joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035bb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1008ba4c]
test eax, eax
jne 0x10035c19
push dword [0x1008a930]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x10035c19
push esi
push 0x16c
call fcn.100486a0
add esp, 4
test eax, eax
je 0x10035be6
mov ecx, eax
call fcn.100486a0
mov esi, eax
jmp 0x10035be8
xor esi, esi
cmp byte [0x1008ba48], 0
jne 0x10035c02
mov ecx, esi
mov dword [0x1008ba4c], esi
call fcn.1001d780
mov eax, esi
pop esi
ret
push esi
push dword [0x1008a930]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, esi
call fcn.1001d780
mov eax, esi
pop esi
ret

Function at 0x10035c20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1008a930]
cmp eax, 0xffffffff
je 0x10035c76
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10035c67
mov ecx, dword [0x1008ba4c]
xor eax, eax
cmp esi, ecx
cmove ecx, eax
mov dword [0x1008ba4c], ecx
mov ecx, esi
call fcn.1001d7b0
mov ecx, esi
call fcn.1001d750
push 0x16c
push esi
call fcn.100486a0
add esp, 8
push 0
push dword [0x1008a930]
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
ret

Function at 0x100486a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100486af
pop dword [ebp - 0x20]
mov eax, 0xa16aed3e
add eax, 0x6e999971
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x116ede1d
add dword [ebp - 0x30], 0x3ce3672e
mov dword [ebp - 0x2c], 0xd96bbe1c
add dword [ebp - 0x2c], 0x58c78e29
mov dword [ebp - 0x28], 0xe74bb41c
add dword [ebp - 0x28], 0x65009012
mov dword [ebp - 0x24], 0x1e8e588a
sub dword [ebp - 0x24], 0x1e8e588a
lea eax, [ebp - 0x30]
push eax
mov eax, 0xd3e71fb0
sub eax, 0xc3e0ef98
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x73d1dbb
add dword [ebp - 0x30], 0x6d354b9b
mov dword [ebp - 0x2c], 0x602533e9
sub dword [ebp - 0x2c], 0x1eb8d274
mov dword [ebp - 0x28], 0xd4af8dd4
sub dword [ebp - 0x28], 0x71402168
mov dword [ebp - 0x24], 0x3239973a
sub dword [ebp - 0x24], 0x3239973a
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x52e00
push 0
call eax
mov ecx, 0x94e0edbf
sub ecx, 0x94e0aaea
xor edi, edi
add edi, eax
mov esi, 0x10098600
add esi, dword [ebp - 0x20]
mov ebx, 0x2f3291
mov dword [ebp - 0x18], 0x3febd03
mov edx, dword [esi]
xor dword [ebp - 0x10], 0xe6f85b68
add edx, ebx
add dword [ebp - 0xc], esi
mov dword [edi], edx
mov dword [ebp - 0x14], 0x5fe6a635
add edi, 0xe13ceb6f
sub edi, 0xe13ceb6b
add esi, 4
loop 0x100487c2
add eax, 0x16707e8c
add eax, 0xe9907f9b
mov ebx, eax
add eax, 5
mov ecx, 0x2691a138
add ecx, 0xe96e5ec8
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x450591
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4505a0
pop dword [ebp - 0x2c]
mov eax, 0x83cd1e1f
sub eax, 0x8388187f
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3aa46
push 0
mov eax, 0xf6ff7de4
sub eax, 0xf6b65fc4
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xe1001baf
sub ecx, 0xe0ffcca7
mov esi, eax
mov edi, 0x4a657e18
sub edi, 0x4a1bb818
add edi, dword [ebp - 0x2c]
mov ebx, 0x69546e0b
sub ebx, 0x8bcd89c8
xor dword [ebp - 0x20], eax
mov edx, dword [edi]
mov dword [ebp - 4], 0x1bed084
xor edx, ebx
xor dword [ebp - 8], 0xf85f7581
mov dword [esi], edx
mov dword [ebp - 0x20], 0xb0b9aa7a
add esi, 0xdd99b9c5
add esi, 0x2266463f
add edi, 0x6a161e1d
sub edi, 0x6a161e19
loop 0x4505ff
add eax, 0x40d421c4
sub eax, 0x40d2f2d1
xor ebx, ebx
add ebx, eax
add eax, 0x5aa4f169
sub eax, 0x5aa4f164
mov ecx, 0x7b1eef01
add ecx, 0x852110ff
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x1805bb2e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x538]
call fcn.1805ac7f
jg 0x1805bba2
add ecx, dword [eax + eax*4]
movsd dword es:[edi], dword [esi]
sar ch, 1
invalid
clc
das
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
invalid

Function at 0x1805bb76
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [ebp - 0x65243], 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1805ac5d
or byte [eax + 0x2ff845c6], ah

Function at 0x1805cc37
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esp
loopne 0x1805cc39
invalid
call [ecx + 0x50]
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1805ac44
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x1805cc62
jmp 0x1805c621
cmp dword [ebp - 0x37c], 0
je 0x1805cc70
jmp 0x1805cd25
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x1805ccc9
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x1805ccce
jmp 0x1805c621
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x1805cd15
lea eax, [ebp - 0x714]
push eax
call fcn.1805ac8f
xchg ebx, eax
invalid
invalid
call [ecx + 0x50]
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1805ac44
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x1805cd20
jmp 0x1805cd25
jmp 0x1805c621
cmp dword [ebp - 0x37c], 0
jne 0x1805cdcf
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
Function at 0x180dbc6f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x14], edx
xor eax, eax
mov dword [esi], ebx
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
cmp dword [edi + 0x10], eax
je 0x180dbdc4
cmp dword [edi + 0x10], 0x20
jne 0x180dbdc4
mov dword [ebp - 0x18], ebx
mov edx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x180dbcc7
mov eax, dword [edi]
mov cl, byte [eax + edx]
call fcn.180dbbc3
cmp al, 0xff
je 0x180dbdc4
mov ecx, dword [ebp - 0x18]
shl ecx, 4
movzx eax, al
add ecx, eax
inc edx
mov dword [ebp - 0x18], ecx
cmp edx, 8
jl 0x180dbcbd
jmp 0x180dbd1a
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x180dbcf7
mov eax, dword [edi]
mov cl, byte [eax + edx]
call fcn.180dbbc3
cmp al, 0xff
je 0x180dbdc4
mov ecx, dword [ebp - 0x1c]
shl ecx, 4
movzx eax, al
add cx, ax
inc edx
movzx ecx, cx
mov dword [ebp - 0x1c], ecx
cmp edx, 0xc
jl 0x180dbced
cmp edx, 0x10
jae 0x180dbd56
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x180dbd2e
mov eax, dword [edi]
mov cl, byte [eax + edx]
call fcn.180dbbc3
cmp al, 0xff
je 0x180dbdc4
mov ecx, dword [ebp - 0x20]
shl ecx, 4
movzx eax, al
add cx, ax
inc edx
movzx ecx, cx
mov dword [ebp - 0x20], ecx
cmp edx, 0x10
jl 0x180dbd24
mov byte [ebp - 0xd], bl
mov al, 1
cmp edx, 0x20
jae 0x180dbda6
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x14], ecx
xor al, 1
cmp dword [edi + 0x14], 0x10
mov byte [ebp - 0xe], al
mov eax, edi
jb 0x180dbd75
mov eax, dword [edi]
mov cl, byte [eax + edx]
call fcn.180dbbc3
mov cl, byte [ebp - 0xd]
shl cl, 4
add cl, al
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xd], cl
test al, al
je 0x180dbd9a
mov esi, dword [ebp - 0x14]
inc dword [ebp - 0x14]
mov byte [ebp - 0xd], bl
mov byte [esi], cl
inc edx
cmp edx, 0x20
jl 0x180dbd66
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov dword [esi], eax
mov eax, dword [ebp - 0x1c]
mov word [esi + 4], ax
mov eax, dword [ebp - 0x20]
mov word [esi + 6], ax
mov eax, dword [ebp - 8]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
jmp 0x180dbdca
mov eax, dword [ebp - 0x14]
mov byte [eax], 1
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18118dc8
leave
ret
Function at 0x180e8443
Capabilities:
Create http request

Disassembly:
push ebx
push esi
mov esi, ecx
xor eax, eax
inc eax
push 0x102
mov dword [esi + 4], eax
mov dword [esi + 8], eax
lea eax, [esi + 0x14]
push eax
mov dword [esi], 0x181993f0
mov dword [esi + 0xc], 0x18198ef0
call fcn.181551d5
xor ebx, ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
push 0x2c
lfence
call fcn.18119678
add esp, 0xc
mov dword [eax], eax
push 0x10000000
push ebx
push ebx
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
push ebx
mov dword [esi + 0x44], eax
push ebx
mov byte [esi + 0x4c], bl
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 0x10], eax
mov eax, esi
pop esi
pop ebx
ret
Function at 0x180f3b9f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, ecx
mov dword [ebp - 0x28], 0xf
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x3c], ebx
lea esi, [edx + 1]
mov dword [ebp - 0x2c], ebx
mov al, byte [edx]
inc edx
test al, al
jne 0x180f3bc5
sub edx, esi
push edx
push ecx
lea ecx, [ebp - 0x3c]
call fcn.1801e678
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x20]
call fcn.180d67e3
mov eax, dword [ebp - 0x28]
cmp eax, 0x10
jb 0x180f3c1a
mov ecx, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], ecx
cmp eax, 0x1000
jb 0x180f3c11
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.18007c32
mov eax, dword [ebp - 8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x24]
push eax
push ecx
call fcn.181192f6
pop ecx
pop ecx
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
jb 0x180f3c26
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180f3c38
test al, 0x10
jne 0x180f3c38
mov bl, 1
lea ecx, [ebp - 0x20]
call fcn.1800fd77
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.18118dc8
leave
ret

Function at 0x180fd86b
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
fild dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
fstp qword [esi + 8]
fild dword [ebp + 0xc]
mov dword [esi], 0x18199830
fstp qword [esi + 0x10]
fld qword [ebp + 0x10]
fstp qword [esi + 0x18]
fld qword [ebp + 0x18]
fstp qword [esi + 0x20]
fldz
fst qword [esi + 0x28]
fst qword [esi + 0x30]
fstp qword [esi + 0x38]
call fcn.181557ad
or dword [esi + 0x13c4], 0xffffffff
lea edi, [esi + 0x48]
mov ecx, eax
xor edx, edx
mov dword [esi + 0x44], ecx
inc edx
mov ebx, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
inc edx
mov dword [edi], ecx
lea edi, [edi + 4]
cmp edx, ebx
jb 0x180fd8b9
fldz
mov ecx, esi
mov dword [esi + 0x40], ebx
fstp qword [esi + 0x13c8]
fld1
fstp qword [esi + 0x13d0]
call fcn.180fd966
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
Function at 0x18148ffa
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.18148c77

Function at 0x1814fd64
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1814fbda

Function at 0x18154720
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1815474d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1815474d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401660
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4015f0
push 0x401eb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x20]
cmp eax, 3
ja case.default.0x401697
jmp dword [eax*4 + 0x4017e0]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne case.default.0x401697
lea ecx, [ebp - 0x24]
push ecx
push 0x2001f
push ebx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne case.default.0x401697
mov edx, dword [ebp + 0x14]
cmp edx, ebx
jbe case.default.0x401697
cmp edx, 2
jbe 0x401720
cmp edx, 4
jne case.default.0x401697
push edx
lea ecx, [ebp + 0x1c]
push ecx
push edx
push ebx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne case.default.0x401697
jmp 0x4017a4
mov esi, dword [ebp + 0x18]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push edx
push ebx
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne case.default.0x401697
jmp 0x4017a4
lea eax, [ebp - 0x24]
push eax
push 0x2001f
push ebx
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne case.default.0x401697
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne case.default.0x401697
jmp 0x4017a4
lea edx, [ebp - 0x24]
push edx
push 0x2001f
push ebx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne case.default.0x401697
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne case.default.0x401697
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.004017cb
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401820
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push ebp
push 0x401448
push eax
call sub.MSVCRT.dll_fopen
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x40183b
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ebx
push esi
push edi
push ecx
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
test esi, esi
mov ebx, eax
je 0x401888
test edi, edi
je 0x401888
test ebx, ebx
je 0x401888
push ebp
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push eax
push 1
push ebx
call sub.MSVCRT.dll_fwrite
add esp, 0x10
push ebp
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401d40
Capabilities:
Start service

Disassembly:
push edi
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x401d85
mov eax, dword [esp + 8]
push ebx
push esi
push 0x10010
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x401d80
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
call ebx
push edi
call ebx
pop esi
pop ebx
pop edi
ret

Function at 0x401d90
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
sub esp, 0x520
call dword [sym.imp.USER32.dll_GetInputState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0
push 0
lea eax, [esp + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
push 0x4015b4
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
push eax
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
je 0x401de3
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
push 0x401800
call dword [sym.imp.KERNEL32.DLL_SetUnhandledExceptionFilter]
push 0x4011ee
push 0x40118a
call fcn.00401ae0
mov esi, eax
add esp, 8
test esi, esi
je 0x401ea4
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push esi
lea edx, [esp + 0x12c]
push 0x4014ec
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
add esp, 0xc
lea eax, [esp + 0x24]
push 0
push eax
call edi
lea ecx, [esp + 0x28]
push eax
push ecx
push 1
lea edx, [esp + 0x138]
push 0x4015a4
push edx
push 0x80000002
call fcn.00401660
add esp, 0x1c
push 0
push 0x40137e
call edi
push eax
push 0x40137e
push 1
lea eax, [esp + 0x138]
push 0x401594
push eax
push 0x80000002
call fcn.00401660
push esi
call fcn.00401d40
add esp, 0x20
pop edi
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x4047ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40480e
pop dword [ebp - 0x40]
mov eax, 0x6e5affc
add eax, 0xf95a9812
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x8c1ec858
sub dword [ebp - 0x50], 0x3dcc830d
mov dword [ebp - 0x4c], 0x941e182d
add dword [ebp - 0x4c], 0x9e153418
mov dword [ebp - 0x48], 0xd3f15a02
add dword [ebp - 0x48], 0x785aea2c
mov dword [ebp - 0x44], 0xc170cb96
add dword [ebp - 0x44], 0x3e8f346a
lea eax, [ebp - 0x50]
push eax
mov eax, 0xb7b5d720
sub eax, 0xb7723670
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x2743de73
sub dword [ebp - 0x50], 0xb2d1751d
mov dword [ebp - 0x4c], 0x12d729cc
add dword [ebp - 0x4c], 0x2e9537a9
mov dword [ebp - 0x48], 0x76fb8ff6
add dword [ebp - 0x48], 0xec73dc76
mov dword [ebp - 0x44], 0xb8330935
sub dword [ebp - 0x44], 0xb8330935
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xe7294835
sub eax, 0xe6e5a7fd
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3efb6
push 0
call eax
mov ecx, 0xa45b86da
sub ecx, 0xa45b3c04
xor ebx, ebx
add ebx, eax
mov edx, 0x1f5231a4
sub edx, 0x1f0cb7a4
add edx, dword [ebp - 0x40]
mov edi, 0xd6a66695
xor dword [ebp - 0x10], edi
mov esi, dword [edx]
add dword [ebp - 0x28], eax
add esi, edi
add dword [ebp - 8], 0xb60ce77a
mov dword [ebx], esi
sub dword [ebp - 0x28], edx
add ebx, 4
add edx, 0xc224d749
sub edx, 0xc224d745
loop 0x40492c
add eax, 0x11e2b
xor ebx, ebx
add ebx, eax
add eax, 0xe0faf70c
add eax, 0x1f0508f9
mov ecx, 0xa17a20b2
add ecx, 0x5ec5df4e
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x402060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x415979
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x6a65d4]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x30]
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QMessageLogger::constructor_char_const___int__char_const__]
mov ecx, eax
call dword [sym.imp.QL_Core.dll_public:_class_QDebug___thiscall_QMessageLogger::debug_void_]
push 0x419f58
mov ecx, eax
mov dword [esp + 0x40], ebx
call dword [sym.imp.QL_Core.dll_public:_class_QDebug____thiscall_QDebug::operator___char_const__]
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0xffffffff
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QDebug::destructor_void_]
mov edx, dword [sym.imp.QL_Core.dll_struct_QMetaObject_const_QIODevice::staticMetaObject]
mov ecx, dword [sym.imp.QL_Core.dll_public:_void___thiscall_QIODevice::readyRead_void_]
mov edi, dword [sym.imp.QL_Core.dll_private:_static_bool___cdecl_QObject::disconnectImpl_class_QObject_const___void____class_QObject_const___void____struct_QMetaObject_const__]
push edx
mov edx, dword [esi + 0x40]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], ecx
push esi
lea ecx, [esp + 0x20]
push ecx
push edx
mov dword [esp + 0x24], 0x401c10
call edi
mov ecx, dword [sym.imp.QL_Network.dll_struct_QMetaObject_const_QNetworkReply::staticMetaObject]
mov eax, dword [sym.imp.QL_Network.dll_public:_void___thiscall_QNetworkReply::error_enum_QNetworkReply::NetworkError_]
push ecx
mov ecx, dword [esi + 0x40]
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x38], eax
push esi
lea eax, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x40], fcn.00401ca0
call edi
mov ecx, dword [esp + 0x6c]
add esp, 0x28
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QObject::deleteLater_void_]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
cmp byte [esi + 0xc], bl
je 0x402176
mov ecx, dword [esi + 0x2c]
mov byte [esi + 0xc], bl
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QTimer::stop_void_]
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x34]
call eax
mov ecx, dword [esi + 0x24]
cmp ecx, ebx
je 0x40215e
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push 1
call eax
push ecx
lea edx, [esi + 0x3c]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov ecx, esi
call fcn.00413540
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret 4