fb
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5a0490]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x56d6dd
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x570488
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x570522.0
jmp dword [ecx*4 + 0x5704bb]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5704ed
sub dl, 8
je 0x5704fc
jmp case.0x570522.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x570130
jmp case.0x570522.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x570188
jmp case.0x570522.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x570522.0
movzx ecx, byte [ecx + 0x570529]
jmp dword [ecx*4 + 0x57053a]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x570234
jmp case.0x570522.0
cmp dl, 3
jne 0x570567
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x57028c
jmp case.0x570522.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x570248
jmp case.0x570522.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5702d0
jmp case.0x570522.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x570592
sub dl, 8
je 0x57059e
jmp case.0x570522.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5702fc
jmp case.0x570522.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x570368
jmp case.0x570522.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5705bd
sub dl, 8
je 0x5705c9
jmp case.0x570522.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x570424
jmp case.0x570522.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x57044c
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x57066b
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0056f634
test eax, eax
je 0x57066b
mov eax, ebx
call fcn.00570674
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x570604
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x570674
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5706a5
dec al
je 0x5706e0
dec al
je 0x570725
dec al
je 0x57078e
jmp 0x570818
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x570818
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5706b5
jmp 0x570818
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x570818
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5706f0
jmp 0x570818
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x570818
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x570754
xor ebp, ebp
jmp 0x570764
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x57076d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x570735
jmp 0x570818
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x570818
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5707e7
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0056d704
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5707a2
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x587cb4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x10
mov eax, 0x10
call fcn.0041dad4
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004073c0
mov eax, dword [ebp - 8]
call fcn.0041db24
mov esp, ebp
pop ebp
ret
Function at 0x10007f50
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10008114
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x10007f7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10007f81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10007f70
mov eax, 1
add ebx, ebx
jne 0x10007f93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10007f88
jne 0x10007fa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10007f88
xor ecx, ecx
sub eax, 3
jb 0x10007fb8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1000802a
mov ebp, eax
add ebx, ebx
jne 0x10007fc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10007fd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10007ff4
inc ecx
add ebx, ebx
jne 0x10007fe0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10007fd5
jne 0x10007ff1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10007fd5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10008014
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10008005
jmp 0x10007f76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10008014
add edi, ecx
jmp 0x10007f76
pop esi
mov edi, esi
mov ecx, 0x5d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10008032
cmp byte [edi], 2
jne 0x10008032
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10008037
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x100080a6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x80f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8164]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10008064
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8168]
or eax, eax
je 0x100080a0
mov dword [ebx], eax
add ebx, 4
jmp 0x10008081
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100080d7
cmp al, 0xef
ja 0x100080ca
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100080ac
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100080b9
mov ebp, dword [esi + 0x816c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1000810b
sub esp, 0xffffff80
jmp 0x100014fd
Function at 0x418a50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x425569
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x28]
push edi
call dword [sym.imp.Qt3Support4.dll_public:_class_Q3ListViewItem____thiscall_Q3ListView::currentItem_void_const]
push 0xa
lea eax, [esp + 0x10]
push 0
push eax
call dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QString::number_int__int_]
add esp, 0xc
mov edi, eax
mov ecx, dword [esi + 0xd8]
mov ebx, dword [sym.imp.Qt3Support4.dll_public:_int___thiscall_Q3ListBox::currentItem_void_const]
mov dword [esp + 0x18], 0
call ebx
mov ecx, dword [esi + 0x30]
push eax
push edi
push ecx
mov ecx, dword [esi + 0xd8]
call dword [sym.imp.Qt3Support4.dll_public:_void___thiscall_Q3ListBox::changeItem_class_QPixmap_const___class_QString_const___int_]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x418ad3
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
add esp, 4
cmp dword [esi + 0x54], 0
je 0x418b0a
mov edx, dword [esi + 0x18]
cmp byte [edx + 0x26], 0
je 0x418b0a
mov ecx, dword [esi + 0xd8]
call ebx
mov ecx, dword [esi + 0x54]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
add ecx, 0x28
call fcn.00412650
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
call fcn.00417330
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x422bb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x428559
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp], eax
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push 2
lea edx, [esp + 0x30]
push 0x4627f0
push ecx
mov dword [esp + 0x18], edx
call dword [sym.imp.QtCore4.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___]
add esp, 0x10
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call dword [sym.imp.QtGui4.dll_public_virtual:_void___thiscall_QPixmap::destructor_void_]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10

Function at 0x4247ca
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x462848]
jne 0x4247d4
repz ret
jmp fcn.004247ec

Function at 0x424b30
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_unsigned_short_int_const___int_]
add esp, 0xc
mov ecx, eax
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray___thiscall_QString::toLocal8Bit_void_]
mov edx, dword [esp + 8]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x424b72
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
add esp, 4
push 8
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0
call fcn.00424ab0
lea ecx, [esp + 4]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::detach_void_]
mov ecx, dword [esp + 0x20]
lea edx, [esp]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
push eax
mov eax, dword [edx + 0xc]
mov edx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x24]
push eax
push ecx
push edx
call sub.QtCore4.dll_void___cdecl_qWinMain_struct_HINSTANCE_____struct_HINSTANCE_____char___int__int___class_QVector_char____
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
add esp, 0x18
cmp ecx, 1
je 0x424bd6
mov eax, dword [esp]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
push edx
push eax
lea ecx, [esp + 8]
call fcn.00424900
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
push esi
add eax, 0x10
push eax
push ecx
call fcn.0041f0c0
mov esi, eax
mov eax, dword [esp + 0xc]
add esp, 8
test eax, eax
je 0x424c0e
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x424c0e
mov eax, dword [esp + 4]
push 4
push eax
call dword [sym.imp.QtCore4.dll_public:_static_void___cdecl_QVectorData::free_struct_QVectorData___int_]
add esp, 8
mov ecx, dword [esp + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x424c29
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.QtCore4.dll_void___cdecl_qFree_void__]
add esp, 4
mov eax, esi
pop esi
add esp, 0x10
ret 0x10
Function at 0x41cec9
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x437d00
call fcn.0041cfb0
push 1
call fcn.0041c879
pop ecx
test al, al
jne 0x41cd80
push 7
call fcn.0041d1b5
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041c844
mov byte [ebp - 0x24], al
mov eax, dword [0x45885c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x41cd79
test eax, eax
jne 0x41cdea
mov dword [0x45885c], ecx
push 0x430270
push 0x430254
call fcn.00425166
pop ecx
pop ecx
test eax, eax
je 0x41cdcd
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41cec3
push 0x430250
push 0x430220
call fcn.0042510a
pop ecx
pop ecx
mov dword [0x45885c], 2
jmp 0x41cdef
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0041c9d3
pop ecx
call fcn.0041d459
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x41ce1f
push esi
call fcn.0041c949
pop ecx
test al, al
je 0x41ce1f
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0041cf9b
call esi
call fcn.0041d45f
mov esi, eax
cmp dword [esi], edi
je 0x41ce3d
push esi
call fcn.0041c949
pop ecx
test al, al
je 0x41ce3d
push dword [esi]
call fcn.00424576
pop ecx
call fcn.0041d2d0
movzx eax, ax
push eax
call fcn.004250b7
push eax
push edi
push 0x400000
call fcn.0041b905
mov esi, eax
call fcn.00424485
test al, al
jne 0x41ce68
push esi
call fcn.004245ae
test bl, bl
jne 0x41ce71
call fcn.00424551
push edi
push 1
call fcn.0041c9f0
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41cec3
call fcn.0041cff6
ret
mov edi, edi
push ebp
mov ebp, esp
jmp 0x41cd61
Function at 0x4063e8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004068a8
mov byte [esp], al
cmp byte [esp], 0
jne 0x406571
test edi, edi
je 0x406571
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4064b1
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x40648c
cmp edi, 0xffffffff
je 0x40644d
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40644d
mov byte [esp], 0
jmp 0x406571
cmp dword [esi], 1
jg 0x40648c
cmp dword [esi], 0
jne 0x40647e
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x40647e
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x406571
lea eax, [esp + 0xc]
call fcn.00406080
dec ebp
test ebp, ebp
jg 0x406432
cmp edi, 0xffffffff
je 0x4064b1
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4064af
mov byte [esp], 0
jmp 0x406571
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x4063f6
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4064b1
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.004065ec
mov edx, eax
mov ebx, dword [0x4248f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x406515
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x406513
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x406515
xor edi, edi
cmp byte [esp], 0
je 0x40653b
mov ebx, dword [esi]
test bl, 1
jne 0x406551
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40651b
mov byte [esp + 1], 1
jmp 0x406551
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40653b
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x4064c8
cmp byte [esp], 0
je 0x406571
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x407064
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, 0x426b98
cmp dword [ebp + 0xc], 2
jl 0x407078
mov ebx, 0x426bc8
mov esi, ebx
lea edi, [ebp - 0x40]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
pop dword [ebx + 0x20]
pop dword [ebx + 0x1c]
pop dword [ebx + 0x18]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0x40]
mov dword [ebx], ecx
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x4070b0
mov ecx, dword [eax]
mov dword [ebx + 0xc], ecx
mov eax, 0x402748
mov dword [0x42401c], eax
mov eax, 0x402750
mov dword [0x424020], eax
mov eax, ebx
call fcn.00406f48
mov eax, dword [ebp + 0xc]
inc eax
mov byte [ebx + 0x28], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [ebx + 0x24], edx
je 0x4070e5
cmp al, 3
jge 0x4070e5
call dword [ecx + eax*4]
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4070f6
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call ecx
pop ecx
mov eax, dword [ebp + 0xc]
cmp al, 3
jl 0x407101
call dword [ecx + eax*4]
cmp dword [0x42403c], 0
jne 0x407117
mov byte [0x424044], 1
fnstcw word [0x42201c]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.004073c4
call fcn.00406ff8
ret 4

Function at 0x40732c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x424054], 0
je 0x407393
cmp word [0x424344], 0xd7b2
jne 0x407355
cmp dword [0x42434c], 0
jbe 0x407355
mov eax, 0x424340
call dword [0x42435c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x4073c0
call fcn.00407ab0
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x422026], 0
jne 0x4073af
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret