joyce8/EMBER2024-capa huggingface dataset:
Function at 0x670747c0
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x672bfab0]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp dword [rcx + 0xc], 0
mov rbx, rcx
jne 0x67074886
mov ecx, dword [rcx + 8]
lea r8, [rsp + 0x20]
mov r9d, 8
mov edx, 0x1014
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x6707481e
mov dword [rbx + 0xc], 3
mov eax, 3
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.671623b0
add rsp, 0x50
pop rbx
ret
movzx eax, word [rsp + 0x20]
cmp ax, 0x31
jne 0x67074832
mov dword [rbx + 0xc], 3
jmp 0x67074886
cmp ax, 0x30
jne 0x67074841
mov dword [rbx + 0xc], 1
jmp 0x67074886
cmp ax, 0x32
jne 0x67074850
mov dword [rbx + 0xc], 2
jmp 0x67074886
mov ecx, dword [rbx + 8]
mov r9d, 0xb
lea r8, [rsp + 0x30]
lea edx, [r9 + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x670747ff
movzx ecx, word [rsp + 0x30]
movzx eax, word [rsp + 0x20]
xor edx, edx
add ecx, 2
cmp eax, ecx
setne dl
add edx, 2
mov dword [rbx + 0xc], edx
mov eax, dword [rbx + 0xc]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.671623b0
add rsp, 0x50
pop rbx
ret

Function at 0x67074930
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rdx
mov dword [rsp + 0x40], 0
mov r9d, 2
lea r8, [rsp + 0x40]
lea edx, [r9 + 0xb]
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x670749d6
or r8d, 0xffffffff
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call sym.QtCoreVBox4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_unsigned_short_int_const____ptr64__int_
nop
lea rax, [0x671e8f18]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call sym.QtCoreVBox4.dll_public:_bool___cdecl_QString::operator_class_QLatin1String_const____ptr64_const___ptr64
test al, al
je 0x670749c2
mov edx, 1
mov rcx, rdi
call sym.QtCoreVBox4.dll_public:_void___cdecl_QVariant::constructor_int____ptr64
nop
mov rax, qword [rsp + 0x50]
lock dec dword [rax]
jne 0x670749e0
mov rcx, qword [rsp + 0x50]
call sym.QtCoreVBox4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data____ptr64_
jmp 0x670749e0
mov rax, qword [rsp + 0x50]
lock dec dword [rax]
jne 0x670749d6
mov rcx, qword [rsp + 0x50]
call sym.QtCoreVBox4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data____ptr64_
xor edx, edx
mov rcx, rdi
call sym.QtCoreVBox4.dll_public:_void___cdecl_QVariant::constructor_int____ptr64
mov rax, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x670749f0
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rax, qword [0x672bfab0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea r9d, [rbx + 0xf]
lea r8, [rsp + 0x30]
lea edx, [rbx + 0x28]
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x67074a6e
or r8d, 0xffffffff
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call sym.QtCoreVBox4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_unsigned_short_int_const____ptr64__int_
nop
mov rdx, rax
mov rcx, rdi
call sym.QtCoreVBox4.dll_public:_void___cdecl_QVariant::constructor_class_QString_const____ptr64____ptr64
nop
mov rcx, qword [rsp + 0x20]
lock dec dword [rcx]
jne 0x67074a78
mov rcx, qword [rsp + 0x20]
call sym.QtCoreVBox4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data____ptr64_
jmp 0x67074a78
mov dword [rdi + 8], 0x80000000
mov qword [rdi], rbx
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.671623b0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x67074aa0
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rax, qword [0x672bfab0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea r9d, [rbx + 0xf]
lea r8, [rsp + 0x30]
lea edx, [rbx + 0x29]
