joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7ba50b36
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x15d62d43
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x98a68c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x98a6b3
call fcn.0092cbf8
mov dword [eax], esi
call fcn.0092cbe5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0092d83a
mov eax, esi
jmp 0x98a708
test dword [ebp + 0xc], 0xfffffff9
jne 0x98a699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x98a6e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0092cc0b
pop ecx
call fcn.0092cbe5
mov eax, dword [eax]
jmp 0x98a708
test al, 0x10
jne 0x98a706
test al, 1
je 0x98a706
test byte [ebp + 0xc], 2
je 0x98a706
call fcn.0092cbf8
mov dword [eax], 5
call fcn.0092cbe5
mov dword [eax], 0xd
jmp 0x98a6d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
mov ecx, 0x54e53b81
nop
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
mov eax, str.s0a
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x303314d1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0040eb78
push str._JAVA_LAUNCHER_DEBUG
mov eax, dword [eax]
mov dword [0x433680], eax
call fcn.0040ed74
xor ebp, ebp
pop ecx
test eax, eax
je 0x401059
push str.Windows_original_main_args:_n
call fcn.00401112
pop ecx
mov esi, ebp
call fcn.0040e6c7
cmp dword [eax], ebp
jle 0x401059
call fcn.0040e6cd
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00401112
add esp, 0xc
inc esi
call fcn.0040e6c7
cmp esi, dword [eax]
jl 0x401037
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.0040121d
call fcn.00401285
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call fcn.00401135
pop ecx
pop ecx
mov esi, eax
call fcn.0040128b
mov edx, ebp
test ebx, ebx
jle 0x401093
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, ebx
jl 0x401088
mov edi, dword [str.java]
mov dword [esi + edx*4], ebp
test edi, edi
jne 0x4010a2
mov edi, dword [esi]
mov edx, dword [section..data]
test edx, edx
jne 0x4010ae
mov edx, dword [esi]
mov ecx, dword [0x432990]
push ebp
xor ebp, ebp
inc ebp
test ecx, ecx
push ebp
push ebp
setne al
movzx eax, al
push eax
push edi
push edx
push 0x426274
push 0x426278
push dword [0x432994]
push ebp
push ecx
push ebp
push esi
push ebx
call fcn.00401d65
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x402640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x439959
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x2c]
push edi
lea ecx, [esp + 0x10]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_int_]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x20
mov dword [ecx], 0x10
mov ecx, dword [esi + 0x1c]
push eax
mov dword [esp + 0x30], 0
call dword [sym.imp.QtGui4.dll_public:_int___thiscall_QComboBox::findData_class_QVariant_const___int__class_QFlags_enum_Qt::MatchFlag__const]
mov ecx, dword [esi + 0x1c]
push eax
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QComboBox::setCurrentIndex_int_]
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
push edi
mov ecx, esi
call fcn.00402560
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 4

Function at 0x404440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x439e39
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esp + 0x38]
mov ecx, dword [esi + 0x60]
mov eax, dword [ecx]
mov eax, dword [eax + 0xa0]
push edx
lea edx, [esp + 0xc]
push edx
call eax
cmp dword [esp + 8], 0
mov dword [esp + 0x30], 0
jl 0x4044bd
cmp dword [esp + 0xc], 0
jl 0x4044bd
cmp dword [esp + 0x14], 0
je 0x4044bd
mov ecx, dword [esi + 0x64]
mov edx, dword [ecx]
mov edx, dword [edx + 0xa4]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
call edx
mov eax, dword [eax]
mov ecx, dword [esi + 0x38]
push eax
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QComboBox::setCurrentIndex_int_]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4
Function at 0x407660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43a602
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0xc], ebx
je 0x407701
call dword [sym.imp.QtCore4.dll_protected:_void___thiscall_QAbstractItemModel::beginResetModel_void_]
mov byte [esi + 8], bl
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x48], ebx
call eax
mov edi, eax
lea ecx, [esi + 0x10]
mov byte [esp + 0x38], 1
call fcn.00407320
push edi
mov ecx, esi
call fcn.004071e0
mov ecx, esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.QtCore4.dll_protected:_void___thiscall_QAbstractItemModel::endResetModel_void_]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x407720
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43a602
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
cmp dword [esi + 0xc], edi
je 0x4077b0
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
lea edx, [esp + 0x10]
push edx
push edi
push edi
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x48], edi
call eax
mov ebx, eax
lea ecx, [esi + 0x10]
mov byte [esp + 0x38], 1
call fcn.00407320
push ebx
mov ecx, esi
call fcn.004071e0
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov ecx, esi
call dword [sym.imp.QtCore4.dll_protected:_void___thiscall_QAbstractItemModel::endResetModel_void_]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x40d7b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x43b565
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x10], eax
or ecx, 0xffffffff
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QPersistentModelIndex::constructor_class_QModelIndex_const__]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esi + 0x20]
mov byte [esp + 0x3c], 2
call fcn.0040d140
mov ecx, eax
mov byte [esp + 0x30], 3
call dword [sym.imp.QtCore4.dll_public:_class_QModelIndex_const____thiscall_QPersistentModelIndex::operator_class_QModelIndex_const__void_const]
mov ecx, dword [eax]
mov esi, dword [esp + 0x38]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov edi, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QPersistentModelIndex::destructor_void_]
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], 1
mov byte [esp + 0x30], 2
call edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call edi
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 8
Function at 0x4103b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43bd73
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x2c]
push eax
lea ecx, [esp + 0x30]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
push 1
lea ecx, [esp + 0xc]
push ecx
push ecx
mov byte [esp + 0x18], 0x26
mov edx, dword [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x18], 0x445cec
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QChar::constructor_struct_QLatin1Char_]
lea ecx, [esp + 0x38]
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::replace_class_QChar__class_QLatin1String_const___enum_Qt::CaseSensitivity_]
mov esi, dword [esp + 0x28]
push eax
mov ecx, esi
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], 1
mov byte [esp + 0x20], 0
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x410458
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 8
Function at 0x414ad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4398f9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
sub edx, dword [eax + 8]
mov ecx, dword [esi + 4]
cmp ecx, edx
jge 0x414b2d
lea edx, [ecx + 1]
mov dword [esi + 4], edx
mov edx, dword [eax + 8]
add edx, ecx
lea eax, [eax + edx*4 + 0x14]
push eax
lea ecx, [esi + 0x30]
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_class_QString_const__]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
push 0
lea ecx, [esp + 0xc]
push str.Missing_filter_argument.
push ecx
call fcn.00414110
add esp, 0xc
push eax
lea ecx, [esi + 0x38]
mov dword [esp + 0x18], 0
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_class_QString_const__]
mov edx, dword [esp + 8]
mov dword [esp + 0x14], 0xffffffff
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x414b76
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x414b90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43c62a
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
call fcn.004143b0
mov esi, dword [esp + 0x30]
add esp, 4
push ebx
push eax
mov ecx, esi
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_int__enum_Qt::Initialization_]
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], 1
cmp eax, 1
jne 0x414bf9
mov eax, dword [esi]
lea ecx, [eax + 0x12]
cmp dword [eax + 0xc], ecx
je 0x414c01
mov ecx, esi
call dword [sym.imp.QtCore4.dll_private:_void___thiscall_QString::realloc_void_]
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ebx, dword [edi]
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x1c], eax
call fcn.004140b0
mov ebx, dword [ebx + 4]
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov ebp, dword [esp + 0x1c]
lea ebx, [ecx + ecx]
push ebx
push eax
push ebp
call sub.MSVCR90.dll_memcpy
mov ecx, dword [edi + 4]
lea eax, [esp + 0x28]
push eax
add ebp, ebx
push ecx
mov dword [esp + 0x30], ebp
call fcn.004140b0
add esp, 0x1c
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x414de0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43c6e9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x1c], esi
mov eax, dword [sym.imp.QtCore4.dll_struct_QListData::Data_QListData::shared_null]
mov dword [esi], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
xor ebx, ebx
mov dword [esi + 4], ebx
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esp + 0x28], ebx
mov dword [esi + 8], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esi + 0xc], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esi + 0x10], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
lea ecx, [esi + 0x14]
mov byte [esp + 0x28], 3
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QUrl::constructor_void_]
mov byte [esi + 0x18], bl
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esi + 0x30], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov byte [esi + 0x36], bl
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esi + 0x38], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
lea edi, [ebx + 1]
sub edx, ecx
cmp edx, edi
mov byte [esp + 0x28], 6
jle 0x414f40
lea ebx, [ebx]
add ecx, edi
lea ebp, [eax + ecx*4 + 0x14]
lea eax, [esp + 0x18]
push eax
mov ecx, ebp
call dword [sym.imp.QtCore4.dll_public:_class_QString___thiscall_QString::toLower_void_]
push str._quiet
mov ecx, eax
mov byte [esp + 0x2c], 7
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QString::operator_char_const__const]
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x17], al
mov byte [esp + 0x28], 6
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x414f19
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
add esp, 4
cmp byte [esp + 0x17], bl
je 0x414f25
mov byte [esi + 0x36], 1
jmp 0x414f2d
push ebp
mov ecx, esi
call fcn.0040d8b0
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
inc edi
sub edx, ecx
cmp edi, edx
jl 0x414ed0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x415de0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43c942
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x1c]
call dword [sym.imp.QtGui4.dll_public:_class_QPalette_const____thiscall_QWidget::palette_void_const]
push eax
lea ecx, [esp + 0xc]
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QPalette::constructor_class_QPalette_const__]
cmp byte [esp + 0x40], 0
mov dword [esp + 0x38], 0
je 0x415e37
push 3
lea ecx, [esp + 0x24]
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QColor::constructor_enum_Qt::GlobalColor_]
jmp 0x415e53
push 0xff
push 0x66
push 0x66
push 0xff
lea ecx, [esp + 0x20]
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QColor::setRgb_int__int__int__int_]
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x48]
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QBrush::constructor_class_QColor_const___enum_Qt::BrushStyle_]
push eax
push 9
push 0
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 1
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QPalette::setBrush_enum_QPalette::ColorGroup__enum_QPalette::ColorRole__class_QBrush_const__]
lea ecx, [esp + 0x40]
mov byte [esp + 0x38], 0
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QBrush::destructor_void_]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 8]
push eax
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QWidget::setPalette_class_QPalette_const__]
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QPalette::destructor_void_]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 4

Function at 0x417560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43cc9c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_void_]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 8]
push eax
push 0x4d0df8
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x44], 1
call dword [sym.imp.QtHelp4.dll_public:_class_QVariant___thiscall_QHelpEngineCore::customValue_class_QString_const___class_QVariant_const__]
mov esi, dword [esp + 0x40]
push esi
mov ecx, eax
mov byte [esp + 0x3c], 2
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray___thiscall_QVariant::toByteArray_void_]
mov edi, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 1
call edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call edi
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
Function at 0x417690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43cc9c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_void_]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 8]
push eax
push 0x4d0de8
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x44], 1
call dword [sym.imp.QtHelp4.dll_public:_class_QVariant___thiscall_QHelpEngineCore::customValue_class_QString_const___class_QVariant_const__]
mov esi, dword [esp + 0x40]
push esi
mov ecx, eax
mov byte [esp + 0x3c], 2
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray___thiscall_QVariant::toByteArray_void_]
mov edi, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 1
call edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call edi
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4

Function at 0x4177c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43cc9c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d0d8c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_void_]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 8]
push eax
push 0x4d0e04
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x44], 1
call dword [sym.imp.QtHelp4.dll_public:_class_QVariant___thiscall_QHelpEngineCore::customValue_class_QString_const___class_QVariant_const__]
mov esi, dword [esp + 0x40]
push esi
mov ecx, eax
mov byte [esp + 0x3c], 2
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray___thiscall_QVariant::toByteArray_void_]
mov edi, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 1
call edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call edi
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4