joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67155fd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67299b28
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x674c7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
push 0x30
call fcn.67284a71
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
push 0x50f01
call sym.Qt5Core.dll_public:_void___thiscall_QObjectPrivate::constructor_int_
push dword [ebp + 8]
mov ecx, esi
push eax
call sym.Qt5Core.dll_protected:_void___thiscall_QObject::constructor_class_QObjectPrivate___class_QObject__
mov dword [ebp - 4], 0
mov dword [esi], vtable.QWindowsPipeReader.0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0x1000
mov byte [ebp - 4], 1
push 0xc
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 1
mov word [esi + 0x3c], 0
mov dword [ebp + 8], sym.Qt5Core.dll_private:_void___thiscall_QWindowsPipeReader::emitPendingReadyRead_void_
mov dword [ebp - 0x10], sym.Qt5Core.dll_public:_void___thiscall_QWindowsPipeReader::_q_queueReadyRead_struct_QWindowsPipeReader::QPrivateSignal_
call fcn.67284a71
push sym.Qt5Core.dll_struct_QMetaObject_const_QWindowsPipeReader::staticMetaObject
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
push 0
push 2
push eax
mov dword [eax], 1
mov dword [eax + 4], 0x67156a60
mov dword [eax + 8], ecx
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push esi
push eax
call sym.Qt5Core.dll_private:_static_class_QMetaObject::Connection___cdecl_QObject::connectImpl_class_QObject_const___void____class_QObject_const___void____class_QtPrivate::QSlotObjectBase___enum_Qt::ConnectionType__int_const___struct_QMetaObject_const__
mov ecx, dword [ebp - 0x14]
add esp, 0x28
test ecx, ecx
je 0x671560e6
or eax, 0xffffffff
lock xadd dword [ecx + 0x24], eax
dec eax
jne 0x671560e6
push ecx
call fcn.671b91e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x67156500
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6728695d
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x674c7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x67156547
mov edi, dword [ebp - 0x14]
jmp 0x67156565
cmp byte [esi + 0x3b], 0
jne 0x67156563
push 0
push 2
push sym.Qt5Core.dll_struct_QMetaObject_const_QWindowsPipeReader::staticMetaObject
push esi
mov byte [esi + 0x3b], 1
call sym.Qt5Core.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___
add esp, 0x10
xor edi, edi
mov eax, 0x1000
cmp edi, eax
cmovb edi, eax
cmp byte [esi + 0x3b], 0
jne 0x67156678
mov ecx, dword [esi + 0x10]
mov eax, ecx
mov edx, dword [esi + 0x14]
or eax, edx
je 0x6715665b
sub ecx, dword [esi + 0x20]
sbb edx, dword [esi + 0x24]
xor eax, eax
cmp eax, edx
jl 0x671565b3
jg 0x6715659b
cmp edi, ecx
jbe 0x671565b3
mov edi, ecx
mov ecx, edx
test ecx, ecx
jl 0x67156678
jg 0x671565b1
test edi, edi
je 0x67156678
mov eax, ecx
push eax
lea ecx, [esi + 0x18]
push edi
call sym.Qt5Core.dll_public:_char____thiscall_QRingBuffer::reserve_long_long___int64__
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0xc]
mov word [esi + 0x38], 0x100
test eax, eax
jne 0x671565e0
push 0x18
call fcn.67284a71
mov dword [ebp - 0x10], eax
add esp, 4
mov dword [eax + 0x14], esi
mov dword [esi + 0xc], eax
push sym.Qt5Core.dll_private:_static_void___stdcall_QWindowsPipeReader::readFileCompleted_unsigned_long_int__unsigned_long_int__struct__OVERLAPPED__
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
push dword [esi + 0xc]
push edi
push dword [ebp - 0x14]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x67156678
mov byte [esi + 0x39], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, edi
sub ecx, 0x6d
je 0x67156662
sub ecx, 0x7c
je 0x67156662
push 0x22
push str.QWindowsPipeReader::startAsyncRead
call sym.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromLatin1_helper_char_const___int_
add esp, 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push edi
mov ecx, esi
call sym.Qt5Core.dll_public:_void___thiscall_QWindowsPipeReader::winError_unsigned_long_int__class_QString_const__
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_void___thiscall_QVector_class_QPoint_::destructor_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x671565b3
push 0
push 2
push sym.Qt5Core.dll_struct_QMetaObject_const_QWindowsPipeReader::staticMetaObject
push esi
mov byte [esi + 0x3b], 1
call sym.Qt5Core.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x67156710
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
call fcn.671dc950
cmp dword [0x674e4954], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount64]
ja 0x6715674a
cmp dword [0x674e4950], 0
ja 0x6715674a
call ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
jmp 0x67156765
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
or ecx, 0xffffffff
mov byte [edi + 0x3a], 0
cmp esi, ecx
mov eax, esi
push 1
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_SleepEx]
cmp eax, 0xc0
jne 0x67156820
nop word [eax + eax]
cmp byte [edi + 0x3a], 0
jne 0x6715682c
call fcn.671dc950
cmp dword [0x674e4954], 0
ja 0x671567b5
cmp dword [0x674e4950], 0
ja 0x671567b5
call ebx
jmp 0x671567c8
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
cmp esi, 0xffffffff
jne 0x671567d1
or ecx, esi
jmp 0x67156801
sub eax, dword [esp + 0xc]
sbb edx, dword [esp + 0x10]
push edx
push eax
call fcn.671dc9b0
add esp, 8
push 0
push 0xf4240
push edx
push eax
call fcn.67286040
mov ecx, esi
sub ecx, eax
mov eax, 0
cmovs ecx, eax
test ecx, ecx
je 0x67156820
cmp ecx, 0xffffffff
mov eax, 0xffffffff
push 1
cmove ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_SleepEx]
cmp eax, 0xc0
je 0x67156790
mov al, byte [edi + 0x3a]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x67156f10
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
call fcn.671dc950
cmp dword [0x674e4954], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount64]
ja 0x67156f4a
cmp dword [0x674e4950], 0
ja 0x67156f4a
call ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
jmp 0x67156f65
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
or ecx, 0xffffffff
mov byte [edi + 0x22], 0
cmp esi, ecx
mov eax, esi
push 1
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_SleepEx]
cmp eax, 0xc0
jne 0x67157020
nop word [eax + eax]
cmp byte [edi + 0x22], 0
jne 0x6715702c
call fcn.671dc950
cmp dword [0x674e4954], 0
ja 0x67156fb5
cmp dword [0x674e4950], 0
ja 0x67156fb5
call ebx
jmp 0x67156fc8
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
cmp esi, 0xffffffff
jne 0x67156fd1
or ecx, esi
jmp 0x67157001
sub eax, dword [esp + 0xc]
sbb edx, dword [esp + 0x10]
push edx
push eax
call fcn.671dc9b0
add esp, 8
push 0
push 0xf4240
push edx
push eax
call fcn.67286040
mov ecx, esi
sub ecx, eax
mov eax, 0
cmovs ecx, eax
test ecx, ecx
je 0x67157020
cmp ecx, 0xffffffff
mov eax, 0xffffffff
push 1
cmove ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_SleepEx]
cmp eax, 0xc0
je 0x67156f90
mov al, byte [edi + 0x22]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x67157040
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x21], 0
jne 0x67157102
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x6715706c
push 0x18
call fcn.67284a71
add esp, 4
mov dword [esp + 0xc], eax
mov dword [eax + 0x14], esi
mov dword [esi + 0xc], eax
push dword [esp + 0x14]
xorps xmm0, xmm0
lea ecx, [esi + 0x10]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
call fcn.670329e0
mov eax, dword [esi + 0x10]
push sym.Qt5Core.dll_private:_static_void___stdcall_QWindowsPipeWriter::writeFileCompleted_unsigned_long_int__unsigned_long_int__struct__OVERLAPPED__
push dword [esi + 0xc]
mov word [esi + 0x20], 0x100
mov ecx, dword [eax + 0xc]
push dword [eax + 4]
add ecx, eax
push ecx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
jne 0x6715710c
mov byte [esi + 0x21], al
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
test eax, eax
je 0x671570cc
cmp eax, 0xffffffff
je 0x671570e0
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
setne al
test al, al
jne 0x671570e0
mov eax, dword [esi + 0x10]
cmp eax, 0x674c7cb4
je 0x671570e0
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [esi + 0x10], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
je 0x67157102
push str.QWindowsPipeWriter::write_failed.
push eax
call sym.Qt5Core.dll_void___cdecl_qErrnoWarning_int__char_const__
add esp, 8
xor al, al
pop edi
pop esi
add esp, 8
ret 4
pop edi
mov al, 1
pop esi
add esp, 8
ret 4
Function at 0x67183010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
mov eax, dword [esp + 0x68]
mov dword [esp + 0x1c], edx
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 0x10], ebp
push esi
push edi
cmp eax, 0x20
jle 0x671831d2
lea edx, [eax - 0x21]
shr edx, 5
inc edx
mov dword [esp + 0x1c], edx
nop dword [eax]
lea eax, [ebp + 0x80]
mov dword [esp + 0x28], eax
cmp ebp, eax
je 0x671831bf
lea ebx, [ebp + 4]
mov dword [esp + 0x14], ebx
cmp ebx, eax
je 0x671831bf
mov esi, dword [esp + 0x7c]
lea eax, [esi + 4]
mov dword [esp + 0x20], eax
nop dword [eax]
push dword [esp + 0x20]
mov ecx, dword [esi + 0x14]
push dword [esi]
mov edx, dword [ebx]
mov edi, dword [ebp]
mov eax, dword [ecx]
push edx
mov dword [esp + 0x84], edx
lea edx, [esp + 0x5c]
push edx
mov dword [esp + 0x20], ebx
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x14]
lea edx, [esi + 4]
push edx
push dword [esi]
lea edx, [esp + 0x68]
mov eax, dword [ecx]
push edi
push edx
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
lea edx, [esp + 0x50]
push edx
lea edx, [esp + 0x64]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0xd0]
call eax
test al, al
je 0x671830e4
mov eax, ebx
sub eax, ebp
push eax
lea eax, [ebp + 4]
push ebp
push eax
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [esp + 0x84]
add esp, 0xc
mov dword [ebp], eax
jmp 0x671831a8
mov ecx, dword [esi + 0x14]
lea edx, [esi + 4]
push edx
push dword [esi]
lea edi, [ebx - 4]
push dword [esp + 0x80]
mov eax, dword [ecx]
lea edx, [esp + 0x3c]
mov dword [esp + 0x30], edi
mov edi, dword [edi]
push edx
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x14]
lea edx, [esi + 4]
push edx
push dword [esi]
lea edx, [esp + 0x48]
mov eax, dword [ecx]
push edi
push edx
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
lea edx, [esp + 0x30]
push edx
lea edx, [esp + 0x44]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0xd0]
call eax
test al, al
je 0x6718319e
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x78]
nop
mov ecx, dword [esp + 0x10]
lea edx, [esi + 4]
mov eax, dword [ebp]
push edx
mov dword [esp + 0x14], ebp
lea edx, [esp + 0x34]
mov dword [ecx], eax
sub ebp, 4
mov ecx, dword [esi + 0x14]
push dword [esi]
mov edi, dword [ebp]
mov eax, dword [ecx]
push ebx
push edx
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x14]
lea edx, [esi + 4]
push edx
push dword [esi]
lea edx, [esp + 0x48]
mov eax, dword [ecx]
push edi
push edx
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
lea edx, [esp + 0x30]
push edx
lea edx, [esp + 0x44]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0xd0]
call eax
test al, al
jne 0x67183140
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x78]
mov dword [ecx], eax
mov eax, dword [esp + 0x28]
add ebx, 4
mov dword [esp + 0x14], ebx
cmp ebx, eax
jne 0x67183070
mov edx, dword [esp + 0x1c]
sub edx, 1
mov dword [esp + 0x18], eax
mov ebp, eax
mov dword [esp + 0x1c], edx
jne 0x67183040
push dword [esp + 0x7c]
mov edx, dword [esp + 0x30]
mov ecx, ebp
call fcn.67181e10
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
Function at 0x67195fe0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6729d6dd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x674c7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ecx + 4]
mov ecx, dword [ebx + 0x30]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 8]
je 0x67196066
mov edi, dword [ebx + 0x20]
nop
inc dword [edi + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
xor esi, esi
mov ecx, dword [ebx + 0x30]
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
test eax, eax
jle 0x67196063
mov eax, dword [ecx + 8]
add eax, esi
mov ecx, dword [ecx + eax*4 + 0x10]
test ecx, ecx
je 0x67196055
push dword [ebp + 0x10]
mov eax, dword [ecx]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x6719607c
mov ecx, dword [ebx + 0x30]
inc esi
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
cmp esi, eax
jl 0x67196034
dec dword [edi + 8]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
dec dword [edi + 8]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x671974d0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, ecx
mov dword [esp + 0x10], eax
push ebx
push esi
mov eax, dword [eax + 4]
push edi
mov eax, dword [eax + 0x20]
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x671975c6
call fcn.671dc950
cmp dword [0x674e4954], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
ja 0x67197522
cmp dword [0x674e4950], 0
ja 0x67197522
call edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
jmp 0x67197540
lea eax, [esp + 0x10]
push eax
call ebx
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
nop dword [eax]
mov eax, dword [esp + 0x1c]
mov edx, dword [ebp + 8]
and edx, 0xfffffffb
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x20]
mov eax, dword [ecx + 0x2c]
test eax, eax
je 0x671975c6
mov ecx, dword [ecx + 0x2c]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x671975c6
call fcn.671dc950
cmp dword [0x674e4954], 0
ja 0x67197581
cmp dword [0x674e4950], 0
ja 0x67197581
call edi
jmp 0x67197590
lea eax, [esp + 0x20]
push eax
call ebx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, dword [esp + 0xc]
sbb edx, dword [esp + 0x10]
push edx
push eax
call fcn.671dc9b0
add esp, 8
push 0
push 0xf4240
push edx
push eax
call fcn.67286040
mov esi, eax
mov ecx, edx
mov eax, dword [ebp + 0xc]
cdq
cmp ecx, edx
jl 0x67197540
jg 0x671975c6
cmp esi, eax
jbe 0x67197540
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x67199d10
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
push 1
call sym.Qt5Core.dll_public:_static_class_QThreadData____cdecl_QThreadData::current_bool_
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0x67199df5
call fcn.671dc950
cmp dword [0x674e4954], 0
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
ja 0x67199d64
cmp dword [0x674e4950], 0
ja 0x67199d64
call edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
jmp 0x67199d80
lea eax, [esp + 0x10]
push eax
call ebx
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
nop dword [eax + eax]
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x2c]
mov eax, dword [ebp + 8]
and eax, 0xfffffffb
push eax
call edx
test al, al
je 0x67199df5
call fcn.671dc950
cmp dword [0x674e4954], 0
ja 0x67199db4
cmp dword [0x674e4950], 0
ja 0x67199db4
call edi
jmp 0x67199dc3
lea eax, [esp + 0x20]
push eax
call ebx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, dword [esp + 0xc]
sbb edx, dword [esp + 0x10]
push edx
push eax
call fcn.671dc9b0
add esp, 8
push 0
push 0xf4240
push edx
push eax
call fcn.67286040
mov esi, eax
mov ecx, edx
mov eax, dword [ebp + 0xc]
cdq
cmp ecx, edx
jl 0x67199d80
jg 0x67199df5
cmp esi, eax
jbe 0x67199d80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x671dd2c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x672a147e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x674c7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push 0x50f01
call sym.Qt5Core.dll_public:_void___thiscall_QObjectPrivate::constructor_int_
mov dword [ebp - 4], 0
mov dword [edi], vtable.QSharedMemoryPrivate.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [edi + 0x3c], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
lea esi, [edi + 0x48]
mov dword [ebp - 0x10], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [ebp - 0x18], esi
push 0x1c
mov byte [ebp - 4], 4
call fcn.67284a71
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [eax], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [eax + 4], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [eax + 0x18], 0
mov dword [esi], eax
push 0
push 0
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 5
push eax
mov ecx, esi
call sym.Qt5Core.dll_public:_void___thiscall_QSystemSemaphore::setKey_class_QString_const___int__enum_QSystemSemaphore::AccessMode_
mov eax, dword [sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null]
test eax, eax
je 0x671dd3af
cmp eax, 0xffffffff
je 0x671dd3bd
or eax, 0xffffffff
lock xadd dword [sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null], eax
dec eax
setne al
test al, al
jne 0x671dd3bd
mov eax, sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
cmp eax, 0x674c7cb4
je 0x671dd3bd
push sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov byte [edi + 0x4c], 0
mov eax, edi
mov dword [edi + 0x50], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x671dd930
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6728b02d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
mov eax, dword [0x674c7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [ebp + 8], 0
mov ecx, 4
push 0
push 0
mov eax, 0xf001f
cmove eax, ecx
mov ecx, esi
push 0
push eax
call sym.Qt5Core.dll_public:_void____thiscall_QSharedMemoryPrivate::handle_void_
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x30], eax
test eax, eax
jne 0x671dd9ae
push str.QSharedMemory::attach
push 0x15
mov ecx, esi
call sym.Qt5Core.dll_public:_void___thiscall_QSharedMemoryPrivate::setErrorString_class_QLatin1String_
mov ecx, esi
call sym.Qt5Core.dll_public:_bool___thiscall_QSharedMemoryPrivate::cleanHandle_void_
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x1c
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x671dda87
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x10]
mov dword [esi + 0x40], 8
push str._1:_size_query_failed
push eax
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QSharedMemory::tr_char_const___char_const___int_
add esp, 0xc
mov dword [ebp - 4], 0
mov ecx, esp
mov edx, 0x20
push 0
push str.QSharedMemory::attach:
mov word [ecx], dx
lea ecx, [ebp + 8]
push 0x17
push ecx
mov ecx, eax
call sym.Qt5Core.dll_public:_class_QString___thiscall_QString::arg_class_QLatin1String__int__class_QChar_
mov edx, dword [esi + 0x44]
mov ecx, dword [eax]
mov dword [esi + 0x44], ecx
or esi, 0xffffffff
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
je 0x671dda2e
cmp eax, esi
je 0x671dda42
mov eax, dword [ebp + 8]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x671dda42
mov eax, dword [ebp + 8]
cmp eax, 0x674c7cb4
je 0x671dda42
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
test eax, eax
je 0x671dda5f
cmp eax, 0xffffffff
je 0x671dda73
mov eax, dword [ebp - 0x10]
lock xadd dword [eax], esi
dec esi
setne al
test al, al
jne 0x671dda73
mov eax, dword [ebp - 0x10]
cmp eax, 0x674c7cb4
je 0x671dda73
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x34], eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4