joyce8/EMBER2024-capa huggingface dataset:
Function at 0x670dd5d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rbp
mov rbx, r8
mov rbp, rdx
mov rsi, rcx
mov r12, qword [rcx + 0x18]
test r8, r8
js 0x670dd6f4
xor edi, edi
cmp qword [rcx + 0x70], rdi
je 0x670dd64f
nop word [rax + rax]
mov r8, rbx
sub r8, rdi
lea rcx, [rdi + rbp]
mov r9, qword [rsi + 0x70]
mov edx, 1
call qword [sym.imp.MSVCR100.dll_fwrite]
add rdi, rax
test rax, rax
jne 0x670dd641
call qword [sym.imp.MSVCR100.dll__errno]
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x670dd649
xor ecx, ecx
cmp rdi, rbx
setl cl
test ecx, ecx
jne 0x670dd610
jmp 0x670dd696
cmp dword [rcx + 0x98], 0xffffffff
je 0x670dd696
nop dword [rax + rax]
mov r8d, ebx
sub r8d, edi
lea rdx, [rdi + rbp]
mov ecx, dword [rsi + 0x98]
call qword [sym.imp.MSVCR100.dll__write]
cmp eax, 0xffffffff
jne 0x670dd688
call qword [sym.imp.MSVCR100.dll__errno]
cmp dword [rax], 4
jne 0x670dd696
jmp 0x670dd660
test eax, eax
jle 0x670dd696
cdqe
add rdi, rax
cmp rdi, rbx
jl 0x670dd660
test rbx, rbx
je 0x670dd72d
test rdi, rdi
jne 0x670dd72d
or rdi, 0xffffffffffffffff
call qword [sym.imp.MSVCR100.dll__errno]
mov edx, dword [rax]
lea rcx, [rsp + 0x50]
call sym.QtCoreVBox4.dll_class_QString___cdecl_qt_error_string_int_
mov rbx, rax
call qword [sym.imp.MSVCR100.dll__errno]
mov edx, 2
mov ecx, 4
cmp dword [rax], 0x1c
cmove edx, ecx
mov r8, rbx
mov rcx, r12
call sym.QtCoreVBox4.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFile::FileError__class_QString_const____ptr64____ptr64
nop
mov rcx, qword [rsp + 0x50]
lock dec dword [rcx]
jne 0x670dd72d
mov rcx, qword [rsp + 0x50]
jmp 0x670dd728
mov edx, 0x16
lea rcx, [rsp + 0x60]
call sym.QtCoreVBox4.dll_class_QString___cdecl_qt_error_string_int_
nop
mov r8, rax
mov edx, 2
mov rcx, r12
call sym.QtCoreVBox4.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFile::FileError__class_QString_const____ptr64____ptr64
nop
mov rcx, qword [rsp + 0x60]
or rdi, 0xffffffffffffffff
lock dec dword [rcx]
jne 0x670dd72d
mov rcx, qword [rsp + 0x60]
call sym.QtCoreVBox4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data____ptr64_
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x670ddc20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0x9c], 1
je 0x670ddc52
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0x9c], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x670ea970
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rbp, r8
mov r12, rdx
mov rsi, rcx
mov r13, qword [rcx + 0x18]
mov rax, qword [rcx + 0x70]
test rax, rax
jne 0x670eaa78
cmp dword [rcx + 0x98], 0xffffffff
jne 0x670eaa73
cmp qword [rcx + 0x78], 0xffffffffffffffff
je 0x670eaac7
mov edi, r8d
mov dword [r11 + 8], r8d
xor r14d, r14d
mov ebx, r14d
lea r15, [0x6720b1a0]
nop word [rax + rax]
lea rax, [rsp + 0x90]
cmp edi, 0x2000000
cmovae rax, r15
lea rdx, [rbx + r12]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xa8]
mov r8d, dword [rax]
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x670eaa32
mov ecx, dword [rsp + 0xa8]
test ecx, ecx
je 0x670eaa6e
add rbx, rcx
sub edi, ecx
mov dword [rsp + 0x90], edi
cmp rbx, rbp
jge 0x670eaa6e
jmp 0x670ea9e0
test rbx, rbx
jne 0x670eaa6e
or edx, 0xffffffff
lea rcx, [rsp + 0x30]
call sym.QtCoreVBox4.dll_class_QString___cdecl_qt_error_string_int_
nop
mov r8, rax
lea edx, [rbx + 1]
mov rcx, r13
call sym.QtCoreVBox4.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFile::FileError__class_QString_const____ptr64____ptr64
nop
mov rax, qword [rsp + 0x30]
lock dec dword [rax]
jne 0x670eaa68
mov rcx, qword [rsp + 0x30]
call sym.QtCoreVBox4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data____ptr64_
or rax, 0xffffffffffffffff
jmp 0x670eaadb
mov rax, rbx
jmp 0x670eaadb
test rax, rax
je 0x670eaacd
call fcn.670ea520
test al, al
je 0x670eaacd
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.MSVCR100.dll_feof]
test eax, eax
je 0x670eaacd
call qword [sym.imp.MSVCR100.dll__errno]
mov edx, dword [rax]
lea rcx, [rsp + 0x38]
call sym.QtCoreVBox4.dll_class_QString___cdecl_qt_error_string_int_
nop
mov r8, rax
mov edx, 1
mov rcx, r13
call sym.QtCoreVBox4.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFile::FileError__class_QString_const____ptr64____ptr64
nop
mov rcx, qword [rsp + 0x38]
lock dec dword [rcx]
jne 0x670eaac7
mov rcx, qword [rsp + 0x38]
call sym.QtCoreVBox4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data____ptr64_
or rax, 0xffffffffffffffff
jmp 0x670eaadb
mov r8, rbp
mov rdx, r12
mov rcx, rsi
call fcn.670dd2e0
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x670ddcc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0x9c], 2
je 0x670ddcf2
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0x9c], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x670eab00
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rbp, r8
mov r12, rdx
mov rsi, rcx
mov r13, qword [rcx + 0x18]
cmp qword [rcx + 0x70], 0
jne 0x670eabf5
cmp dword [rcx + 0x98], 0xffffffff
jne 0x670eabf5
cmp qword [rcx + 0x78], 0xffffffffffffffff
je 0x670eabea
mov edi, r8d
xor r14d, r14d
mov ebx, r14d
lea r15, [0x6720b1a0]
mov dword [rsp + 0x80], edi
lea rax, [rsp + 0x80]
cmp edi, 0x2000000
cmovae rax, r15
lea rdx, [rbx + r12]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x98]
mov r8d, dword [rax]
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x670eabb4
mov eax, dword [rsp + 0x98]
test eax, eax
je 0x670eabf0
add rbx, rax
sub rdi, rax
cmp rbx, rbp
jge 0x670eabf0
jmp 0x670eab61
test rbx, rbx
jne 0x670eabf0
or edx, 0xffffffff
lea rcx, [rsp + 0x30]
call sym.QtCoreVBox4.dll_class_QString___cdecl_qt_error_string_int_
nop
mov r8, rax
lea edx, [rbx + 2]
mov rcx, r13
call sym.QtCoreVBox4.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFile::FileError__class_QString_const____ptr64____ptr64
nop
mov rax, qword [rsp + 0x30]
lock dec dword [rax]
jne 0x670eabea
mov rcx, qword [rsp + 0x30]
call sym.QtCoreVBox4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data____ptr64_
or rax, 0xffffffffffffffff
jmp 0x670eabfa
mov rax, rbx
jmp 0x670eabfa
call fcn.670dd5d0
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x670e78a0
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov rdi, rcx
mov dword [rax - 0x28], 0x18
mov dword [rax - 0x18], 1
mov r9d, 0x100000
lea r8, [rax - 0x28]
mov qword [rax - 0x20], rsi
test dl, dl
je 0x670e78f8
lea rdx, [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x670e7956
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rdi + 8]
jmp 0x670e7920
lea rdx, [rcx + 8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x670e7956
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9, rdi
mov rdx, qword [rsp + 0x80]
mov dword [rsp + 0x30], 2
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x670e7956
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x670e7ab0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x100]
test rcx, rcx
je 0x670e7ace
mov rcx, qword [rcx]
mov edx, 0xf291
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x670e8050
Capabilities:
Read file on windows
Read pipe
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
mov rcx, qword [rcx + 0x158]
cmp rcx, 0xffffffffffffffff
jne 0x670e8078
xor eax, eax
jmp 0x670e819d
xor esi, esi
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [rbx + 0xec], 2
jne 0x670e8199
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x670e819d
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0x78]
call sym.QtCoreVBox4.dll_public:_void___cdecl_QByteArray::constructor_int__char____ptr64
nop
mov dword [rsp + 0x68], esi
mov rcx, qword [rsp + 0x78]
mov edi, dword [rcx + 8]
mov eax, dword [rcx]
cmp eax, 1
jne 0x670e80e6
mov rax, qword [rsp + 0x78]
lea rdx, [rax + 0x18]
cmp qword [rax + 0x10], rdx
je 0x670e80f8
mov edx, dword [rcx + 8]
lea rcx, [rsp + 0x78]
call sym.QtCoreVBox4.dll_private:_void___cdecl_QByteArray::realloc_int____ptr64
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, qword [rax + 0x10]
mov rcx, qword [rbx + 0x158]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x670e8181
cmp dword [rsp + 0x68], 0
jbe 0x670e8181
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
test rax, rax
je 0x670e8181
mov dword [rsp + 0x70], esi
mov rcx, qword [rsp + 0x78]
mov edx, dword [rcx]
mov rcx, qword [rsp + 0x78]
cmp edx, 1
jne 0x670e8153
lea rdx, [rcx + 0x18]
cmp qword [rcx + 0x10], rdx
je 0x670e8165
mov edx, dword [rcx + 8]
lea rcx, [rsp + 0x78]
call sym.QtCoreVBox4.dll_private:_void___cdecl_QByteArray::realloc_int____ptr64
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rcx + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x60], esi
mov rax, qword [rsp + 0x78]
lock dec dword [rax]
jne 0x670e8199
mov rcx, qword [rsp + 0x78]
call sym.QtCoreVBox4.dll_void___cdecl_qFree_void____ptr64_
mov eax, dword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x670e81b0
Capabilities:
Read file on windows
Read pipe
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
mov rcx, qword [rcx + 0x188]
cmp rcx, 0xffffffffffffffff
jne 0x670e81d8
xor eax, eax
jmp 0x670e82fd
xor esi, esi
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [rbx + 0xec], 2
jne 0x670e82f9
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x670e82fd
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0x78]
call sym.QtCoreVBox4.dll_public:_void___cdecl_QByteArray::constructor_int__char____ptr64
nop
mov dword [rsp + 0x68], esi
mov rcx, qword [rsp + 0x78]
mov edi, dword [rcx + 8]
mov eax, dword [rcx]
cmp eax, 1
jne 0x670e8246
mov rax, qword [rsp + 0x78]
lea rdx, [rax + 0x18]
cmp qword [rax + 0x10], rdx
je 0x670e8258
mov edx, dword [rcx + 8]
lea rcx, [rsp + 0x78]
call sym.QtCoreVBox4.dll_private:_void___cdecl_QByteArray::realloc_int____ptr64
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, qword [rax + 0x10]
mov rcx, qword [rbx + 0x188]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x670e82e1
cmp dword [rsp + 0x68], 0
jbe 0x670e82e1
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
test rax, rax
je 0x670e82e1
mov dword [rsp + 0x70], esi
mov rcx, qword [rsp + 0x78]
mov edx, dword [rcx]
mov rcx, qword [rsp + 0x78]
cmp edx, 1
jne 0x670e82b3
lea rdx, [rcx + 0x18]
cmp qword [rcx + 0x10], rdx
je 0x670e82c5
mov edx, dword [rcx + 8]
lea rcx, [rsp + 0x78]
call sym.QtCoreVBox4.dll_private:_void___cdecl_QByteArray::realloc_int____ptr64
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rcx + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x60], esi
mov rax, qword [rsp + 0x78]
lock dec dword [rax]
jne 0x670e82f9
mov rcx, qword [rsp + 0x78]
call sym.QtCoreVBox4.dll_void___cdecl_qFree_void____ptr64_
mov eax, dword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x670e8310
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call fcn.670e8050
lea r9, [rsp + 0x50]
lea rcx, [rsp + 0x58]
cmp rbx, rax
mov qword [rsp + 0x58], rax
cmovge r9, rcx
xor eax, eax
mov r8d, dword [r9]
mov dword [rsp + 0x58], eax
test r8d, r8d
je 0x670e838c
mov rcx, qword [rdi + 0x158]
lea r9, [rsp + 0x58]
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x670e8388
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x670e83a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call fcn.670e81b0
lea r9, [rsp + 0x50]
lea rcx, [rsp + 0x58]
cmp rbx, rax
mov qword [rsp + 0x58], rax
cmovge r9, rcx
xor eax, eax
mov r8d, dword [r9]
mov dword [rsp + 0x58], eax
test r8d, r8d
je 0x670e841c
mov rcx, qword [rdi + 0x188]
lea r9, [rsp + 0x58]
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x670e8418
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x670e9200
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp + 0x4f], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov rdi, r9
mov rbx, r8
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp + 0x77]
call fcn.670e8e20
nop
mov dword [rbp - 0x39], 0x68
xor esi, esi
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x29], rsi
mov qword [rbp - 0x21], rsi
mov dword [rbp - 0x19], 0x80000000
mov dword [rbp - 0x15], 0x80000000
mov dword [rbp - 0x11], 0x80000000
mov dword [rbp - 0xd], 0x80000000
mov qword [rbp - 9], rsi
mov qword [rbp - 1], rsi
mov dword [rbp + 7], esi
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x1f], rsi
mov qword [rbp + 0x27], rsi
mov rax, qword [rbx]
cmp dword [rax + 8], esi
jne 0x670e9291
mov ebx, esi
jmp 0x670e929c
mov rcx, rbx
call sym.QtCoreVBox4.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64
mov rbx, rax
lea rcx, [rbp + 0x77]
call sym.QtCoreVBox4.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64
mov rdx, rax
lea rax, [rbp + 0x37]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x410
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne bl
test bl, bl
je 0x670e9306
mov rcx, qword [rbp + 0x3f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x37]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x670e9306
mov ecx, dword [rbp + 0x47]
mov qword [rdi], rcx
mov rcx, qword [rbp + 0x77]
lock dec dword [rcx]
jne 0x670e9318
mov rcx, qword [rbp + 0x77]
call sym.QtCoreVBox4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data____ptr64_
movzx eax, bl
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x670ea970
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0x9c], 1
je 0x670ddc52
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0x9c], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x670ea970
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rbp, r8
mov r12, rdx
mov rsi, rcx
mov r13, qword [rcx + 0x18]
mov rax, qword [rcx + 0x70]
test rax, rax
jne 0x670eaa78
cmp dword [rcx + 0x98], 0xffffffff
jne 0x670eaa73
cmp qword [rcx + 0x78], 0xffffffffffffffff
je 0x670eaac7
mov edi, r8d
mov dword [r11 + 8], r8d
xor r14d, r14d
mov ebx, r14d
lea r15, [0x6720b1a0]
nop word [rax + rax]
lea rax, [rsp + 0x90]
cmp edi, 0x2000000
cmovae rax, r15
lea rdx, [rbx + r12]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xa8]
mov r8d, dword [rax]
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x670eaa32
mov ecx, dword [rsp + 0xa8]
test ecx, ecx
je 0x670eaa6e
add rbx, rcx
sub edi, ecx
mov dword [rsp + 0x90], edi
cmp rbx, rbp
jge 0x670eaa6e
jmp 0x670ea9e0
test rbx, rbx
jne 0x670eaa6e
or edx, 0xffffffff
lea rcx, [rsp + 0x30]
call sym.QtCoreVBox4.dll_class_QString___cdecl_qt_error_string_int_
nop
mov r8, rax
lea edx, [rbx + 1]
mov rcx, r13
call sym.QtCoreVBox4.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFile::FileError__class_QString_const____ptr64____ptr64
nop
mov rax, qword [rsp + 0x30]
lock dec dword [rax]
jne 0x670eaa68
mov rcx, qword [rsp + 0x30]
call sym.QtCoreVBox4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data____ptr64_
or rax, 0xffffffffffffffff
jmp 0x670eaadb
mov rax, rbx
jmp 0x670eaadb
test rax, rax
je 0x670eaacd
call fcn.670ea520
test al, al
je 0x670eaacd
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.MSVCR100.dll_feof]
test eax, eax
je 0x670eaacd
call qword [sym.imp.MSVCR100.dll__errno]
mov edx, dword [rax]
lea rcx, [rsp + 0x38]
call sym.QtCoreVBox4.dll_class_QString___cdecl_qt_error_string_int_
nop
mov r8, rax
mov edx, 1
mov rcx, r13
call sym.QtCoreVBox4.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFile::FileError__class_QString_const____ptr64____ptr64
nop
mov rcx, qword [rsp + 0x38]
lock dec dword [rcx]
jne 0x670eaac7
mov rcx, qword [rsp + 0x38]
call sym.QtCoreVBox4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data____ptr64_
or rax, 0xffffffffffffffff
jmp 0x670eaadb
mov r8, rbp
mov rdx, r12
mov rcx, rsi
call fcn.670dd2e0
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x670eab00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0x9c], 2
je 0x670ddcf2
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0x9c], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x670eab00
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rbp, r8
mov r12, rdx
mov rsi, rcx
mov r13, qword [rcx + 0x18]
cmp qword [rcx + 0x70], 0
jne 0x670eabf5
cmp dword [rcx + 0x98], 0xffffffff
jne 0x670eabf5
cmp qword [rcx + 0x78], 0xffffffffffffffff
je 0x670eabea
mov edi, r8d
xor r14d, r14d
mov ebx, r14d
lea r15, [0x6720b1a0]
mov dword [rsp + 0x80], edi
lea rax, [rsp + 0x80]
cmp edi, 0x2000000
cmovae rax, r15
lea rdx, [rbx + r12]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x98]
mov r8d, dword [rax]
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x670eabb4
mov eax, dword [rsp + 0x98]
test eax, eax
je 0x670eabf0
add rbx, rax
sub rdi, rax
cmp rbx, rbp
jge 0x670eabf0
jmp 0x670eab61
test rbx, rbx
jne 0x670eabf0
or edx, 0xffffffff
lea rcx, [rsp + 0x30]
call sym.QtCoreVBox4.dll_class_QString___cdecl_qt_error_string_int_
nop
mov r8, rax
lea edx, [rbx + 2]
mov rcx, r13
call sym.QtCoreVBox4.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFile::FileError__class_QString_const____ptr64____ptr64
nop
mov rax, qword [rsp + 0x30]
lock dec dword [rax]
jne 0x670eabea
mov rcx, qword [rsp + 0x30]
call sym.QtCoreVBox4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data____ptr64_
or rax, 0xffffffffffffffff
jmp 0x670eabfa
mov rax, rbx
jmp 0x670eabfa
call fcn.670dd5d0
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret