joyce8/EMBER2024-capa huggingface dataset:
Function at 0x670a7e80
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6728ddfe
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x674c7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x34], 0
mov eax, dword [ebx + 8]
cmp dword [eax + 4], 0
jne 0x670a7f64
push 0xb
lea eax, [ebp - 0x28]
push eax
push 0x13
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x670a7f64
push 0
push 0
push 2
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x2c]
call fcn.671e2a80
add esp, 0xc
mov ecx, dword [sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null]
or eax, 0xffffffff
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
test ecx, ecx
je 0x670a7f1e
cmp ecx, eax
je 0x670a7f35
lock xadd dword [sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null], eax
dec eax
setne al
test al, al
jne 0x670a7f32
mov eax, dword [ebp - 0x2c]
cmp eax, 0x674c7cb4
je 0x670a7f32
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
or eax, 0xffffffff
mov ecx, dword [ebx + 8]
mov dword [ebx + 8], esi
mov edx, dword [ecx]
test edx, edx
je 0x670a7f52
cmp edx, 0xffffffff
je 0x670a7f64
lock xadd dword [ecx], eax
dec eax
setne al
test al, al
jne 0x670a7f64
cmp ecx, 0x674c7cb4
je 0x670a7f64
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, dword [edi + 8]
and eax, 0xc000000a
or eax, 0xa
and eax, 0xbfffffff
and eax, 0x7fffffff
mov dword [edi + 8], eax
mov eax, dword [ebx + 8]
mov dword [edi], eax
mov ecx, dword [eax]
test ecx, ecx
je 0x670a7f8f
cmp ecx, 0xffffffff
je 0x670a7f8f
lock inc dword [eax]
and dword [edi + 8], 0xbfffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.67284a63
mov esp, ebp
pop ebp
ret 4
Function at 0x670a8ea0
Capabilities:
Get geographical location

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6728dffe
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x10
push esi
push edi
mov eax, dword [0x674c7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], 0
push eax
push 0xd
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x670a901a
xor eax, eax
cmp word [ebp - 0x14], ax
je 0x670a8f0b
inc eax
cmp word [ebp + eax*2 - 0x14], 0
jne 0x670a8f02
push 0
add eax, eax
lea edx, [ebp - 0x14]
push 0
push eax
lea ecx, [ebp - 0x18]
call fcn.671e2a80
add esp, 0xc
mov eax, dword [sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null]
or edi, 0xffffffff
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x18], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
test eax, eax
je 0x670a8f4c
cmp eax, edi
je 0x670a8f60
mov eax, edi
lock xadd dword [sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null], eax
dec eax
setne al
test al, al
jne 0x670a8f60
mov eax, dword [ebp - 0x18]
cmp eax, 0x674c7cb4
je 0x670a8f60
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [esi + 4]
cmp ecx, 1
jne 0x670a8ff0
push 0x673f45ec
push ecx
sub esp, 8
mov edx, esp
cmp esi, sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
jne 0x670a8f83
xor eax, eax
jmp 0x670a8f88
mov eax, dword [esi + 0xc]
add eax, esi
mov dword [edx], ecx
mov ecx, 1
mov dword [edx + 4], eax
call fcn.67092d40
add esp, 0x10
test eax, eax
jne 0x670a8ff0
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + 8]
and eax, 0xc0000002
or eax, 2
and eax, 0xbfffffff
and eax, 0x7fffffff
mov dword [ecx + 8], eax
mov dword [ecx], 1
mov eax, dword [esi]
test eax, eax
je 0x670a8fd6
cmp eax, 0xffffffff
je 0x670a8fec
lock xadd dword [esi], edi
dec edi
setne al
test al, al
jne 0x670a8fec
cmp esi, 0x674c7cb4
je 0x670a8fec
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push esi
call eax
mov ecx, dword [ebx + 8]
add esp, 4
mov eax, ecx
jmp 0x670a903e
mov eax, dword [esi]
test eax, eax
je 0x670a9007
cmp eax, 0xffffffff
je 0x670a901a
lock xadd dword [esi], edi
dec edi
setne al
test al, al
jne 0x670a901a
cmp esi, 0x674c7cb4
je 0x670a901a
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push esi
call eax
add esp, 4
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 8]
and ecx, 0xc0000002
or ecx, 2
and ecx, 0xbfffffff
and ecx, 0x7fffffff
mov dword [eax + 8], ecx
mov dword [eax], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x670a9060
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6728e046
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x674c7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push 4
push eax
mov dword [ebp - 0x20], edi
push 0x100c
mov dword [ebp - 0x28], 0
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x670a918c
xor eax, eax
cmp word [ebp - 0x18], ax
je 0x670a90c9
nop dword [eax + eax]
inc eax
cmp word [ebp + eax*2 - 0x18], 0
jne 0x670a90c0
push 0
add eax, eax
lea edx, [ebp - 0x18]
push 0
push eax
lea ecx, [ebp - 0x1c]
call fcn.671e2a80
add esp, 0xc
mov eax, dword [ebp - 0x1c]
or ebx, 0xffffffff
mov dword [ebp - 0x20], eax
mov eax, dword [sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null]
mov dword [ebp - 0x1c], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
test eax, eax
je 0x670a910d
cmp eax, ebx
je 0x670a9121
mov eax, ebx
lock xadd dword [sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null], eax
dec eax
setne al
test al, al
jne 0x670a9121
mov eax, dword [ebp - 0x1c]
cmp eax, 0x674c7cb4
je 0x670a9121
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x20]
push 0xa
push 0
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
add ecx, esi
call fcn.670a0080
mov ecx, eax
add esp, 8
mov eax, dword [edi + 8]
and eax, 0xc0000003
or eax, 3
and eax, 0xbfffffff
and eax, 0x7fffffff
mov dword [edi + 8], eax
lea eax, [ecx + 1]
mov dword [edi], eax
mov eax, dword [esi]
mov ecx, dword [ebp - 0x20]
test eax, eax
je 0x670a9178
cmp eax, 0xffffffff
je 0x670a91aa
lock xadd dword [ecx], ebx
dec ebx
setne al
test al, al
jne 0x670a91aa
cmp ecx, 0x674c7cb4
je 0x670a91aa
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x670a91aa
mov eax, dword [edi + 8]
and eax, 0xc0000002
or eax, 2
and eax, 0xbfffffff
and eax, 0x7fffffff
mov dword [edi + 8], eax
mov dword [edi], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.67284a63
mov esp, ebp
pop ebp
ret 4
Function at 0x670aaee0
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x204]
sub esp, 0x204
push 0xffffffffffffffff
push 0x6728e397
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x674c7008]
xor eax, ebp
mov dword [ebp + 0x200], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 0
mov dword [edi], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
push 0xff
lea eax, [ebp]
mov dword [ebp - 4], 0
push eax
push 0x5a
push edx
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x670aafee
xor eax, eax
cmp word [ebp], ax
je 0x670aaf69
nop
inc eax
cmp word [ebp + eax*2], 0
jne 0x670aaf60
push 0
add eax, eax
lea edx, [ebp]
push 0
push eax
lea ecx, [ebp - 0x10]
call fcn.671e2a80
add esp, 0xc
mov eax, dword [sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null]
or ebx, 0xffffffff
mov esi, dword [ebp - 0x10]
mov edx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [ebp - 0x10], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
test eax, eax
je 0x670aafb0
cmp eax, ebx
je 0x670aafc6
mov eax, ebx
lock xadd dword [sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null], eax
dec eax
setne al
test al, al
jne 0x670aafc6
mov eax, dword [ebp - 0x10]
cmp eax, 0x674c7cb4
je 0x670aafc6
push eax
call edx
mov edx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, dword [edi]
mov dword [edi], esi
mov ecx, dword [eax]
test ecx, ecx
je 0x670aafe1
cmp ecx, 0xffffffff
je 0x670aafee
lock xadd dword [eax], ebx
dec ebx
setne cl
test cl, cl
jne 0x670aafee
cmp eax, 0x674c7cb4
je 0x670aafee
push eax
call edx
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.67284a63
lea esp, [ebp + 0x204]
pop ebp
ret
Function at 0x670ac760
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6728e5d4
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x674c7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.6727f670
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffd2
jne 0x670ac8ec
call fcn.670b00c0
mov ecx, eax
call sym.Qt5Core.dll_public:_void_____thiscall_QThreadStorageData::get_void_const
test eax, eax
jne 0x670ac8ea
push 4
call fcn.67284a71
add esp, 4
mov dword [ebp - 0x10], eax
push 0x10
mov dword [ebp - 4], 0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x670ac896
push 0
push 0x10
mov dword [esi], fcn.67280d00
mov dword [esi + 4], fcn.67280d10
mov dword [esi + 8], 0
call fcn.67280d00
mov edi, eax
add esp, 8
test edi, edi
je 0x670ac883
mov eax, dword [0x674e4964]
test eax, eax
jne 0x670ac831
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x38]
dec eax
mov dword [0x674e4964], eax
lea ebx, [eax + 0x80000]
not eax
push 4
push 0x2000
and ebx, eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x670ac85d
push dword [esi + 8]
mov eax, dword [esi + 4]
push edi
call eax
add esp, 8
jmp 0x670ac883
lea edx, [eax + ebx]
mov dword [edi + 0xc], eax
mov dword [edi + 4], edx
mov ecx, edi
mov dword [edi + 8], edx
add edx, 0xffff8000
call fcn.672543f0
test eax, eax
jne 0x670ac8e0
mov edx, esi
mov ecx, edi
call fcn.672543c0
push dword [esi + 8]
mov eax, dword [esi + 4]
push esi
mov dword [esi + 0xc], 0
call eax
add esp, 8
xor esi, esi
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
mov dword [edi], esi
call fcn.670b00c0
push edi
mov ecx, eax
call sym.Qt5Core.dll_public:_void_____thiscall_QThreadStorageData::set_void__
push dword [ebp + 0x18]
mov edx, dword [ebp - 0x14]
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.6727f670
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
mov dword [edi], eax
mov dword [esi + 0xc], edi
jmp 0x670ac898
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x670c17c0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebx, ecx
mov bp, dx
push esi
push edi
mov edi, dword [esp + 0x28]
mov ecx, 0xffff
mov eax, dword [ebx]
mov edx, ecx
mov word [esp + 0x12], bp
mov dword [esp + 0x14], ecx
cmp dword [edi + 4], 0
mov eax, dword [eax + 0x1c]
mov word [ebx + 0xe], dx
mov dword [edi + 0xc], 0
jbe 0x670c1a02
movzx esi, bp
xor edx, edx
mov dword [esp + 0x28], esi
lea eax, [eax + esi*4]
mov dword [esp + 0x18], eax
nop word [eax + eax]
mov eax, dword [edi + 0x14]
lea ecx, [edx + edx*4]
mov eax, dword [eax + ecx*4 + 4]
mov ecx, dword [esp + 0x18]
not eax
test dword [ecx], eax
je 0x670c19e8
mov eax, dword [ebx]
cmp bp, word [eax + 0x20]
jae 0x670c19bd
mov eax, dword [eax + 0x18]
lea ecx, [esi + esi*2]
movzx ebp, word [eax + ecx*4 + 6]
lea edx, [eax + ecx*4]
movzx eax, word [edx + 4]
xor ecx, ecx
xor esi, esi
mov dword [esp + 0x20], edx
cmp cx, word [edx + 8]
jae 0x670c19b4
dec eax
mov dword [esp + 0x1c], eax
nop dword [eax]
movzx eax, si
lea ecx, [eax + eax*8]
mov eax, dword [edx]
lea edx, [eax + ecx*8]
mov eax, dword [esp + 0x1c]
cmp eax, 7
ja case.default.0x670c1878
jmp dword [eax*4 + 0x670c1a0c]
push ecx
push 0xffff
push ebp
push edi
mov ecx, ebx
call fcn.670b9ed0
jmp 0x670c199b
push ecx
push 0xffff
push ebp
push edi
mov ecx, ebx
call fcn.670bac20
jmp 0x670c199b
push ecx
push 0xffff
push ebp
push edi
mov ecx, ebx
call fcn.670bb250
jmp 0x670c199b
push ecx
push 0xffff
push ebp
push edi
mov ecx, ebx
call fcn.670bb930
jmp 0x670c199b
push ecx
push 0xffff
push ebp
push edi
mov ecx, ebx
call fcn.670bc430
jmp 0x670c199b
push ecx
push 0xffff
push ebp
push edi
mov ecx, ebx
call fcn.670bc920
jmp 0x670c199b
movzx eax, byte [edx]
sub eax, 1
je 0x670c1937
sub eax, 1
je 0x670c1922
sub eax, 1
jne 0x670c19d4
push 1
push 0xffff
push ebp
push edi
add edx, 4
mov ecx, ebx
call fcn.670be3d0
jmp 0x670c199b
push 1
push 0xffff
push ebp
push edi
add edx, 4
mov ecx, ebx
call fcn.670be020
jmp 0x670c199b
push 1
push 0xffff
push ebp
push edi
add edx, 4
mov ecx, ebx
call fcn.670bdd50
jmp 0x670c199b
movzx eax, byte [edx]
sub eax, 1
je 0x670c1988
sub eax, 1
je 0x670c1973
sub eax, 1
jne 0x670c19d4
push 1
push 0xffff
push ebp
push edi
add edx, 4
mov ecx, ebx
call fcn.670c0ae0
jmp 0x670c199b
push 1
push 0xffff
push ebp
push edi
add edx, 4
mov ecx, ebx
call fcn.670c02a0
jmp 0x670c199b
push 1
push 0xffff
push ebp
push edi
add edx, 4
mov ecx, ebx
call fcn.670bfd50
add esp, 0x10
cmp eax, 0xffff
jne 0x670c19d9
mov edx, dword [esp + 0x20]
inc esi
cmp si, word [edx + 8]
jb 0x670c1860
mov bp, word [esp + 0x12]
mov esi, dword [esp + 0x28]
mov eax, 0xffff
mov edx, dword [edi + 0xc]
cmp eax, 0xffff
je 0x670c19f1
mov ecx, eax
mov dword [esp + 0x14], ecx
jmp 0x670c19f9
mov eax, 0x157f
test eax, eax
jne 0x670c1a04
mov bp, word [esp + 0x12]
mov esi, dword [esp + 0x28]
jmp 0x670c19c2
mov eax, 0xffff
mov word [ebx + 0xe], ax
mov ecx, dword [esp + 0x14]
inc edx
mov dword [edi + 0xc], edx
cmp edx, dword [edi + 4]
jb 0x670c1810
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x670deab0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x34
mov eax, dword [0x674c7008]
xor eax, esp
mov dword [esp + 0x30], eax
push edi
mov edi, dword [esp + 0x40]
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 0x2c
push eax
push 0
push 0
push edx
mov byte [edi], 0
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x670deb30
movups xmm0, xmmword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x40]
mov byte [edi], 1
mov dword [esi], eax
mov eax, dword [esp + 0x10]
add eax, dword [esp + 0xc]
movups xmmword [esi + 0xc], xmm0
sub ecx, eax
mov dword [esi + 4], eax
movups xmm0, xmmword [esp + 0x28]
add ecx, dword [esp + 0xc]
mov eax, esi
mov dword [esi + 8], ecx
movups xmmword [esi + 0x1c], xmm0
pop esi
pop edi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.67284a63
add esp, 0x34
ret
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
pop edi
xor ecx, esp
call fcn.67284a63
add esp, 0x34
ret
Function at 0x670dfaa0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x674c7008]
xor eax, esp
mov dword [esp + 0xc], eax
push 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
cmp eax, 3
jne 0x670dfaf1
lea eax, [esp + 4]
push eax
push 3
call sym.Qt5Core.dll_public:_static_enum_QLocale::Country___cdecl_QLocalePrivate::codeToCountry_class_QStringView_
add esp, 8
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.67284a63
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc]
xor eax, eax
xor ecx, esp
call fcn.67284a63
mov esp, ebp
pop ebp
ret
Function at 0x67108090
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6729374d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x674c7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0x30
call fcn.67284a71
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
push 0x50f01
call sym.Qt5Core.dll_public:_void___thiscall_QObjectPrivate::constructor_int_
push 0
push eax
mov ecx, esi
call sym.Qt5Core.dll_protected:_void___thiscall_QObject::constructor_class_QObjectPrivate___class_QObject__
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [esi], vtable.QNonContiguousByteDeviceIoDeviceImpl.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x4000
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x30], 0
mov dword [esi + 8], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0x38]
call eax
push 2
push str.2readyRead__
push esi
push str.2readyRead__
push dword [esi + 8]
mov dword [esi + 0x38], eax
lea eax, [ebp + 8]
push eax
mov dword [esi + 0x3c], edx
call sym.Qt5Core.dll_public:_static_class_QMetaObject::Connection___cdecl_QObject::connect_class_QObject_const___char_const___class_QObject_const___char_const___enum_Qt::ConnectionType_
mov ecx, dword [ebp + 8]
add esp, 0x18
or edi, 0xffffffff
test ecx, ecx
je 0x67108178
mov eax, edi
lock xadd dword [ecx + 0x24], eax
dec eax
jne 0x67108178
push ecx
call fcn.671b91e0
push 2
push str.2readyRead__
push esi
push str.2readChannelFinished__
push dword [esi + 8]
lea eax, [ebp + 8]
push eax
call sym.Qt5Core.dll_public:_static_class_QMetaObject::Connection___cdecl_QObject::connect_class_QObject_const___char_const___class_QObject_const___char_const___enum_Qt::ConnectionType_
mov ecx, dword [ebp + 8]
add esp, 0x18
test ecx, ecx
je 0x671081a9
lock xadd dword [ecx + 0x24], edi
dec edi
jne 0x671081a9
push ecx
call fcn.671b91e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x67109870
Capabilities:
Get disk size

Disassembly:
push esi
mov esi, ecx
call fcn.67109da0
mov ecx, dword [esi]
pop esi
jmp fcn.671555f0
Function at 0x67133850
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67296ce0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x674c7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
mov dword [esi], vtable.QProcess.0
mov dword [ebp - 0x1c], eax
cmp dword [eax + 0x8c], 0
je 0x671339af
movaps xmm0, xmmword [0x6741d630]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0x672aa80c
movups xmmword [ebp - 0x34], xmm0
call sym.Qt5Core.dll_public:_class_QDebug___thiscall_QMessageLogger::warning_void_
push str.QProcess:_Destroyed_while_process__
mov ecx, dword [eax]
mov byte [ecx + 0x14], 0
mov ecx, eax
call sym.Qt5Core.dll_public:_class_QDebug____thiscall_QDebug::operator___char_const__
mov ecx, dword [esi + 4]
mov edi, eax
mov eax, dword [ecx + 0x100]
mov dword [ebp - 0x14], eax
mov ecx, dword [eax]
test ecx, ecx
je 0x671338de
cmp ecx, 0xffffffff
je 0x671338de
lock inc dword [eax]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QDir::toNativeSeparators_class_QString_const__
add esp, 8
mov ecx, dword [eax]
mov eax, dword [ecx + 0xc]
push dword [ecx + 4]
add eax, ecx
mov ecx, edi
push eax
call sym.Qt5Core.dll_private:_void___thiscall_QDebug::putString_class_QChar_const___unsigned_int_
mov ecx, dword [edi]
cmp byte [ecx + 0x14], 0
je 0x6713390f
push 0x20
call sym.Qt5Core.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
push str.__is_still_running.
mov ecx, edi
call sym.Qt5Core.dll_public:_class_QDebug____thiscall_QDebug::operator___char_const__
mov eax, dword [ebp - 0x10]
or edi, 0xffffffff
mov eax, dword [eax]
test eax, eax
je 0x6713393c
cmp eax, edi
je 0x67133950
mov eax, dword [ebp - 0x10]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x67133950
mov eax, dword [ebp - 0x10]
cmp eax, 0x674c7cb4
je 0x67133950
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x14]
test ecx, ecx
je 0x6713396d
cmp ecx, 0xffffffff
je 0x6713397e
lock xadd dword [eax], edi
dec edi
setne cl
test cl, cl
jne 0x6713397e
cmp eax, 0x674c7cb4
je 0x6713397e
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
lea ecx, [ebp - 0x18]
call sym.Qt5Core.dll_public:_void___thiscall_QDebug::destructor_void_
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x94]
test eax, eax
je 0x671339a0
push 0xf291
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x7530
mov ecx, esi
call sym.Qt5Core.dll_public:_bool___thiscall_QProcess::waitForFinished_int_
mov eax, dword [ebp - 0x1c]
mov ecx, eax
call fcn.67132c50
mov ecx, esi
mov dword [esi], vtable.QIODevice.0
call sym.Qt5Core.dll_public_virtual:_void___thiscall_QObject::destructor_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x67133d40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
push 0
mov esi, ecx
push 4
push sym.Qt5Core.dll_struct_QMetaObject_const_QIODevice::staticMetaObject
push esi
mov edi, dword [esi + 4]
call sym.Qt5Core.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___
add esp, 0x10
nop
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
mov eax, dword [eax + 0x5c]
call eax
test al, al
jne 0x67133d60
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x94]
test eax, eax
je 0x67133d89
push 0xf291
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xffffffffffffffff
mov ecx, esi
call sym.Qt5Core.dll_public:_bool___thiscall_QProcess::waitForFinished_int_
push 0
mov ecx, edi
call sym.Qt5Core.dll_public:_void___thiscall_QIODevicePrivate::setWriteChannelCount_int_
mov ecx, esi
call sym.Qt5Core.dll_public_virtual:_void___thiscall_QIODevice::close_void_
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x67138130
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x10]
mov ecx, dword [esi + 0x134]
test ecx, ecx
je 0x67138151
mov dword [esp + 0x10], edi
lea edx, [esp + 0x10]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
push dword [edi + 0x24]
movzx eax, byte [edi + 0x10]
push dword [edi + 0x20]
push dword [edi + 0x1c]
push dword [edi + 0x18]
push dword [edi + 0x14]
push eax
push dword [edi + 0xc]
push dword [edi + 8]
push dword [edi + 4]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
mov eax, dword [esi + 0xb0]
setne bl
cmp eax, 0xffffffff
je 0x67138199
push eax
call edi
mov dword [esi + 0xb0], 0xffffffff
mov eax, dword [esi + 0xd4]
cmp eax, 0xffffffff
je 0x671381b1
push eax
call edi
mov dword [esi + 0xd4], 0xffffffff
mov ecx, dword [esi + 0xf4]
cmp ecx, 0xffffffff
je 0x671381c9
push ecx
call edi
mov dword [esi + 0xf4], 0xffffffff
pop edi
pop esi
mov al, bl
pop ebx
ret 4