joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x1666c3d
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x36d118d0
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401c80
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4de8d9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
push str.SOFTWARENokiaLaunchApplication
lea ecx, [esp + 0x10]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_char_const__]
lea ecx, [esp + 8]
push ecx
push 0x2001f
push 0
mov ecx, eax
mov dword [esp + 0x24], 0
call dword [sym.imp.QtCore4.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
lea ecx, [esp + 0xc]
sete bl
mov dword [esp + 0x18], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
test bl, bl
je 0x401d29
mov ecx, dword [esp + 8]
xor edx, edx
cmp byte [esp + 0x20], dl
push 4
lea eax, [esp + 0x24]
push eax
push 4
sete dl
push 0
push 0x4f8088
push ecx
mov dword [esp + 0x38], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x14
ret 4

Function at 0x403530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d32cb
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QCoreApplication::translate_char_const___char_const___char_const___enum_QCoreApplication::Encoding_]
push 1
push str.Argument_is_the_UI_manufacturer_name__e.g.__Nokia_PC_Suite_
push str.__1_PC_Suite_
lea eax, [esp + 0x18]
push 0x4f82f8
push eax
call edi
add esp, 0x14
push eax
mov ecx, esi
mov dword [esp + 0x34], 0
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QWidget::setWindowTitle_class_QString_const__]
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
push 1
push str.Do_not_translate
push str.mainWindow
lea ecx, [esp + 0x1c]
push 0x4f82f8
push ecx
call edi
add esp, 0x14
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_class_QString_const__]
push eax
push str.themeRole
mov ecx, esi
mov byte [esp + 0x38], 2
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QObject::setProperty_char_const___class_QVariant_const__]
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x406ae0
Capabilities:
Create process on windows

Disassembly:
push ecx
push ecx
mov ecx, esp
mov dword [esp + 4], esp
push str.WebLinkEUR
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [esp + 4]
push eax
call fcn.004074a0
mov ecx, dword [esp]
mov edx, dword [ecx + 0xc]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
pop ecx
ret

Function at 0x406b20
Capabilities:
Create process on windows

Disassembly:
push ecx
push ecx
mov ecx, esp
mov dword [esp + 4], esp
push str.WebLinkUS
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [esp + 4]
push eax
call fcn.004074a0
mov ecx, dword [esp]
mov edx, dword [ecx + 0xc]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
pop ecx
ret

Function at 0x406b60
Capabilities:
Create process on windows

Disassembly:
push ecx
push ecx
mov ecx, esp
mov dword [esp + 4], esp
push str.WebLinkAPAC
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [esp + 4]
push eax
call fcn.004074a0
mov ecx, dword [esp]
mov edx, dword [ecx + 0xc]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
pop ecx
ret

Function at 0x406ba0
Capabilities:
Create process on windows

Disassembly:
push ecx
push ecx
mov ecx, esp
mov dword [esp + 4], esp
push str.WebLinkChina
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [esp + 4]
push eax
call fcn.004074a0
mov ecx, dword [esp]
mov edx, dword [ecx + 0xc]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
pop ecx
ret

Function at 0x406be0
Capabilities:
Create process on windows

Disassembly:
push ecx
push ecx
mov ecx, esp
mov dword [esp + 4], esp
push str.WebLinkLTA
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [esp + 4]
push eax
call fcn.004074a0
mov ecx, dword [esp]
mov edx, dword [ecx + 0xc]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
pop ecx
ret
Function at 0x406c20
Capabilities:
Create process on windows

Disassembly:
push ecx
push ecx
mov ecx, esp
mov dword [esp + 4], esp
push str.WebLinkFAQ
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [esp + 4]
push eax
call fcn.004074a0
mov ecx, dword [esp]
mov edx, dword [ecx + 0xc]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
pop ecx
ret

Function at 0x406c60
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e2169
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push str.WebLinkDISCUSSIONS
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [esp + 0xc]
push eax
call fcn.004074a0
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
call dword [sym.imp.QtCore4.dll_public:_class_QString___thiscall_QString::trimmed_void_]
mov edx, dword [eax]
cmp dword [edx + 8], 0
lea ecx, [esp + 0xc]
sete bl
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
test bl, bl
je 0x406cdd
push str.http:__discussions.europe.nokia.com_discussions_
lea ecx, [esp + 0xc]
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_char_const__]
mov eax, dword [esp + 8]
mov eax, dword [eax + 0xc]
push 5
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x14
ret

Function at 0x406d20
Capabilities:
Create process on windows

Disassembly:
push ecx
push ecx
mov ecx, esp
mov dword [esp + 4], esp
push str.SignUpLink
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [esp + 4]
push eax
call fcn.004074a0
mov ecx, dword [esp]
mov edx, dword [ecx + 0xc]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
pop ecx
ret
Function at 0x406d60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d8dc4
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea ecx, [esp + 0x2c]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_void_]
mov esi, eax
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x4c], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QSettings::constructor_class_QObject__]
push esi
push 0x571a38
lea ecx, [esp + 0x24]
push ecx
mov ecx, eax
mov byte [esp + 0x54], 1
call dword [sym.imp.QtCore4.dll_public:_class_QVariant___thiscall_QSettings::value_class_QString_const___class_QVariant_const__]
lea edx, [esp + 0xc]
push edx
mov ecx, eax
mov byte [esp + 0x4c], 2
call dword [sym.imp.QtCore4.dll_public:_class_QString___thiscall_QVariant::toString_void_]
mov byte [esp + 0x48], 4
mov esi, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [esp + 0x1c]
call esi
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 5
call dword [sym.imp.QtCore4.dll_public_virtual:_void___thiscall_QSettings::destructor_void_]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x48], 6
call esi
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
lea ecx, [esp + 0x10]
push ecx
push str.WebLinkTutorial_
push eax
call fcn.00402970
add esp, 0xc
lea edx, [esp + 0xc]
push edx
call fcn.004074a0
mov eax, dword [esp + 8]
mov eax, dword [eax + 0xc]
push 5
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 8]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0xc]
mov dword [esp + 0x48], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409c80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4d8af3
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
push ecx
mov eax, esp
mov dword [esp + 0xc], 0
mov dword [eax], 0
mov eax, dword [esp + 0x30]
add eax, 0x18
mov dword [esp + 0x10], esp
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.QtGui4.dll_public:_static_class_QPixmap___cdecl_QPixmap::fromImage_class_QImage_const___class_QFlags_enum_Qt::ImageConversionFlag__]
add esp, 0xc
push eax
mov ecx, esi
mov dword [esp + 0x28], 1
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QIcon::constructor_class_QPixmap_const__]
lea ecx, [esp + 0x10]
mov dword [esp + 8], 1
mov byte [esp + 0x24], 0
call dword [sym.imp.QtGui4.dll_public_virtual:_void___thiscall_QPixmap::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8

Function at 0x40a1b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d3101
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov dword [esp + 0x1c], 0
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esi], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
lea edi, [esi + 4]
mov dword [edi], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
lea ecx, [esi + 8]
mov dword [ecx], eax
mov edx, eax
mov eax, 1
lock xadd dword [edx], eax
mov edx, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
lea ebp, [esi + 0xc]
mov dword [ebp], edx
mov eax, edx
mov edx, 1
lock xadd dword [eax], edx
lea eax, [esp + 0x30]
mov byte [esp + 0x1c], 7
mov ebx, dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_class_QString_const__]
push eax
call ebx
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
call ebx
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call ebx
lea eax, [esp + 0x34]
push eax
mov ecx, ebp
call ebx
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x30]
mov byte [esp + 0x1c], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14
Function at 0x40b920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d8bed
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QProcess::constructor_class_QObject__]
push str.CommunicationCentre
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_char_const__]
push 0x4fa360
push eax
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x38], 2
call fcn.004029f0
lea ecx, [esp + 0x40]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x44], 3
call fcn.004028f0
add esp, 0x18
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 5
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 6
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.QtCore4.dll_public:_static_bool___cdecl_QProcess::startDetached_class_QString_const__]
add esp, 4
lea ecx, [esp + 0xc]
mov bl, al
mov byte [esp + 0x2c], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 0
call dword [sym.imp.QtCore4.dll_public_virtual:_void___thiscall_QProcess::destructor_void_]
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov al, bl
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x28
ret 4
Function at 0x40f620
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4d8af3
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
push ecx
mov eax, esp
mov dword [esp + 0xc], 0
mov dword [eax], 0
mov eax, dword [esp + 0x30]
add eax, 0x24
mov dword [esp + 0x10], esp
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.QtGui4.dll_public:_static_class_QPixmap___cdecl_QPixmap::fromImage_class_QImage_const___class_QFlags_enum_Qt::ImageConversionFlag__]
add esp, 0xc
push eax
mov ecx, esi
mov dword [esp + 0x28], 1
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QIcon::constructor_class_QPixmap_const__]
lea ecx, [esp + 0x10]
mov dword [esp + 8], 1
mov byte [esp + 0x24], 0
call dword [sym.imp.QtGui4.dll_public_virtual:_void___thiscall_QPixmap::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8

Function at 0x40f6b0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x4de5f2
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x28]
mov ebx, dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_class_QString_const__]
push edi
lea ecx, [esi + 0x54]
call ebx
lea eax, [edi + 4]
push eax
lea ecx, [esi + 0x58]
call ebx
lea ecx, [edi + 8]
push ecx
lea ecx, [esi + 0x5c]
call ebx
lea edx, [edi + 0xc]
push edx
lea ecx, [esi + 0x60]
call ebx
mov eax, dword [edi + 0x10]
lea edx, [esp + 0x28]
mov dword [esi + 0x64], eax
mov ecx, dword [edi + 0x14]
push edx
push edi
mov dword [esi + 0x68], ecx
call fcn.00409c80
mov dword [esp + 0x20], 0
mov ebx, dword [sym.imp.QtGui4.dll_public:_class_QIcon____thiscall_QIcon::operator_class_QIcon_const__]
push eax
lea ecx, [esi + 0x6c]
call ebx
mov dword [esp + 0x20], 0xffffffff
mov ebp, dword [sym.imp.QtGui4.dll_public:_void___thiscall_QIcon::destructor_void_]
lea ecx, [esp + 0x28]
call ebp
lea eax, [esp + 0x14]
push eax
push edi
call fcn.0040f620
push eax
lea ecx, [esi + 0x70]
mov dword [esp + 0x24], 1
call ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
call ebp
mov cl, byte [edi + 0x30]
mov byte [esi + 0x74], cl
mov dl, byte [edi + 0x31]
mov byte [esi + 0x75], dl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x40fb30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d2dcd
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esi], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
lea edi, [esi + 4]
mov dword [edi], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esi + 8], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esi + 0xc], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov byte [esp + 0x1c], 3
mov ebp, dword [sym.imp.QtGui4.dll_public:_void___thiscall_QImage::constructor_void_]
or eax, 0xffffffff
lea ecx, [esi + 0x18]
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
call ebp
lea ecx, [esi + 0x24]
mov byte [esp + 0x1c], 4
call ebp
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
lea ecx, [esi + 0x38]
mov dword [ecx], eax
mov edx, eax
mov eax, 1
lock xadd dword [edx], eax
mov edx, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
lea ebp, [esi + 0x3c]
mov dword [ebp], edx
mov eax, edx
mov edx, 1
lock xadd dword [eax], edx
mov byte [esp + 0x1c], 7
push 0x4f81e4
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_char_const__]
push 0x4f81e4
mov ecx, ebp
mov byte [esi + 0x32], bl
mov byte [esi + 0x33], bl
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov byte [esi + 0x36], 1
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_char_const__]
push 0x4f81e4
mov ecx, edi
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_char_const__]
mov byte [esi + 0x40], bl
mov dword [esi + 0x44], 0xd
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x4110d0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d8ab2
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
cmp dword [eax], edx
mov dword [esp + 8], edx
jl 0x4111a3
cmp dword [eax + 4], edx
jl 0x4111a3
cmp dword [eax + 0xc], edx
je 0x4111a3
mov eax, dword [eax + 8]
cmp eax, 0x64
je 0x4111a3
cmp eax, 0xc8
je 0x4111a3
or esi, 0xffffffff
cmp eax, edx
je 0x4111a6
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
cmp byte [eax + 0x32], dl
jne 0x411173
lea esi, [esp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edx
mov dword [esp + 0x30], edx
mov eax, dword [ecx]
push edx
mov edx, dword [eax + 0x2c]
push esi
call edx
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
lea esi, [esp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edx
mov dword [esp + 0x30], 1
mov eax, dword [ecx]
mov edx, dword [eax + 0x2c]
push 1
push esi
call edx
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
or esi, 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x412b90
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4de3a8
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56e01c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
mov ecx, dword [sym.imp.QtCore4.dll_struct_QMetaObject_const_QObject::staticMetaObject]
push ebp
call dword [sym.imp.QtCore4.dll_public:_class_QObject____thiscall_QMetaObject::cast_class_QObject__const]
push eax
mov ecx, esi
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QThread::constructor_class_QObject__]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 0
push eax
lea ecx, [esi + 8]
mov dword [esi], vtable.NGLApplicationListModelThread.0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov ecx, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
lea ebx, [esi + 0xc]
mov dword [ebx], ecx
mov edx, ecx
mov eax, 1
lock xadd dword [edx], eax
mov ecx, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
lea edi, [esi + 0x10]
mov dword [edi], ecx
mov edx, ecx
mov eax, 1
lock xadd dword [edx], eax
mov dword [esi + 0x14], ebp
mov ecx, dword [sym.imp.QtCore4.dll_struct_QMapData_QMapData::shared_null]
lea ebp, [esi + 0x18]
mov eax, ecx
mov dword [ebp], ecx
add eax, 0x34
mov edx, 1
lock xadd dword [eax], edx
mov byte [esp + 0x1c], 4
call fcn.004acdb0
mov edi, ebx
call fcn.004ace90
mov al, byte [esp + 0x30]
push ebp
mov byte [esi + 0x1c], al
call fcn.00416e60
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10