joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64082570
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x640a6334
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x640ee650]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QSharedData::constructor_void_]
lea ecx, [esp + 8]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::constructor_void_]
push 0
push eax
lea ecx, [esi + 4]
mov dword [esp + 0x24], 0
call sym.QtNetwork4.dll_public:_void___thiscall_QSslCertificate::constructor_class_QByteArray_const___enum_QSsl::EncodingFormat_
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::destructor_void_]
mov eax, dword [sym.imp.QtCore4.dll_struct_QListData::Data_QListData::shared_null]
mov ecx, eax
mov dword [esi + 8], eax
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::ref_void_]
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 3
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::constructor_void_]
push 0
push eax
lea ecx, [esi + 0xc]
mov byte [esp + 0x24], 4
call sym.QtNetwork4.dll_public:_void___thiscall_QSslCertificate::constructor_class_QByteArray_const___enum_QSsl::EncodingFormat_
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 6
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::destructor_void_]
lea ecx, [esi + 0x10]
call sym.QtNetwork4.dll_public:_void___thiscall_QSslKey::constructor_void_
lea ecx, [esi + 0x14]
mov byte [esp + 0x1c], 7
call sym.QtNetwork4.dll_public:_void___thiscall_QSslCipher::constructor_void_
mov ecx, dword [sym.imp.QtCore4.dll_struct_QListData::Data_QListData::shared_null]
mov byte [esp + 0x1c], 8
mov dword [esi + 0x18], ecx
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::ref_void_]
mov edx, dword [sym.imp.QtCore4.dll_struct_QListData::Data_QListData::shared_null]
mov ecx, edx
mov byte [esp + 0x1c], 9
mov dword [esi + 0x1c], edx
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::ref_void_]
mov dword [esi + 0x20], 5
mov dword [esi + 0x24], 3
mov dword [esi + 0x28], 0
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 0x15
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret
Function at 0x64083e90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x640a6778
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x640ee650]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
push 8
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], 0
test edi, edi
je 0x64083f04
lea ecx, [esp + 0xc]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::constructor_void_]
push 0
push eax
lea ecx, [edi + 4]
mov byte [esp + 0x28], 1
call sym.QtNetwork4.dll_public:_void___thiscall_QSslCertificate::constructor_class_QByteArray_const___enum_QSsl::EncodingFormat_
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 3
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::destructor_void_]
mov eax, edi
jmp 0x64083f06
xor eax, eax
mov dword [esi], eax
mov ecx, dword [esp + 0x28]
mov dword [eax], ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 4
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::constructor_void_]
push 0
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 5
call sym.QtNetwork4.dll_public:_void___thiscall_QSslCertificate::constructor_class_QByteArray_const___enum_QSsl::EncodingFormat_
mov ecx, dword [esi]
push eax
add ecx, 4
mov byte [esp + 0x24], 6
call sym.QtNetwork4.dll_public:_class_QSslCertificate____thiscall_QSslCertificate::operator_class_QSslCertificate_const__
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 5
call sym.QtNetwork4.dll_public:_void___thiscall_QSslCertificate::destructor_void_
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 4
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 4
Function at 0x64084110
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x640a6824
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x640ee650]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
push ecx
mov ebx, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], ebx
call sym.QtNetwork4.dll_public:_void___thiscall_QSslError::constructor_enum_QSslError::SslError_
lea edx, [esp + 0xc]
push edx
mov ecx, eax
mov byte [esp + 0x24], 2
call sym.QtNetwork4.dll_public:_class_QString___thiscall_QSslError::errorString_void_
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call dword [sym.imp.QtCore4.dll_public:_class_QDebug____thiscall_QDebug::operator___class_QString_const__]
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov eax, dword [esp + 0x10]
mov byte [esp + 0x20], bl
mov esi, eax
test eax, eax
je 0x640841a5
lea ecx, [eax + 4]
call sym.QtNetwork4.dll_public:_void___thiscall_QSslCertificate::destructor_void_
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esi], eax
add dword [eax + 0xc], ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], ebx
mov byte [esp + 0x20], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QDebug::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x64087fe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x640a6fb1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x640ee650]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 4]
cmp byte [esi + 0x130], 0
jne 0x6408801a
mov ecx, esi
call fcn.640874d0
cmp dword [esi + 0x184], 0
mov byte [esi + 0x130], 0
jne 0x6408803e
push ecx
mov ecx, dword [esp + 0x3c]
mov eax, esp
mov dword [eax], ecx
mov ecx, esi
mov dword [esp + 0x10], esp
call fcn.64087540
lea edx, [esp + 0xc]
push edx
mov ecx, edi
call sym.QtNetwork4.dll_public:_class_QNetworkProxy___thiscall_QAbstractSocket::proxy_void_
mov ecx, dword [esi + 0x184]
push eax
mov dword [esp + 0x2c], 0
call sym.QtNetwork4.dll_public:_void___thiscall_QAbstractSocket::setProxy_class_QNetworkProxy_const__
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call sym.QtNetwork4.dll_public:_void___thiscall_QNetworkProxy::destructor_void_
push str._q_user_agent
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call dword [sym.imp.QtCore4.dll_public:_class_QVariant___thiscall_QObject::property_char_const__]
mov ecx, dword [esi + 0x184]
push eax
push str._q_user_agent
mov dword [esp + 0x30], 1
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QObject::setProperty_char_const___class_QVariant_const__]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
push ecx
mov ecx, dword [esp + 0x3c]
mov eax, esp
mov dword [eax], ecx
mov ecx, edi
mov dword [esp + 0x10], esp
call dword [sym.imp.QtCore4.dll_public_virtual:_bool___thiscall_QIODevice::open_class_QFlags_enum_QIODevice::OpenModeFlag__]
mov edx, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x34]
mov eax, esp
mov dword [eax], edx
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], esp
push eax
push ecx
mov ecx, dword [esi + 0x184]
call sym.QtNetwork4.dll_public:_void___thiscall_QAbstractSocket::connectToHost_class_QString_const___unsigned_short_int__class_QFlags_enum_QIODevice::OpenModeFlag__
mov ecx, dword [esi + 0x184]
call sym.QtNetwork4.dll_public:_int___thiscall_QAbstractSocket::socketDescriptor_void_const
mov dword [esi + 0xc0], eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0xc
Function at 0x640917b0
Capabilities:
Check os version

Disassembly:
cmp dword [esp + 8], 0
jne case.default.0x640917c8
mov eax, dword [esp + 0xc]
cmp eax, 8
ja case.default.0x640917c8
jmp dword [eax*4 + 0x64091880]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov ecx, dword [esp + 4]
push edx
call fcn.64029330
ret
mov ecx, dword [esp + 4]
jmp fcn.64029400
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov eax, dword [edx]
push ecx
mov ecx, dword [esp + 8]
push eax
call fcn.64029410
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [ecx]
mov eax, dword [eax + 4]
mov ecx, dword [esp + 4]
push edx
push eax
call fcn.64029420
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 4]
mov eax, dword [edx]
mov ecx, dword [esp + 4]
push eax
call fcn.64029440
ret
mov ecx, dword [esp + 4]
jmp fcn.64029460
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 4]
mov ecx, dword [esp + 4]
push edx
call fcn.64029470
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [esp + 8]
call fcn.64029480
ret
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
mov eax, dword [ecx + 4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0x10]
push edx
call fcn.64029240
ret

Function at 0x640917e3
Capabilities:
Check os version

Disassembly:
cmp dword [esp + 8], 0
jne case.default.0x640917c8
mov eax, dword [esp + 0xc]
cmp eax, 8
ja case.default.0x640917c8
jmp dword [eax*4 + 0x64091880]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov ecx, dword [esp + 4]
push edx
call fcn.64029330
ret
mov ecx, dword [esp + 4]
jmp fcn.64029400
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov eax, dword [edx]
push ecx
mov ecx, dword [esp + 8]
push eax
call fcn.64029410
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [ecx]
mov eax, dword [eax + 4]
mov ecx, dword [esp + 4]
push edx
push eax
call fcn.64029420
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 4]
mov eax, dword [edx]
mov ecx, dword [esp + 4]
push eax
call fcn.64029440
ret
mov ecx, dword [esp + 4]
jmp fcn.64029460
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 4]
mov ecx, dword [esp + 4]
push edx
call fcn.64029470
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [esp + 8]
call fcn.64029480
ret
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
mov eax, dword [ecx + 4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0x10]
push edx
call fcn.64029240
ret
Function at 0x64092b30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x640a7e49
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x640ee650]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
push eax
lea edx, [esp + 0x40]
mov dword [esp + 0x18], edx
lea edx, [esp + 0x48]
push 4
mov dword [esp + 0x24], edx
lea edx, [esp + 0x58]
push 0x640ee5b0
push ecx
mov dword [esp + 0x40], 2
mov dword [esp + 0x1c], 0
mov dword [esp + 0x34], edx
call dword [sym.imp.QtCore4.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___]
mov ecx, dword [esp + 0x48]
add esp, 0x10
mov byte [esp + 0x30], 1
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::deref_void_]
test al, al
jne 0x64092be7
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0xc]
lea edx, [eax + ecx*4 + 0x14]
mov ecx, dword [eax + 8]
push edx
lea edx, [eax + ecx*4 + 0x14]
push edx
lea ecx, [esp + 0x40]
mov esi, eax
call fcn.64014a20
push esi
call dword [sym.imp.QtCore4.dll_void___cdecl_qFree_void__]
add esp, 4
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov esi, dword [esp + 0x4c]
mov edi, dword [esp + 0x48]
mov dword [esp + 0x30], 0xffffffff
test esi, esi
je 0x64092c44
lea ecx, [esi + 8]
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::deref_void_]
test al, al
jne 0x64092c2d
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
test al, al
jne 0x64092c2d
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esi + 4]
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::deref_void_]
test al, al
jne 0x64092c44
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 0x20
Function at 0x64093d00
Capabilities:
Check http status code
Reference http user-agent string
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ecx + 4]
cmp byte [eax + 0x90], 0
mov byte [eax + 0x95], 0
je 0x64068fe8
jmp fcn.64067ab0
ret
mov eax, dword [ecx + 4]
cmp byte [eax + 0x91], 0
mov byte [eax + 0x96], 0
je 0x64069008
jmp fcn.64067ad0
ret
mov eax, dword [ecx + 4]
mov byte [eax + 0x97], 0
jmp fcn.64067b10
mov eax, dword [ecx + 4]
cmp dword [eax + 0x88], 2
jne 0x640695ca
cmp byte [eax + 0x91], 0
je 0x640695ca
jmp fcn.64069180
ret
cmp dword [esp + 8], 0
jne case.default.0x64093d10
mov eax, dword [esp + 0xc]
cmp eax, 8
ja case.default.0x64093d10
jmp dword [eax*4 + 0x64093d80]
mov ecx, dword [esp + 4]
jmp fcn.64069880
mov ecx, dword [esp + 4]
jmp sym.QtNetwork4.dll_public_virtual:_void___thiscall_QNetworkReply::ignoreSslErrors_void_
mov ecx, dword [esp + 4]
jmp fcn.64069c70
mov ecx, dword [esp + 4]
jmp 0x640695b0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov ecx, dword [esp + 4]
push edx
call fcn.640695d0
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov ecx, dword [esp + 4]
push edx
call sym.QtNetwork4.dll_public_virtual:_void___thiscall_QNetworkSessionPrivate::setALREnabled_bool_
ret
mov ecx, dword [esp + 4]
jmp 0x64068fd0
mov ecx, dword [esp + 4]
jmp 0x64068ff0
mov ecx, dword [esp + 4]
jmp 0x64069010

Function at 0x64093d17
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, dword [ecx + 4]
cmp byte [eax + 0x90], 0
mov byte [eax + 0x95], 0
je 0x64068fe8
jmp fcn.64067ab0
ret
mov eax, dword [ecx + 4]
cmp byte [eax + 0x91], 0
mov byte [eax + 0x96], 0
je 0x64069008
jmp fcn.64067ad0
ret
mov eax, dword [ecx + 4]
mov byte [eax + 0x97], 0
jmp fcn.64067b10
mov eax, dword [ecx + 4]
cmp dword [eax + 0x88], 2
jne 0x640695ca
cmp byte [eax + 0x91], 0
je 0x640695ca
jmp fcn.64069180
ret
cmp dword [esp + 8], 0
jne case.default.0x64093d10
mov eax, dword [esp + 0xc]
cmp eax, 8
ja case.default.0x64093d10
jmp dword [eax*4 + 0x64093d80]
mov ecx, dword [esp + 4]
jmp fcn.64069880
mov ecx, dword [esp + 4]
jmp sym.QtNetwork4.dll_public_virtual:_void___thiscall_QNetworkReply::ignoreSslErrors_void_
mov ecx, dword [esp + 4]
jmp fcn.64069c70
mov ecx, dword [esp + 4]
jmp 0x640695b0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov ecx, dword [esp + 4]
push edx
call fcn.640695d0
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov ecx, dword [esp + 4]
push edx
call sym.QtNetwork4.dll_public_virtual:_void___thiscall_QNetworkSessionPrivate::setALREnabled_bool_
ret
mov ecx, dword [esp + 4]
jmp 0x64068fd0
mov ecx, dword [esp + 4]
jmp 0x64068ff0
mov ecx, dword [esp + 4]
jmp 0x64069010
Function at 0x64093d29
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ecx + 4]
cmp byte [eax + 0x90], 0
mov byte [eax + 0x95], 0
je 0x64068fe8
jmp fcn.64067ab0
ret
mov eax, dword [ecx + 4]
cmp byte [eax + 0x91], 0
mov byte [eax + 0x96], 0
je 0x64069008
jmp fcn.64067ad0
ret
mov eax, dword [ecx + 4]
mov byte [eax + 0x97], 0
jmp fcn.64067b10
mov eax, dword [ecx + 4]
cmp dword [eax + 0x88], 2
jne 0x640695ca
cmp byte [eax + 0x91], 0
je 0x640695ca
jmp fcn.64069180
ret
cmp dword [esp + 8], 0
jne case.default.0x64093d10
mov eax, dword [esp + 0xc]
cmp eax, 8
ja case.default.0x64093d10
jmp dword [eax*4 + 0x64093d80]
mov ecx, dword [esp + 4]
jmp fcn.64069880
mov ecx, dword [esp + 4]
jmp sym.QtNetwork4.dll_public_virtual:_void___thiscall_QNetworkReply::ignoreSslErrors_void_
mov ecx, dword [esp + 4]
jmp fcn.64069c70
mov ecx, dword [esp + 4]
jmp 0x640695b0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov ecx, dword [esp + 4]
push edx
call fcn.640695d0
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov ecx, dword [esp + 4]
push edx
call sym.QtNetwork4.dll_public_virtual:_void___thiscall_QNetworkSessionPrivate::setALREnabled_bool_
ret
mov ecx, dword [esp + 4]
jmp 0x64068fd0
mov ecx, dword [esp + 4]
jmp 0x64068ff0
mov ecx, dword [esp + 4]
jmp 0x64069010
Function at 0x640943f8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x640ee650]
jne 0x64094402
repz ret
jmp fcn.64094b0b
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x53612a11
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xc8d26f8
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x9cb5a5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9cb5cc
call fcn.0096daf8
mov dword [eax], esi
call fcn.0096dae5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0096e73a
mov eax, esi
jmp 0x9cb621
test dword [ebp + 0xc], 0xfffffff9
jne 0x9cb5b2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9cb5f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0096db0b
pop ecx
call fcn.0096dae5
mov eax, dword [eax]
jmp 0x9cb621
test al, 0x10
jne 0x9cb61f
test al, 1
je 0x9cb61f
test byte [ebp + 0xc], 2
je 0x9cb61f
call fcn.0096daf8
mov dword [eax], 5
call fcn.0096dae5
mov dword [eax], 0xd
jmp 0x9cb5f0
xor eax, eax
pop esi
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4b74781c
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x37bf48b6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401aa0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401adf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401adf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401adf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401adf
cmp dword [ecx + 0x74], 0xe
jbe 0x401adf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x406bd0
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x406c1b
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00406d6b
test al, al
jne 0x406c15
sub edx, 2
cmp edx, edi
jne 0x406bfb
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x406c3d
lea eax, [edi + 2]
cmp edx, eax
je 0x406c3d
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00406b1c
add esp, 0x10
jmp 0x406d37
push esi
lea ecx, [ebp - 0x255]
call fcn.00406d6b
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406c80
push dword [ebp - 0x25c]
jmp 0x406c2d
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x406cbd
cmp word [ebp - 0x226], 0
je 0x406cde
cmp word [ebp - 0x226], ax
jne 0x406cbd
cmp word [ebp - 0x224], 0
je 0x406cde
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00406b1c
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x406d2a
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x406c97
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x406d12
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x406d37
push 0x40694c
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00409870
add esp, 0x10
jmp 0x406d07
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040126a
leave
ret