joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401cd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401d28
cmp byte [esi + ebx - 1], 0xa
je 0x401cfc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4030d8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x401ed0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x401f5b
cmp ax, 9
je 0x401f48
cmp ax, 0x20
je 0x401f48
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x401fb0
cmp ax, 0x22
je 0x401fc0
mov dword [ebp - 0x54], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x401f5b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x401f00
test edi, 1
jne 0x401f00
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x401f48
cmp ax, 0x20
je 0x401f48
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x401fd8
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc dword [ebp - 0x54]
jmp 0x401f1b
and dword [ebp - 0x54], 1
jne 0x401f14
xor edi, 1
jmp 0x401f1b
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x401f74

Function at 0x401ff0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x63003e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6304d241
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6309ff88]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 1
test esi, esi
je 0x63003e62
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 8]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
mov dword [esi + 0xc], edx
mov eax, esi
jmp 0x63003e64
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
inc dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10
Function at 0x63008850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6304d839
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x6309ff88]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x18]
push eax
lea ecx, [esp + 0xc]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QReadLocker::constructor_class_QReadWriteLock__]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0x4c]
mov dword [esp + 0x10], edx
lea edx, [esp + 0xc]
mov dword [esp + 0x14], ecx
push edx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.630078e0
mov ecx, dword [esp + 8]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
test ecx, ecx
je 0x630088df
test cl, 1
je 0x630088df
and ecx, 0xfffffffe
mov dword [esp + 8], ecx
and ecx, 0xfffffffe
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QReadWriteLock::unlock_void_]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 0xc
Function at 0x63008d10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6304d912
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6309ff88]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x1c], ebp
lea eax, [ebp + 0x18]
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QWriteLocker::constructor_class_QReadWriteLock__]
mov dword [esp + 0x38], 0
call fcn.630089d0
add eax, 4
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QMutexLocker::constructor_class_QMutex__]
mov byte [esp + 0x38], 1
call fcn.630089d0
mov eax, dword [eax]
mov ecx, dword [eax + 8]
lea edi, [eax + ecx*4 + 0x14]
call fcn.630089d0
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
lea eax, [eax + edx*4 + 0x14]
cmp edi, eax
je 0x63008e2f
mov ebx, dword [sym.imp.QtCore4.dll_public:_struct_QHashData____thiscall_QHashData::detach_helper2_void____cdecl___struct_QHashData::Node___void____void____cdecl___struct_QHashData::Node____int__int_]
lea esi, [ebp + 8]
jmp 0x63008da0
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov edx, dword [edi]
mov dword [esp + 0x20], eax
mov eax, dword [esi]
add eax, 8
mov eax, dword [eax]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
cmp eax, 1
je 0x63008df7
mov ecx, dword [esi]
push 8
push 0x30
push sym.QtOpenGL4.dll_public:_void___thiscall_QGLContextResource::destructor_void_
push 0x63002c00
call ebx
mov ebp, eax
mov eax, dword [esi]
add eax, 8
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x63008df1
mov ecx, dword [esi]
push sym.QtOpenGL4.dll_public:_void___thiscall_QGLContextResource::destructor_void_
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QHashData::free_helper_void____cdecl___struct_QHashData::Node___]
mov dword [esi], ebp
mov ebp, dword [esp + 0x1c]
push 0
lea edx, [esp + 0x24]
push edx
mov ecx, esi
call fcn.63003ed0
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x63008e16
add eax, 0x18
push eax
mov ecx, ebp
call fcn.63007850
add edi, 4
call fcn.630089d0
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
lea eax, [eax + ecx*4 + 0x14]
cmp edi, eax
jne 0x63008da0
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x38], 0
test cl, 1
je 0x63008e4d
and ecx, 0xfffffffe
mov dword [esp + 0x14], ecx
and ecx, 0xfffffffe
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QMutex::unlock_void_]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
test ecx, ecx
je 0x63008e72
test cl, 1
je 0x63008e72
and ecx, 0xfffffffe
mov dword [esp + 0x18], ecx
and ecx, 0xfffffffe
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QReadWriteLock::unlock_void_]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
Function at 0x6300c2a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6304df26
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x6309ff88]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x24]
lea edi, [esi + 0xc]
xor ebp, ebp
mov ecx, edi
mov dword [esi], eax
mov byte [esi + 4], 1
mov dword [esi + 8], ebp
call sym.QtOpenGL4.dll_public:_void___thiscall_QGLPaintDevice::constructor_void_
mov dword [edi], vtable.QGLPBufferGLPaintDevice.0
lea ecx, [esi + 0x20]
mov dword [esp + 0x1c], ebp
call sym.QtOpenGL4.dll_public:_void___thiscall_QGLFormat::constructor_void_
lea ecx, [esi + 0x24]
mov byte [esp + 0x1c], 1
call sym.QtOpenGL4.dll_public:_void___thiscall_QGLFormat::constructor_void_
mov dword [esi + 0x28], ebp
or eax, 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x3c], ebp
mov dword [esi + 0x40], ebp
mov dword [esi + 0x34], ebp
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 4

Function at 0x6300cac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6304e00f
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x6309ff88]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call dword [sym.imp.QtGui4.dll_protected:_void___thiscall_QPaintDevice::constructor_void_]
push 0x44
mov dword [esp + 0x20], 0
mov dword [esi], vtable.QGLPixelBuffer.0
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0xc], eax
mov byte [esp + 0x1c], 1
test eax, eax
je 0x6300cb1f
push esi
mov ecx, eax
call fcn.6300c2a0
jmp 0x6300cb21
xor eax, eax
mov dword [esi + 8], eax
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
push edx
mov dword [esp + 0x14], ecx
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 8]
mov byte [esp + 0x28], 2
call fcn.6300c340
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret 0x10
Function at 0x6300e440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6304e17f
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6309ff88]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call dword [sym.imp.QtGui4.dll_protected:_void___thiscall_QPaintDevice::constructor_void_]
push 0x54
mov dword [esp + 0x1c], 0
mov dword [esi], vtable.QGLFramebufferObject.0
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0xc], eax
mov byte [esp + 0x18], 1
test eax, eax
je 0x6300e49e
mov ecx, eax
call fcn.6300d000
jmp 0x6300e4a0
xor eax, eax
mov dword [esi + 8], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 0x10]
push ecx
mov ecx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esi + 8]
push edx
push eax
push esi
mov byte [esp + 0x30], 2
call fcn.6300da80
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 8

Function at 0x63012080
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6304e7a5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6309ff88]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x10], ebx
fld qword [esp + 0x24]
lea eax, [esp + 0x2c]
fstp qword [ebx]
push eax
lea ecx, [ebx + 8]
mov dword [esp + 0x20], 0
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QBrush::constructor_class_QBrush_const__]
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
mov dword [ebx + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x18], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
push ecx
