joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451170
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b8289
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0xc18374]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor eax, eax
lea edi, [esi + 4]
mov dword [esi], vtable.ConsoleMode::GeneralSetting.0
mov dword [esp + 0x30], eax
mov dword [edi], eax
mov dword [edi + 4], eax
lea ebp, [esi + 0xc]
mov dword [ebp], eax
mov dword [ebp + 4], eax
lea ebx, [esi + 0x14]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x20]
push eax
call fcn.0044f710
mov ecx, dword [eax]
mov byte [esp + 0x30], 4
call fcn.004a0f50
push eax
lea ecx, [esp + 0x1c]
call fcn.004a5b20
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ecx
push edx
mov ecx, edi
mov byte [esp + 0x38], 5
call fcn.00427bb0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x38], 4
call fcn.00427b50
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
push edx
push eax
mov byte [esp + 0x40], 3
call fcn.00427b50
add esp, 0x10
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x3c]
call fcn.0044fbf0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ecx
push edx
mov ecx, ebp
mov byte [esp + 0x38], 6
call fcn.00402c90
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov byte [esp + 0x30], 3
mov ebp, eax
test eax, eax
je 0x45129a
add eax, 8
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x451283
mov edx, dword [ebp]
mov eax, dword [edx + 4]
mov ecx, ebp
call eax
test al, al
jne 0x451283
test edi, edi
je 0x451283
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
lea ecx, [ebp + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x45129a
mov eax, dword [ebp]
mov edx, dword [eax]
push 1
mov ecx, ebp
call edx
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x20]
push eax
call fcn.0044fc30
mov ecx, dword [eax]
push ecx
mov ecx, dword [eax + 4]
push ecx
mov ecx, ebx
mov byte [esp + 0x38], 7
call fcn.00402c90
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov byte [esp + 0x30], 3
mov edi, eax
test eax, eax
je 0x45130b
add eax, 8
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x4512f5
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
test al, al
jne 0x4512f5
test ebx, ebx
je 0x4512f5
mov eax, dword [ebx]
mov edx, dword [eax]
push 1
mov ecx, ebx
call edx
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x45130b
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x452b60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b85b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xc18374]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0044df80
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov eax, dword [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esi], vtable.APCore::ConnBromUSBSetting.0
call fcn.004525c0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x456d30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b9002
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0xc18374]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0xc]
push eax
push 0
push ecx
mov dword [esp + 0x18], 0
call sub.Flashtoollib.dll_Ordinal_263
mov edx, dword [esp + 0xc]
push edx
mov esi, eax
push esi
lea eax, [esp + 0x1c]
push str.ret___d__GetVoltage___d_
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], str.APCore::DeviceTestCommand::GetVoltage
mov dword [esp + 0x2c], str....._flashtoolCmdDeviceTestCommand.cpp
mov dword [esp + 0x30], 0x71
call fcn.0040b750
add esp, 0x10
cmp esi, 0x410
jne 0x456e3a
push 0xffffffffffffffff
push str.Battery_is_nonexistence_OR_Function_is_not_supported__n
call dword [sym.imp.QtCore4.dll_private:_static_struct_QString::Data____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [esp + 0x44], eax
push 0x12
lea ecx, [esp + 0x18]
mov dword [esp + 0x40], 0
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QColor::constructor_enum_Qt::GlobalColor_]
mov edi, dword [edi + 0x68]
test edi, edi
je 0x456e11
mov ecx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov edx, dword [esp + 0x28]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 8], ecx
mov dx, word [esp + 0x30]
mov word [eax + 0xc], dx
lea eax, [esp + 0x54]
push eax
call edi
add esp, 0x14
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x3c], 0xffffffff
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x456eda
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
jmp 0x456ed7
test esi, esi
jne 0x456ed1
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esp + 0x10], eax
mov ecx, 1
lock xadd dword [eax], ecx
push 0xf
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 1
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QColor::constructor_enum_Qt::GlobalColor_]
mov edx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push str.Battery_is__d_n
push eax
call dword [sym.imp.QtCore4.dll_public:_class_QString____cdecl_QString::sprintf_char_const__]
mov edx, dword [edi + 0x68]
add esp, 0xc
test edx, edx
je 0x456eaf
mov esi, dword [esp + 0x24]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], esi
mov esi, dword [esp + 0x38]
mov dword [ecx + 4], esi
mov esi, dword [esp + 0x3c]
mov dword [ecx + 8], esi
mov si, word [esp + 0x40]
push eax
mov word [ecx + 0xc], si
call edx
add esp, 0x14
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], 0xffffffff
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x456eda
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
jmp 0x456ed7
push esi
call fcn.00456c50
add esp, 4
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret 4
Function at 0x457000
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b903b
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0xc18374]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [esp + 0x48]
push eax
lea ecx, [esp + 0x28]
push str.BatteryTest__type___d_
mov edi, 1
push ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], str.APCore::DeviceTestCommand::BatteryTestAndSleep
mov dword [esp + 0x38], str....._flashtoolCmdDeviceTestCommand.cpp
mov dword [esp + 0x3c], 0x56
call fcn.0040b750
mov esi, dword [esp + 0x50]
mov eax, dword [esi]
add esp, 0xc
cmp dword [eax], edi
jle 0x457169
push 0x44
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x3c], 0
test eax, eax
je 0x457092
mov ecx, eax
call fcn.004827f0
jmp 0x457094
xor eax, eax
or ebx, 0xffffffff
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], ebx
call fcn.004a5b20
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x44], edi
call edx
mov ecx, dword [eax]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push esi
mov byte [esp + 0x40], 2
call edx
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 1
call fcn.0044d080
mov ecx, dword [esi]
call fcn.004011e0
lea ecx, [esp + 0x44]
mov dword [esp + 0x44], ebx
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QTime::start_void_]
mov edi, dword [sym.imp.QtCore4.dll_public:_int___thiscall_QTime::elapsed_void_const]
lea ecx, [esp + 0x44]
call edi
cmp eax, 0x1f4
jge 0x45712a
mov ebx, dword [sym.imp.QtCore4.dll_public:_static_void___cdecl_QCoreApplication::processEvents_class_QFlags_enum_QEventLoop::ProcessEventsFlag__]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
mov dword [eax], 0
call ebx
add esp, 4
lea ecx, [esp + 0x44]
call edi
cmp eax, 0x1f4
jl 0x457108
or ebx, 0xffffffff
lea eax, [esp + 0x14]
push str.BatteryTest_disconnect_wait_500ms_end_
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], str.APCore::DeviceTestCommand::BatteryTestAndSleep
mov dword [esp + 0x24], str....._flashtoolCmdDeviceTestCommand.cpp
mov dword [esp + 0x28], 0x64
call fcn.0040b750
add esp, 8
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], ebx
call fcn.0044d080
mov ecx, dword [esp + 0x48]
push ecx
mov ecx, dword [esi]
call fcn.004011d0
mov ecx, dword [esi]
call fcn.00401530
mov ecx, dword [esi]
call fcn.00401070
push eax
mov ecx, ebp
call fcn.00456d30
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
Function at 0x459d90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4b9718
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0xc18374]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
mov dword [esi + 0x18], ecx
lea ecx, [esp + 8]
call fcn.00469c40
mov edx, dword [esi + 0x18]
push edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.00469970
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 8]
mov edx, dword [edx + 0x2c]
push eax
call edx
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call fcn.00469b40
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 4
Function at 0x4659a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bafa3
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0xc18374]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0x4edc10
lea eax, [esp + 0x10]
push 0xc1990c
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.MSVCP90.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char__struct_std::char_traits_char___class_std::allocator_char___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
mov ecx, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
push ecx
push eax
push esi
mov dword [esp + 0x48], 1
call dword [sym.imp.MSVCP90.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char__struct_std::char_traits_char___class_std::allocator_char___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
add esp, 0x18
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x30], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x465df0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x418
mov eax, dword [0xc18374]
xor eax, esp
mov dword [esp + 0x414], eax
mov eax, dword [esp + 0x420]
push ebx
mov ebx, dword [esp + 0x420]
push ebp
push esi
mov ebp, 0x10
push edi
mov dword [esp + 0x20], eax
lea edi, [ebx + 4]
cmp dword [ebx + 0x18], ebp
jb 0x465e2b
mov eax, dword [edi]
jmp 0x465e2d
mov eax, edi
push 0x4e01e0
push eax
call dword [sym.imp.MSVCR90.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x465e88
cmp dword [ebx + 0x18], ebp
jb 0x465e49
mov edi, dword [edi]
push edi
push str.FileUtils::ComputeCheckSum
lea ecx, [esp + 0x18]
push str._s__:_file_open_failed:__s.
push ecx
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], str.FileUtils::ComputeCheckSum
mov dword [esp + 0x28], str....._flashtoolUtilityFileUtils.cpp
mov dword [esp + 0x2c], 0x1d0
call fcn.0040b750
add esp, 0x10
xor al, al
jmp 0x465f19
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.MSVCR90.dll_feof]
push esi
mov byte [ebx], 0
call ebp
add esp, 4
test eax, eax
jne 0x465ed5
mov edi, dword [sym.imp.MSVCR90.dll_fread]
push esi
push 0x400
lea edx, [esp + 0x2c]
push 1
push edx
call edi
add esp, 0x10
xor ecx, ecx
test eax, eax
jbe 0x465ecb
mov dl, byte [ebx]
nop
add dl, byte [esp + ecx + 0x24]
inc ecx
cmp ecx, eax
jb 0x465ec0
mov byte [ebx], dl
push esi
call ebp
add esp, 4
test eax, eax
je 0x465ea5
movzx eax, byte [ebx]
push eax
push str.FileUtils::ComputeCheckSum
lea ecx, [esp + 0x18]
push str._s__:_check_sum_result__u_.
push ecx
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], str.FileUtils::ComputeCheckSum
mov dword [esp + 0x28], str....._flashtoolUtilityFileUtils.cpp
mov dword [esp + 0x2c], 0x1de
call fcn.0040b750
push esi
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 0x14
mov al, 1
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ac9a4
add esp, 0x418
ret
Function at 0x466070
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
mov bl, byte [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x20]
cmp dword [ebp + 0x18], 0x10
push esi
push edi
mov byte [esp + 0x11], 0
mov byte [esp + 0x10], bl
lea edi, [ebp + 4]
jb 0x466095
mov eax, dword [edi]
jmp 0x466097
mov eax, edi
push 0x4ef360
push eax
call dword [sym.imp.MSVCR90.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4660f6
cmp dword [ebp + 0x18], 0x10
jb 0x4660b4
mov edi, dword [edi]
push edi
push str.FileUtils::SaveCheckSum
lea eax, [esp + 0x1c]
push str._s__:_file_create_open_failed:__s.
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], str.FileUtils::SaveCheckSum
mov dword [esp + 0x2c], str....._flashtoolUtilityFileUtils.cpp
mov dword [esp + 0x30], 0x203
call fcn.0040b750
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x14
ret
push esi
push 2
lea ecx, [esp + 0x18]
push 1
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
movzx edx, bl
push edx
push str.FileUtils::SaveCheckSum
lea eax, [esp + 0x2c]
push str._s__:_check_sum_result__u_.
push eax
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], str.FileUtils::SaveCheckSum
mov dword [esp + 0x3c], str....._flashtoolUtilityFileUtils.cpp
mov dword [esp + 0x40], 0x209
call fcn.0040b750
push esi
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 0x24
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x14
ret
Function at 0x4662d0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4bb091
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebp
push esi
push edi
mov eax, dword [0xc18374]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x6c]
test edi, edi
je 0x466450
mov ebp, dword [esp + 0x70]
test ebp, ebp
je 0x466450
mov esi, dword [esp + 0x74]
test esi, esi
je 0x466450
push 0x4ef360
lea ecx, [esp + 0x44]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x68], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x78]
call fcn.004653e0
lea ecx, [esp + 0x24]
mov byte [esp + 0x64], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x40]
mov byte [esp + 0x64], 2
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4663cd
lea eax, [esp + 0x14]
push str.Open_file_failed.
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], str.FileUtils::SaveFile
mov dword [esp + 0x24], str....._flashtoolUtilityFileUtils.cpp
mov dword [esp + 0x28], 0x25f
call fcn.0040b750
add esp, 8
lea ecx, [esp + 0x6c]
call fcn.00465440
mov eax, 2
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x58
ret
push eax
push esi
push 1
push ebp
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp esi, eax
jbe 0x466432
lea ecx, [esp + 0x14]
push str.Write_to_file_failed.
push ecx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], str.FileUtils::SaveFile
mov dword [esp + 0x24], str....._flashtoolUtilityFileUtils.cpp
mov dword [esp + 0x28], 0x265
call fcn.0040b750
add esp, 8
lea ecx, [esp + 0x6c]
call fcn.00465440
mov eax, 3
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x58
ret
lea ecx, [esp + 0x6c]
call fcn.00465440
xor eax, eax
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x58
ret
lea edx, [esp + 0x24]
push str.File_path_or_content_buffer_or_file_length_is_abnormal__please_check_it_first.
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], str.FileUtils::SaveFile
mov dword [esp + 0x34], str....._flashtoolUtilityFileUtils.cpp
mov dword [esp + 0x38], 0x258
call fcn.0040b750
add esp, 8
mov eax, 1
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x58
ret
Function at 0x473a40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4bcf49
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0xc18374]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x74]
lea eax, [esp + 8]
push eax
call dword [sym.imp.QtGui4.dll_public:_class_QString___thiscall_QComboBox::currentText_void_]
push ecx
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
mov dword [esp + 0x20], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
call fcn.0042ab50
mov esi, eax
mov eax, dword [esp + 0xc]
add esp, 4
mov dword [esp + 0x18], 0xffffffff
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x473abc
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x476db0
Capabilities:
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x4bd89d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0xc18374]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x80]
push 0x64
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0047f530
add esp, 0xc
push eax
mov ecx, esi
mov dword [esp + 0x28], 0
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QWidget::setWindowTitle_class_QString_const__]
mov edx, dword [esp + 0x14]
or edi, 0xffffffff
mov dword [esp + 0x24], edi
mov eax, edi
lock xadd dword [edx], eax
mov ebx, dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
jne 0x476e25
mov ecx, dword [esp + 0x14]
push ecx
call ebx
add esp, 4
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 0x10]
mov eax, dword [eax + 0x10]
mov cl, byte [eax + 6]
and cl, 1
je 0x476ecc
mov edx, dword [esi + 0x1c]
mov eax, dword [edx + 0x80]
push 0x65
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0047f530
add esp, 0xc
mov ecx, dword [esi + 0x18]
mov ecx, dword [ecx + 8]
push eax
mov dword [esp + 0x28], 1
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QLabel::setText_class_QString_const__]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], edi
mov eax, edi
lock xadd dword [edx], eax
jne 0x476e82
mov ecx, dword [esp + 0x14]
push ecx
call ebx
add esp, 4
mov edx, dword [esi + 0x1c]
mov eax, dword [edx + 0x80]
push 0x29
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0047f530
add esp, 0xc
mov ecx, dword [esi + 0x18]
mov ecx, dword [ecx + 0x10]
push eax
mov dword [esp + 0x28], 2
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QAbstractButton::setText_class_QString_const__]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], edi
lock xadd dword [edx], edi
jne 0x476f5a
mov eax, dword [esp + 0x14]
push eax
jmp 0x476f55
mov ecx, dword [esi + 0x1c]
mov eax, dword [ecx + 0x80]
push 0x10
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.0047f530
add esp, 0xc
push eax
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 8]
mov dword [esp + 0x28], 3
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QLabel::setText_class_QString_const__]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], edi
mov edx, edi
lock xadd dword [ecx], edx
jne 0x476f14
mov eax, dword [esp + 0x14]
push eax
call ebx
add esp, 4
mov ecx, dword [esi + 0x1c]
mov eax, dword [ecx + 0x80]
push 0x29
push eax
lea edx, [esp + 0x20]
push edx
call fcn.0047f530
add esp, 0xc
push eax
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x28], 4
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QAbstractButton::setText_class_QString_const__]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], edi
lock xadd dword [ecx], edi
jne 0x476f5a
mov edx, dword [esp + 0x18]
push edx
call ebx
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x478270
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4bdd49
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0xc18374]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
lea esi, [edi + edi + 2]
cmp esi, ebp
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], edi
jge 0x478308
jmp 0x4782c0
lea eax, [esi*8]
sub eax, esi
lea eax, [ebx + eax*4]
lea ecx, [eax - 0x1c]
push ecx
push eax
call dword [0x4dc2a8]
add esp, 8
test al, al
je 0x4782df
dec esi
lea edx, [esi*8]
sub edx, esi
lea ecx, [edi*8]
lea eax, [ebx + edx*4]
sub ecx, edi
push eax
lea ecx, [ebx + ecx*4]
call dword [0x4dc250]
mov edi, esi
lea esi, [esi + esi + 2]
cmp esi, ebp
jl 0x4782c0
jne 0x47832d
lea edx, [ebp*8]
sub edx, ebp
lea ecx, [edi*8]
lea eax, [ebx + edx*4 - 0x1c]
sub ecx, edi
push eax
lea ecx, [ebx + ecx*4]
call dword [0x4dc250]
lea edi, [ebp - 1]
sub esp, 0x1c
lea edx, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov eax, dword [esp + 0x30]
push eax
push edi
push ebx
call fcn.00477fc0
add esp, 0x28
lea ecx, [esp + 0x38]
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret