joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49106c
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x64468c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
cmp dword [esp + 0x44], 0
push 0
jne 0x4525dc
push 0x497ad5
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
mov ecx, dword [esp + 0x34]
add esp, 8
mov dword [ecx], eax
mov eax, ecx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
add esp, 0x24
ret 0x28
push 0
push dword [esp + 0x38]
lea ecx, [esp + 0x1c]
push dword [esp + 0x40]
push dword [esp + 0x48]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QTime::constructor_int__int__int__int_]
push eax
push dword [esp + 0x44]
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x20]
inc eax
push eax
mov eax, dword [esp + 0x54]
add eax, 0x76c
push eax
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QDate::constructor_int__int__int_]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QDateTime::constructor_class_QDate_const___class_QTime_const___enum_Qt::TimeSpec_]
push 0x13
push str.yyyy_MM_dd_hh:mm:ss
mov dword [esp + 0x2c], 1
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [esp + 4], eax
lea eax, [esp + 4]
mov byte [esp + 0x24], 2
push eax
push dword [esp + 0x30]
lea ecx, [esp + 0x10]
call dword [sym.imp.Qt5Core.dll_public:_class_QString___thiscall_QDateTime::toString_class_QString_const__]
lea ecx, [esp + 4]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], 1
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 8]
mov byte [esp + 0x24], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QDateTime::destructor_void_]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
add esp, 0x24
ret 0x28
Function at 0x454190
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x491325
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x64468c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
cmp dword [esp + 0x48], 0x64
push 0
jge 0x4541ee
push 0x497ad5
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
mov ecx, dword [esp + 0x38]
add esp, 8
mov dword [ecx], eax
mov eax, ecx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 0x28
push 0
push dword [esp + 0x3c]
lea ecx, [esp + 0x20]
push dword [esp + 0x44]
push dword [esp + 0x4c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QTime::constructor_int__int__int__int_]
push eax
push dword [esp + 0x48]
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x24]
inc eax
push eax
mov eax, dword [esp + 0x58]
add eax, 0x76c
push eax
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QDate::constructor_int__int__int_]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QDateTime::constructor_class_QDate_const___class_QTime_const___enum_Qt::TimeSpec_]
mov dword [esp + 0x28], 1
call fcn.00462200
mov ecx, eax
call fcn.00462290
push 0x13
test al, al
je 0x454263
push str.yyyy_MM_dd_hh:mm:ss
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [esp + 0xc], eax
mov byte [esp + 0x28], 2
jmp 0x45427a
push str.dd_MM_yyyy_hh:mm:ss
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [esp + 0xc], eax
mov byte [esp + 0x28], 3
mov esi, dword [esp + 0x30]
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x10]
call dword [sym.imp.Qt5Core.dll_public:_class_QString___thiscall_QDateTime::toString_class_QString_const__]
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 1
mov byte [esp + 0x28], 1
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QDateTime::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 0x28
Function at 0x454a00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x491403
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x64468c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x30]
push 0x28
push dword [esp + 0x38]
mov dword [esp + 0x2c], 1
mov cl, byte [eax + 0x14]
mov byte [esp + 0x1f], cl
lea ecx, [esp + 0x38]
mov byte [eax + 0x14], 0
call dword [sym.imp.Qt5Core.dll_public:_class_QDebug____thiscall_QDebug::operator___char_const__]
mov ecx, eax
call dword [sym.imp.Qt5Core.dll_public:_class_QDebug____thiscall_QDebug::operator___char_]
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov edi, dword [ecx + 0xc]
add esi, 4
add edi, 4
lea esi, [ecx + esi*4]
lea edi, [ecx + edi*4]
cmp esi, edi
je 0x454a89
push dword [esi]
lea ecx, [esp + 0x34]
call dword [sym.imp.Qt5Core.dll_public:_class_QDebug____thiscall_QDebug::operator___int_]
add esi, 4
mov ebx, edi
xor eax, eax
sub ebx, esi
xor ebp, ebp
add ebx, 3
shr ebx, 2
cmp esi, edi
cmova ebx, eax
test ebx, ebx
je 0x454ac1
push dword [esi]
lea ecx, [esp + 0x34]
push 0x49de4c
call dword [sym.imp.Qt5Core.dll_public:_class_QDebug____thiscall_QDebug::operator___char_const__]
mov ecx, eax
call dword [sym.imp.Qt5Core.dll_public:_class_QDebug____thiscall_QDebug::operator___int_]
inc ebp
lea esi, [esi + 4]
cmp ebp, ebx
jne 0x454aa0
push 0x29
lea ecx, [esp + 0x34]
call dword [sym.imp.Qt5Core.dll_public:_class_QDebug____thiscall_QDebug::operator___char_]
mov eax, dword [esp + 0x30]
mov cl, byte [esp + 0x17]
mov byte [eax + 0x14], cl
mov eax, dword [esp + 0x30]
cmp byte [eax + 0x14], 0
je 0x454af0
push 0x20
mov ecx, eax
call dword [sym.imp.Qt5Core.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov dword [esi], eax
inc dword [eax + 0xc]
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], 1
mov byte [esp + 0x24], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QDebug::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x45db00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x491325
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x64468c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
cmp dword [esp + 0x48], 0
push 0
jne 0x45db5e
push 0x497ad5
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
mov ecx, dword [esp + 0x38]
add esp, 8
mov dword [ecx], eax
mov eax, ecx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 0x28
push 0
push dword [esp + 0x3c]
lea ecx, [esp + 0x20]
push dword [esp + 0x44]
push dword [esp + 0x4c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QTime::constructor_int__int__int__int_]
push eax
push dword [esp + 0x48]
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x24]
inc eax
push eax
mov eax, dword [esp + 0x58]
add eax, 0x76c
push eax
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QDate::constructor_int__int__int_]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QDateTime::constructor_class_QDate_const___class_QTime_const___enum_Qt::TimeSpec_]
mov dword [esp + 0x28], 1
call fcn.00462200
mov ecx, eax
call fcn.00462290
push 0x13
test al, al
je 0x45dbd3
push str.yyyy_MM_dd_hh:mm:ss
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [esp + 0xc], eax
mov byte [esp + 0x28], 2
jmp 0x45dbea
push str.dd_MM_yyyy_hh:mm:ss
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [esp + 0xc], eax
mov byte [esp + 0x28], 3
mov esi, dword [esp + 0x30]
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x10]
call dword [sym.imp.Qt5Core.dll_public:_class_QString___thiscall_QDateTime::toString_class_QString_const__]
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 1
mov byte [esp + 0x28], 1
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QDateTime::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 0x28
Function at 0x45f1d0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x491759
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x64468c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esp + 0x1c], 0x3e7
jbe 0x45f213
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18
mov dword [esp + 8], esi
test esi, esi
je 0x45f226
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QMutex::lock_void_]
or dword [esp + 8], 1
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QMutexLocker::relock_void_]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esi + 4]
call fcn.0045dd10
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x45f257
push eax
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov eax, dword [esp + 0x20]
lea ecx, [esi + 0x10]
push dword [esp + 0x30]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esi], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 4], eax
call dword [sym.imp.Qt5Core.dll_public:_class_QString____thiscall_QString::operator_class_QString_const__]
lea ecx, [esp + 8]
mov byte [esi + 0x14], 1
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QMutexLocker::unlock_void_]
lea ecx, [esp + 8]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QMutexLocker::unlock_void_]
mov al, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18

Function at 0x45f2b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
mov eax, 0x55555556
imul dword [esp + 0x10]
push ebp
push esi
mov ebp, dword [esp + 0x20]
lea eax, [ebx + ebx*2]
push edi
mov edi, dword [esp + 0x14]
mov esi, edx
push 0
push 0x49df00
push eax
shr esi, 0x1f
mov eax, ebx
add esi, edx
sar eax, 1
mov edx, dword [esp + 0x24]
add esi, esi
push eax
push ebx
push ebp
lea ecx, [esi + edx]
sar esi, 2
push ebx
add esi, ecx
push esi
push ecx
push edx
push edi
call fcn.0045f6a0
add esp, 0x2c
test ebp, ebp
jle 0x45f32f
lea eax, [ebx + ebx*2]
test ebx, ebx
jle 0x45f32a
mov eax, edi
mov esi, ebx
lea esp, [esp]
mov cl, byte [eax + 2]
lea eax, [eax + 3]
xor byte [eax - 3], cl
mov dl, byte [eax - 3]
xor dl, cl
xor byte [eax - 3], dl
mov byte [eax - 1], dl
dec esi
jne 0x45f310
lea eax, [ebx + ebx*2]
add edi, eax
dec ebp
jne 0x45f304
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x4614e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x492b87
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x64468c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov ebx, dword [esp + 0x38]
mov ecx, ebx
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::constructor_void_]
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x30], 0
mov dword [esp + 0x14], 1
mov eax, dword [ebp]
cmp dword [eax + 0xc], 0
je 0x46153d
mov esi, dword [eax + 0x14]
jmp 0x461540
lea esi, [eax + 8]
add eax, 8
cmp esi, eax
je 0x461625
jmp 0x461550
lea eax, [esp + 0x24]
lea ecx, [esi + 0x10]
push eax
call dword [sym.imp.Qt5Core.dll_public:_class_QByteArray___thiscall_QString::toLocal8Bit_void_]
mov edi, eax
lea eax, [esp + 0x20]
mov dword [esp + 0x30], 1
lea ecx, [esi + 0xc]
push eax
call dword [sym.imp.Qt5Core.dll_public:_class_QByteArray___thiscall_QString::toLocal8Bit_void_]
push 0x49eb8c
push eax
lea eax, [esp + 0x24]
mov byte [esp + 0x38], 2
push eax
call fcn.00461430
push edi
push eax
lea eax, [esp + 0x2c]
mov byte [esp + 0x44], 3
push eax
call fcn.004613a0
push str.__r_n_
push eax
lea eax, [esp + 0x5c]
mov byte [esp + 0x50], 4
push eax
call fcn.00461430
add esp, 0x24
push eax
mov ecx, ebx
mov byte [esp + 0x34], 5
call dword [sym.imp.Qt5Core.dll_public:_class_QByteArray____thiscall_QByteArray::append_class_QByteArray_const__]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 4
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 3
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 2
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 1
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
mov ecx, esi
call dword [sym.imp.Qt5Core.dll_public:_struct_QMapNodeBase_const____thiscall_QMapNodeBase::nextNode_void_const]
mov ecx, dword [ebp]
mov esi, eax
add ecx, 8
cmp esi, ecx
jne 0x461550
mov eax, ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x461ca0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov eax, dword [ecx]
xor esi, esi
push edi
xor edi, edi
mov edx, dword [eax + 4]
mov eax, dword [ebp]
mov dword [esp + 0xc], edx
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
test eax, eax
je 0x461d1a
push ebx
lea ebx, [ebx]
cmp esi, edx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edi
sbb eax, eax
mov dword [esp + 0x1c], ebp
and esi, eax
mov dword [esp + 0x20], edi
push esi
call dword [sym.imp.Qt5Core.dll_public:_char___thiscall_QByteArray::operator___unsigned_int_const]
lea ecx, [esp + 0x14]
mov bl, al
call dword [sym.imp.Qt5Core.dll_public:_char___thiscall_QByteRef::operator_char_void_const]
xor bl, al
lea ecx, [esp + 0x1c]
movzx eax, bl
push eax
call dword [sym.imp.Qt5Core.dll_public:_class_QByteRef____thiscall_QByteRef::operator_char_]
mov ecx, dword [esp + 0x2c]
inc edi
mov edx, dword [esp + 0x10]
inc esi
cmp edi, dword [esp + 0x28]
jb 0x461cd0
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 8
Function at 0x463770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4931d9
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x64468c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
push 6
push str.Volume
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [esp + 8], eax
push dword [esp + 0x34]
lea eax, [esp + 0x1c]
mov dword [esp + 0x30], 0
push eax
lea ecx, [esi + 0x2c]
call fcn.00460820
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 1
push ecx
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call fcn.00460790
push dword [esp + 0x38]
mov ecx, eax
mov byte [esp + 0x30], 2
call fcn.00460670
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
mov dword [esp + 0xc], vtable.JKey.0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x18], vtable.JKey.0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov eax, dword [esi + 0x38]
test eax, eax
jle 0x463839
push eax
mov ecx, esi
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QObject::killTimer_int_]
push 1
push 0x3e8
mov ecx, esi
call dword [sym.imp.Qt5Core.dll_public:_int___thiscall_QObject::startTimer_int__enum_Qt::TimerType_]
mov dword [esi + 0x38], eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 8
Function at 0x4653e0
Capabilities:
Access peb ldr_data
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49372d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x64468c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 1
push 0x49eec4
mov dword [esp + 0x24], 0
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
mov dword [esp + 0x10], eax
push 1
push 0x49cb60
mov byte [esp + 0x2c], 1
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 0x10
mov dword [esp + 4], eax
push 1
lea eax, [esp + 0xc]
mov byte [esp + 0x20], 2
push eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
call dword [sym.imp.Qt5Core.dll_public:_class_QString____thiscall_QString::replace_class_QString_const___class_QString_const___enum_Qt::CaseSensitivity_]
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
lea ecx, [esp + 4]
mov byte [esp + 0x1c], 4
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 5
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push str.GB18030
call dword [sym.imp.Qt5Core.dll_public:_static_class_QTextCodec____cdecl_QTextCodec::codecForName_char_const__]
add esp, 4
mov ecx, eax
call dword [sym.imp.Qt5Core.dll_public:_class_QByteArray___thiscall_QTextCodec::fromUnicode_class_QString_const__]
push 0xa
push 0
mov ecx, eax
mov byte [esp + 0x24], 6
call dword [sym.imp.Qt5Core.dll_public:_char_const____thiscall_QByteArray::constData_void_const]
push eax
push str.explorer
push 0x49eedc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 5
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret 4
Function at 0x465500
Capabilities:
Access peb ldr_data
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49372d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x64468c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 1
push 0x49eec4
mov dword [esp + 0x24], 0
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
mov dword [esp + 0x10], eax
push 1
push 0x49cb60
mov byte [esp + 0x2c], 1
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 0x10
mov dword [esp + 4], eax
push 1
lea eax, [esp + 0xc]
mov byte [esp + 0x20], 2
push eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
call dword [sym.imp.Qt5Core.dll_public:_class_QString____thiscall_QString::replace_class_QString_const___class_QString_const___enum_Qt::CaseSensitivity_]
push eax
lea eax, [esp + 0x10]
push str._select_
push eax
call fcn.00426170
add esp, 0xc
lea ecx, [esp + 4]
mov byte [esp + 0x1c], 4
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 5
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push str.GB18030
call dword [sym.imp.Qt5Core.dll_public:_static_class_QTextCodec____cdecl_QTextCodec::codecForName_char_const__]
add esp, 4
mov ecx, eax
call dword [sym.imp.Qt5Core.dll_public:_class_QByteArray___thiscall_QTextCodec::fromUnicode_class_QString_const__]
push 0xa
push 0
mov ecx, eax
mov byte [esp + 0x24], 6
call dword [sym.imp.Qt5Core.dll_public:_char_const____thiscall_QByteArray::constData_void_const]
push eax
push str.explorer
push 0x49eedc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 5
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret 4