joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67062560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67137279
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67221378]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, ecx
xor edi, edi
mov dword [esp + 0x1c], edi
mov ebx, dword [esp + 0x30]
mov dword [ebx], sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov eax, sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov ecx, 1
lock xadd dword [eax], ecx
mov ecx, dword [ebp]
mov esi, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov edx, dword [esp + 0x34]
mov eax, dword [edx]
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x3c]
push ecx
push edx
mov edx, dword [esp + 0x1c]
push eax
push edi
push esi
push edx
mov dword [esp + 0x40], edi
mov dword [esp + 0x34], 1
call fcn.67059670
mov esi, eax
add esp, 0x18
cmp esi, 0xffffffff
je 0x670626a4
lea ecx, [ecx]
cmp edi, esi
jne 0x670625fb
cmp dword [esp + 0x38], 0
jne 0x67062658
mov eax, esi
sub eax, edi
push eax
push edi
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebp
call sym.QtCore4.dll_public:_class_QString___thiscall_QString::mid_int__int_
push eax
mov ecx, ebx
mov dword [esp + 0x2c], 1
call fcn.6701fb90
mov edx, dword [esp + 0x18]
mov byte [esp + 0x28], 0
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x67062658
mov eax, dword [esp + 0x18]
test byte [eax + 0x10], 8
mov edi, eax
je 0x6706264f
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [0x672214d0]
mov dword [esp + 0x18], eax
call fcn.6705a660
push edi
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov edx, dword [esp + 0x34]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
lea edi, [ecx + esi]
xor edx, edx
test ecx, ecx
mov esi, ecx
mov ecx, dword [ebp]
mov ebx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
sete dl
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x3c]
push ecx
push esi
push eax
add edx, edi
push edx
mov edx, dword [esp + 0x24]
push ebx
push edx
call fcn.67059670
mov ebx, dword [esp + 0x48]
mov esi, eax
add esp, 0x18
cmp esi, 0xffffffff
jne 0x670625f0
mov eax, dword [ebp]
cmp edi, dword [eax + 8]
jne 0x670626b3
cmp dword [esp + 0x38], 0
jne 0x6706270d
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x3c]
push ecx
mov ecx, ebp
call sym.QtCore4.dll_public:_class_QString___thiscall_QString::mid_int__int_
push eax
mov ecx, ebx
mov dword [esp + 0x2c], 2
call fcn.6701fb90
mov edx, dword [esp + 0x34]
mov byte [esp + 0x28], 0
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x6706270d
mov eax, dword [esp + 0x34]
test byte [eax + 0x10], 8
mov esi, eax
je 0x67062704
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [0x672214d0]
mov dword [esp + 0x40], eax
call fcn.6705a660
push esi
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x67062730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x671372c9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67221378]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, ecx
xor edi, edi
mov dword [esp + 0x18], edi
mov ebx, dword [esp + 0x30]
mov dword [ebx], sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov eax, sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [esp + 0x3c]
mov eax, dword [ebp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
push edx
mov edx, dword [esp + 0x38]
movzx edx, word [edx]
push edx
push eax
xor eax, eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x24], 1
call fcn.67059430
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x67062847
nop
cmp edi, esi
jne 0x670627bb
cmp dword [esp + 0x38], 0
jne 0x67062818
mov eax, esi
sub eax, edi
push eax
push edi
lea ecx, [esp + 0x1c]
push ecx
mov ecx, ebp
call sym.QtCore4.dll_public:_class_QString___thiscall_QString::mid_int__int_
push eax
mov ecx, ebx
mov dword [esp + 0x2c], 1
call fcn.6701fb90
mov edx, dword [esp + 0x14]
mov byte [esp + 0x28], 0
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x67062818
mov eax, dword [esp + 0x14]
test byte [eax + 0x10], 8
mov edi, eax
je 0x6706280f
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [0x672214d0]
mov dword [esp + 0x20], eax
call fcn.6705a660
push edi
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov edx, dword [esp + 0x3c]
mov eax, dword [ebp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
push edx
mov edx, dword [esp + 0x38]
movzx edx, word [edx]
push edx
lea edi, [esi + 1]
push eax
mov eax, edi
call fcn.67059430
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x670627b0
mov eax, dword [ebp]
cmp edi, dword [eax + 8]
jne 0x67062856
cmp dword [esp + 0x38], 0
jne 0x670628b0
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x44]
push ecx
mov ecx, ebp
call sym.QtCore4.dll_public:_class_QString___thiscall_QString::mid_int__int_
push eax
mov ecx, ebx
mov dword [esp + 0x2c], 2
call fcn.6701fb90
mov edx, dword [esp + 0x3c]
mov byte [esp + 0x28], 0
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x670628b0
mov eax, dword [esp + 0x3c]
test byte [eax + 0x10], 8
mov esi, eax
je 0x670628a7
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [0x672214d0]
mov dword [esp + 0x38], eax
call fcn.6705a660
push esi
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x67064390
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x671362db
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x67221378]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x24]
mov dword [esi], eax
mov dword [esi + 4], sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov ecx, sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov edx, 1
lock xadd dword [ecx], edx
mov eax, dword [esp + 0x30]
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0
mov dword [esi + 8], ebp
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 0
test eax, eax
je 0x67064409
cmp dword [esp + 0x34], edi
jb 0x67064409
and dword [esi + 0x14], 0xfffffffe
mov dword [esi + 0x18], eax
jmp 0x67064423
push edi
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
jne 0x6706441f
call sym.QtCore4.dll_void___cdecl_qBadAlloc_void_
or dword [esi + 0x14], 1
mov eax, dword [esi + 0x18]
mov ecx, dword [esi]
push eax
push edi
push ebp
push ecx
call fcn.670640b0
add esp, 0x10
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 0x14
Function at 0x670658e0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, ebx
test ecx, ecx
je 0x670659d2
mov esi, dword [ecx + 0x1c]
test esi, esi
je 0x670659d2
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x670659d2
mov eax, dword [esi + 0x18]
cmp eax, 2
je 0x670659d2
cmp eax, 1
jne 0x67065928
cmp dword [esi + 4], 0x2a
jne 0x670659d2
test eax, eax
je 0x67065941
mov eax, dword [ecx + 0x30]
push ebx
push ebp
push eax
call sym.QtCore4.dll_adler32
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov dword [ecx + 0x30], eax
cmp ebx, 3
jb 0x670659cb
mov eax, dword [esi + 0x2c]
add eax, 0xfffffefa
cmp ebx, eax
jbe 0x6706595c
mov edi, eax
sub ebx, edi
add ebp, ebx
mov edx, dword [esi + 0x38]
push edi
push ebp
push edx
call sub.MSVCR90.dll_memcpy
mov edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x6c], edi
mov dword [esi + 0x5c], edi
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
add esp, 0xc
xor edx, edx
mov dword [esi + 0x48], eax
add edi, 0xfffffffd
nop
mov ebx, dword [esi + 0x48]
mov ecx, dword [esi + 0x58]
mov eax, dword [esi + 0x38]
movzx eax, byte [eax + edx + 2]
mov ebp, dword [esi + 0x40]
shl ebx, cl
mov ecx, dword [esi + 0x44]
xor eax, ebx
and eax, dword [esi + 0x54]
mov ebx, dword [esi + 0x34]
mov dword [esi + 0x48], eax
mov ax, word [ecx + eax*2]
and ebx, edx
mov word [ebp + ebx*2], ax
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2], dx
inc edx
cmp edx, edi
jbe 0x67065990
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
ret

Function at 0x67067610
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x6706766a
cmp byte [esi + 0x5c], 0x77
jne 0x6706766a
cmp dword [esi + 0x10], 0
jne 0x67067655
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, 0x4000
je 0x6706764e
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x10], 0x4000
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
push esi
call sym.QtCore4.dll_deflateParams
add esp, 0xc
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x67067680
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
jne 0x670676d6
cmp dword [esi + 4], 0
jne 0x670676df
call dword [sym.imp.MSVCR90.dll__errno]
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x670676da
mov edx, dword [esi + 0x40]
push edx
mov dword [esi + 0x3c], 1
call dword [sym.imp.MSVCR90.dll_ferror]
add esp, 4
test eax, eax
je 0x670676d6
mov dword [esi + 0x38], 0xffffffff
or eax, 0xffffffff
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
dec dword [esi + 4]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
ret
Function at 0x670676f0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, eax
push edi
mov edi, dword [esi + 4]
cmp edi, 2
jae 0x67067768
test edi, edi
je 0x67067709
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov dl, byte [eax]
mov byte [ecx], dl
call dword [sym.imp.MSVCR90.dll__errno]
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, edi
push eax
mov eax, dword [esi + 0x44]
mov edx, 0x4000
sar edx, cl
add eax, edi
push edx
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fread]
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x67067752
mov ecx, dword [esi + 0x40]
push ecx
call dword [sym.imp.MSVCR90.dll_ferror]
add esp, 4
test eax, eax
je 0x67067752
mov dword [esi + 0x38], 0xffffffff
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov edx, dword [esi + 0x44]
mov dword [esi], edx
cmp eax, 2
jae 0x67067768
pop edi
mov dword [esi + 0x58], eax
pop esi
ret
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x6706783e
cmp byte [eax + 1], 0x8b
jne 0x6706783e
add dword [esi + 4], 0xfffffffe
add eax, 2
push ebx
mov dword [esi], eax
call fcn.67067680
mov edi, eax
call fcn.67067680
mov ebx, eax
cmp edi, 8
jne 0x67067833
test bl, 0xe0
jne 0x67067833
mov edi, 6
lea esp, [esp]
call fcn.67067680
sub edi, 1
jne 0x670677b0
test bl, 4
je 0x670677e1
call fcn.67067680
mov edi, eax
call fcn.67067680
shl eax, 8
add edi, eax
mov eax, edi
dec edi
test eax, eax
je 0x670677e1
call fcn.67067680
cmp eax, 0xffffffff
jne 0x670677d0
test bl, 8
je 0x670677f4
call fcn.67067680
test eax, eax
je 0x670677f4
cmp eax, 0xffffffff
jne 0x670677e6
test bl, 0x10
je 0x6706780e
lea esp, [esp]
call fcn.67067680
test eax, eax
je 0x6706780e
cmp eax, 0xffffffff
jne 0x67067800
test bl, 2
je 0x67067822
mov edi, 2
call fcn.67067680
sub edi, 1
jne 0x67067818
mov ecx, dword [esi + 0x3c]
neg ecx
sbb ecx, ecx
pop ebx
and ecx, 0xfffffffd
pop edi
mov dword [esi + 0x38], ecx
pop esi
ret
pop ebx
pop edi
mov dword [esi + 0x38], 0xfffffffd
pop esi
ret
pop edi
mov dword [esi + 0x58], 1
pop esi
ret
Function at 0x67067900
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x670679ac
cmp byte [esi + 0x5c], 0x77
jne 0x670679ac
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ebx
test ebx, ebx
je 0x6706798f
push edi
mov edi, dword [sym.imp.MSVCR90.dll_fwrite]
cmp dword [esi + 0x10], 0
jne 0x67067957
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call edi
add esp, 0x10
cmp eax, 0x4000
jne 0x67067987
mov dword [esi + 0x10], eax
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x10]
add dword [esi + 0x64], edx
add dword [esi + 0x68], eax
push 0
push esi
call sym.QtCore4.dll_deflate
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x10]
sub dword [esi + 0x64], ecx
sub dword [esi + 0x68], edx
add esp, 8
mov dword [esi + 0x38], eax
test eax, eax
jne 0x6706798e
test ecx, ecx
jne 0x67067930
jmp 0x6706798e
mov dword [esi + 0x38], 0xffffffff
pop edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x4c]
push ebx
push eax
push ecx
call sym.QtCore4.dll_crc32
add esp, 0xc
mov dword [esi + 0x4c], eax
mov eax, ebx
sub eax, dword [esi + 4]
pop ebx
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x67067ac0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x67067b75
cmp byte [esi + 0x5c], 0x77
jne 0x67067b75
mov dword [esi + 4], ebx
push edi
lea esp, [esp]
mov edi, 0x4000
sub edi, dword [esi + 0x10]
je 0x67067b0f
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
push eax
push edi
push 1
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, edi
jne 0x67067b6b
mov edx, dword [esi + 0x48]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x4000
test ebx, ebx
jne 0x67067b5b
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push ecx
push esi
call sym.QtCore4.dll_deflate
mov ecx, dword [esi + 0x10]
sub dword [esi + 0x68], ecx
add esp, 8
mov dword [esi + 0x38], eax
test edi, edi
jne 0x67067b3c
cmp eax, 0xfffffffb
jne 0x67067b3c
mov dword [esi + 0x38], edi
test ecx, ecx
jne 0x67067b4a
cmp dword [esi + 0x38], 1
je 0x67067b4a
xor ebx, ebx
jmp 0x67067b4f
mov ebx, 1
mov eax, dword [esi + 0x38]
test eax, eax
je 0x67067ae0
cmp eax, 1
je 0x67067ae0
mov esi, dword [esi + 0x38]
mov eax, esi
dec eax
neg eax
sbb eax, eax
pop edi
and eax, esi
pop esi
pop ebx
ret
or eax, 0xffffffff
pop edi
mov dword [esi + 0x38], eax
pop esi
pop ebx
ret
pop esi
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x67084290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67137781
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x67221378]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov esi, dword [esp + 0x30]
mov dword [esi], sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov eax, sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov edx, 1
lock xadd dword [eax], edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x50]
push ebx
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], 1
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ecx
mov dword [ecx], ebx
mov edx, dword [esp + 0x3c]
mov ecx, esp
mov dword [ecx], edx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x18], esp
push ecx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x38], 1
call sym.QtCore4.dll_public:_void___thiscall_QDirIterator::constructor_class_QString_const___class_QStringList_const___class_QFlags_enum_QDir::Filter___class_QFlags_enum_QDirIterator::IteratorFlag__
mov edx, dword [esp + 0xc]
mov bl, 3
mov byte [esp + 0x28], bl
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x67084339
mov ecx, dword [esp + 0xc]
push ecx
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
lea ecx, [esp + 0x18]
call sym.QtCore4.dll_public:_bool___thiscall_QDirIterator::hasNext_void_const
test al, al
je 0x670843b4
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x1c]
call sym.QtCore4.dll_public:_class_QString___thiscall_QDirIterator::next_void_
mov eax, dword [esp + 0x38]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x6708436e
mov edx, dword [esp + 0x38]
push edx
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call sym.QtCore4.dll_public:_class_QString___thiscall_QDirIterator::fileName_void_
push eax
mov ecx, esi
mov byte [esp + 0x2c], 4
call fcn.6701fb90
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x28], bl
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x670843a7
mov eax, dword [esp + 0x10]
push eax
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
lea ecx, [esp + 0x18]
call sym.QtCore4.dll_public:_bool___thiscall_QDirIterator::hasNext_void_const
test al, al
jne 0x67084346
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 0
call sym.QtCore4.dll_public_virtual:_void___thiscall_QDirIterator::destructor_void_
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret 0xc
Function at 0x67085d00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x671378b6
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x67221378]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
mov dword [esi], vtable.QDataStream.0
mov dword [esi + 4], ebx
push 8
mov dword [esp + 0x24], ebx
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x20], 1
cmp eax, ebx
je 0x67085d63
mov ecx, dword [esp + 0x28]
push ebx
push ecx
mov ecx, eax
call sym.QtCore4.dll_public:_void___thiscall_QBuffer::constructor_class_QByteArray___class_QObject__
mov edi, eax
jmp 0x67085d65
xor edi, edi
push 1
mov ecx, edi
mov byte [esp + 0x24], bl
call sym.QtCore4.dll_public:_bool___thiscall_QObject::blockSignals_bool_
mov edx, dword [esp + 0x2c]
push ecx
mov eax, esp
mov dword [eax], edx
mov eax, dword [edi]
mov edx, dword [eax + 0x30]
mov ecx, edi
mov dword [esp + 0x2c], esp
call edx
mov dword [esi + 8], edi
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xc
mov byte [esi + 0xd], bl
mov dword [esi + 0x18], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8

Function at 0x67085dc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x671378b6
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x67221378]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
mov dword [esi], vtable.QDataStream.0
mov dword [esi + 4], ebx
push 8
mov dword [esp + 0x24], ebx
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x20], 1
cmp eax, ebx
je 0x67085e1e
push ebx
mov ecx, eax
call sym.QtCore4.dll_public:_void___thiscall_QBuffer::constructor_class_QObject__
mov edi, eax
jmp 0x67085e20
xor edi, edi
push 1
mov ecx, edi
mov byte [esp + 0x24], bl
call sym.QtCore4.dll_public:_bool___thiscall_QObject::blockSignals_bool_
mov eax, dword [esp + 0x28]
push eax
mov ecx, edi
call sym.QtCore4.dll_public:_void___thiscall_QBuffer::setData_class_QByteArray_const__
push ecx
mov eax, esp
mov dword [eax], 1
mov edx, dword [edi]
mov eax, dword [edx + 0x30]
mov ecx, edi
mov dword [esp + 0x2c], esp
call eax
mov dword [esi + 8], edi
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xc
mov byte [esi + 0xd], bl
mov dword [esi + 0x18], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
Function at 0x67086670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67137990
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x67221378]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, sym.QtCore4.dll_struct_QByteArray::Data_QByteArray::shared_null
mov dword [esp + 0xc], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov dword [esp + 0x20], 0
mov dword [esp + 8], eax
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [esp + 0x28]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
push esi
push ecx
mov byte [esp + 0x30], 1
call sym.QtCore4.dll_public:_static_class_QByteArray___cdecl_QUrl::toPercentEncoding_class_QString_const___class_QByteArray_const___class_QByteArray_const__
mov edx, dword [eax]
mov eax, dword [edx + 0xc]
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x3c], 2
call sym.QtCore4.dll_public:_static_class_QString___cdecl_QString::fromLatin1_char_const___int_
add esp, 0x1c
push eax
mov ecx, esi
mov byte [esp + 0x24], 3
call fcn.6705a9c0
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x20], 2
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x67086721
mov eax, dword [esp + 0x10]
push eax
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x20], 1
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x67086740
mov eax, dword [esp + 0x14]
push eax
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov ecx, dword [esp + 8]
mov byte [esp + 0x20], 0
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x6708675f
mov eax, dword [esp + 8]
push eax
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x67086781
mov eax, dword [esp + 0xc]
push eax
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret
Function at 0x67086cf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x67137aa0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x67221378]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x10]
push eax
call sym.QtCore4.dll_public:_class_QString___thiscall_QUrl::path_void_
lea ecx, [esp + 0xb]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
mov byte [esp + 0xf], 0x2f
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
call fcn.67019b90
lea edx, [esp + 0xc]
push edx
mov ecx, esi
mov byte [esp + 0x30], 1
call sym.QtCore4.dll_public:_void___thiscall_QUrl::setPath_class_QString_const__
mov eax, dword [esp + 0xc]
mov byte [esp + 0x2c], 0
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x67086d87
mov edx, dword [esp + 0xc]
push edx
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x67086da9
mov edx, dword [esp + 0x10]
push edx
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 4