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x67074b1e
or r8d, 0xffffffff
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call sym.QtCoreVBox4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_unsigned_short_int_const____ptr64__int_
nop
mov rdx, rax
mov rcx, rdi
call sym.QtCoreVBox4.dll_public:_void___cdecl_QVariant::constructor_class_QString_const____ptr64____ptr64
nop
mov rcx, qword [rsp + 0x20]
lock dec dword [rcx]
jne 0x67074b28
mov rcx, qword [rsp + 0x20]
call sym.QtCoreVBox4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data____ptr64_
jmp 0x67074b28
mov dword [rdi + 8], 0x80000000
mov qword [rdi], rbx
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.671623b0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x67074b50
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rax, qword [0x672bfab0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov dword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x30]
mov edx, 0x100c
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x67074bdf
or r8d, 0xffffffff
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call sym.QtCoreVBox4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_unsigned_short_int_const____ptr64__int_
nop
xor edx, edx
lea r8d, [rdx + 0xa]
mov rcx, rax
call sym.QtCoreVBox4.dll_public:_unsigned_int___cdecl_QString::toUInt_bool____ptr64__int_const___ptr64
lea edx, [rax + 1]
mov rcx, rdi
call sym.QtCoreVBox4.dll_public:_void___cdecl_QVariant::constructor_unsigned_int____ptr64
nop
mov rcx, qword [rsp + 0x20]
lock dec dword [rcx]
jne 0x67074bec
mov rcx, qword [rsp + 0x20]
call sym.QtCoreVBox4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data____ptr64_
jmp 0x67074bec
mov edx, 1
mov rcx, rdi
call sym.QtCoreVBox4.dll_public:_void___cdecl_QVariant::constructor_int____ptr64
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.671623b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x67074c10
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov qword [rbp + 0x37], 0xfffffffffffffffe
mov qword [rsp + 0x100], rbx
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov dword [rbp + 0x7f], 0
mov edx, 0x40
test r9d, r9d
cmovne edx, r9d
mov dword [rbp - 0x65], edx
cmp edx, 0x40
jle 0x67074c7d
movsxd rcx, edx
add rcx, rcx
call sym.QtCoreVBox4.dll_void____ptr64___cdecl_qMalloc_unsigned_long_long_unsigned___int64__
mov qword [rbp - 0x61], rax
test rax, rax
jne 0x67074c75
call sym.QtCoreVBox4.dll_void___cdecl_qBadAlloc_void_
mov rax, qword [rbp - 0x61]
mov edx, dword [rbp - 0x65]
mov dword [rbp - 0x69], edx
jmp 0x67074c8c
lea rax, [rbp - 0x59]
mov qword [rbp - 0x61], rax
mov dword [rbp - 0x69], 0x40
mov r9d, edx
mov r8, rax
mov edx, edi
mov ecx, dword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x67074cbe
lea rax, sym.QtCoreVBox4.dll_struct_QString::Data_QString::shared_null
mov qword [rbx], rax
lock inc dword [sym.QtCoreVBox4.dll_struct_QString::Data_QString::shared_null]
mov dword [rbp + 0x7f], 1
jmp 0x67074d64
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x67074d4d
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov ecx, dword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edx, eax
test eax, eax
jne 0x67074cfe
lea rax, sym.QtCoreVBox4.dll_struct_QString::Data_QString::shared_null
mov qword [rbx], rax
lock inc dword [sym.QtCoreVBox4.dll_struct_QString::Data_QString::shared_null]
mov dword [rbp + 0x7f], 1
jmp 0x67074d64
mov dword [rbp + 0x67], eax
lea rax, [rbp - 0x69]
lea rcx, [rbp + 0x67]
cmp edx, dword [rbp - 0x69]
cmovge rax, rcx
mov r8d, dword [rax]
lea rcx, [rbp - 0x69]
call fcn.670f0660
mov r9d, dword [rbp - 0x65]
mov r8, qword [rbp - 0x61]
mov edx, edi
mov ecx, dword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x67074d4d
lea rax, sym.QtCoreVBox4.dll_struct_QString::Data_QString::shared_null
mov qword [rbx], rax
lock inc dword [sym.QtCoreVBox4.dll_struct_QString::Data_QString::shared_null]
mov dword [rbp + 0x7f], 1
jmp 0x67074d64
or r8d, 0xffffffff
mov rdx, qword [rbp - 0x61]
mov rcx, rbx
call sym.QtCoreVBox4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_unsigned_short_int_const____ptr64__int_
mov dword [rbp + 0x7f], 1
lea rax, [rbp - 0x59]
mov rcx, qword [rbp - 0x61]
cmp rcx, rax
je 0x67074d76
call sym.QtCoreVBox4.dll_void___cdecl_qFree_void____ptr64_
mov rax, rbx
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x67076340
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0x250
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x270], rbx
mov rax, qword [0x672bfab0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, edx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x20], 0
lea rcx, sym.QtCoreVBox4.dll_struct_QString::Data_QString::shared_null
mov qword [rdi], rcx
lock inc dword [sym.QtCoreVBox4.dll_struct_QString::Data_QString::shared_null]
mov dword [rsp + 0x20], 1
mov r9d, 0xff
lea r8, [rsp + 0x40]
mov edx, 0x5a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x670763e6
or r8d, 0xffffffff
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call sym.QtCoreVBox4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_unsigned_short_int_const____ptr64__int_
mov rdx, qword [rdi]
mov rcx, qword [rax]
mov qword [rdi], rcx
mov qword [rax], rdx
mov rcx, qword [rsp + 0x28]
lock dec dword [rcx]
jne 0x670763e6
mov rcx, qword [rsp + 0x28]
call sym.QtCoreVBox4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data____ptr64_
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.671623b0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x670784e0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x118
mov rax, qword [0x672bfab0]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r10d, r8d
mov r11d, edx
mov r9d, ecx
test r8d, r8d
jle 0x67078680
mov ecx, 1
mov dword [rsp], 0xedb88320
mov eax, ecx
nop dword [rax]
mov dword [rsp + rax*4], ecx
inc rax
add ecx, ecx
cmp rax, 0x20
jl 0x67078520
xor r8d, r8d
mov eax, dword [rsp + r8]
xor edx, edx
lea rcx, [rsp]
test eax, eax
je 0x6707854e
nop
test al, 1
je 0x67078546
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x67078540
mov dword [rsp + r8 + 0x80], edx
add r8, 4
cmp r8, 0x80
jl 0x67078531
xor r8d, r8d
mov eax, dword [rsp + r8 + 0x80]
xor edx, edx
lea rcx, [rsp + 0x80]
test eax, eax
je 0x6707858e
nop dword [rax]
test al, 1
je 0x67078586
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x67078580
mov dword [rsp + r8], edx
add r8, 4
cmp r8, 0x80
jl 0x67078566
nop
xor r8d, r8d
nop word [rax + rax]
mov eax, dword [rsp + r8]
xor edx, edx
lea rcx, [rsp]
test eax, eax
je 0x670785ce
nop
test al, 1
je 0x670785c6
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x670785c0
mov dword [rsp + r8 + 0x80], edx
add r8, 4
cmp r8, 0x80
jl 0x670785b0
test r10b, 1
je 0x6707860c
xor ecx, ecx
lea rax, [rsp + 0x80]
test r9d, r9d
je 0x67078609
test r9b, 1
je 0x67078600
xor ecx, dword [rax]
add rax, 4
shr r9d, 1
jne 0x670785f8
mov r9d, ecx
sar r10d, 1
je 0x6707867d
xor r8d, r8d
mov eax, dword [rsp + r8 + 0x80]
xor edx, edx
lea rcx, [rsp + 0x80]
test eax, eax
je 0x6707863e
nop word [rax + rax]
test al, 1
je 0x67078636
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x67078630
mov dword [rsp + r8], edx
add r8, 4
cmp r8, 0x80
jl 0x67078614
test r10b, 1
je 0x67078674
xor ecx, ecx
lea rax, [rsp]
test r9d, r9d
je 0x67078671
test r9b, 1
je 0x67078668
xor ecx, dword [rax]
add rax, 4
shr r9d, 1
jne 0x67078660
mov r9d, ecx
sar r10d, 1
jne 0x670785a0
xor r9d, r11d
mov eax, r9d
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.671623b0
add rsp, 0x118
ret
jmp 0x670784e0
Function at 0x670786a0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x118
mov rax, qword [0x672bfab0]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r10d, r8d
mov r11d, edx
mov r9d, ecx
test r8d, r8d
jle 0x67078680
mov ecx, 1
mov dword [rsp], 0xedb88320
mov eax, ecx
nop dword [rax]
mov dword [rsp + rax*4], ecx
inc rax
add ecx, ecx
cmp rax, 0x20
jl 0x67078520
xor r8d, r8d
mov eax, dword [rsp + r8]
xor edx, edx
lea rcx, [rsp]
test eax, eax
je 0x6707854e
nop
test al, 1
je 0x67078546
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x67078540
mov dword [rsp + r8 + 0x80], edx
add r8, 4
cmp r8, 0x80
jl 0x67078531
xor r8d, r8d
mov eax, dword [rsp + r8 + 0x80]
xor edx, edx
lea rcx, [rsp + 0x80]
test eax, eax
je 0x6707858e
nop dword [rax]
test al, 1
je 0x67078586
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x67078580
mov dword [rsp + r8], edx
add r8, 4
cmp r8, 0x80
jl 0x67078566
nop
xor r8d, r8d
nop word [rax + rax]
mov eax, dword [rsp + r8]
xor edx, edx
lea rcx, [rsp]
test eax, eax
je 0x670785ce
nop
test al, 1
je 0x670785c6
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x670785c0
mov dword [rsp + r8 + 0x80], edx
add r8, 4
cmp r8, 0x80
jl 0x670785b0
test r10b, 1
je 0x6707860c
xor ecx, ecx
lea rax, [rsp + 0x80]
test r9d, r9d
je 0x67078609
test r9b, 1
je 0x67078600
xor ecx, dword [rax]
add rax, 4
shr r9d, 1
jne 0x670785f8
mov r9d, ecx
sar r10d, 1
je 0x6707867d
xor r8d, r8d
mov eax, dword [rsp + r8 + 0x80]
xor edx, edx
lea rcx, [rsp + 0x80]
test eax, eax
je 0x6707863e
nop word [rax + rax]
test al, 1
je 0x67078636
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x67078630
mov dword [rsp + r8], edx
add r8, 4
cmp r8, 0x80
jl 0x67078614
test r10b, 1
je 0x67078674
xor ecx, ecx
lea rax, [rsp]
test r9d, r9d
je 0x67078671
test r9b, 1
je 0x67078668
xor ecx, dword [rax]
add rax, 4
shr r9d, 1
jne 0x67078660
mov r9d, ecx
sar r10d, 1
jne 0x670785a0
xor r9d, r11d
mov eax, r9d
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.671623b0
add rsp, 0x118
ret
jmp 0x670784e0
Function at 0x670786c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
mov r12d, r8d
test rcx, rcx
je 0x670787e2
mov rbx, qword [rcx + 0x28]
test rbx, rbx
je 0x670787e2
test rdx, rdx
je 0x670787e2
mov eax, dword [rbx + 0x2c]
cmp eax, 2
je 0x670787e2
cmp eax, 1
jne 0x67078720
cmp dword [rbx + 8], 0x2a
jne 0x670787e2
cmp eax, 0
je 0x67078730
mov ecx, dword [rcx + 0x4c]
call sym.QtCoreVBox4.dll_adler32
mov dword [rbp + 0x4c], eax
cmp edi, 3
jb 0x670787de
mov eax, dword [rbx + 0x44]
cmp edi, eax
jbe 0x6707874a
sub edi, eax
mov r12d, eax
mov eax, edi
add rsi, rax
mov rcx, qword [rbx + 0x50]
mov r8d, r12d
mov rdx, rsi
call sub.MSVCR100.dll_memcpy
mov rax, qword [rbx + 0x50]
mov ecx, dword [rbx + 0x80]
mov dword [rbx + 0x94], r12d
mov dword [rbx + 0x84], r12d
movzx edx, byte [rax]
mov dword [rbx + 0x70], edx
movzx eax, byte [rax + 1]
shl edx, cl
xor edx, eax
xor r9d, r9d
and edx, dword [rbx + 0x7c]
add r12d, 0xfffffffd
mov r10d, r9d
mov dword [rbx + 0x70], edx
nop
mov rax, qword [rbx + 0x50]
mov ecx, dword [rbx + 0x80]
mov edx, dword [rbx + 0x4c]
movzx r8d, byte [rax + r10 + 2]
mov eax, dword [rbx + 0x70]
and rdx, r10
shl eax, cl
mov rcx, qword [rbx + 0x60]
inc r10
xor r8d, eax
mov rax, qword [rbx + 0x68]
and r8d, dword [rbx + 0x7c]
mov dword [rbx + 0x70], r8d
movzx eax, word [rax + r8*2]
mov word [rcx + rdx*2], ax
mov ecx, dword [rbx + 0x70]
mov rax, qword [rbx + 0x68]
mov word [rax + rcx*2], r9w
inc r9d
cmp r9d, r12d
jbe 0x67078790
xor eax, eax
jmp 0x670787e7
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x67078f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
mov eax, dword [rdi + 0x44]
sub esi, dword [rdi + 0x9c]
lea ecx, [rbx + rax - 0x106]
sub esi, edx
cmp edx, ecx
jb 0x6707902f
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call sub.MSVCR100.dll_memcpy
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop dword [rax]
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, ebx
jb 0x67079000
sub eax, ebx
jmp 0x67079002
xor eax, eax
dec r8d
mov word [rdx], ax
jne 0x67078ff0
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, ebx
jb 0x67079024
sub eax, ebx
jmp 0x67079026
xor eax, eax
dec edx
mov word [rcx], ax
jne 0x67079014
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x6707911f
mov edx, dword [rdi + 0x9c]
mov eax, dword [rdi + 0x94]
mov r8d, esi
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.67078d30
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x67079097
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x670790ad
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x67078fa0
mov ecx, dword [rdi + 0x1718]
mov esi, dword [rdi + 0x58]
cmp ecx, esi
jae 0x6707911f
mov eax, dword [rdi + 0x94]
lea ebx, [r9 + rax]
cmp ecx, ebx
jae 0x670790f1
sub esi, ebx
mov eax, 0x102
mov ecx, ebx
cmp esi, eax
cmova esi, eax
add rcx, qword [rdi + 0x50]
xor edx, edx
mov r8d, esi
call sub.MSVCR100.dll_memset
lea r11d, [rsi + rbx]
mov dword [rdi + 0x1718], r11d
jmp 0x6707911f
lea eax, [rbx + 0x102]
cmp ecx, eax
jae 0x6707911f
sub ebx, ecx
sub esi, ecx
mov eax, 0x102
add ebx, eax
cmp ebx, esi
cmova ebx, esi
add rcx, qword [rdi + 0x50]
xor edx, edx
mov r8d, ebx
call sub.MSVCR100.dll_memset
add dword [rdi + 0x1718], ebx
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x6707b8c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, r9
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
mov dword [r9], 0
nop word [rax + rax]
mov edx, dword [rbx]
mov ecx, dword [rsi + 4]
mov r8d, edi
sub r8d, edx
add rdx, rbp
call qword [sym.imp.MSVCR100.dll__read]
test eax, eax
jle 0x6707b910
add dword [rbx], eax
cmp dword [rbx], edi
jb 0x6707b8f0
test eax, eax
jns 0x6707b933
call qword [sym.imp.MSVCR100.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.MSVCR100.dll_strerror]
or edx, 0xffffffff
mov rcx, rsi
mov r8, rax
call fcn.6707b230
or eax, 0xffffffff
jmp 0x6707b940
test eax, eax
jne 0x6707b93e
mov dword [rsi + 0x3c], 1
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x67099f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx edx, cx
mov ecx, 0x1f00
movzx eax, dx
xor ax, cx
mov ecx, 0x100
cmp ax, cx
jae 0x67099f6e
mov eax, 0x1f69
cmp dx, ax
ja 0x67099f4e
test dl, 6
jne 0x67099f4e
movzx eax, dx
add eax, 4
ret
mov eax, 0x1fbf
cmp dx, ax
jne 0x67099f5e
mov eax, 0x1fce
ret
mov eax, 0x1ffe
cmp dx, ax
jne 0x67099f6e
mov eax, 0x1fde
ret
lea rax, [0x671eebc0]
mov ecx, 0x391
nop word [rax + rax]
cmp cx, dx
je 0x67099f92
movzx ecx, word [rax + 6]
add rax, 4
test cx, cx
jne 0x67099f80
movzx eax, word [rax]
ret

Function at 0x670b32d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rdx, sym.QtCoreVBox4.dll_struct_QMetaObject_const_QProcess::staticMetaObject
xor r9d, r9d
xor r8d, r8d
jmp sym.QtCoreVBox4.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject____ptr64__struct_QMetaObject_const____ptr64__int__void____ptr64____ptr64_

Function at 0x670b3400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r9d, r9d
lea rdx, sym.QtCoreVBox4.dll_struct_QMetaObject_const_QProcess::staticMetaObject
lea r8d, [r9 + 5]
jmp sym.QtCoreVBox4.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject____ptr64__struct_QMetaObject_const____ptr64__int__void____ptr64____ptr64_

Function at 0x670b3420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r9d, r9d
lea rdx, sym.QtCoreVBox4.dll_struct_QMetaObject_const_QProcess::staticMetaObject
lea r8d, [r9 + 6]
jmp sym.QtCoreVBox4.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject____ptr64__struct_QMetaObject_const____ptr64__int__void____ptr64____ptr64_

Function at 0x670b3d60
Capabilities:
Enumerate gui resources

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x670e7a60

Function at 0x670b3d70
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
jmp fcn.670e7ab0
Function at 0x670dd2e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rsi, r8
mov r14, rdx
mov rbp, rcx
mov r15, qword [rcx + 0x18]
test r8, r8
js 0x670dd44d
xor ebx, ebx
cmp qword [rcx + 0x70], rbx
je 0x670dd3bd
mov r13b, 1
nop word [rax + rax]
mov r8, rsi
sub r8, rbx
lea rcx, [rbx + r14]
mov r9, qword [rbp + 0x70]
mov edx, 1
call qword [sym.imp.MSVCR100.dll_fread]
mov rdi, rax
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.MSVCR100.dll_feof]
test eax, eax
setne r12b
test r13b, r13b
je 0x670dd38a
test r12b, r12b
je 0x670dd38a
test rdi, rdi
jne 0x670dd38a
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.MSVCR100.dll__ftelli64]
mov rdx, rax
xor r8d, r8d
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.MSVCR100.dll__fseeki64]
xor r13b, r13b
jmp 0x670dd38d
add rbx, rdi
test r12b, r12b
jne 0x670dd48f
test rdi, rdi
jne 0x670dd3ab
call qword [sym.imp.MSVCR100.dll__errno]
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x670dd3b3
xor ecx, ecx
cmp rbx, rsi
setl cl
test ecx, ecx
jne 0x670dd330
jmp 0x670dd411
cmp dword [rcx + 0x98], 0xffffffff
je 0x670dd416
nop word [rax + rax]
mov r8d, esi
sub r8d, ebx
lea rdx, [rbx + r14]
mov ecx, dword [rbp + 0x98]
call qword [sym.imp.MSVCR100.dll__read]
movsxd rdi, eax
cmp edi, 0xffffffff
jne 0x670dd3fb
call qword [sym.imp.MSVCR100.dll__errno]
cmp dword [rax], 4
jne 0x670dd407
jmp 0x670dd3d0
test eax, eax
jle 0x670dd407
add rbx, rdi
cmp rbx, rsi
jl 0x670dd3d0
cmp edi, 0xffffffff
setne al
test al, al
jne 0x670dd48f
test rbx, rbx
jne 0x670dd48f
or rbx, 0xffffffffffffffff
call qword [sym.imp.MSVCR100.dll__errno]
mov edx, dword [rax]
lea rcx, [rsp + 0x70]
call sym.QtCoreVBox4.dll_class_QString___cdecl_qt_error_string_int_
nop
mov r8, rax
lea edx, [rbx + 2]
mov rcx, r15
call sym.QtCoreVBox4.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFile::FileError__class_QString_const____ptr64____ptr64
nop
mov rcx, qword [rsp + 0x70]
lock dec dword [rcx]
jne 0x670dd48f
mov rcx, qword [rsp + 0x70]
jmp 0x670dd48a
mov edx, 0x16
lea rcx, [rsp + 0x80]
call sym.QtCoreVBox4.dll_class_QString___cdecl_qt_error_string_int_
nop
mov r8, rax
mov edx, 1
mov rcx, r15
call sym.QtCoreVBox4.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFile::FileError__class_QString_const____ptr64____ptr64
nop
mov rcx, qword [rsp + 0x80]
or rbx, 0xffffffffffffffff
lock dec dword [rcx]
jne 0x670dd48f
mov rcx, qword [rsp + 0x80]
call sym.QtCoreVBox4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data____ptr64_
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret