joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6713ece0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67269b7d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
mov eax, dword [0x674c412c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.67138570
add esp, 8
mov ecx, eax
mov dword [ebp - 4], 0
call sym.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
mov eax, dword [ebp - 0x10]
setne bl
mov eax, dword [eax]
test eax, eax
je 0x6713ed4f
cmp eax, 0xffffffff
je 0x6713ed5e
mov ecx, dword [ebp - 0x10]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
setne cl
test cl, cl
jne 0x6713ed5e
push 4
push 2
push dword [ebp - 0x10]
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData___unsigned_int__unsigned_int_
add esp, 0xc
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6713ee40
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6727cb35
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
mov eax, dword [0x674c412c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x50]
push 0x440000
push eax
push esi
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x44], 0xffffffff
call fcn.6713b600
mov eax, dword [ebp - 0x4c]
add esp, 0xc
test eax, 0x400000
je 0x6713ef56
test eax, 0x40000
je 0x6713ef56
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.671124e0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QDir::toNativeSeparators_class_QString_const__
add esp, 8
mov ecx, eax
mov byte [ebp - 4], 1
call sym.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
mov eax, dword [ebp - 0x10]
setne bl
or esi, 0xffffffff
mov eax, dword [eax]
test eax, eax
je 0x6713ef08
cmp eax, esi
je 0x6713ef17
mov eax, dword [ebp - 0x10]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x6713ef17
push 4
push 2
push dword [ebp - 0x10]
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData___unsigned_int__unsigned_int_
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
test eax, eax
je 0x6713ef34
cmp eax, 0xffffffff
je 0x6713ef43
mov eax, dword [ebp - 0x14]
lock xadd dword [eax], esi
dec esi
setne al
test al, al
jne 0x6713ef43
push 4
push 2
push dword [ebp - 0x14]
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData___unsigned_int__unsigned_int_
add esp, 0xc
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x67141820
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67273ebd
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x674c412c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov word [ebx + 0x35], 0x101
call fcn.67141b90
cmp byte [ebx + 0x36], 0
je 0x67141924
cmp byte [ebx + 0x35], 0
je 0x67141924
mov ecx, ebx
call fcn.67142080
cmp byte [ebx + 0x36], 0
je 0x67141924
cmp byte [ebx + 0x35], 0
je 0x67141924
lea esi, [ebx + 4]
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.67141940
mov edx, dword [ebx + 8]
add esp, 8
mov ecx, dword [eax]
mov dword [ebx + 8], ecx
lea ecx, [ebp - 0x14]
mov dword [eax], edx
call sym.Qt5Core.dll_public:_void___thiscall_QBitArray::destructor_void_
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
call ebx
mov edi, eax
lea eax, [ebp - 0x10]
push esi
push eax
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QDir::toNativeSeparators_class_QString_const__
add esp, 8
mov esi, dword [ebp - 0x18]
mov dword [ebp - 4], 0
lea ecx, [esi + 0x20]
push ecx
lea eax, [esi + 0x18]
push eax
lea eax, [esi + 0x28]
push eax
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
push edi
setne al
mov byte [esi + 0x35], al
call ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
test eax, eax
je 0x67141915
cmp eax, 0xffffffff
je 0x67141924
mov eax, dword [ebp - 0x10]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x67141924
push 4
push 2
push dword [ebp - 0x10]
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData___unsigned_int__unsigned_int_
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x67142960
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6726e09d
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x674c412c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x671429a7
mov edi, dword [ebp - 0x14]
jmp 0x671429ba
cmp byte [esi + 0x53], 0
jne 0x671429b8
mov ecx, esi
mov byte [esi + 0x53], 1
call sym.Qt5Core.dll_public:_void___thiscall_QWindowsPipeReader::pipeClosed_void_
xor edi, edi
mov eax, 0x1000
cmp edi, eax
cmovb edi, eax
cmp byte [esi + 0x53], 0
jne 0x67142aa4
mov ecx, dword [esi + 0x28]
mov eax, ecx
mov edx, dword [esi + 0x2c]
or eax, edx
je 0x67142a92
sub ecx, dword [esi + 0x38]
sbb edx, dword [esi + 0x3c]
xor eax, eax
cmp eax, edx
jl 0x67142a08
jg 0x671429f0
cmp edi, ecx
jbe 0x67142a08
mov edi, ecx
mov ecx, edx
test ecx, ecx
jl 0x67142aa4
jg 0x67142a06
test edi, edi
je 0x67142aa4
mov eax, ecx
push eax
lea ecx, [esi + 0x30]
push edi
call sym.Qt5Core.dll_public:_char____thiscall_QRingBuffer::reserve_long_long___int64__
push sym.Qt5Core.dll_private:_static_void___stdcall_QWindowsPipeReader::readFileCompleted_unsigned_long_int__unsigned_long_int__struct__OVERLAPPED__
lea ecx, [esi + 0xc]
mov word [esi + 0x50], 0x100
push ecx
push edi
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
push eax
mov dword [ecx + 0x10], 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x67142aa4
mov byte [esi + 0x51], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, edi
sub ecx, 0x6d
je 0x67142a99
sub ecx, 0x7c
je 0x67142a99
push 0x22
push str.QWindowsPipeReader::startAsyncRead
call sym.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromLatin1_helper_char_const___int_
add esp, 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push edi
mov ecx, esi
call sym.Qt5Core.dll_public:_void___thiscall_QWindowsPipeReader::winError_unsigned_long_int__class_QString_const__
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x67142a08
mov ecx, esi
mov byte [esi + 0x53], 1
call sym.Qt5Core.dll_public:_void___thiscall_QWindowsPipeReader::pipeClosed_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x671431d0
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
mov edi, ecx
cmp byte [edi + 0x31], 0
jne 0x67143243
push esi
push dword [esp + 0x10]
lea esi, [edi + 0xc]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
lea ecx, [edi + 0x24]
mov dword [esi + 0x10], 0
call fcn.670687f0
mov eax, dword [edi + 0x24]
push sym.Qt5Core.dll_private:_static_void___stdcall_QWindowsPipeWriter::writeFileCompleted_unsigned_long_int__unsigned_long_int__struct__OVERLAPPED__
push esi
mov word [edi + 0x30], 0x100
mov edx, dword [eax + 0xc]
push dword [eax + 4]
add edx, eax
push edx
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
pop esi
test eax, eax
jne 0x6714324a
lea ecx, [edi + 0x24]
mov byte [edi + 0x31], al
call sym.Qt5Core.dll_public:_void___thiscall_QByteArray::clear_void_
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
je 0x67143243
push str.QWindowsPipeWriter::write_failed.
push eax
call sym.Qt5Core.dll_void___cdecl_qErrnoWarning_int__char_const__
add esp, 8
pop edi
xor al, al
pop ebx
ret 4
pop edi
mov al, 1
pop ebx
ret 4
Function at 0x6717dbd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67280f6d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x674c412c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ecx + 4]
mov ecx, dword [ebx + 0x30]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 8]
je 0x6717dc5f
mov edi, dword [ebx + 0x20]
nop
inc dword [edi + 8]
mov edx, dword [edi + 8]
mov dword [ebp - 0x10], edi
mov ecx, dword [ebx + 0x30]
xor esi, esi
mov dword [ebp - 4], 0
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
test eax, eax
jle 0x6717dc59
mov eax, dword [ecx + 8]
add eax, esi
mov ecx, dword [ecx + eax*4 + 0x10]
test ecx, ecx
je 0x6717dc48
push dword [ebp + 0x10]
mov eax, dword [ecx]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x6717dc75
mov ecx, dword [ebx + 0x30]
inc esi
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
cmp esi, eax
jl 0x6717dc27
mov edx, dword [edi + 8]
lea eax, [edx - 1]
mov dword [edi + 8], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
dec dword [edi + 8]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x671c45c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
test eax, eax
je 0x671c462c
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push 0
push 0
push ecx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x671c462c
cmp dword [esp + 0xc], 4
jne 0x671c462c
mov dword [esp + 8], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 4
push eax
push 0
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 8]
test eax, eax
mov eax, dword [esp + 0x18]
sete dl
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], dl
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x18]
pop edi
pop esi
mov dword [eax], 0
mov byte [eax + 4], 0
add esp, 0xc
ret 0xc
Function at 0x671db550
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x672870fc
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x674c412c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
push 8
mov dword [ebp - 4], 0
call fcn.67267bfd
add esp, 4
mov dword [ebp - 0x14], eax
push 0
mov ecx, eax
mov byte [ebp - 4], 1
call sym.Qt5Core.dll_public:_void___thiscall_QBuffer::constructor_class_QObject__
mov esi, eax
mov byte [ebp - 4], 0
push 1
mov ecx, esi
call sym.Qt5Core.dll_public:_bool___thiscall_QObject::blockSignals_bool_
push dword [ebp + 8]
mov ecx, esi
call sym.Qt5Core.dll_public:_void___thiscall_QBuffer::setData_class_QByteArray_const__
mov ecx, dword [esi]
push ecx
mov eax, esp
mov edx, dword [ecx + 0x30]
mov ecx, esi
mov dword [eax], 1
call edx
mov dword [edi + 4], esi
mov eax, edi
mov word [edi + 8], 1
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0x13
mov dword [edi + 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x671db610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x672870fc
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x674c412c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
push 8
mov dword [ebp - 4], 0
call fcn.67267bfd
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push dword [ebp + 8]
mov ecx, eax
mov byte [ebp - 4], 1
call sym.Qt5Core.dll_public:_void___thiscall_QBuffer::constructor_class_QByteArray___class_QObject__
mov esi, eax
mov byte [ebp - 4], 0
push 1
mov ecx, esi
call sym.Qt5Core.dll_public:_bool___thiscall_QObject::blockSignals_bool_
mov edx, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
call dword [edx + 0x30]
mov dword [edi + 4], esi
mov eax, edi
mov word [edi + 8], 1
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0x13
mov dword [edi + 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x671f26e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67288ccb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x674c412c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x64
call fcn.67267bfd
add esp, 4
mov dword [ebp - 0x14], eax
push edi
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.671f28d0
mov esi, eax
mov dword [edi], esi
push 8
mov dword [ebp - 4], 1
call fcn.67267bfd
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push dword [ebp + 8]
mov ecx, eax
mov byte [ebp - 4], 2
call sym.Qt5Core.dll_public:_void___thiscall_QBuffer::constructor_class_QByteArray___class_QObject__
mov dword [esi + 0x2c], eax
mov byte [ebp - 4], 1
mov ecx, dword [eax]
push ecx
mov edx, dword [ecx + 0x30]
mov ecx, esp
mov dword [ecx], 2
mov ecx, eax
call edx
or dword [esi + 0x34], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x671f2800
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67288d04
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x674c412c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0x64
call fcn.67267bfd
add esp, 4
mov dword [ebp - 0x10], eax
push esi
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.671f28d0
mov ecx, dword [ebp + 8]
mov dword [esi], eax
mov dword [eax + 0x30], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x671f5200
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp esi, dword [esp + 0x10]
je 0x671f530b
mov eax, dword [esp + 0x14]
push ebx
sub eax, esi
push ebp
mov dword [esp + 0x1c], eax
push edi
nop dword [eax]
lea ecx, [eax + esi]
mov edi, esi
lea ebx, [ecx + 0xc]
mov dword [ecx], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
lea ebp, [ecx + 0x18]
mov dword [esp + 0x18], ecx
push edi
mov dword [esp + 0x14], edi
add esi, 0x38
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebx], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebp], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [ebp + 4], 0
mov dword [ebp + 8], 0
mov dword [ecx + 0x24], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
call fcn.6708b5d0
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
mov eax, dword [edi + 8]
add edi, 0xc
mov dword [ecx + 8], eax
mov ecx, ebx
push edi
call fcn.6708b5d0
mov eax, dword [edi + 4]
mov ecx, ebp
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov ebx, dword [esp + 0x10]
lea edi, [ebx + 0x18]
push edi
call fcn.6708b5d0
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 8]
lea edi, [ebx + 0x24]
mov dword [ebp + 8], eax
mov ebp, dword [esp + 0x18]
push edi
lea ecx, [ebp + 0x24]
call fcn.6708b5d0
mov eax, dword [edi + 4]
mov dword [ebp + 0x28], eax
mov eax, dword [edi + 8]
mov dword [ebp + 0x2c], eax
mov eax, ebx
mov eax, dword [eax + 0x34]
xor eax, dword [ebp + 0x34]
and eax, 1
xor dword [ebp + 0x34], eax
mov eax, dword [esp + 0x20]
cmp esi, dword [esp + 0x1c]
jne 0x671f5220
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret 0xc
Function at 0x671f6a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67288f1d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x674c412c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x48]
call sym.Qt5Core.dll_public:_void___thiscall_QXmlStreamAttribute::constructor_class_QXmlStreamAttribute_const__
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
test eax, eax
jns 0x671f6a8b
mov eax, dword [ebx]
mov eax, dword [eax + 4]
push eax
mov ecx, ebx
call sym.Qt5Core.dll_public:_void___thiscall_QVector_class_QXmlStreamAttribute_::resize_int_
mov edx, dword [ebx]
mov esi, dword [edx + 4]
test esi, esi
je 0x671f6b3c
mov ecx, dword [edx + 0xc]
lea eax, [ecx + edx]
mov dword [ebp + 8], eax
lea eax, [esi*8]
sub eax, esi
lea edi, [ecx + eax*8]
add edi, edx
lea eax, [ecx + edx]
cmp edi, eax
je 0x671f6b3c
mov ebx, dword [ebp + 8]
lea esi, [edi - 0x24]
lea eax, [ebp - 0x48]
push eax
lea ecx, [esi - 0x14]
call fcn.6708b5d0
mov eax, dword [ebp - 0x44]
lea ecx, [esi - 8]
mov dword [esi - 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [esi - 0xc], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.6708b5d0
mov eax, dword [ebp - 0x38]
lea ecx, [esi + 4]
mov dword [esi - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esi], eax
lea eax, [ebp - 0x30]
push eax
call fcn.6708b5d0
mov eax, dword [ebp - 0x2c]
lea ecx, [esi + 0x10]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call fcn.6708b5d0
mov eax, dword [ebp - 0x20]
lea esi, [esi - 0x38]
mov dword [esi + 0x4c], eax
sub edi, 0x38
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x58]
xor eax, dword [ebp - 0x14]
and eax, 1
xor dword [esi + 0x58], eax
cmp edi, ebx
jne 0x671f6ac4
mov ebx, dword [ebp - 0x10]
lea ecx, [ebp - 0x48]
call sym.Qt5Core.dll_public:_void___thiscall_QXmlStreamAttribute::destructor_void_
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x67207950
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6728991b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x674c412c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x1c
call fcn.67267bfd
mov esi, eax
mov dword [ebp - 0x14], esi
push 8
mov dword [ebp - 4], 0
call fcn.67267bfd
add esp, 8
mov dword [ebp - 0x18], eax
push 0
push dword [ebp + 8]
mov ecx, eax
mov byte [ebp - 4], 1
call sym.Qt5Core.dll_public:_void___thiscall_QBuffer::constructor_class_QByteArray___class_QObject__
mov dword [esi], eax
mov dword [esi + 0x14], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov byte [esi + 0x18], 0
mov dword [esi + 8], esi
mov dword [esi + 0xc], 2
mov dword [esi + 0x10], 1
mov dword [edi], esi
mov byte [esi + 0x18], 1
mov eax, dword [edi]
push 0x22
mov dword [ebp - 4], 2
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x672429e0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
push edi
mov edi, ecx
mov esi, edx
cmp esi, dword [edi + 0xc]
jb 0x67242a35
cmp esi, dword [edi + 4]
jae 0x67242a35
mov eax, dword [0x674ca284]
test eax, eax
jne 0x67242a11
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0xc]
dec eax
mov dword [0x674ca284], eax
not eax
mov ecx, eax
and eax, dword [edi + 8]
and ecx, esi
cmp ecx, eax
je 0x67242a50
jae 0x67242a3d
push 4
push 0x1000
sub eax, ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x67242a50
pop edi
xor eax, eax
pop esi
add esp, 0x24
ret
push 0x4000
sub ecx, eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x67242a35
mov dword [edi + 8], esi
mov eax, esi
pop edi
pop esi
add esp, 0x24
ret
Function at 0x6725f7c0
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x24
push ebx
push esi
push edi
cmp eax, 1
jb 0x6725f8ca
mov edi, dword [esp + 0x38]
cmp edi, 1
jb 0x6725f8ca
push dword [esp + 0x3c]
cmp eax, edi
mov ebx, edi
push 0x10
cmovbe ebx, eax
add ebx, 0x1fff
and ebx, 0xffffe000
call fcn.6722bef0
mov esi, eax
add esp, 8
test esi, esi
je 0x6725f8ca
push ebp
lea ebp, [edi + 0x1fff]
and ebp, 0xffffe000
cmp ebx, ebp
ja 0x6725f877
cmp ebx, 1
jb 0x6725f877
push dword [esi + 8]
mov eax, dword [esi]
push 0x10
call eax
mov edi, eax
add esp, 8
test edi, edi
je 0x6725f877
mov eax, dword [0x674ca284]
test eax, eax
jne 0x6725f851
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
dec eax
mov dword [0x674ca284], eax
add ebp, eax
not eax
push 4
push 0x2000
and ebp, eax
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x6725f894
push dword [esi + 8]
mov eax, dword [esi + 4]
push edi
call eax
add esp, 8
push dword [esi + 8]
mov eax, dword [esi + 4]
push esi
mov dword [esi + 0xc], 0
call eax
add esp, 8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret
lea edx, [eax + ebp]
mov dword [edi + 0xc], eax
mov dword [edi + 4], edx
mov ecx, edi
mov dword [edi + 8], edx
sub edx, ebx
call fcn.672429e0
test eax, eax
jne 0x6725f8b8
mov edx, esi
mov ecx, edi
call fcn.672429b0
jmp 0x6725f877
mov eax, dword [edi + 4]
mov dword [edi], eax
mov eax, esi
pop ebp
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
add esp, 0x24
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret