joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6706b640
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x671508b8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x67258980]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [esp + 0x40]
push 0xf
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x10], 0
mov ecx, dword [ecx + 4]
push 0x29
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x6706b6da
push 0xffffffffffffffff
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
call sym.QtCore_Ad_4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_
add esp, 0xc
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QVariant::constructor_class_QString_const__
mov ecx, dword [esp + 8]
mov dword [esp + 0x38], 0xffffffff
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x6706b6e7
mov eax, dword [esp + 8]
push eax
call sym.QtCore_Ad_4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
jmp 0x6706b6e7
mov dword [esi + 8], 0x80000000
mov dword [esi], 0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.67149782
add esp, 0x34
ret 4

Function at 0x6706b710
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x671508e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x67258980]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
push 4
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x10], 0
mov ecx, dword [ecx + 4]
push 0x100c
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x6706b7b9
push 0xffffffffffffffff
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
call sym.QtCore_Ad_4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_
add esp, 0xc
push 0xa
push 0
mov ecx, eax
mov dword [esp + 0x28], 0
call sym.QtCore_Ad_4.dll_public:_unsigned_int___thiscall_QString::toUInt_bool___int_const
inc eax
push eax
mov ecx, esi
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QVariant::constructor_unsigned_int_
mov ecx, dword [esp + 8]
mov dword [esp + 0x20], 0xffffffff
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x6706b7c2
mov eax, dword [esp + 8]
push eax
call sym.QtCore_Ad_4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
jmp 0x6706b7c2
push 1
mov ecx, esi
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QVariant::constructor_int_
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.67149782
add esp, 0x1c
ret 4
Function at 0x6706b810
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x6715093a
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0xb4]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x14], 0
test eax, eax
jne 0x6706b857
mov eax, 0x40
mov ecx, eax
mov dword [esp + 0x20], ecx
cmp eax, 0x40
jle 0x6706b888
add eax, eax
push eax
call sym.QtCore_Ad_4.dll_void____cdecl_qMalloc_unsigned_int_
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
jne 0x6706b87e
call sym.QtCore_Ad_4.dll_void___cdecl_qBadAlloc_void_
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x1c], ecx
jmp 0x6706b898
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0x40
mov esi, dword [esp + 0xc8]
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ecx
mov ecx, dword [ebp + 4]
push eax
push esi
mov ebx, 1
push ecx
mov dword [esp + 0xcc], ebx
call edi
test eax, eax
jne 0x6706b8db
mov esi, dword [esp + 0xc4]
mov dword [esi], sym.QtCore_Ad_4.dll_struct_QString::Data_QString::shared_null
mov edx, sym.QtCore_Ad_4.dll_struct_QString::Data_QString::shared_null
mov eax, ebx
lock xadd dword [edx], eax
jmp 0x6706b982
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x6706b96b
mov edx, dword [ebp + 4]
push 0
push 0
push esi
push edx
call edi
test eax, eax
jne 0x6706b91d
mov esi, dword [esp + 0xc4]
mov dword [esi], sym.QtCore_Ad_4.dll_struct_QString::Data_QString::shared_null
mov eax, sym.QtCore_Ad_4.dll_struct_QString::Data_QString::shared_null
mov ecx, ebx
lock xadd dword [eax], ecx
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x2c]
cmp eax, edx
jmp 0x6706b98c
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x1c]
cmp eax, dword [esp + 0x1c]
jl 0x6706b92f
lea ecx, [esp + 0x18]
mov ecx, dword [ecx]
push ecx
push eax
lea ecx, [esp + 0x24]
call fcn.67121910
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [ebp + 4]
push edx
push eax
push esi
push ecx
call edi
test eax, eax
jne 0x6706b96b
mov esi, dword [esp + 0xc4]
mov dword [esi], sym.QtCore_Ad_4.dll_struct_QString::Data_QString::shared_null
mov edx, sym.QtCore_Ad_4.dll_struct_QString::Data_QString::shared_null
mov eax, ebx
lock xadd dword [edx], eax
jmp 0x6706b982
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0xc4]
push 0xffffffffffffffff
push edx
push esi
call sym.QtCore_Ad_4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_
add esp, 0xc
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x2c]
cmp eax, ecx
mov byte [esp + 0xbc], 0
mov dword [esp + 0x14], ebx
je 0x6706b9a3
push eax
call sym.QtCore_Ad_4.dll_void___cdecl_qFree_void__
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret 0xc
Function at 0x6706cfd0
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x67150c42
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x67258980]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0x214]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esi], sym.QtCore_Ad_4.dll_struct_QString::Data_QString::shared_null
mov ecx, sym.QtCore_Ad_4.dll_struct_QString::Data_QString::shared_null
mov edx, 1
lock xadd dword [ecx], edx
mov ecx, dword [esp + 0x224]
push 0xff
mov dword [esp + 0x220], eax
lea eax, [esp + 0x14]
push eax
push 0x5a
push ecx
mov dword [esp + 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x6706d088
push 0xffffffffffffffff
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xc]
push eax
call sym.QtCore_Ad_4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_
mov edx, dword [eax]
mov ecx, dword [esi]
mov dword [esi], edx
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
add esp, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x6706d088
mov edx, dword [esp + 4]
push edx
call sym.QtCore_Ad_4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x214]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.67149782
add esp, 0x21c
ret
Function at 0x6706f2a0
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 0x104
mov eax, dword [0x67258980]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x108]
push ebx
mov ebx, ecx
test ebx, ebx
jle 0x6706f410
mov edx, 1
mov dword [esp + 4], 0xedb88320
mov ecx, edx
mov dword [esp + ecx*4 + 4], edx
inc ecx
add edx, edx
cmp ecx, 0x20
jl 0x6706f2d5
push esi
push edi
xor edi, edi
mov ecx, dword [esp + edi + 0xc]
xor esi, esi
lea edx, [esp + 0xc]
test ecx, ecx
je 0x6706f301
test cl, 1
je 0x6706f2fa
xor esi, dword [edx]
add edx, 4
shr ecx, 1
jne 0x6706f2f3
mov dword [esp + edi + 0x8c], esi
add edi, 4
cmp edi, 0x80
jl 0x6706f2e5
xor edi, edi
jmp 0x6706f320
mov ecx, dword [esp + edi + 0x8c]
xor esi, esi
lea edx, [esp + 0x8c]
test ecx, ecx
je 0x6706f342
test cl, 1
je 0x6706f33b
xor esi, dword [edx]
add edx, 4
shr ecx, 1
jne 0x6706f334
mov dword [esp + edi + 0xc], esi
add edi, 4
cmp edi, 0x80
jl 0x6706f320
xor edi, edi
mov ecx, dword [esp + edi + 0xc]
xor esi, esi
lea edx, [esp + 0xc]
test ecx, ecx
je 0x6706f36f
test cl, 1
je 0x6706f368
xor esi, dword [edx]
add edx, 4
shr ecx, 1
jne 0x6706f361
mov dword [esp + edi + 0x8c], esi
add edi, 4
cmp edi, 0x80
jl 0x6706f353
test bl, 1
je 0x6706f3a2
xor edx, edx
lea ecx, [esp + 0x8c]
test eax, eax
je 0x6706f3a0
test al, 1
je 0x6706f399
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x6706f393
mov eax, edx
sar ebx, 1
je 0x6706f407
xor edi, edi
jmp 0x6706f3b0
mov ecx, dword [esp + edi + 0x8c]
xor esi, esi
lea edx, [esp + 0x8c]
test ecx, ecx
je 0x6706f3d2
test cl, 1
je 0x6706f3cb
xor esi, dword [edx]
add edx, 4
shr ecx, 1
jne 0x6706f3c4
mov dword [esp + edi + 0xc], esi
add edi, 4
cmp edi, 0x80
jl 0x6706f3b0
test bl, 1
je 0x6706f3ff
xor edx, edx
lea ecx, [esp + 0xc]
test eax, eax
je 0x6706f3fd
test al, 1
je 0x6706f3f6
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x6706f3f0
mov eax, edx
sar ebx, 1
jne 0x6706f351
xor eax, dword [esp + 0x118]
pop edi
pop esi
mov ecx, dword [esp + 0x104]
pop ebx
xor ecx, esp
call fcn.67149782
add esp, 0x104
ret
Function at 0x6706f470
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, ebx
test ecx, ecx
je 0x6706f558
mov esi, dword [ecx + 0x1c]
test esi, esi
je 0x6706f558
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x6706f558
mov eax, dword [esi + 0x18]
cmp eax, 2
je 0x6706f558
cmp eax, 1
jne 0x6706f4b8
cmp dword [esi + 4], 0x2a
jne 0x6706f558
test eax, eax
je 0x6706f4d1
mov eax, dword [ecx + 0x30]
push ebx
push ebp
push eax
call sym.QtCore_Ad_4.dll_adler32
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov dword [ecx + 0x30], eax
cmp ebx, 3
jb 0x6706f551
mov eax, dword [esi + 0x2c]
cmp ebx, eax
jbe 0x6706f4e3
mov edi, eax
sub ebx, edi
add ebp, ebx
mov edx, dword [esi + 0x38]
push edi
push ebp
push edx
call sub.MSVCR100.dll_memcpy
mov edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x6c], edi
mov dword [esi + 0x5c], edi
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
add esp, 0xc
xor edx, edx
mov dword [esi + 0x48], eax
add edi, 0xfffffffd
mov ebx, dword [esi + 0x48]
mov ecx, dword [esi + 0x58]
mov eax, dword [esi + 0x38]
movzx eax, byte [eax + edx + 2]
mov ebp, dword [esi + 0x40]
shl ebx, cl
mov ecx, dword [esi + 0x44]
xor eax, ebx
and eax, dword [esi + 0x54]
mov ebx, dword [esi + 0x34]
mov dword [esi + 0x48], eax
mov ax, word [ecx + eax*2]
and ebx, edx
mov word [ebp + ebx*2], ax
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2], dx
inc edx
cmp edx, edi
jbe 0x6706f516
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x6706fbd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esi + 0x2c]
push edi
lea esp, [esp]
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea edx, [ecx + ebp - 0x106]
mov dword [esp + 0xc], edi
cmp eax, edx
jb 0x6706fc5d
mov eax, dword [esi + 0x38]
push ebp
lea ecx, [eax + ebp]
push ecx
push eax
call sub.MSVCR100.dll_memcpy
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebp
sub dword [esi + 0x6c], ebp
add esp, 0xc
sub dword [esi + 0x5c], ebp
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x6706fc2f
sub eax, ebp
jmp 0x6706fc31
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x6706fc20
mov ecx, dword [esi + 0x40]
mov edx, ebp
lea ecx, [ecx + ebp*2]
nop
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x6706fc4f
sub eax, ebp
jmp 0x6706fc51
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x6706fc40
add edi, ebp
mov dword [esp + 0xc], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x6706fd8a
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [esp + 0xc]
mov ebx, ecx
mov dword [esp + 0x10], eax
cmp ebx, edx
jbe 0x6706fc85
mov ebx, edx
test ebx, ebx
je 0x6706fcd6
mov edx, dword [edi + 0x1c]
sub ecx, ebx
mov dword [edi + 4], ecx
mov ecx, dword [edx + 0x18]
cmp ecx, 1
jne 0x6706fca8
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
push eax
push ecx
call sym.QtCore_Ad_4.dll_adler32
jmp 0x6706fcba
cmp ecx, 2
jne 0x6706fcc4
mov edx, dword [edi]
mov eax, dword [edi + 0x30]
push ebx
push edx
push eax
call sym.QtCore_Ad_4.dll_crc32
mov dword [edi + 0x30], eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [edi]
push ebx
push ecx
push eax
call sub.MSVCR100.dll_memcpy
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov ebx, dword [esi + 0x74]
cmp ebx, 3
jb 0x6706fcfe
mov edx, dword [esi + 0x6c]
add edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x6706fd12
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x6706fbe0
mov eax, dword [esi + 0x16c0]
mov ecx, dword [esi + 0x3c]
cmp eax, ecx
jae 0x6706fd8a
mov edi, dword [esi + 0x6c]
add edi, ebx
cmp eax, edi
jae 0x6706fd59
sub ecx, edi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x6706fd39
mov ebx, 0x102
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call fcn.67149868
add esp, 0xc
add ebx, edi
pop edi
pop ebp
mov dword [esi + 0x16c0], ebx
pop ebx
add esp, 8
ret
lea edx, [edi + 0x102]
cmp eax, edx
jae 0x6706fd8a
sub edi, eax
add edi, 0x102
sub ecx, eax
cmp edi, ecx
jbe 0x6706fd73
mov edi, ecx
mov ecx, dword [esi + 0x38]
push edi
add ecx, eax
push 0
push ecx
call fcn.67149868
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x67071e20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [sym.imp.MSVCR100.dll__read]
mov dword [esi], 0
lea ecx, [ecx]
mov eax, dword [esi]
mov ecx, edi
sub ecx, eax
add eax, dword [esp + 8]
push ecx
push eax
mov eax, dword [ebx + 4]
push eax
call ebp
add esp, 0xc
test eax, eax
jle 0x67071e4f
add dword [esi], eax
cmp dword [esi], edi
jb 0x67071e30
pop ebp
test eax, eax
jns 0x67071e73
call dword [sym.imp.MSVCR100.dll__errno]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.MSVCR100.dll_strerror]
push eax
push 0xffffffffffffffff
push ebx
call fcn.67071880
add esp, 0x10
or eax, 0xffffffff
ret
jne 0x67071e7c
mov dword [ebx + 0x28], 1
xor eax, eax
ret
Function at 0x67078550
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x670784f7
lea edi, [eax + 8]
mov ecx, dword [eax + 4]
add ecx, eax
cmp edi, ecx
jae 0x670784f2
movzx ecx, word [edi]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x670784e6
mov edx, dword [ebp + 0xc]
and ecx, 0xfff
dec dword [edi]
add byte [eax], al
add ecx, dword [ebp + 0xc]
sub edx, dword [esi + 0x34]
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x670784ee
cmp edx, ebx
jne 0x67078643
inc edi
inc edi
jmp 0x670784b5
add eax, dword [eax + 4]
jmp 0x670784ae
mov dword [ebp - 8], ebx
jmp 0x67078502
mov esi, dword [ebp - 0x88]
mov ax, word [ebp - 8]
cmp ax, word [esi + 6]
jne 0x6707851b
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov esi, 0x60000000
jmp 0x67078543
call fcn.67077e38
je 0x67078567
jo 0x670784d6
movzx eax, word [ebp - 8]
lea eax, [eax + eax*4]
mov ecx, dword [esi + eax*8 + 0x104]
mov edx, dword [esi + eax*8 + 0x108]
lea eax, [esi + eax*8 + 0xf8]
mov esi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
ror byte [ecx - 0x3e74f7bb], cl
ror byte [ecx - 0x3e74f7bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp + 8]
ja 0x67078599
mov edx, esi
mov edi, esi
and edx, 0x20000000
add byte [eax], al
add byte [eax], ah
and edi, 0x40000000
and esi, 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x67078582
or byte [eax + ecx], 1
cmp edi, ebx
je 0x6707858a
or byte [eax + ecx], 2
cmp esi, ebx
je 0x67078593
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp + 8]
jbe 0x67078577
inc dword [ebp - 8]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp - 8]
cmp cx, word [eax + 6]
jbe 0x670784fc
mov esi, dword [ebp + 0xc]
xor edi, edi
Function at 0x67078570
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x670784f7
lea edi, [eax + 8]
mov ecx, dword [eax + 4]
add ecx, eax
cmp edi, ecx
jae 0x670784f2
movzx ecx, word [edi]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x670784e6
mov edx, dword [ebp + 0xc]
and ecx, 0xfff
dec dword [edi]
add byte [eax], al
add ecx, dword [ebp + 0xc]
sub edx, dword [esi + 0x34]
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x670784ee
cmp edx, ebx
jne 0x67078643
inc edi
inc edi
jmp 0x670784b5
add eax, dword [eax + 4]
jmp 0x670784ae
mov dword [ebp - 8], ebx
jmp 0x67078502
mov esi, dword [ebp - 0x88]
mov ax, word [ebp - 8]
cmp ax, word [esi + 6]
jne 0x6707851b
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov esi, 0x60000000
jmp 0x67078543
call fcn.67077e38
je 0x67078567
jo 0x670784d6
movzx eax, word [ebp - 8]
lea eax, [eax + eax*4]
mov ecx, dword [esi + eax*8 + 0x104]
mov edx, dword [esi + eax*8 + 0x108]
lea eax, [esi + eax*8 + 0xf8]
mov esi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
ror byte [ecx - 0x3e74f7bb], cl
ror byte [ecx - 0x3e74f7bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp + 8]
ja 0x67078599
mov edx, esi
mov edi, esi
and edx, 0x20000000
add byte [eax], al
add byte [eax], ah
and edi, 0x40000000
and esi, 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x67078582
or byte [eax + ecx], 1
cmp edi, ebx
je 0x6707858a
or byte [eax + ecx], 2
cmp esi, ebx
je 0x67078593
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp + 8]
jbe 0x67078577
inc dword [ebp - 8]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp - 8]
cmp cx, word [eax + 6]
jbe 0x670784fc
mov esi, dword [ebp + 0xc]
xor edi, edi
Function at 0x67091430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67151231
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov esi, dword [esp + 0x30]
mov dword [esi], sym.QtCore_Ad_4.dll_struct_QListData::Data_QListData::shared_null
mov eax, sym.QtCore_Ad_4.dll_struct_QListData::Data_QListData::shared_null
mov edx, 1
lock xadd dword [eax], edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x50]
push ebx
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], 1
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ecx
mov dword [ecx], ebx
mov edx, dword [esp + 0x3c]
mov ecx, esp
mov dword [ecx], edx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x18], esp
push ecx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x38], 1
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QDirIterator::constructor_class_QString_const___class_QStringList_const___class_QFlags_enum_QDir::Filter___class_QFlags_enum_QDirIterator::IteratorFlag__
mov edx, dword [esp + 0xc]
mov bl, 3
mov byte [esp + 0x28], bl
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x670914d9
mov ecx, dword [esp + 0xc]
push ecx
call sym.QtCore_Ad_4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
lea ecx, [esp + 0x18]
call sym.QtCore_Ad_4.dll_public:_bool___thiscall_QDirIterator::hasNext_void_const
test al, al
je 0x67091554
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x1c]
call sym.QtCore_Ad_4.dll_public:_class_QString___thiscall_QDirIterator::next_void_
mov eax, dword [esp + 0x38]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x6709150e
mov edx, dword [esp + 0x38]
push edx
call sym.QtCore_Ad_4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call sym.QtCore_Ad_4.dll_public:_class_QString___thiscall_QDirIterator::fileName_void_
push eax
mov ecx, esi
mov byte [esp + 0x2c], 4
call fcn.6701f760
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x28], bl
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x67091547
mov eax, dword [esp + 0x10]
push eax
call sym.QtCore_Ad_4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
lea ecx, [esp + 0x18]
call sym.QtCore_Ad_4.dll_public:_bool___thiscall_QDirIterator::hasNext_void_const
test al, al
jne 0x670914e6
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 0
call sym.QtCore_Ad_4.dll_public_virtual:_void___thiscall_QDirIterator::destructor_void_
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret 0xc
Function at 0x67093090
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x67151376
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
mov dword [esi], vtable.QDataStream.0
mov dword [esi + 4], ebx
push 8
mov dword [esp + 0x24], ebx
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x20], 1
cmp eax, ebx
je 0x670930f3
mov ecx, dword [esp + 0x28]
push ebx
push ecx
mov ecx, eax
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QBuffer::constructor_class_QByteArray___class_QObject__
mov edi, eax
jmp 0x670930f5
xor edi, edi
push 1
mov ecx, edi
mov byte [esp + 0x24], bl
call sym.QtCore_Ad_4.dll_public:_bool___thiscall_QObject::blockSignals_bool_
mov edx, dword [esp + 0x2c]
push ecx
mov eax, esp
mov dword [eax], edx
mov eax, dword [edi]
mov edx, dword [eax + 0x30]
mov ecx, edi
mov dword [esp + 0x2c], esp
call edx
mov dword [esi + 8], edi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xc
mov word [esi + 0xc], 1
mov dword [esi + 0x18], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8

Function at 0x67093150
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x67151376
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
mov dword [esi], vtable.QDataStream.0
mov dword [esi + 4], ebx
push 8
mov dword [esp + 0x24], ebx
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x20], 1
cmp eax, ebx
je 0x670931ae
push ebx
mov ecx, eax
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QBuffer::constructor_class_QObject__
mov edi, eax
jmp 0x670931b0
xor edi, edi
push 1
mov ecx, edi
mov byte [esp + 0x24], bl
call sym.QtCore_Ad_4.dll_public:_bool___thiscall_QObject::blockSignals_bool_
mov eax, dword [esp + 0x28]
push eax
mov ecx, edi
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QBuffer::setData_class_QByteArray_const__
push ecx
mov eax, esp
mov dword [eax], 1
mov edx, dword [edi]
mov eax, dword [edx + 0x30]
mov ecx, edi
mov dword [esp + 0x2c], esp
call eax
mov dword [esi + 8], edi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xc
mov word [esi + 0xc], 1
mov dword [esi + 0x18], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4