joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49bd00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4da669
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
xor ebx, ebx
push ebx
mov ecx, esi
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QThread::constructor_class_QObject__]
mov dword [esp + 0x18], ebx
mov ebp, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QMutex::constructor_enum_QMutex::RecursionMode_]
push ebx
lea ecx, [esi + 0x18]
mov dword [esi], vtable.NGLAsyncOperation.0
call ebp
mov byte [esp + 0x18], 1
push ebx
lea ecx, [esi + 0x24]
mov dword [esi + 0x20], 0xffffffff
call ebp
lea ecx, [esi + 0x28]
mov byte [esp + 0x18], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QWaitCondition::constructor_void_]
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
lea ecx, [esi + 0x2c]
mov dword [ecx], eax
mov edx, eax
mov eax, 1
lock xadd dword [edx], eax
mov byte [esp + 0x18], 4
mov dword [esi + 8], edi
cmp edi, ebx
je 0x49bd97
mov eax, dword [edi + 0x18]
lea edx, [eax + 1]
mov dword [edi + 0x18], edx
mov dword [esi + 0x10], eax
jmp 0x49bd9a
mov dword [esi + 0x10], ebx
push 0x4f81e4
mov dword [esi + 0xc], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_char_const__]
mov eax, dword [esp + 0x24]
inc dword [0x570a28]
mov dword [esi + 0x14], eax
mov byte [esi + 0x1c], bl
mov dword [esi + 0x30], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x49e4a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d3c12
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
cmp dword [ecx + 8], 0
je 0x49e53e
mov edx, dword [esi]
cmp dword [edx + 8], 0
je 0x49e53e
push str._IMEI:
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004029f0
push esi
push eax
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x2c], 0
call fcn.004028f0
add esp, 0x18
lea ecx, [esp + 8]
mov byte [esp + 0x14], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x1c]
call fcn.004ad7e0
lea ecx, [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x49e9f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cfd55
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esi], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov dword [esp + 0x1c], 0
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
lea edi, [esi + 4]
mov dword [edi], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
lea ebp, [esi + 8]
mov dword [ebp], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
lea ebx, [esi + 0xc]
mov dword [ebx], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
lea ecx, [esi + 0x10]
mov dword [ecx], eax
mov edx, eax
mov eax, 1
lock xadd dword [edx], eax
xor eax, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov edx, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esi + 0x20], edx
mov eax, edx
mov edx, 1
lock xadd dword [eax], edx
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esi + 0x24], eax
mov edx, eax
mov eax, 1
lock xadd dword [edx], eax
mov edx, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esi + 0x28], edx
mov eax, edx
mov edx, 1
lock xadd dword [eax], edx
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esi + 0x30], eax
mov edx, eax
mov eax, 1
lock xadd dword [edx], eax
mov edx, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esi + 0x34], edx
mov eax, edx
mov edx, 1
lock xadd dword [eax], edx
push 0x4f81e4
mov byte [esp + 0x20], 9
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_char_const__]
push 0x4f81e4
mov ecx, esi
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_char_const__]
push 0x4f81e4
mov ecx, edi
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_char_const__]
push 0x4f81e4
mov ecx, ebp
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_char_const__]
push 0x4f81e4
mov ecx, ebx
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_char_const__]
xor eax, eax
push 0x4f81e4
lea ecx, [esi + 0x30]
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], eax
mov byte [esi + 0x2c], al
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_char_const__]
push 0x4f81e4
lea ecx, [esi + 0x34]
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_char_const__]
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x49eb80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cfcb9
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
lea ecx, [esi + 0x34]
mov dword [esp + 0x10], 8
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 7
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 6
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 5
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 4
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esi + 0x10]
mov byte [esp + 0x10], 3
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esi + 0xc]
mov byte [esp + 0x10], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esi + 8]
mov byte [esp + 0x10], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esi + 4]
mov byte [esp + 0x10], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4

Function at 0x49ecb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cf5d9
mov eax, dword fs:[0]
push eax
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
add ecx, 0x30
mov dword [esp + 0x10], 0
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_class_QString_const__]
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4
Function at 0x4a9b20
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e8251
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
push ebx
push esi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [esp + 0x1c]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QProcess::constructor_class_QObject__]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0xd4], 0
call dword [sym.imp.QtCore4.dll_public:_class_QString___thiscall_QFile::fileName_void_]
mov ebx, 1
mov byte [esp + 0xd0], bl
mov eax, dword [esp + 0x10]
cmp dword [eax + 8], 0
jle 0x4a9c54
mov eax, dword [eax + 0xc]
push 5
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x4a9c4a
push 0
lea ecx, [esp + 0x28]
push ecx
call fcn.00438e10
mov byte [esp + 0xd0], 2
mov byte [esp + 0xc], 0x20
mov edx, dword [esp + 0xc]
push edx
lea ecx, [esp + 0x10]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QChar::constructor_struct_QLatin1Char_]
mov eax, str.Argument_is_a_file_name_with_path.
mov ecx, str._Failed_to_start_the_process__1_
lea esi, [esp + 0x14]
call fcn.004a4be0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
lea edx, [esp + 0x10]
push edx
push 0
lea edx, [esp + 0x1c]
push edx
push ecx
mov ecx, eax
mov byte [esp + 0xe4], 3
call dword [sym.imp.QtCore4.dll_public:_class_QString___thiscall_QString::arg_class_QString_const___int__class_QChar_const__]
lea ecx, [esp + 0x28]
call fcn.004394d0
mov ecx, esi
mov byte [esp + 0xd0], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x24]
call dword [sym.imp.QtGui4.dll_public:_int___thiscall_QDialog::exec_void_]
mov ecx, dword [edi + 0x4c]
add dword [edi + 0x5c], ebx
push ebx
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QSemaphore::release_int_]
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xd4], bl
call fcn.00439210
jmp 0x4a9c61
push edi
mov ecx, esi
call fcn.004a9720
jmp 0x4a9c61
mov ecx, dword [edi + 0x4c]
add dword [edi + 0x5c], ebx
push ebx
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QSemaphore::release_int_]
lea ecx, [esp + 0x10]
mov byte [esp + 0xd0], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x18]
mov dword [esp + 0xd0], 0xffffffff
call dword [sym.imp.QtCore4.dll_public_virtual:_void___thiscall_QProcess::destructor_void_]
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc8
ret
Function at 0x4ad950
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d3814
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x56e01c]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ecx, dword [esi + 8]
mov ebp, dword [esp + 0x4c]
mov al, 0xa
mov byte [esp + 0x31], al
mov byte [esp + 0x33], al
mov eax, dword [esi + 0xc]
add ecx, eax
xor bl, bl
cmp dword [esp + 0x48], ecx
mov byte [esp + 0x2c], 0x89
mov byte [esp + 0x2d], 0x50
mov byte [esp + 0x2e], 0x4e
mov byte [esp + 0x2f], 0x47
mov byte [esp + 0x30], 0xd
mov byte [esp + 0x32], 0x1a
jl 0x4adaba
add eax, edi
push 8
push eax
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.MSVCR90.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x4adaba
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QBuffer::constructor_class_QObject__]
mov dword [esp + 0x40], 0
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
add ecx, edi
push eax
push ecx
lea ecx, [esp + 0x20]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QBuffer::setData_char_const___int_]
push ecx
mov eax, esp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esp
mov dword [eax], 1
call dword [sym.imp.QtCore4.dll_public_virtual:_bool___thiscall_QBuffer::open_class_QFlags_enum_QIODevice::OpenModeFlag__]
push 0x5357ec
lea ecx, [esp + 0x14]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::constructor_char_const__]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x48], 1
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QImageReader::constructor_class_QIODevice___class_QByteArray_const__]
mov bl, 3
mov byte [esp + 0x40], bl
mov ecx, dword [esp + 0x10]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4ada62
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.QtCore4.dll_void___cdecl_qFree_void__]
add esp, 4
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x18]
call dword [sym.imp.QtGui4.dll_public:_class_QImage___thiscall_QImageReader::read_void_]
push eax
mov ecx, ebp
mov byte [esp + 0x44], 4
call dword [sym.imp.QtGui4.dll_public:_class_QImage____thiscall_QImage::operator_class_QImage_const__]
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], bl
call dword [sym.imp.QtGui4.dll_public_virtual:_void___thiscall_QImage::destructor_void_]
lea ecx, [esp + 0x18]
call dword [sym.imp.QtCore4.dll_public_virtual:_void___thiscall_QBuffer::close_void_]
lea ecx, [esp + 0x14]
mov bl, 1
