joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418cc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43cebc
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_void_]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 8]
push eax
push 0x4d0df0
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x44], 1
call dword [sym.imp.QtHelp4.dll_public:_class_QVariant___thiscall_QHelpEngineCore::customValue_class_QString_const___class_QVariant_const__]
mov esi, dword [esp + 0x40]
push eax
push esi
mov byte [esp + 0x40], 2
call fcn.00418a30
add esp, 8
mov edi, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 1
call edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call edi
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4

Function at 0x418d70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43cebc
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_void_]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 8]
push eax
push 0x4d0de0
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x44], 1
call dword [sym.imp.QtHelp4.dll_public:_class_QVariant___thiscall_QHelpEngineCore::customValue_class_QString_const___class_QVariant_const__]
mov esi, dword [esp + 0x40]
push eax
push esi
mov byte [esp + 0x40], 2
call fcn.00418a30
add esp, 8
mov edi, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 1
call edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call edi
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
Function at 0x41fb50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43de00
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov dword [esp + 0x28], 0
mov byte [esp + 0x24], 0x20
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QChar::constructor_struct_QLatin1Char_]
mov esi, dword [sym.imp.QtCore4.dll_private:_static_struct_QString::Data____cdecl_QString::fromLatin1_helper_char_const___int_]
push 0xffffffffffffffff
push str.4.7.3
call esi
mov dword [esp + 0x20], eax
push 0xffffffffffffffff
push str.qthelpcollection__1.qhc
mov dword [esp + 0x44], 1
call esi
add esp, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0xc]
push ecx
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 2
call dword [sym.imp.QtCore4.dll_public:_class_QString___thiscall_QString::arg_class_QString_const___int__class_QChar_const__]
mov esi, eax
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esp + 0x10], eax
mov ecx, 1
lock xadd dword [eax], ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push 1
push eax
mov byte [esp + 0x40], 4
call fcn.0041f790
mov edi, eax
lea ecx, [esp + 0x1a]
push ecx
mov byte [esp + 0x44], 5
call dword [sym.imp.QtCore4.dll_public:_static_class_QChar___cdecl_QDir::separator_void_]
movzx edx, word [eax]
push edx
lea eax, [esp + 0x30]
push edi
push eax
call fcn.0041bf40
push esi
mov esi, dword [esp + 0x5c]
push eax
push esi
mov byte [esp + 0x5c], 6
call fcn.0040fd40
add esp, 0x28
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x28], 1
mov byte [esp + 0x34], 5
or edx, 0xffffffff
lock xadd dword [ecx], edx
mov edi, dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
jne 0x41fc65
mov eax, dword [esp + 0x1c]
push eax
call edi
add esp, 4
mov ecx, dword [esp + 0x20]
mov byte [esp + 0x34], 4
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x41fc81
mov eax, dword [esp + 0x20]
push eax
call edi
add esp, 4
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x34], 3
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x41fc9d
mov eax, dword [esp + 0x10]
push eax
call edi
add esp, 4
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x34], 2
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x41fcb9
mov eax, dword [esp + 0x24]
push eax
call edi
add esp, 4
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x34], 1
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x41fcd5
mov eax, dword [esp + 0x14]
push eax
call edi
add esp, 4
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x34], 0
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x41fcf1
mov eax, dword [esp + 0x18]
push eax
call edi
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x421dc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x43e313
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea ecx, [esp + 0x18]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QDateTime::constructor_void_]
push 1
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.QtCore4.dll_public:_class_QString___thiscall_QDateTime::toString_enum_Qt::DateFormat_]
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call fcn.00421a20
mov ecx, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esp + 0xc], ecx
mov edx, 1
lock xadd dword [ecx], edx
push eax
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + 0x30], 3
call fcn.0041a880
add esp, 4
mov ecx, eax
call fcn.004172b0
mov edx, dword [esp + 0xc]
mov byte [esp + 0x24], 2
or eax, 0xffffffff
lock xadd dword [edx], eax
mov edi, dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
jne 0x421e69
mov ecx, dword [esp + 0xc]
push ecx
call edi
add esp, 4
mov eax, dword [esp + 0x10]
mov byte [esp + 0x24], 1
test eax, eax
je 0x421eae
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x421eae
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0xc]
lea edx, [eax + ecx*4 + 0x14]
mov ecx, dword [eax + 8]
push edx
lea edx, [eax + ecx*4 + 0x14]
push edx
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.00401490
mov eax, dword [esi]
test eax, eax
jne 0x421eae
push esi
call dword [sym.imp.QtCore4.dll_void___cdecl_qFree_void__]
add esp, 4
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x24], 0
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x421eca
mov eax, dword [esp + 0x14]
push eax
call edi
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QDateTime::destructor_void_]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 4
Function at 0x427a70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43efe9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 8], eax
mov ecx, dword [sym.imp.QtCore4.dll_struct_QListData::Data_QListData::shared_null]
mov esi, dword [esp + 0x1c]
mov dword [esi], ecx
mov edx, ecx
mov ecx, 1
lock xadd dword [edx], ecx
mov edx, dword [sym.imp.QtGui4.dll_struct_QMetaObject_const_QComboBox::staticMetaObject]
mov ecx, dword [esp + 0x20]
push esi
push edx
push eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
push eax
push ecx
mov dword [esp + 0x1c], 1
call dword [sym.imp.QtCore4.dll_void___cdecl_qt_qFindChildren_helper_class_QObject_const___class_QString_const___class_QRegExp_const___struct_QMetaObject_const___class_QList_void____]
add esp, 0x14
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x432200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4406bc
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_void_]
mov ecx, dword [esp + 0x44]
push eax
push 0x4d0e64
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x44], 1
call dword [sym.imp.QtHelp4.dll_public:_class_QVariant___thiscall_QHelpEngineCore::customValue_class_QString_const___class_QVariant_const__]
mov esi, dword [esp + 0x40]
push esi
mov ecx, eax
mov byte [esp + 0x3c], 2
call dword [sym.imp.QtCore4.dll_public:_class_QString___thiscall_QVariant::toString_void_]
mov edi, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 1
call edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call edi
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret

Function at 0x432770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4406bc
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_void_]
mov ecx, dword [esp + 0x44]
push eax
push 0x4d0e50
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x44], 1
call dword [sym.imp.QtHelp4.dll_public:_class_QVariant___thiscall_QHelpEngineCore::customValue_class_QString_const___class_QVariant_const__]
mov esi, dword [esp + 0x40]
push esi
mov ecx, eax
mov byte [esp + 0x3c], 2
call dword [sym.imp.QtCore4.dll_public:_class_QString___thiscall_QVariant::toString_void_]
mov edi, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 1
call edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call edi
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x432a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43cc9c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_void_]
mov ecx, dword [esp + 0x44]
push eax
push 0x4d0e68
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x44], 1
call dword [sym.imp.QtHelp4.dll_public:_class_QVariant___thiscall_QHelpEngineCore::customValue_class_QString_const___class_QVariant_const__]
mov esi, dword [esp + 0x40]
push esi
mov ecx, eax
mov byte [esp + 0x3c], 2
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray___thiscall_QVariant::toByteArray_void_]
mov edi, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 1
call edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call edi
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret

Function at 0x432b70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43cc9c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_void_]
mov ecx, dword [esp + 0x44]
push eax
push 0x4d0e3c
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x44], 1
call dword [sym.imp.QtHelp4.dll_public:_class_QVariant___thiscall_QHelpEngineCore::customValue_class_QString_const___class_QVariant_const__]
mov esi, dword [esp + 0x40]
push esi
mov ecx, eax
mov byte [esp + 0x3c], 2
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray___thiscall_QVariant::toByteArray_void_]
mov edi, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 1
call edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call edi
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x432c80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43cc9c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_void_]
mov ecx, dword [esp + 0x44]
push eax
push 0x4d0e5c
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x44], 1
call dword [sym.imp.QtHelp4.dll_public:_class_QVariant___thiscall_QHelpEngineCore::customValue_class_QString_const___class_QVariant_const__]
mov esi, dword [esp + 0x40]
push esi
mov ecx, eax
mov byte [esp + 0x3c], 2
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray___thiscall_QVariant::toByteArray_void_]
mov edi, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 1
call edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call edi
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret

Function at 0x432d90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43cc9c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_void_]
mov ecx, dword [esp + 0x44]
push eax
push 0x4d0e30
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x44], 1
call dword [sym.imp.QtHelp4.dll_public:_class_QVariant___thiscall_QHelpEngineCore::customValue_class_QString_const___class_QVariant_const__]
mov esi, dword [esp + 0x40]
push esi
mov ecx, eax
mov byte [esp + 0x3c], 2
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray___thiscall_QVariant::toByteArray_void_]
mov edi, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 1
call edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call edi
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x432ea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43cc9c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_void_]
mov ecx, dword [esp + 0x44]
push eax
push 0x4d0e4c
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x44], 1
call dword [sym.imp.QtHelp4.dll_public:_class_QVariant___thiscall_QHelpEngineCore::customValue_class_QString_const___class_QVariant_const__]
mov esi, dword [esp + 0x40]
push esi
mov ecx, eax
mov byte [esp + 0x3c], 2
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray___thiscall_QVariant::toByteArray_void_]
mov edi, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 1
call edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call edi
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x43869a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d0d8c]
jne 0x4386a4
repz ret
jmp fcn.00438bc0

Function at 0x439400
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_unsigned_short_int_const___int_]
add esp, 0xc
mov ecx, eax
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray___thiscall_QString::toLocal8Bit_void_]
mov edx, dword [esp + 8]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x439442
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
add esp, 4
push 8
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0
call fcn.00439380
lea ecx, [esp + 4]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::detach_void_]
mov ecx, dword [esp + 0x20]
lea edx, [esp]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
push eax
mov eax, dword [edx + 0xc]
mov edx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x24]
push eax
push ecx
push edx
call sub.QtCore4.dll_void___cdecl_qWinMain_struct_HINSTANCE_____struct_HINSTANCE_____char___int__int___class_QVector_char____
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
add esp, 0x18
cmp ecx, 1
je 0x4394a6
mov eax, dword [esp]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
push edx
push eax
lea ecx, [esp + 8]
call fcn.004391d0
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
push esi
add eax, 0x10
push eax
push ecx
call fcn.0041dd90
mov esi, eax
mov eax, dword [esp + 0xc]
add esp, 8
test eax, eax
je 0x4394de
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x4394de
mov eax, dword [esp + 4]
push 4
push eax
call dword [sym.imp.QtCore4.dll_public:_static_void___cdecl_QVectorData::free_struct_QVectorData___int_]
add esp, 8
mov ecx, dword [esp + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4394f9
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.QtCore4.dll_void___cdecl_qFree_void__]
add esp, 4
mov eax, esi
pop esi
add esp, 0x10
ret 0x10
Function at 0x1000547b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x1000549f
cmp dword [edi + 0x54], 0
jne 0x1000549f
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.1000e986
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1000543c
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1000aa2b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x1000aa72
call fcn.1000e986
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1000aa72
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x1000aa8e
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.1000a5a5
mov esi, eax
test edi, edi
je 0x1000aa8c
test ebx, ebx
je 0x1000aa8c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1001362b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10086ba0]
jne 0x10013635
repz ret
jmp fcn.1001a2fb
Function at 0x100270b3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1001bab7
and dword [ebp - 4], 0
cmp dword [0x1008af0c], 0
mov ebx, eax
jne 0x10027164
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10027215
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1006f88c
push edi
call esi
test eax, eax
je 0x10027215
push eax
call fcn.1001ba45
mov dword [esp], 0x1006f87c
push edi
mov dword [0x1008af0c], eax
call esi
push eax
call fcn.1001ba45
mov dword [esp], 0x1006f868
push edi
mov dword [0x1008af10], eax
call esi
push eax
call fcn.1001ba45
mov dword [esp], 0x1006f84c
push edi
mov dword [0x1008af14], eax
call esi
push eax
call fcn.1001ba45
pop ecx
mov dword [0x1008af1c], eax
test eax, eax
je 0x10027164
push 0x1006f834
push edi
call esi
push eax
call fcn.1001ba45
pop ecx
mov dword [0x1008af18], eax
mov eax, dword [0x1008af18]
cmp eax, ebx
je 0x100271bc
cmp dword [0x1008af1c], ebx
je 0x100271bc
push eax
call fcn.1001bac0
push dword [0x1008af1c]
mov esi, eax
call fcn.1001bac0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100271bc
test edi, edi
je 0x100271bc
call esi
test eax, eax
je 0x100271b3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100271b3
test byte [ebp - 0xc], 1
jne 0x100271bc
or dword [ebp + 0x10], 0x200000
jmp 0x100271f5
mov eax, dword [0x1008af10]
cmp eax, ebx
je 0x100271f5
push eax
call fcn.1001bac0
pop ecx
test eax, eax
je 0x100271f5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100271f5
mov eax, dword [0x1008af14]
cmp eax, ebx
je 0x100271f5
push eax
call fcn.1001bac0
pop ecx
test eax, eax
je 0x100271f5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1008af0c]
call fcn.1001bac0
pop ecx
test eax, eax
je 0x10027215
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10027217
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002a798
Capabilities:
Inspect section memory permissions

Disassembly:
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
invalid
mov ecx, dword [eax + 0x14]
invalid
inc eax

Function at 0x1002a79e
Capabilities:
Inspect section memory permissions

Disassembly:
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
invalid
mov ecx, dword [eax + 0x14]
invalid
inc eax
Function at 0x1002a7aa
Capabilities:
Inspect section memory permissions

Disassembly:
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push ecx
push eax
call fcn.1002a1c2
inc dword [ebx + 0x45ff0cc4]
or al, 0x66
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x1002a78e
call fcn.1002a251
or eax, 0x8b7bd627
jle 0x1002a809
add edi, esi
mov dword [ebp - 0x88], edi
mov ebp, 0xffffff78
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x1002aa40
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x1002a7f6
cmp dword [eax + 0xc], ebx
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.1002a251
mov edi, 0x39f8c2b4
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
invalid
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret