joyce8/EMBER2024-capa huggingface dataset:
Function at 0x670d97f2
Capabilities:
Write file on windows

Disassembly:
push 0x50
mov eax, 0x671b135a
call fcn.671a2b36
mov edi, ecx
push edi
lea ecx, [ebp - 0x5c]
call fcn.670c1504
xor eax, eax
mov dword [ebp - 0x4c], 0xc
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x38]
push eax
call fcn.670c1b4c
push 0
push 0x80
xor ebx, ebx
lea ecx, [ebp - 0x4c]
inc ebx
push ebx
push ecx
push ebx
push 0xc0000000
mov ecx, eax
mov byte [ebp - 4], bl
call sym.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
mov esi, eax
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
cmp esi, 0xffffffff
jne 0x670d98ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
sub ecx, 5
je 0x670d98b7
sub ecx, 0x1b
je 0x670d9932
sub ecx, 0x30
je 0x670d9932
sub ecx, 0x67
je 0x670d9932
movaps xmm0, xmmword [0x671be450]
push 0
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], 0x671bd654
push str.Got_unexpected_locking_error__llu
push eax
movups xmmword [ebp - 0x24], xmm0
call sym.Qt5Core.dll_public:_void___cdecl_QMessageLogger::warning_char_const__const
add esp, 0x10
push 3
pop ebx
jmp 0x670d9932
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x5c]
call fcn.670c1b4c
mov ecx, eax
mov byte [ebp - 4], 2
call sym.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const
lea ecx, [ebp - 0x34]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
neg eax
lea ecx, [ebp - 0x38]
sbb ebx, ebx
add ebx, 2
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
jmp 0x670d9932
lea eax, [ebp - 0x3c]
mov dword [edi + 4], esi
push eax
mov ecx, edi
call fcn.670af2a1
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x40]
and dword [ebp - 0x40], 0
xor ebx, ebx
push ebx
push edx
mov ecx, dword [eax + 0xc]
push dword [eax + 4]
add ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x670d9927
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x670d992a
push 3
pop ebx
lea ecx, [ebp - 0x3c]
call sym.Qt5Core.dll_public:_void___thiscall_QByteArray::destructor_void_
lea ecx, [ebp - 0x58]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
lea ecx, [ebp - 0x5c]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
mov eax, ebx
call fcn.671a2af1
ret
Function at 0x670d9f88
Capabilities:
Copy file

Disassembly:
push 8
mov eax, 0x671ae868
call fcn.671a2b02
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.670c1b4c
and dword [ebp - 4], 0
mov ecx, eax
call sym.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const
mov ecx, dword [ebp + 8]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
call fcn.670c1b4c
mov ecx, eax
mov byte [ebp - 4], 1
call sym.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
lea ecx, [ebp - 0x10]
test esi, esi
setne bl
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
lea ecx, [ebp - 0x14]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
test esi, esi
jne 0x670d9ffb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], 2
mov al, bl
call fcn.671a2adc
ret
Function at 0x670da20d
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x671b1463
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x6753165c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x214]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x10], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
and dword [ebp - 4], 0
lea eax, [ebp]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test esi, esi
je 0x670da2eb
cmp esi, ebx
jbe 0x670da2c6
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.671a37a1
pop ecx
mov ebx, eax
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x670da2bd
push esi
lea eax, [ebp - 0x14]
push ebx
push eax
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_
mov ecx, dword [ebp - 0x10]
mov edx, eax
add esp, 0xc
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov dword [edx], ecx
lea ecx, [ebp - 0x14]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
push ebx
call fcn.671a37aa
pop ecx
jmp 0x670da2eb
push esi
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_
mov ecx, dword [ebp - 0x10]
mov edx, eax
add esp, 0xc
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov dword [edx], ecx
lea ecx, [ebp - 0x14]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
mov eax, dword [ebp - 0x10]
push 2
pop ecx
cmp dword [eax + 4], ecx
jl 0x670da34c
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_void___thiscall_QString::detach_void_
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x12]
push eax
call sym.Qt5Core.dll_public:_class_QChar___thiscall_QCharRef::operator_class_QChar_void_
cmp word [eax], 0x3a
jne 0x670da34c
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
movzx esi, word [ecx + eax]
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_void___thiscall_QString::detach_void_
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x10]
mov ecx, esi
mov dword [ebp - 0x1c], eax
call sym.Qt5Core.dll_public:_static_unsigned_int___fastcall_QChar::toUpper_unsigned_int_
movzx eax, ax
lea ecx, [ebp - 0x1c]
push eax
call sym.Qt5Core.dll_public:_class_QCharRef____thiscall_QCharRef::operator_class_QChar_
push dword [ebp - 0x10]
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.670c156d
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.671a2acb
add ebp, 0x20c
leave
ret
Function at 0x670db523
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x254]
sub esp, 0x254
push 0xffffffffffffffff
push 0x671b16b7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x6753165c]
xor eax, ebp
mov dword [ebp + 0x250], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0x25c]
mov esi, dword [ebp + 0x260]
mov ecx, dword [ecx]
mov dword [ebp - 0x10], ecx
call fcn.670042b7
mov eax, dword [ebp - 0x10]
and dword [ebp - 4], 0
cmp dword [eax + 4], 2
jne 0x670db59a
mov ecx, dword [eax + 0xc]
cmp word [ecx + eax + 2], 0x3a
jne 0x670db59a
push ecx
mov eax, esp
push 0x5c
pop ecx
mov word [eax], cx
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_class_QString____thiscall_QString::operator_class_QChar_
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.670d877f
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call sym.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x670db5f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x670db5d3
cmp eax, 0x20
jne 0x670db5f1
lea eax, [ebp]
push eax
push ecx
mov ecx, dword [ebp - 0x14]
mov eax, esp
mov dword [eax], ecx
call fcn.670042b7
call fcn.670dae8e
test al, al
pop ecx
cmovne ebx, dword [ebp]
pop ecx
test esi, esi
je 0x670db5fd
cmp ebx, 0xffffffff
setne al
mov byte [esi], al
cmp ebx, 0xffffffff
jne 0x670db606
xor ebx, ebx
jmp 0x670db60c
shr ebx, 4
and bl, 1
lea ecx, [ebp - 0x14]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp + 0x250]
xor ecx, ebp
call fcn.671a2acb
add ebp, 0x254
leave
ret
Function at 0x670dc1cf
Capabilities:
Delete file

Disassembly:
push 0x18
mov eax, 0x671a5b54
call fcn.671a2b02
mov ecx, dword [ebp + 8]
call fcn.670a5172
test al, al
je 0x670dc219
push str.Empty_filename_passed_to_function
movaps xmm0, xmmword [0x671be450]
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x14], 0x671bd654
movups xmmword [ebp - 0x24], xmm0
call sym.Qt5Core.dll_public:_void___cdecl_QMessageLogger::warning_char_const__const
pop ecx
pop ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x16
xor al, al
jmp 0x670dc272
push dword [ebp + 8]
call fcn.670dba3f
pop ecx
test al, al
je 0x670dc22d
push str.Broken_filename_passed_to_function
jmp 0x670dc1ec
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.670c1b4c
and dword [ebp - 4], 0
mov ecx, eax
call sym.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
lea ecx, [ebp - 0x10]
test esi, esi
setne bl
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
test esi, esi
jne 0x670dc270
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], 2
mov al, bl
call fcn.671a2adc
ret

Function at 0x670dc278
Capabilities:
Move file

Disassembly:
push 0x1c
mov eax, 0x671b187a
call fcn.671a2b02
mov ecx, dword [ebp + 8]
call fcn.670a5172
test al, al
je 0x670dc2c5
push str.Empty_filename_passed_to_function
movaps xmm0, xmmword [0x671be450]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x18], 0x671bd654
movups xmmword [ebp - 0x28], xmm0
call sym.Qt5Core.dll_public:_void___cdecl_QMessageLogger::warning_char_const__const
pop ecx
pop ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x16
xor al, al
jmp 0x670dc359
push dword [ebp + 8]
call fcn.670dba3f
pop ecx
test al, al
je 0x670dc2d9
push str.Broken_filename_passed_to_function
jmp 0x670dc295
mov ecx, dword [ebp + 0xc]
call fcn.670a5172
test al, al
jne 0x670dc290
push dword [ebp + 0xc]
call fcn.670dba3f
pop ecx
test al, al
jne 0x670dc2d2
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.670c1b4c
and dword [ebp - 4], 0
mov ecx, eax
call sym.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const
mov ecx, dword [ebp + 8]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
call fcn.670c1b4c
mov ecx, eax
mov byte [ebp - 4], 1
call sym.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov esi, eax
lea ecx, [ebp - 0x10]
test esi, esi
setne bl
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
lea ecx, [ebp - 0x14]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
test esi, esi
jne 0x670dc357
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], 2
mov al, bl
call fcn.671a2adc
ret
Function at 0x670dc35f
Capabilities:
Move file

Disassembly:
push 0x1c
mov eax, 0x671b187a
call fcn.671a2b02
mov ecx, dword [ebp + 8]
call fcn.670a5172
test al, al
je 0x670dc3ac
push str.Empty_filename_passed_to_function
movaps xmm0, xmmword [0x671be450]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x18], 0x671bd654
movups xmmword [ebp - 0x28], xmm0
call sym.Qt5Core.dll_public:_void___cdecl_QMessageLogger::warning_char_const__const
pop ecx
pop ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x16
xor al, al
jmp 0x670dc442
push dword [ebp + 8]
call fcn.670dba3f
pop ecx
test al, al
je 0x670dc3c0
push str.Broken_filename_passed_to_function
jmp 0x670dc37c
mov ecx, dword [ebp + 0xc]
call fcn.670a5172
test al, al
jne 0x670dc377
push dword [ebp + 0xc]
call fcn.670dba3f
pop ecx
test al, al
jne 0x670dc3b9
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.670c1b4c
and dword [ebp - 4], 0
mov ecx, eax
call sym.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const
mov ecx, dword [ebp + 8]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
call fcn.670c1b4c
mov ecx, eax
mov byte [ebp - 4], 1
call sym.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, eax
lea ecx, [ebp - 0x10]
test esi, esi
setne bl
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
lea ecx, [ebp - 0x14]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
test esi, esi
jne 0x670dc440
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], 2
mov al, bl
call fcn.671a2adc
ret
Function at 0x670dca1f
Capabilities:
Get disk information

Disassembly:
push 8
mov eax, 0x671a5e2f
call fcn.671a2b02
mov ecx, dword [ebp + 8]
xor bl, bl
xor esi, esi
call fcn.670c19e6
test al, al
je 0x670dca93
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
call edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push esi
mov ebx, eax
call edi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.670c171e
mov ecx, dword [eax]
mov eax, dword [ecx + 0xc]
movzx ecx, word [eax + ecx]
call sym.Qt5Core.dll_public:_static_unsigned_int___fastcall_QChar::toUpper_unsigned_int_
lea ecx, [ebp - 0x14]
movzx esi, ax
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
lea ecx, [esi - 0x41]
xor esi, esi
inc esi
shl esi, cl
and esi, ebx
setne bl
neg esi
sbb esi, esi
and esi, 0x14
jmp 0x670dcb2d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.670c1b4c
and dword [ebp - 4], 0
mov edi, str._UNC
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
push 1
push edi
push eax
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_bool___thiscall_QString::startsWith_class_QLatin1String__enum_Qt::CaseSensitivity_const
test al, al
je 0x670dcb25
mov eax, dword [ebp - 0x10]
push 1
push 7
mov ecx, dword [eax + 0xc]
mov ax, word [eax + ecx]
lea ecx, [ebp - 0x10]
mov word [ebp - 0x14], ax
push dword [ebp - 0x14]
call sym.Qt5Core.dll_public:_int___thiscall_QString::indexOf_class_QChar__int__enum_Qt::CaseSensitivity_const
mov edx, eax
test edx, edx
jle 0x670dcb12
mov eax, dword [ebp - 0x10]
push 1
mov ecx, dword [eax + 0xc]
mov ax, word [eax + ecx]
lea ecx, [ebp - 0x10]
mov word [ebp - 0x14], ax
lea eax, [edx + 1]
push eax
push dword [ebp - 0x14]
call sym.Qt5Core.dll_public:_int___thiscall_QString::indexOf_class_QChar__int__enum_Qt::CaseSensitivity_const
mov ecx, eax
test ecx, ecx
jle 0x670dcb12
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
dec eax
cmp ecx, eax
jne 0x670dcb25
lea eax, [ebp - 0x10]
push eax
call fcn.670dcc77
pop ecx
test al, al
je 0x670dcb25
push 0x10
pop esi
mov bl, 1
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
test bl, bl
je 0x670dcb3c
mov ecx, dword [ebp + 0xc]
push 0
push esi
call fcn.670da53b
mov al, bl
call fcn.671a2adc
ret
Function at 0x670dcbc4
Capabilities:
Enumerate network shares

Disassembly:
push 0x14
mov eax, 0x671b198b
call fcn.671a2b02
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
push 1
call sym.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const
push eax
call sub.NETAPI32.dll_NetShareEnum
mov esi, eax
test esi, esi
je 0x670dcc0b
cmp esi, 0xea
jne 0x670dcc58
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov edi, dword [ebp - 0x14]
inc ebx
cmp eax, ebx
jb 0x670dcc58
cmp dword [ebp + 0xc], 0
je 0x670dcc50
cmp dword [edi + 4], 0
jne 0x670dcc50
push 0xffffffffffffffff
push dword [edi]
lea eax, [ebp - 0x20]
push eax
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_
add esp, 0xc
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
push eax
call fcn.67015291
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
mov eax, dword [ebp - 0x10]
add edi, 0xc
inc ebx
cmp ebx, eax
jbe 0x670dcc18
push dword [ebp - 0x14]
call sub.NETAPI32.dll_NetApiBufferFree
cmp esi, 0xea
je 0x670dcbdb
test esi, esi
sete al
call fcn.671a2adc
ret
Function at 0x670de232
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x41c]
sub esp, 0x41c
push 0xffffffffffffffff
push 0x671b1d68
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x6753165c]
xor eax, ebp
mov dword [ebp + 0x418], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea edx, [esi + 4]
mov ebx, eax
push edx
lea eax, [ebp - 0x1c]
push eax
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QDir::toNativeSeparators_class_QString_const__
pop ecx
pop ecx
mov ecx, 0x105
lea eax, [ebp + 0x20c]
push ecx
push eax
xor edx, edx
lea eax, [ebp - 0x18]
push eax
push edx
push edx
push ecx
lea eax, [ebp]
mov dword [ebp - 4], edx
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], edx
call sym.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x670de2cf
mov byte [esi + 0x35], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
sete al
mov byte [esi + 0x36], al
jmp 0x670de341
push 0xffffffffffffffff
lea eax, [ebp + 0x20c]
push eax
lea eax, [ebp - 0x14]
push eax
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
call sym.Qt5Core.dll_private:_static_class_QByteArray___cdecl_QString::toLatin1_helper_inplace_class_QString__
mov ecx, dword [esi + 0x10]
add esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x10]
mov dword [esi + 0x10], eax
call sym.Qt5Core.dll_public:_void___thiscall_QByteArray::destructor_void_
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
push 0xffffffffffffffff
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_
mov edx, dword [esi + 0x14]
add esp, 0xc
mov ecx, dword [eax]
mov dword [esi + 0x14], ecx
lea ecx, [ebp - 0x14]
mov dword [eax], edx
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
mov eax, dword [ebp - 0x18]
shr eax, 0x13
and al, 1
mov byte [esi + 0x34], al
push ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea ecx, [ebp - 0x1c]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp + 0x418]
xor ecx, ebp
call fcn.671a2acb
add ebp, 0x41c
leave
ret
Function at 0x670de82c
Capabilities:
Read file on windows

Disassembly:
push 4
mov eax, 0x671a4c10
call fcn.671a2b02
mov esi, ecx
call sym.Qt5Core.dll_private:_unsigned_long_int___thiscall_QWindowsPipeReader::checkPipeState_void_
mov edi, eax
mov eax, 0x1000
cmp edi, eax
cmovb edi, eax
xor ebx, ebx
cmp byte [esi + 0x3b], bl
jne 0x670de924
mov ecx, dword [esi + 0x10]
mov eax, ecx
mov edx, dword [esi + 0x14]
or eax, edx
je 0x670de888
sub ecx, dword [esi + 0x20]
sbb edx, dword [esi + 0x24]
cmp ebx, edx
jl 0x670de888
jg 0x670de872
cmp edi, ecx
jbe 0x670de888
mov ebx, edx
mov edi, ecx
test ebx, ebx
jl 0x670de924
jg 0x670de888
test edi, edi
je 0x670de924
push ebx
lea ecx, [esi + 0x18]
push edi
call sym.Qt5Core.dll_public:_char____thiscall_QRingBuffer::reserve_long_long___int64__
mov ecx, dword [esi + 0xc]
mov ebx, eax
mov word [esi + 0x38], 0x100
test ecx, ecx
jne 0x670de8b4
push 0x18
call fcn.671a2a8d
mov dword [ebp - 0x10], eax
pop ecx
mov ecx, eax
mov dword [eax + 0x14], esi
mov dword [esi + 0xc], eax
call fcn.670de5ed
push sym.Qt5Core.dll_private:_static_void___stdcall_QWindowsPipeReader::readFileCompleted_unsigned_long_int__unsigned_long_int__struct__OVERLAPPED__
push dword [esi + 0xc]
push edi
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x670de924
mov byte [esi + 0x39], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, edi
sub ecx, 0x6d
je 0x670de919
sub ecx, 0x7c
je 0x670de919
mov ebx, str.QWindowsPipeReader::startAsyncRead
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
push eax
push ebx
call sym.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromLatin1_helper_char_const___int_
add esp, 0xc
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push edi
mov ecx, esi
call sym.Qt5Core.dll_public:_void___thiscall_QWindowsPipeReader::winError_unsigned_long_int__class_QString_const__
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
jmp 0x670de924
mov ecx, esi
mov byte [esi + 0x3b], 1
call sym.Qt5Core.dll_public:_void___thiscall_QWindowsPipeReader::pipeClosed_void_
call fcn.671a2adc
ret
Function at 0x670dee4a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x21], 0
jne 0x670deece
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x670dee72
push 0x18
call fcn.671a2a8d
pop ecx
mov dword [ebp - 4], eax
mov ecx, eax
mov dword [eax + 0x14], esi
mov dword [esi + 0xc], eax
call fcn.670de5ed
push dword [ebp + 8]
lea edi, [esi + 0x10]
mov ecx, edi
call fcn.6704fe2a
mov eax, dword [edi]
push sym.Qt5Core.dll_private:_static_void___stdcall_QWindowsPipeWriter::writeFileCompleted_unsigned_long_int__unsigned_long_int__struct__OVERLAPPED__
push dword [esi + 0xc]
mov word [esi + 0x20], 0x100
mov edx, dword [eax + 0xc]
push dword [eax + 4]
add edx, eax
push edx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
jne 0x670deed6
mov ecx, edi
mov byte [esi + 0x21], al
call sym.Qt5Core.dll_public:_void___thiscall_QByteArray::clear_void_
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
je 0x670deece
push str.QWindowsPipeWriter::write_failed.
push eax
call sym.Qt5Core.dll_void___cdecl_qErrnoWarning_int__char_const__
pop ecx
pop ecx
xor al, al
pop edi
pop esi
leave
ret 4
mov al, 1
jmp 0x670deed0

Function at 0x671042ba
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x671b4570
call fcn.671a2b02
and dword [ebp - 0x220], 0
lea eax, [ebp - 0x214]
mov ebx, 0x104
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x224], ebx
and dword [ebp - 4], 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
cmp esi, ebx
jbe 0x67104324
cmp esi, dword [ebp - 0x224]
mov ecx, esi
cmovl ecx, dword [ebp - 0x224]
push ecx
push esi
lea ecx, [ebp - 0x224]
call fcn.670dbf6c
push esi
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
push esi
push dword [ebp - 0x21c]
push dword [ebp + 8]
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_
lea eax, [ebp - 0x214]
add esp, 0xc
cmp dword [ebp - 0x21c], eax
je 0x67104351
push dword [ebp - 0x21c]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov eax, dword [ebp + 8]
call fcn.671a2adc
ret