mov byte [esp + 0x40], 0
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QImageReader::destructor_void_]
lea ecx, [esp + 0x18]
mov dword [esp + 0x40], 0xffffffff
call dword [sym.imp.QtCore4.dll_public_virtual:_void___thiscall_QBuffer::destructor_void_]
mov al, bl
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004ce3bb
add esp, 0x38
ret
Function at 0x4b14b4
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4b14ef
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4b14d6
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4b14e7
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4b14f1
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4b14cc
xor eax, eax
pop edi
pop esi
ret

Function at 0x4b1530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
aas
and al, 0x8b
jge 0x4b153d
mov esi, dword [edi + 0x3c]
add esi, edi
mov ebx, dword [esi + 0x78]
call fcn.004b1474
inc eax
pop edi
fiadd word [edi + 0x56]
push ebx
call fcn.004b14b4
pop ecx
test eax, eax
pop ecx
je 0x4b1607
push edi
push esi
push ebx
call fcn.004b14f4
add esp, 0xc
call fcn.004b1474
sbb eax, 0x8b22f379
jbe 0x4b15e6
test esi, esi
je 0x4b1607
mov ebx, dword [esi + edi + 0x24]
add esi, edi
add ebx, edi
call fcn.004b1474
push ss
stosb byte es:[di], al
inc esp
mov eax, dword [esi + 0x20]
add eax, edi
mov edi, dword [esi + 0x1c]
add edi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
shr eax, 0x10
test ax, ax
je 0x4b1616
and dword [ebp - 4], 0
mov eax, dword [edi]
mov dword [ebp - 0x10], eax
call fcn.004b1474
ja 0x4b15cb
jle 0x4b15cf
cmp dword [ebp - 0x10], 0
je 0x4b15fb
mov eax, dword [ebp - 0x14]
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, dword [ebp - 4]
jne 0x4b15e7
pop ss
mov eax, dword [ebp - 0xc]
push dword [ebp + 0xc]
mov eax, dword [eax]
add eax, dword [ebp + 8]
push eax
call fcn.004b140a
pop ecx
test eax, eax
pop ecx
je 0x4b160e
daa
mov eax, dword [esi + 0x18]
inc dword [ebp - 0x10]
add dword [ebp - 8], 2
add dword [ebp - 0xc], 4
dec eax
cmp dword [ebp - 0x10], eax
jbe 0x4b15c5
mov eax, dword [esi + 0x14]
inc dword [ebp - 4]
dec eax
cmp dword [ebp - 4], eax
jbe 0x4b15a4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 4]
mov eax, dword [edi + eax*4]
jmp 0x4b164b
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x10]
add eax, ebx
cmp dword [ebp + 0xc], eax
jne 0x4b1636
call fcn.004b1474
invalid
mov eax, dword [esi + 0x14]
add dword [ebp - 0x10], 4
inc ebx
dec eax
cmp ebx, eax
jbe 0x4b161b
jmp 0x4b1607
add eax, dword [ebp + 8]
jmp 0x4b1609

Function at 0x4b1700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov ch, 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.004b1474
mov ebx, ebp
mov dl, 0xd5
lea eax, [ebp - 0x58]
push eax
call fcn.004b1484
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004b1439
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
Function at 0x4b1800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004b1484
push eax
push esi
push dword [ebp + 8]
call fcn.004b1439
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004b1484
push eax
push esi
push dword [ebp + 8]
call fcn.004b1439
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
invalid
pop ebp
Function at 0x4b6280
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4e3227
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov ecx, dword [edi + 0x24]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QTimer::stop_void_]
lea eax, [esp + 0x14]
call fcn.004b1de0
lea ebp, [edi + 0x10]
push eax
mov ecx, ebp
mov dword [esp + 0x34], ebx
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_class_QString_const__]
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov eax, dword [edi + 0x18]
cmp eax, ebx
je 0x4b6355
cmp byte [eax + 0x24], bl
je 0x4b6355
mov ebx, dword [sym.imp.QtCore4.dll_public:_class_QString___thiscall_QString::trimmed_void_]
lea eax, [esp + 0x24]
push eax
mov ecx, ebp
call ebx
mov dword [esp + 0x18], eax
mov eax, 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x18]
lea esi, [esp + 0x20]
call fcn.004b7da0
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x34], 2
mov esi, 3
mov ecx, eax
mov dword [esp + 0x18], esi
call ebx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x30], esi
mov ebx, 7
push edx
mov ecx, eax
mov dword [esp + 0x18], ebx
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QString::operator_class_QString_const__const]
mov byte [esp + 0x13], 1
test al, al
jne 0x4b635a
mov byte [esp + 0x13], 0
mov dword [esp + 0x30], 2
test bl, 4
je 0x4b6378
and ebx, 0xfffffffb
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], ebx
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov dword [esp + 0x30], 1
test bl, 2
je 0x4b6396
and ebx, 0xfffffffd
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], ebx
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov dword [esp + 0x30], 0xffffffff
test bl, 1
je 0x4b63ad
lea ecx, [esp + 0x24]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
cmp byte [esp + 0x13], 0
jne 0x4b6410
mov eax, dword [ebp]
cmp dword [eax + 8], 0
je 0x4b6410
mov ecx, dword [edi + 0x1c]
call dword [sym.imp.QtCore4.dll_public:_int___thiscall_QSemaphore::available_void_const]
test eax, eax
jle 0x4b6410
mov ecx, dword [edi + 0x1c]
push 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QSemaphore::acquire_int_]
mov edx, dword [edi + 0x18]
test edx, edx
je 0x4b63e1
call fcn.004b90c0
lea esi, [edi + 8]
mov byte [edi + 0x29], 1
call fcn.004b72b0
mov ecx, dword [edi + 0x1c]
push 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QSemaphore::release_int_]
mov ecx, dword [edi + 0x14]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push ebp
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
push edi
call fcn.004b5fc0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x4bdab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d9048
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [esp + 0x40]
mov ecx, dword [esi + 0x20]
push 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QSemaphore::acquire_int_]
lea eax, [esp + 0x14]
push eax
lea ebx, [esi + 0xc]
call fcn.004be220
xor ebp, ebp
mov dword [esp + 0x38], ebp
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
sub edx, ecx
xor edi, edi
test edx, edx
jle 0x4bdb77
mov ebx, dword [sym.imp.QtCore4.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___]
add ecx, edi
mov esi, dword [eax + ecx*4 + 0x14]
lea ecx, [esp + 0x20]
push ecx
push 3
lea eax, [esp + 0x20]
push 0x56e934
push esi
mov byte [esi + 0x14], 1
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], eax
call ebx
mov edx, dword [esi + 0xc]
lea ecx, [esp + 0x38]
push ecx
push ebp
lea eax, [esp + 0x34]
push 0x56e934
push esi
mov dword [esp + 0x3c], edx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], eax
call ebx
mov eax, dword [esp + 0x34]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
inc edi
sub edx, ecx
add esp, 0x20
cmp edi, edx
jl 0x4bdb11
mov esi, dword [esp + 0x40]
mov ecx, dword [esi + 0x20]
push 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QSemaphore::release_int_]
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x4bdbb3
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4bdbb3
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
test eax, eax
jne 0x4bdbb3
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.QtCore4.dll_void___cdecl_qFree_void__]
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4