joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67041aa0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, edx
mov dword [esp + 8], 0x10
mov eax, ecx
push esi
sub eax, ebp
push edi
mov dword [esp + 0x14], eax
nop dword [eax]
mov edi, dword [eax + ebp]
xor ecx, ecx
mov ebx, dword [eax + ebp + 4]
mov edx, edi
mov eax, ebx
shrd edx, eax, 0x10
xor edx, edi
and edx, 0xffff0000
mov eax, edx
shld ecx, eax, 0x10
shl eax, 0x10
xor ecx, 0
xor eax, edx
xor ebx, ecx
xor edi, eax
mov esi, ebx
mov edx, edi
shrd edx, esi, 8
shr esi, 8
xor edx, edi
xor esi, ebx
and edx, 0xff00
and esi, 0xff00
mov eax, edx
mov ecx, esi
shld ecx, eax, 8
xor ecx, esi
shl eax, 8
xor eax, edx
xor ebx, ecx
xor edi, eax
mov esi, ebx
mov edx, edi
shrd edx, esi, 4
shr esi, 4
xor edx, edi
xor esi, ebx
and edx, 0xf000f0
and esi, 0xf000f0
mov eax, edx
mov ecx, esi
shld ecx, eax, 4
xor ecx, esi
shl eax, 4
xor eax, edx
xor ebx, ecx
xor edi, eax
mov esi, ebx
mov edx, edi
shrd edx, esi, 2
shr esi, 2
xor edx, edi
xor esi, ebx
and edx, 0xc0c0c0c
and esi, 0xc0c0c0c
mov eax, edx
mov ecx, esi
shld ecx, eax, 2
xor ecx, esi
shl eax, 2
xor eax, edx
xor ebx, ecx
xor edi, eax
mov esi, ebx
mov edx, edi
shrd edx, esi, 1
shr esi, 1
xor edx, edi
xor esi, ebx
and edx, 0x22222222
and esi, 0x22222222
mov eax, edx
mov ecx, esi
shld ecx, eax, 1
add eax, eax
xor ecx, esi
xor eax, edx
xor eax, edi
xor ecx, ebx
mov dword [ebp], eax
mov dword [ebp + 4], ecx
sub dword [esp + 0x10], 1
lea ebp, [ebp + 8]
mov eax, dword [esp + 0x14]
jne 0x67041ac0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x67041bd0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ecx
cmp dword [esp + 8], 0
mov eax, ecx
push ebx
push ebp
push esi
push edi
mov ebp, edx
jbe 0x67041ce9
sub eax, ebp
mov dword [esp + 0x10], eax
nop word [eax + eax]
mov edi, dword [eax + ebp]
xor ecx, ecx
mov ebx, dword [eax + ebp + 4]
mov edx, edi
mov eax, ebx
shrd edx, eax, 0x10
xor edx, edi
and edx, 0xffff0000
mov eax, edx
shld ecx, eax, 0x10
shl eax, 0x10
xor ecx, 0
xor eax, edx
xor ebx, ecx
xor edi, eax
mov esi, ebx
mov edx, edi
shrd edx, esi, 8
shr esi, 8
xor edx, edi
xor esi, ebx
and edx, 0xff00
and esi, 0xff00
mov eax, edx
mov ecx, esi
shld ecx, eax, 8
xor ecx, esi
shl eax, 8
xor eax, edx
xor ebx, ecx
xor edi, eax
mov esi, ebx
mov edx, edi
shrd edx, esi, 4
shr esi, 4
xor edx, edi
xor esi, ebx
and edx, 0xf000f0
and esi, 0xf000f0
mov eax, edx
mov ecx, esi
shld ecx, eax, 4
xor ecx, esi
shl eax, 4
xor eax, edx
xor ebx, ecx
xor edi, eax
mov esi, ebx
mov edx, edi
shrd edx, esi, 2
shr esi, 2
xor edx, edi
xor esi, ebx
and edx, 0xc0c0c0c
and esi, 0xc0c0c0c
mov eax, edx
mov ecx, esi
shld ecx, eax, 2
xor ecx, esi
shl eax, 2
xor eax, edx
xor ebx, ecx
xor edi, eax
mov esi, ebx
mov edx, edi
shrd edx, esi, 1
shr esi, 1
xor edx, edi
xor esi, ebx
and edx, 0x22222222
and esi, 0x22222222
mov eax, edx
mov ecx, esi
shld ecx, eax, 1
add eax, eax
xor ecx, esi
xor eax, edx
xor eax, edi
xor ecx, ebx
mov dword [ebp], eax
mov dword [ebp + 4], ecx
sub dword [esp + 0x18], 1
lea ebp, [ebp + 8]
mov eax, dword [esp + 0x10]
jne 0x67041bf0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x67041d90
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x124
mov eax, dword [0x674c7008]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x2c], ebp
xor esi, esi
lea edx, [ebp + 0x2b]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
movzx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [esp + esi*4 + 0x30], ecx
inc esi
cmp esi, 0x10
jl 0x67041db3
lea eax, [esp + 0x68]
mov ebx, 0x30
nop dword [eax + eax]
mov edx, dword [eax - 0x34]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov edi, edx
mov ecx, edx
rol edi, 0xe
ror ecx, 7
xor edi, ecx
shr edx, 3
xor edi, edx
mov ecx, esi
mov edx, esi
rol ecx, 0xd
rol edx, 0xf
xor edx, ecx
shr esi, 0xa
xor edx, esi
add edi, edx
add edi, dword [eax - 0x3c]
add edi, dword [eax - 0x18]
mov dword [eax + 4], edi
sub ebx, 1
jne 0x67041df0
mov eax, dword [ebp]
mov edi, eax
mov edx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
xor ebp, ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0x24], eax
jmp 0x67041e69
mov edx, dword [esp + 0x14]
mov esi, ebx
mov eax, ebx
rol eax, 7
and edx, ebx
ror esi, 0xb
mov ecx, ebx
xor esi, eax
not ecx
and ecx, dword [esp + 0x18]
mov eax, ebx
ror eax, 6
xor ecx, edx
xor esi, eax
mov edx, edi
ror edx, 0xd
mov eax, edi
rol eax, 0xa
add esi, ecx
add esi, dword [ebp + 0x673f2e80]
xor edx, eax
add esi, dword [esp + ebp + 0x30]
mov eax, edi
add esi, dword [esp + 0x24]
add ebp, 4
ror eax, 2
xor edx, eax
mov eax, dword [esp + 0x1c]
mov ecx, eax
and eax, edi
xor ecx, edi
and ecx, dword [esp + 0x10]
xor ecx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
add edx, ecx
mov eax, dword [esp + 0x14]
mov ecx, edi
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], eax
lea edi, [edx + esi]
mov eax, dword [esp + 0x10]
add ebx, esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
cmp ebp, 0x100
jl 0x67041e65
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
add eax, edi
pop edi
add dword [ebp + 4], ecx
add dword [ebp + 0x10], ebx
mov ecx, dword [esp + 0x12c]
mov dword [ebp], eax
mov eax, dword [esp + 0xc]
add dword [ebp + 8], eax
mov eax, dword [esp + 0x1c]
add dword [ebp + 0xc], eax
mov eax, dword [esp + 0x10]
add dword [ebp + 0x14], eax
mov eax, dword [esp + 0x14]
add dword [ebp + 0x18], eax
mov eax, dword [esp + 0x20]
add dword [ebp + 0x1c], eax
xor eax, eax
pop esi
mov word [ebp + 0x28], ax
pop ebp
pop ebx
xor ecx, esp
call fcn.67284a63
add esp, 0x124
ret
Function at 0x670429c0
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax]
cmp edx, 0xe
ja case.default.0x670429d1
jmp dword [edx*4 + 0x67042bc0]
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
jmp case.default.0x670429d1
mov dword [eax + 0x10], 0x67452301
mov dword [eax + 0x14], 0xefcdab89
mov dword [eax + 0x18], 0x98badcfe
mov dword [eax + 0x1c], 0x10325476
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
jmp case.default.0x670429d1
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
jmp case.default.0x670429d1
lea ecx, [eax + 8]
test ecx, ecx
je case.default.0x670429d1
mov dword [ecx + 0x24], 0
xor eax, eax
mov dword [ecx + 0x20], 0
mov word [ecx + 0x28], ax
mov eax, dword [0x674ddb40]
mov dword [ecx], eax
mov eax, dword [0x674ddb44]
mov dword [ecx + 4], eax
mov eax, dword [0x674ddb48]
mov dword [ecx + 8], eax
mov eax, dword [0x674ddb4c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x674ddb50]
mov dword [ecx + 0x10], eax
mov eax, dword [0x674ddb54]
mov dword [ecx + 0x14], eax
mov eax, dword [0x674ddb58]
mov dword [ecx + 0x18], eax
mov eax, dword [0x674ddb5c]
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x6c], 0
mov dword [ecx + 0x70], 0
jmp case.default.0x670429d1
lea ecx, [eax + 8]
test ecx, ecx
je case.default.0x670429d1
mov dword [ecx + 0x24], 0
xor eax, eax
mov dword [ecx + 0x20], 0
mov word [ecx + 0x28], ax
mov eax, dword [0x674ddb60]
mov dword [ecx], eax
mov eax, dword [0x674ddb64]
mov dword [ecx + 4], eax
mov eax, dword [0x674ddb68]
mov dword [ecx + 8], eax
mov eax, dword [0x674ddb6c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x674ddb70]
mov dword [ecx + 0x10], eax
mov eax, dword [0x674ddb74]
mov dword [ecx + 0x14], eax
mov eax, dword [0x674ddb78]
mov dword [ecx + 0x18], eax
mov eax, dword [0x674ddb7c]
jmp 0x67042ac7
lea ecx, [eax + 8]
mov edx, 0x674ddb80
call fcn.67042150
jmp case.default.0x670429d1
lea ecx, [eax + 8]
mov edx, 0x674ddbc0
call fcn.67042150
jmp case.default.0x670429d1
push 0xe0
jmp 0x67042b72
push 0x100
jmp 0x67042b72
push 0x180
jmp 0x67042b72
push 0x200
add eax, 8
push eax
call fcn.67036c50
add esp, 8
mov esi, dword [esi]
add esi, 0x1a8
mov ecx, dword [esi]
mov eax, dword [ecx]
test eax, eax
je 0x67042ba2
cmp eax, 0xffffffff
je 0x67042bb5
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
setne al
test al, al
jne 0x67042bb5
mov eax, dword [esi]
cmp eax, 0x674c7cb4
je 0x67042bb5
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [esi], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
pop esi
pop ecx
ret
Function at 0x67055c70
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov ebp, edx
mov esi, ecx
mov edx, 0x40000000
xor ecx, ecx
mov dword [edi], 0
nop dword [eax]
mov eax, ebx
sub eax, ecx
cmp eax, 0x40000000
cmova eax, edx
push eax
lea eax, [ecx + ebp]
push eax
push dword [esi + 0x14]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
test eax, eax
jle 0x67055cc2
mov ecx, dword [edi]
mov edx, 0x40000000
add ecx, eax
mov dword [edi], ecx
cmp ecx, ebx
jb 0x67055c90
test eax, eax
jns 0x67055d9c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov ecx, dword [esi + 0x60]
add esp, 4
mov edi, eax
test ecx, ecx
je 0x67055cf9
cmp dword [esi + 0x5c], 0xfffffffc
je 0x67055cf2
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [esi + 0x60], 0
mov dword [esi], 0
mov dword [esi + 0x5c], 0xffffffff
test edi, edi
je 0x67055d94
mov ecx, dword [esi + 0x18]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x67055d14
sub ecx, edx
mov edx, edi
lea ebx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x67055d22
sub edx, ebx
lea eax, [edx + 3]
add eax, ecx
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov dword [esi + 0x60], ebx
test ebx, ebx
jne 0x67055d52
pop edi
mov dword [esi + 0x5c], 0xfffffffc
or eax, 0xffffffff
pop esi
pop ebp
pop ebx
ret
mov esi, dword [esi + 0x18]
mov ecx, esi
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x67055d60
sub ecx, edx
mov edx, edi
lea ebp, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x67055d70
push edi
sub edx, ebp
push 0x673f1908
push esi
push str._s_s_s
lea eax, [edx + 3]
add eax, ecx
push eax
push ebx
call fcn.67055270
add esp, 0x18
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
test eax, eax
jne 0x67055da7
mov dword [esi + 0x40], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x67061610
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6728a60d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x674c7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xa
lea ecx, [ebp - 0xd]
call fcn.670014c0
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QCoreApplication::applicationVersion_void_
add esp, 4
mov edi, eax
push 0x20
lea ecx, [ebp - 0xe]
mov dword [ebp - 4], 0
call fcn.670014c0
mov esi, eax
lea eax, [ebp - 0x18]
push eax