lea ecx, [ebx + 0x28]
mov byte [esp + 0x20], 1
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x20], eax
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QTransform::constructor_class_QTransform_const__]
lea edi, [ebx + 0x78]
mov ecx, 9
lea esi, [esp + 0x3c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QBrush::destructor_void_]
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x3c
Function at 0x63012ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6304e8e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6309ff88]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
fld qword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
sub esp, 8
fstp qword [esp]
push eax
push ecx
mov ecx, esi
call fcn.63012830
mov edx, dword [esp + 0x2c]
or ecx, 0xffffffff
mov dword [esi + 0x74], ecx
mov dword [esi + 0x70], ecx
mov ecx, dword [esp + 0x30]
xor eax, eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], eax
mov byte [esi + 0x78], al
mov dword [esi + 0x7c], edx
mov dword [esi + 0x80], ecx
lea ecx, [esi + 0x88]
mov dword [esp + 0x14], eax
mov dword [esi], vtable.QGLLineMaskGenerator.0
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QPainterPath::constructor_void_]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18
Function at 0x63017fa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6304edf1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6309ff88]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 8
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
xor eax, eax
mov dword [esp + 0x1c], eax
cmp esi, eax
je 0x63018003
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x2c]
push eax
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], edx
call fcn.630141f0
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
inc dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10

Function at 0x630182f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6304edf1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6309ff88]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 8
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
xor eax, eax
mov dword [esp + 0x1c], eax
cmp esi, eax
je 0x63018353
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x2c]
push eax
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], edx
call fcn.63014170
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
inc dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10
Function at 0x6302ae70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x63050520
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6309ff88]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebx, dword [ecx + 4]
lea eax, [ebx + 0x74]
push eax
lea eax, [esp + 0x18]
push eax
mov byte [ebx + 0x62], 1
call fcn.6302d170
add esp, 8
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x3c], 0
nop
mov ecx, esi
inc esi
mov dword [esp + 0x18], esi
test ecx, ecx
jne 0x6302af22
cmp eax, dword [esp + 0x20]
je 0x6302af22
mov edi, dword [eax]
test esi, esi
je 0x6302af15
mov edx, dword [ebx + 0x54]
test edx, edx
je 0x6302af0e
test edi, edi
je 0x6302af0e
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x54]
test ecx, ecx
je 0x6302af0e
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x6302aefb
mov eax, dword [eax + 0x150]
jmp 0x6302aefd
xor eax, eax
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x4c]
push ecx
mov ecx, dword [eax + 0x34]
push edx
call ecx
mov esi, dword [esp + 0x18]
dec esi
mov dword [esp + 0x18], esi
jmp 0x6302aed3
mov eax, dword [esp + 0x1c]
add eax, 4
mov dword [esp + 0x1c], eax
jmp 0x6302aec0
mov eax, dword [esp + 0x14]
or ebp, 0xffffffff
mov dword [esp + 0x3c], ebp
test eax, eax
je 0x6302af51
mov edx, ebp
lock xadd dword [eax], edx
jne 0x6302af51
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
test ecx, ecx
jne 0x6302af51
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.QtCore4.dll_void___cdecl_qFree_void__]
add esp, 4
lea edi, [ebx + 0x78]
lea eax, [esp + 0x24]
push edi
push eax
call fcn.6302d170
add esp, 8
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], 1
mov edx, eax
inc eax
mov dword [esp + 0x28], eax
test edx, edx
jne 0x6302afb0
cmp ecx, dword [esp + 0x30]
je 0x6302afb0
mov esi, dword [ecx]
test eax, eax
je 0x6302afa3
test esi, esi
je 0x6302af9c
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
push 1
mov ecx, esi
call edx
mov eax, dword [esp + 0x28]
dec eax
mov dword [esp + 0x28], eax
jmp 0x6302af85
mov ecx, dword [esp + 0x2c]
add ecx, 4
mov dword [esp + 0x2c], ecx
jmp 0x6302af72
mov eax, dword [esp + 0x24]
mov dword [esp + 0x3c], ebp
test eax, eax
je 0x6302afda
lock xadd dword [eax], ebp
jne 0x6302afda
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
test ecx, ecx
jne 0x6302afda
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.QtCore4.dll_void___cdecl_qFree_void__]
add esp, 4
lea ecx, [ebx + 0x74]
call fcn.630074c0
mov ecx, edi
call fcn.630074c0
mov byte [ebx + 0x60], 0
mov byte [ebx + 0x62], 0
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x63043b90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x63051fb7
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6309ff88]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], eax
push 0x40
lea ecx, [esi + 0x3c]
mov byte [esp + 0x18], 4
call fcn.63041080
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x630476e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
cmp byte [esi + 8], 0
jne 0x6304791b
test byte [esi + 4], 0x80
je 0x6304791b
cmp byte [esi + 9], 8
jne 0x6304791b
xor ecx, ecx
mov eax, 0x100
mov edx, 4
mul edx
seto cl
push ebp
push edi
neg ecx
or ecx, eax
push ecx
call fcn.6304c1c8
add esp, 4
mov ebp, eax
xor edi, edi
push ebx
lea esp, [esp]
movzx eax, byte [esi + 0xa]
movzx ecx, byte [esi + 0xb]
push eax
push edi
call fcn.63047610
movzx edx, byte [esi + 0xc]
movzx ecx, byte [esi + 0xd]
movzx ebx, al
push edx
or ebx, 0xffffff00
push edi
shl ebx, 8
call fcn.63047610
movzx edx, byte [esi + 0xe]
movzx ecx, byte [esi + 0xf]
movzx eax, al
push edx
or ebx, eax
push edi
shl ebx, 8
call fcn.63047610
movzx eax, al
or ebx, eax
mov dword [ebp + edi*4], ebx
inc edi
add esp, 0x18
cmp edi, 0x100
jl 0x63047730
cmp byte [esi + 9], 8
mov eax, 3
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0x1b
mov dword [esp + 0x18], 0x40
mov dword [esp + 0x1c], 0x43
mov dword [esp + 0x20], 0x58
mov dword [esp + 0x24], 0xad
mov dword [esp + 0x28], 0xb5
mov dword [esp + 0x2c], 0xec
mov dword [esp + 0x30], 0xf7
mov dword [esp + 0x34], 0xa4
mov dword [esp + 0x38], 0x5b
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0x800000
mov dword [esp + 0x44], 0x8000
mov dword [esp + 0x48], 0x808000
mov dword [esp + 0x4c], 0x80
mov dword [esp + 0x50], 0x800080
mov dword [esp + 0x54], 0x8080
mov dword [esp + 0x58], 0xc0c0c0
mov dword [esp + 0x5c], 0xc0dcc0
mov dword [esp + 0x60], 0xa6caf0
mov dword [esp + 0x64], 0xfffbf0
mov dword [esp + 0x68], 0xa0a0a4
mov dword [esp + 0x6c], 0x808080
mov dword [esp + 0x70], 0xff0000
mov dword [esp + 0x74], 0xff00
mov dword [esp + 0x78], 0xffff00
mov dword [esp + 0x7c], 0xff
mov dword [esp + 0x80], 0xff00ff
mov dword [esp + 0x84], 0xffff
mov dword [esp + 0x88], 0xffffff
pop ebx
jne 0x63047910
cmp byte [esi + 0xa], al
jne 0x63047910
cmp byte [esi + 0xb], 0
jne 0x63047910
cmp byte [esi + 0xc], al
jne 0x63047910
cmp byte [esi + 0xd], al
jne 0x63047910
cmp byte [esi + 0xe], 2
jne 0x63047910
cmp byte [esi + 0xf], 6
jne 0x63047910
xor eax, eax
lea ebx, [ebx]
mov ecx, dword [esp + eax + 8]
mov edx, dword [esp + eax + 0x3c]
mov dword [ebp + ecx*4], edx
mov ecx, dword [esp + eax + 0xc]
mov edx, dword [esp + eax + 0x40]
mov dword [ebp + ecx*4], edx
mov ecx, dword [esp + eax + 0x10]
mov edx, dword [esp + eax + 0x44]
mov dword [ebp + ecx*4], edx
mov ecx, dword [esp + eax + 0x14]
mov edx, dword [esp + eax + 0x48]
mov dword [ebp + ecx*4], edx
mov ecx, dword [esp + eax + 0x18]
mov edx, dword [esp + eax + 0x4c]
mov dword [ebp + ecx*4], edx
mov ecx, dword [esp + eax + 0x1c]
mov edx, dword [esp + eax + 0x50]
add eax, 0x18
cmp eax, 0x30
mov dword [ebp + ecx*4], edx
jl 0x630478c0
pop edi
mov eax, ebp
pop ebp
add esp, 0x80
ret
xor eax, eax
add esp, 0x80
ret

Function at 0x6304c3b2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6309ff88]
jne 0x6304c3bc
repz ret
jmp fcn.6304cc0e