joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x409d7a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x409d89
pop dword [ebp - 0x20]
mov eax, 0x409d89
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x37994
push 0
mov eax, 0x2d3a7962
sub eax, 0x2cf99842
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x6a04f53f
sub ecx, 0x6a04b46e
xor edi, edi
add edi, eax
mov ebx, 0xe317933b
add ebx, 0x1d29e4c5
add ebx, dword [ebp - 0x20]
mov esi, 0xdc8a4d90
sub esi, 0xb8f122b
sub dword [ebp - 0x18], ebx
mov edx, dword [ebx]
xor edx, esi
sub dword [ebp - 4], ebx
mov dword [edi], edx
xor dword [ebp - 0x18], esi
add edi, 0x5955ff88
add edi, 0xa6aa007c
add ebx, 0x1e397020
add ebx, 0xe1c68fe4
loop 0x409de5
add eax, 0xb76b13c0
add eax, 0x4895e257
mov ebx, eax
add eax, 5
mov ecx, 0x408d7104
sub ecx, 0x404d7104
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40345b
pop dword [ebp - 8]
mov eax, 0xcca95b3c
add eax, 0x3396d91f
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x63e87c6b
sub dword [ebp - 0x18], 0x15963720
mov dword [ebp - 0x14], 0xc8c4fed6
sub dword [ebp - 0x14], 0x9691b291
mov dword [ebp - 0x10], 0x55e628b
sub dword [ebp - 0x10], 0xb9121e5d
mov dword [ebp - 0xc], 0xebb433a1
add dword [ebp - 0xc], 0x144bcc5f
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xb006cb0a
sub dword [ebp - 0x18], 0x3b9461b4
mov dword [ebp - 0x14], 0x50aa5b7b
add dword [ebp - 0x14], 0xf0c205fa
mov dword [ebp - 0x10], 0x717bc0ff
add dword [ebp - 0x10], 0xf1f3ab6d
mov dword [ebp - 0xc], 0xdef8f8e8
sub dword [ebp - 0xc], 0xdef8f8e8
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xe8b89624
sub eax, 0xe87855d4
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x36087
push 0
call eax
mov ecx, 0xa3756254
add ecx, 0x5c8ae258
xor ebx, ebx
add ebx, eax
mov esi, 0xf20e4b6e
add esi, 0xe323892
add esi, dword [ebp - 8]
mov edx, 0x94353962
sub dword [ebp - 4], ebx
mov edi, dword [esi]
add dword [ebp - 4], 0x213882cb
xor edi, edx
sub dword [ebp - 4], 0x653080fa
mov dword [ebx], edi
sub dword [ebp - 4], ecx
add ebx, 0x48d2a8a5
sub ebx, 0x48d2a8a1
add esi, 0x6a1e291
add esi, 0xf95e1d73
loop 0x403574
add eax, 0x55681015
add eax, 0xaa98f56e
xor ebx, ebx
add ebx, eax
add eax, 0x5454953
sub eax, 0x545494e
mov ecx, 0x84593a57
sub ecx, 0x84193a57
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x298072e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x29876b48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x29807306
xor eax, eax
jmp 0x298073c1
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x29807328
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x29807328
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x298073c1
cmp dword [esi + 0x4c], 0
je 0x298073bf
call fcn.29806a7d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x29807352
push dword [esi + 0x4c]
push eax
call fcn.2981e2c4
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x298073bf
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x298073bf
cmp eax, 1
jle 0x2980738d
cmp eax, 3
jne 0x298073bf
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x29807344
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x298073b1
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x298073bf
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x298073c1
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.29801cc0
leave
ret 4
Function at 0x29826d7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x29854690
call fcn.2985114e
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x29826f9e
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2981e2c4
add esp, 0x10
test eax, eax
js 0x29826f98
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x29826e21
push edi
call fcn.29827ddd
pop ecx
test al, al
je 0x29826e21
mov eax, edi
call fcn.29851670
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x29826e33
push edi
lea ecx, [ebp - 0x424]
call fcn.2981e2c4
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2981e2c4
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x29826f98
push 0x60
push ebx
push eax
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x29826e8b
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x29826e8b
call fcn.29825061
mov ebx, eax
jmp 0x29826f67
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x29826eb2
call fcn.29825061
jmp 0x29826f5a
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x29826ea8
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x29826ee5
mov ebx, 0x8007000e
jmp 0x29826f5c
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2981e2c4
jmp 0x29826f0b
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x29826ede
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2981e2c4
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2981e2c4
mov ebx, eax
test edi, edi
je 0x29826f67
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x29826f80
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826f90
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826f86
mov eax, ebx
jmp 0x29826fcc
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x29826fb3
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826fc3
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826fb9
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.29851106
ret 0x10
Function at 0x7813166c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
je 0x7813167e
xor eax, eax
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x7813167b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x781316b0
cmp eax, 0x20b
jne 0x7813167b
xor eax, eax
cmp dword [ecx + 0x84], 0xe
jbe 0x781316c1
cmp dword [ecx + 0xf8], eax
jmp 0x781316be
xor eax, eax
cmp dword [ecx + 0x74], 0xe
jbe 0x781316c1
cmp dword [ecx + 0xe8], eax
setne al
ret
Function at 0x7813480f
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
xor ebx, ebx
push ebx
push ebx
mov ebp, str.__MSVCRT_HEAP_SELECT
push ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call edi
mov esi, eax
cmp esi, ebx
je 0x78134961
push esi
push ebx
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x7813495f
push esi
push ebx
push ebp
call edi
test eax, eax
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
jbe 0x78134953
cmp eax, esi
ja 0x78134953
cmp byte [ebx], 0
mov ecx, ebx
je 0x78134889
mov al, byte [ecx]
cmp al, 0x61
jl 0x78134883
cmp al, 0x7a
jg 0x78134883
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x78134875
push 0x16
push ebx
push str.__GLOBAL_HEAP_SELECTED
call sym.MSVCR80.dll_memcpy
add esp, 0xc
test eax, eax
jne 0x781348a1
mov edi, ebx
jmp 0x781348fc
push 0x105
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x78134953
push 3
push esi
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
cmp byte [esi], 0
mov ecx, esi
je 0x781348e5
mov al, byte [ecx]
cmp al, 0x61
jl 0x781348df
cmp al, 0x7a
jg 0x781348df
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x781348d1
push esi
push ebx
call sym.MSVCR80.dll_strstr
pop ecx
pop ecx
push esi
push 0
mov edi, eax
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
test edi, edi
je 0x78134953
push 0x2c
push edi
call sym.MSVCR80.dll_strchr
test eax, eax
pop ecx
pop ecx
je 0x78134953
inc eax
cmp byte [eax], 0x20
je 0x7813490e
mov cl, byte [eax]
xor esi, esi
cmp cl, 0x30
jl 0x78134953
cmp cl, 0x39
jg 0x78134934
imul esi, esi, 0xa
movsx ecx, cl
inc eax
lea esi, [esi + ecx - 0x30]
mov cl, byte [eax]
cmp cl, 0x30
jge 0x7813491d
cmp esi, 2
je 0x78134943
cmp esi, 3
je 0x78134943
cmp esi, 1
jne 0x78134953
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov eax, esi
jmp 0x781349c1
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
call sym.MSVCR80.dll__get_osplatform
test eax, eax
pop ecx
je 0x7813497d
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
lea eax, [esp + 0x14]
push eax
call sym.MSVCR80.dll__get_winmajor
test eax, eax
pop ecx
je 0x78134999
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
cmp dword [esp + 0x10], 2
jne 0x781349ac
cmp dword [esp + 0x14], 5
jb 0x781349ac
xor eax, eax
inc eax
jmp 0x781349c1
lea eax, [esp + 0x18]
push eax
call fcn.781347e2
cmp byte [esp + 0x1c], 6
pop ecx
sbb eax, eax
add eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x78138894
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.MSVCR80.dll__invalid_parameter
Function at 0x78139847
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x781c19c8]
jne 0x78139851
repz ret
jmp sym.MSVCR80.dll___report_gsfailure

Function at 0x7815472c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154759
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll_memcpy
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78154735
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154788
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x781547af
test al, 1
je 0x781547af
test byte [esp + 0xc], 2
je 0x781547af
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x7815477f
xor eax, eax
pop esi
ret

Function at 0x78154a51
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154a7e
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll_memcpy
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154a9c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78154a79
test byte [esp + 0xc], 0x80
je 0x78154aa8
and eax, 0xfffffffe
jmp 0x78154aab
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
je 0x78154a8d
xor eax, eax
pop esi
ret

Function at 0x78155c9d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155cca
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll_memcpy
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78155ca6
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155cf9
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x78155d20
test al, 1
je 0x78155d20
test byte [esp + 0xc], 2
je 0x78155d20
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x78155cf0
xor eax, eax
pop esi
ret
Function at 0x78155e6a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155e97
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll_memcpy
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155eb5
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78155e92
test byte [esp + 0xc], 0x80
je 0x78155ec1
and eax, 0xfffffffe
jmp 0x78155ec4
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
je 0x78155ea6
xor eax, eax
pop esi
ret
Function at 0x410120
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
push esi
push edi
mov edi, ecx
nop dword [eax + eax]
mov al, byte [edi + 8]
test al, al
jne 0x410191
push 0x3e8
push str..pipeMBLG
call ebx
test eax, eax
jne 0x410152
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x410176
lea esi, [edi + 0x14]
mov ecx, esi
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QMutex::lock_void_]
push 0x7d0
push esi
lea ecx, [edi + 0x18]
call dword [sym.imp.Qt5Core.dll_public:_bool___thiscall_QWaitCondition::wait_class_QMutex___unsigned_long_int_]
mov ecx, esi
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QMutex::unlock_void_]
jmp 0x410130
lea ecx, [edi + 0xc]
call fcn.00408770
push 0
push 4
push 0x4fb0c8
push eax
call dword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x42ec10
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5689
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4fb00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
lea ecx, [ebx + 8]
call fcn.00408770
push str.EnableBFP
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call dword [sym.imp.Qt5Core.dll_public:_class_QVariant___thiscall_QObject::property_char_const__]
mov dword [ebp - 4], 0
mov ecx, eax
call dword [sym.imp.Qt5Core.dll_public:_bool___thiscall_QVariant::toBool_void_const]
mov byte [ebx + 0x30], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QVariant::destructor_void_]
mov ecx, dword [ebp - 0x10]
add ebx, 0x44
lea ecx, [ecx + 8]
lea edx, [ebx + 0xc]
lea esi, [ebx + 8]
lea edi, [ebx + 4]
call fcn.00408770
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x4cc1d8
push edx
push str.int
push esi
push str.int
push edi
push str.int
push ebx
push str.GetBFPSettings
push eax
call dword [sym.imp.Qt5Core.dll_public:_static_bool___cdecl_QMetaObject::invokeMethod_class_QObject___char_const___class_QGenericArgument__class_QGenericArgument__class_QGenericArgument__class_QGenericArgument__class_QGenericArgument__class_QGenericArgument__class_QGenericArgument__class_QGenericArgument__class_QGenericArgument__class_QGenericArgument_]
mov ebx, dword [ebp - 0x10]
add esp, 0x58
mov dword [ebp - 0x14], 0
lea ecx, [ebx + 8]
lea edx, [ebx + 0x40]
lea esi, [ebx + 0x3c]
lea edi, [ebx + 0x38]
call fcn.00408770
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.int
push edx
push str.int
push esi
push 0x4cc1d8
push edi
push str._BFPProtocolType
lea ecx, [ebp - 0x14]
push ecx
push str.GetBFPProtocolSettings
push eax
call dword [sym.imp.Qt5Core.dll_public:_static_bool___cdecl_QMetaObject::invokeMethod_class_QObject___char_const___class_QGenericArgument__class_QGenericArgument__class_QGenericArgument__class_QGenericArgument__class_QGenericArgument__class_QGenericArgument__class_QGenericArgument__class_QGenericArgument__class_QGenericArgument__class_QGenericArgument_]
add esp, 0x58
mov dword [ebx + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a979f
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push ebx
push esi
push edi
mov eax, dword [0x4fb00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x84]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QVariant::constructor_class_QString_const__]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
mov esi, dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QVariant::constructor_bool_]
push 1
call esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x64]
mov edi, dword [ebp + 8]
movzx eax, byte [edi + 0xd]
push eax
call esi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x54]
movzx eax, byte [edi + 0xc]
push eax
call esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x44]
mov esi, dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QVariant::constructor_int_]
push 1
call esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
push dword [edi + 8]
call esi
mov byte [ebp - 4], 7
lea eax, [edi + 4]
push eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QVariant::constructor_class_QDateTime_const__]
mov byte [ebp - 4], 8
lea ecx, [ebp + 0xc]
call fcn.00407d20
lea ecx, [ebp - 0xa4]
push ecx
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
mov ecx, eax
call edx
mov edx, eax
mov byte [ebp - 4], 9
lea ecx, [ebx + 0x10]
call fcn.00408770
mov esi, eax
lea ecx, [ebp + 8]
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004841b0
add esp, 0x18
lea eax, [ebp + 8]
push eax
push str.AddScheduledScanV4_IDispatch__QDateTime___ScheduleFrequency__int__bool__bool__bool__QString_
lea eax, [ebp - 0x94]
push eax
lea ecx, [esi + 8]
call fcn.00484430
mov ecx, dword [ebp + 8]
call fcn.00403ca0
test al, al
jne 0x43e441
push dword [ebp + 8]
call fcn.0041d650
mov esi, dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [ebp - 0x94]
call esi
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa4]
call esi
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x24]
call esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
call esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x44]
call esi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x54]
call esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x64]
call esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x84]
call esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00407cb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc