joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002120
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x14000216d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140002164
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14000216f
add rax, 0x28
cmp rax, r9
jne 0x140002150
xor eax, eax
ret

Function at 0x140002170
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140002200
mov rdx, qword [0x140004390]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x1400021ee
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x1400021ee
cmp word [rax + 0x18], 0x20b
jne 0x1400021ee
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140002200
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x1400021d9
add rbx, 0x28
cmp rbx, rdi
je 0x140002200
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x1400021d0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140002210
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140004390]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002230
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002238
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002230
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000228d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002284
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002230
add rax, 0x28
cmp rax, r9
jne 0x140002270
xor eax, eax
ret

Function at 0x140002290
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140004390]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400022af
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400022b8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400022af
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400022d0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140004390]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x1400022f0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x1400022f8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400022f0
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140002340
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140002337
test rcx, rcx
je 0x1400022f0
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x140002328
xor eax, eax
ret
Function at 0x140002350
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140004390]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000236f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002378
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002390
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140004390]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400023b0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400023b8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400023b0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x1400023b0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002404
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002410
add rdx, 0x28
cmp rdx, r9
jne 0x1400023f0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002420
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140004390]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002442
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002450
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002442
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002442
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140002442
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400024a5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400024b8
add rdx, 0x28
cmp r10, rdx
jne 0x140002490
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x1400024c7
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x1400024d7
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400024ae
test ecx, ecx
jg 0x1400024c0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x670021e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rdx, sym.QtCoreVBox4.dll_struct_QMetaObject_const_QAbstractAnimation::staticMetaObject
xor r9d, r9d
xor r8d, r8d
jmp sym.QtCoreVBox4.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject____ptr64__struct_QMetaObject_const____ptr64__int__void____ptr64____ptr64_

Function at 0x670049c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x30158
call fcn.67005227
sub rsp, rax
lea rax, [0x672bcc81]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 4]
call fcn.67005177
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 0x4c]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x14]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x40]
call fcn.67005057
mov qword [rsp + 0xf8], rax
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x150]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 0x4c]

Function at 0x67005057
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax*8 + 0x88]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
jmp 0x67005103
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x6700516b
pop rdx
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x88]
call fcn.67004fd7
cmp eax, dword [rsp + 0x80]
jne 0x67005169
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
jmp 0x6700516d
jmp 0x670050f9
xor eax, eax
add rsp, 0x68
ret

Function at 0x67005177
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov rax, qword gs:[0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
add rax, 0x10
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
Function at 0x67008860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
mov r10, rcx
test edx, edx
jne case.default.0x6700888d
cmp r8d, 0xa
ja case.default.0x6700888d
lea rcx, [0x67000000]
movsxd rax, r8d
mov edx, dword [rcx + rax*4 + 0x89c0]
add rdx, rcx
jmp rdx
lea rdx, sym.QtCoreVBox4.dll_struct_QMetaObject_const_QAbstractAnimation::staticMetaObject
xor r9d, r9d
xor r8d, r8d
mov rcx, r10
add rsp, 0x28
jmp sym.QtCoreVBox4.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject____ptr64__struct_QMetaObject_const____ptr64__int__void____ptr64____ptr64_
mov rcx, qword [r9 + 8]
mov rax, qword [r9 + 0x10]
mov edx, dword [rcx]
mov r8d, dword [rax]
mov rcx, r10
add rsp, 0x28
jmp sym.QtCoreVBox4.dll_protected:_void___cdecl_QAbstractAnimation::stateChanged_enum_QAbstractAnimation::State__enum_QAbstractAnimation::State____ptr64
mov rax, qword [r9 + 8]
mov rcx, r10
mov edx, dword [rax]
add rsp, 0x28
jmp sym.QtCoreVBox4.dll_protected:_void___cdecl_QAbstractAnimation::currentLoopChanged_int____ptr64
mov rax, qword [r9 + 8]
mov rcx, r10
mov edx, dword [rax]
add rsp, 0x28
jmp sym.QtCoreVBox4.dll_protected:_void___cdecl_QAbstractAnimation::directionChanged_enum_QAbstractAnimation::Direction____ptr64
mov rcx, qword [r10 + 8]
cmp dword [rcx + 0x88], 2
je case.default.0x6700888d
mov rax, qword [r9 + 8]
cmp dword [rax], 0
setne al
mov byte [rcx + 0xa0], al
mov edx, 2
add rsp, 0x28
jmp fcn.67008490
mov rcx, qword [r10 + 8]
cmp dword [rcx + 0x88], 2
je case.default.0x6700888d
mov edx, 2
mov byte [rcx + 0xa0], 0
add rsp, 0x28
jmp fcn.67008490
mov rcx, qword [r10 + 8]
cmp dword [rcx + 0x88], 0
jne 0x67008957
lea rcx, str.QAbstractAnimation::pause:_Cannot_pause_a_stopped_animation
add rsp, 0x28
jmp sym.QtCoreVBox4.dll_void___cdecl_qWarning_char_const____ptr64_
mov edx, 1
add rsp, 0x28
jmp fcn.67008490
mov rcx, qword [r10 + 8]
cmp dword [rcx + 0x88], 1
je 0x67008906
lea rcx, str.QAbstractAnimation::resume:_Cannot_resume_an_animation_that_is_not_paused
add rsp, 0x28
jmp sym.QtCoreVBox4.dll_void___cdecl_qWarning_char_const____ptr64_
mov rax, qword [r9 + 8]
mov rcx, r10
movzx edx, byte [rax]
add rsp, 0x28
jmp sym.QtCoreVBox4.dll_public:_void___cdecl_QAbstractAnimation::setPaused_bool____ptr64
mov rcx, qword [r10 + 8]
cmp dword [rcx + 0x88], 0
je case.default.0x6700888d
xor edx, edx
add rsp, 0x28
jmp fcn.67008490
mov rax, qword [r9 + 8]
mov rcx, r10
mov edx, dword [rax]
call sym.QtCoreVBox4.dll_public:_void___cdecl_QAbstractAnimation::setCurrentTime_int____ptr64
add rsp, 0x28
ret
Function at 0x6701a2d0
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rsi
mov rsi, rdx
mov ebx, ecx
xor edi, edi
mov dword [rsp + 0x40], edi
mov rax, qword [0x672bfb48]
test rax, rax
je 0x6701a304
call rax
jmp 0x6701a32e
call qword [sym.imp.MSVCR100.dll___iob_func]
mov r8, rsi
lea rdx, [0x67182054]
lea rcx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_fprintf]
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rcx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_fflush]
cmp ebx, 3
je 0x6701a360
cmp ebx, 1
jne 0x6701a35c
lea rdx, str.QT_FATAL_WARNINGS
lea rcx, [rsp + 0x50]
call sym.QtCoreVBox4.dll_class_QByteArray___cdecl_qgetenv_char_const____ptr64_
nop
mov edi, ebx
mov dword [rsp + 0x40], ebx
mov rcx, rax
call sym.QtCoreVBox4.dll_public:_bool___cdecl_QByteArray::isNull_void_const___ptr64
test al, al
je 0x6701a360
xor bl, bl
jmp 0x6701a362
mov bl, 1
test dil, 1
je 0x6701a37c
mov rax, qword [rsp + 0x50]
lock dec dword [rax]
jne 0x6701a37c
mov rcx, qword [rsp + 0x50]
call sym.QtCoreVBox4.dll_void___cdecl_qFree_void____ptr64_
test bl, bl
je 0x6701a38c
mov ecx, 1
call qword [sym.imp.MSVCR100.dll_exit]
int3
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x6701ad60
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x672bfab0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x672bfb54]
test eax, eax
jne 0x6701ae63
mov qword [rsp + 0x150], rbx
lea rcx, [rsp + 0x20]
mov ebx, 0x10
mov dword [0x672bfb54], ebx
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r11d, dword [rsp + 0x30]
test r11d, r11d
je 0x6701ae4e
dec r11d
je 0x6701ae33
mov edx, dword [rsp + 0x24]
cmp edx, 5
jb 0x6701ae53
mov r8d, dword [rsp + 0x28]
jne 0x6701adf7
test r8d, r8d
jne 0x6701addf
lea ebx, [r8 + 0x20]
jmp 0x6701ae53
cmp r8d, 1
jne 0x6701adeb
lea ebx, [r8 + 0x2f]
jmp 0x6701ae53
cmp r8d, 2
jne 0x6701ae20
lea ebx, [r8 + 0x3e]
jmp 0x6701ae53
cmp edx, 6
jne 0x6701ae20
test r8d, r8d
jne 0x6701ae06
lea ebx, [rdx + 0x7a]
jmp 0x6701ae53
cmp r8d, 1
jne 0x6701ae13
mov ebx, 0x90
jmp 0x6701ae53
cmp r8d, 2
jne 0x6701ae20
mov ebx, 0xa0
jmp 0x6701ae53
lea rcx, str.Qt:_Untested_Windows_version__d._d_detected_
call sym.QtCoreVBox4.dll_void___cdecl_qWarning_char_const____ptr64_
mov ebx, 0xf0
jmp 0x6701ae53
mov eax, dword [rsp + 0x28]
cmp eax, 0x5a
jne 0x6701ae41
lea ebx, [rax - 0x56]
jmp 0x6701ae53
xor ebx, ebx
cmp eax, 0xa
sete bl
add ebx, 2
jmp 0x6701ae53
mov ebx, 1
mov dword [0x672bfb54], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.671623b0
add rsp, 0x158
ret
Function at 0x67025740
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
cmp dword [0x672bc818], 0xffffffff
jne 0x67025800
mov eax, dword [0x672bfc28]
lea rbx, [0x672bfc20]
test al, 1
jne 0x67025792
or eax, 1
mov dword [0x672bfc28], eax
xor edx, edx
mov rcx, rbx
call sym.QtCoreVBox4.dll_public:_void___cdecl_QMutex::constructor_enum_QMutex::RecursionMode____ptr64
lea rcx, [0x6717d080]
call fcn.671622f8
nop
mov rcx, qword [0x672bfc20]
mov edi, 1
test byte [rcx + 4], dil
je 0x670257ae
mov rcx, rbx
call sym.QtCoreVBox4.dll_public:_void___cdecl_QMutex::lock_void____ptr64
jmp 0x670257c3
xor eax, eax
lock cmpxchg dword [rcx], edi
sete cl
test cl, cl
jne 0x670257c3
mov rcx, rbx
call sym.QtCoreVBox4.dll_private:_void___cdecl_QMutex::lockInternal_void____ptr64
or rbx, rdi
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x672bc818], eax
test dil, bl
je 0x67025800
and rbx, 0xfffffffffffffffe
mov rcx, qword [rbx]
test byte [rcx + 4], dil
je 0x670257ee
mov rcx, rbx
call sym.QtCoreVBox4.dll_public:_void___cdecl_QMutex::unlock_void____ptr64
jmp 0x67025800
xor edx, edx
mov eax, edi
lock cmpxchg dword [rcx], edx
je 0x67025800
mov rcx, rbx
call sym.QtCoreVBox4.dll_private:_void___cdecl_QMutex::unlockInternal_void____ptr64
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x67026c20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
call fcn.67025740
mov ecx, dword [0x672bc818]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x67026dba
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea ecx, [rax + 2]
call sym.QtCoreVBox4.dll_public:_static_bool___cdecl_QInternal::activateCallbacks_enum_QInternal::Callback__void____ptr64____ptr64_
test al, al
je 0x67026ccb
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
mov rsi, qword [rcx + 0xc0]
mov rdx, rsi
mov ecx, dword [0x672bc818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r11, qword [rsp + 0x70]
mov rax, qword [r11 + 8]
mov byte [rax + 0x90], 1
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
mov byte [rcx + 0x91], 0
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rbx + 0xa8], rax
mov rbx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0xb0], eax
jmp 0x67026d37
mov ecx, 0x68
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x78], rax
test rax, rax
je 0x67026cf1
mov edx, 1
mov rcx, rax
call fcn.670244d0
mov rsi, rax
jmp 0x67026cf3
xor esi, esi
mov qword [rsp + 0x78], rsi
mov rdx, rsi
mov ecx, dword [0x672bc818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov ecx, 0x10
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x80], rax
test rax, rax
je 0x67026d2b
mov rdx, rsi
mov rcx, rax
call fcn.67024880
nop
mov qword [rsi + 8], rax
mov rcx, rsi
call fcn.67024850
mov byte [rsi + 0x60], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r11d, eax
mov qword [rsi + 0x10], r11
cmp qword [sym.QtCoreVBox4.dll_class_QThread____ptr64___ptr64_QCoreApplicationPrivate::theMainThread], 0
jne 0x67026d5f
mov rax, qword [rsi + 8]
mov qword [sym.QtCoreVBox4.dll_class_QThread____ptr64___ptr64_QCoreApplicationPrivate::theMainThread], rax
jmp 0x67026dba
mov qword [rsp + 0x78], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rsi + 8]
mov rcx, qword [rsp + 0x78]
call fcn.670268f0
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x670283e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r8, qword [rdx]
mov rdi, rdx
mov rbx, rcx
mov rax, qword [r8 + 0x10]
mov r10d, dword [r8 + 8]
mov r8, qword [rcx]
movsx r9d, byte [rax]
mov rax, qword [r8 + 0x10]
mov edx, dword [r8 + 8]
shl edx, 3
shl r10d, 3
lea rcx, [rsp + 0x38]
sub r10d, r9d
movsx r9d, byte [rax]
lea rax, [rsp + 0x30]
sub edx, r9d
mov dword [rsp + 0x30], r10d
cmp edx, r10d
mov dword [rsp + 0x38], edx
cmovge rax, rcx
mov rcx, rbx
mov edx, dword [rax]
call sym.QtCoreVBox4.dll_public:_void___cdecl_QBitArray::resize_int____ptr64
mov r11, qword [rbx]
mov eax, dword [r11]
cmp eax, 1
jne 0x67028457
mov rcx, qword [rbx]
lea rax, [rcx + 0x18]
cmp qword [rcx + 0x10], rax
je 0x67028465
mov rax, qword [rbx]
mov rcx, rbx
mov edx, dword [rax + 8]
call sym.QtCoreVBox4.dll_private:_void___cdecl_QByteArray::realloc_int____ptr64
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
mov rax, qword [rdi]
mov edx, dword [rax + 8]
mov r8, qword [rax + 0x10]
inc rcx
dec edx
inc r8
test edx, edx
jle 0x670284a3
nop word [rax + rax]
movzx eax, byte [r8]
dec edx
inc rcx
xor byte [rcx - 1], al
inc r8
test edx, edx
jg 0x67028490
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x67028bd0
Capabilities:
Encode data using xor

Disassembly:
mov r9d, edx
mov r10, rcx
mov r8d, 0xffff
test edx, edx
je 0x67028c2e
lea r11, [0x67185918]
nop word [rax + rax]
movzx edx, byte [r10]
movzx eax, r8w
shr r8w, 4
xor rax, rdx
shr rdx, 4
inc r10
and eax, 0xf
movzx ecx, word [r11 + rax*2]
xor cx, r8w
movzx eax, cx
shr cx, 4
xor rdx, rax
and edx, 0xf
movzx r8d, word [r11 + rdx*2]
xor r8w, cx
dec r9d
jne 0x67028bf0
movzx eax, r8w
not eax
ret
Function at 0x6702c360
Capabilities:
Encode data using base64

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0xa0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x672bfab0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbp, rdx
mov r12, rcx
mov qword [rsp + 0x30], rdx
xor esi, esi
mov dword [rsp + 0x20], esi
movaps xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [0x67185e90]
movaps xmmword [rsp + 0x50], xmm1
movaps xmm0, xmmword [0x67185ea0]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm1, xmmword [0x67185eb0]
movaps xmmword [rsp + 0x70], xmm1
movzx eax, byte [0x67185ec0]
mov byte [r11 - 0x38], al
mov rax, qword [rcx]
mov ecx, dword [rax + 8]
shl ecx, 2
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
lea edx, [rdx + rax + 3]
xor r8d, r8d
mov rcx, rbp
call sym.QtCoreVBox4.dll_public:_void___cdecl_QByteArray::constructor_int__enum_Qt::Initialization____ptr64
mov dword [rsp + 0x20], 1
mov edi, esi
mov rax, qword [rbp]
mov ecx, dword [rax]
cmp ecx, 1
jne 0x6702c424
mov rcx, qword [rbp]
lea rax, [rcx + 0x18]
cmp qword [rcx + 0x10], rax
je 0x6702c433
mov rax, qword [rbp]
mov edx, dword [rax + 8]
mov rcx, rbp
call sym.QtCoreVBox4.dll_private:_void___cdecl_QByteArray::realloc_int____ptr64
mov rax, qword [rbp]
mov rbx, qword [rax + 0x10]
mov rax, qword [r12]
mov ecx, dword [rax + 8]
mov r9, rsi
test ecx, ecx
jle 0x6702c509
nop dword [rax]
mov rdx, qword [rax + 0x10]
movzx r8d, byte [rdx + r9]
shl r8d, 0x10
inc edi
inc r9
cmp edi, ecx
jne 0x6702c46d
mov esi, 2
jmp 0x6702c495
movzx eax, byte [rdx + r9]
shl eax, 8
or r8d, eax
inc edi
inc r9
cmp edi, ecx
jne 0x6702c488
mov esi, 1
jmp 0x6702c495
movzx eax, byte [rdx + r9]
or r8d, eax
inc edi
inc r9
mov eax, r8d
sar eax, 0x12
and eax, 0x3f
mov edx, r8d
sar edx, 0xc
and edx, 0x3f
mov r10d, r8d
sar r10d, 6
and r10d, 0x3f
and r8d, 0x3f
cdqe
movzx ecx, byte [rsp + rax + 0x40]
mov byte [rbx], cl
movsxd rax, edx
movzx ecx, byte [rsp + rax + 0x40]
mov byte [rbx + 1], cl
cmp esi, 1
jle 0x6702c4d5
mov byte [rbx + 2], 0x3d
jmp 0x6702c4e0
movsxd rax, r10d
movzx ecx, byte [rsp + rax + 0x40]
mov byte [rbx + 2], cl
add rbx, 3
test esi, esi
jle 0x6702c4ed
mov byte [rbx], 0x3d
jmp 0x6702c4f7
movsxd rax, r8d
movzx ecx, byte [rsp + rax + 0x40]
mov byte [rbx], cl
inc rbx
mov rax, qword [r12]
mov ecx, dword [rax + 8]
cmp edi, ecx
jl 0x6702c450
mov rax, qword [rbp]
mov ecx, dword [rax]
cmp ecx, 1
jne 0x6702c522
mov rcx, qword [rbp]
lea rax, [rcx + 0x18]
cmp qword [rcx + 0x10], rax
je 0x6702c531
mov rax, qword [rbp]
mov edx, dword [rax + 8]
mov rcx, rbp
call sym.QtCoreVBox4.dll_private:_void___cdecl_QByteArray::realloc_int____ptr64
mov rcx, qword [rbp]
sub ebx, dword [rcx + 0x10]
cmp ebx, dword [rcx + 8]
jge 0x6702c547
mov edx, ebx
mov rcx, rbp
call sym.QtCoreVBox4.dll_public:_void___cdecl_QByteArray::resize_int____ptr64
mov rax, rbp
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.671623b0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x6702f2c0
Capabilities:
Hash data using sha1

Disassembly:
mov r8, qword [rcx]
mov edx, dword [r8]
test edx, edx
je 0x6702f348
dec edx
je 0x6702f313
dec edx
jne 0x6702f36e
xor eax, eax
mov dword [r8 + 8], 0x67452301
mov dword [r8 + 0xc], 0xefcdab89
mov dword [r8 + 0x10], 0x98badcfe
mov dword [r8 + 0x14], 0x10325476
mov dword [r8 + 0x18], 0xc3d2e1f0
mov qword [r8 + 0x20], rax
mov rcx, qword [rcx]
add rcx, 0xa0
jmp sym.QtCoreVBox4.dll_public:_void___cdecl_QByteArray::clear_void____ptr64
xor eax, eax
mov dword [r8 + 8], 0x67452301
mov dword [r8 + 0xc], 0xefcdab89
mov dword [r8 + 0x10], 0x98badcfe
mov qword [r8 + 0x14], 0x10325476
mov dword [r8 + 0x1c], eax
mov rcx, qword [rcx]
add rcx, 0xa0
jmp sym.QtCoreVBox4.dll_public:_void___cdecl_QByteArray::clear_void____ptr64
xor eax, eax
mov dword [r8 + 0x10], 0x67452301
mov dword [r8 + 0x14], 0xefcdab89
mov dword [r8 + 0x18], 0x98badcfe
mov dword [r8 + 0x1c], 0x10325476
mov qword [r8 + 8], rax
mov rcx, qword [rcx]
add rcx, 0xa0
jmp sym.QtCoreVBox4.dll_public:_void___cdecl_QByteArray::clear_void____ptr64