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QCoreApplication::applicationName_void_
push esi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.6701d3d0
push edi
mov edx, eax
lea ecx, [ebp - 0x2c]
call fcn.6701d3d0
push ebx
mov edx, eax
lea ecx, [ebp - 0x34]
call fcn.6701d3d0
add esp, 0x10
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.67062470
xor edx, edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.6705fb60
lea ecx, [ebp - 0x14]
call sym.Qt5Core.dll_public:_void___thiscall_QVector_class_QPoint_::destructor_void_
lea ecx, [ebp - 0x18]
call sym.Qt5Core.dll_public:_void___thiscall_QVector_class_QPoint_::destructor_void_
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call sym.Qt5Core.dll_public:_void___thiscall_QVector_class_QPoint_::destructor_void_
call sym.Qt5Core.dll_void___cdecl_qt_call_post_routines_void_
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x6706ea30
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6728ac04
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x674c7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x70
call fcn.67284a71
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
push 0x50f01
mov ecx, esi
mov dword [ebp - 4], 0
call sym.Qt5Core.dll_public:_void___thiscall_QObjectPrivate::constructor_int_
mov byte [ebp - 4], 1
lea ecx, [esi + 0x40]
mov dword [esi], vtable.QTimeLinePrivate.0
push 0x13
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0x80000000
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0x80000000
call sym.Qt5Core.dll_public:_void___thiscall_QEasingCurve::constructor_enum_QEasingCurve::Type_
push dword [ebp + 0xc]
mov ecx, edi
mov dword [esi + 0x44], 0
push esi
mov dword [esi + 0x48], 0x3e8
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0x28
mov dword [esi + 0x58], 1
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [ebp - 4], 0xffffffff
call sym.Qt5Core.dll_protected:_void___thiscall_QObject::constructor_class_QObjectPrivate___class_QObject__
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 2
mov ecx, dword [edi + 4]
mov dword [edi], vtable.QTimeLine.0
test eax, eax
jg 0x6706eb49
movaps xmm0, xmmword [0x6741d630]
lea eax, [ebp - 0x28]
push str.QTimeLine::setDuration:_cannot_set_duration___0
push eax
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x672aa80c
call sym.Qt5Core.dll_public:_void___cdecl_QMessageLogger::warning_char_const__const
add esp, 8
jmp 0x6706eb4c
mov dword [ecx + 0x48], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x67073df0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
mov ebx, edx
mov dword [esp + 0xc], ecx
push edi
xor edx, edx
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x14], edx
xor esi, esi
test ebx, ebx
jle 0x67073e4b
movsx edx, byte [esi + ecx]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
jbe 0x67073e35
lea ecx, [edx - 0x61]
cmp ecx, 0x19
ja 0x67073e2a
lea ecx, [edx - 0x47]
jmp 0x67073e35
lea ecx, [edx - 0x30]
cmp ecx, 9
ja 0x67073e57
lea ecx, [edx + 4]
cmp ecx, 0xffffffff
jne 0x67073ec8
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, ebx
jl 0x67073e11
mov edx, dword [esp + 0x14]
mov eax, edx
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, eax
and ecx, 1
cmp edx, 0x2b
jne 0x67073e6a
test ecx, ecx
jne 0x67073e81
lea ecx, [edx + 0x13]
jmp 0x67073ec8
cmp edx, 0x2d
jne 0x67073e78
test ecx, ecx
je 0x67073e81
lea ecx, [edx + 0x11]
jmp 0x67073ec8
cmp edx, 0x2f
jne 0x67073eba
test ecx, ecx
je 0x67073ec3
test al, 4
je 0x67073e3e
cmp edx, 0x3d
jne 0x67073f16
test bl, 3
jne 0x67073f07
lea ecx, [ebx - 1]
cmp esi, ecx
je 0x67073e3e
lea ecx, [ebx - 2]
cmp esi, ecx
jne 0x67073eab
mov ecx, dword [esp + 0x10]
inc esi
cmp byte [esi + ecx], dl
je 0x67073e42
mov edx, 3
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp edx, 0x5f
jne 0x67073e81
test ecx, ecx
je 0x67073e81
mov ecx, 0x3f
shl edi, 6
add ebp, 6
or edi, ecx
cmp ebp, 8
jl 0x67073e3e
mov eax, dword [esp + 0x1c]
sub ebp, 8
mov edx, edi
mov ecx, ebp
shr edx, cl
mov ecx, dword [esp + 0x14]
mov byte [ecx + eax], dl
inc ecx
mov eax, dword [esp + 0x20]
mov edx, 1
mov dword [esp + 0x14], ecx
mov ecx, ebp
shl edx, cl
dec edx
and edi, edx
jmp 0x67073e3e
mov edx, 1
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov edx, 2
xor eax, eax
pop ebx
add esp, 8
ret

Function at 0x6707ffdd
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x67080018
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x6707ffff
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x67080010
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x6708001a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x6707fff5
xor eax, eax
pop edi
pop esi
ret
Function at 0x67086c30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6728c6fb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x674c7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [ebp - 4], 0
mov dword [edi + 8], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [edi + 0x14], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [edi + 0x20], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [edi + 0x24], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [edi + 0x28], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dword [edi + 0x30], eax
cmp dword [esi + 4], 3
sete al
mov byte [edi + 0x34], al
cmp dword [esi + 4], 5
sete al
mov byte [edi + 0x35], al
mov dword [edi + 0x48], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [edi + 0x50], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [edi + 0x68], 0
mov dword [edi + 0x74], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov byte [ebp - 4], 9
call fcn.67087980
push dword [esi + 4]
lea eax, [ebp + 8]
push esi
push eax
call sym.Qt5Core.dll_class_QString___cdecl_qt_regexp_toCanonical_class_QString_const___enum_QRegExp::PatternSyntax_
add esp, 0xc
mov byte [ebp - 4], 0xa
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov esi, dword [eax + 4]
add ecx, eax
push esi
push ecx
mov ecx, edi
call fcn.6708bc80
cmp eax, esi
sete cl
mov byte [edi + 0x2e], cl
je 0x67086d15
push str.missing_left_delim
mov ecx, edi
mov byte [edi + 0x2d], 0
call fcn.6708b710
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
je 0x67086d35
cmp eax, 0xffffffff
je 0x67086d49
mov eax, dword [ebp + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x67086d49
mov eax, dword [ebp + 8]
cmp eax, 0x674c7cb4
je 0x67086d49
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x670896b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6728c8f5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x674c7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 4]
push 1
call fcn.6702d900
mov eax, dword [ebx]
lea ecx, [ebp - 0x24]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push esi
lea edi, [eax + 0x20]
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
call fcn.6708ef90
lea eax, [esi + 4]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp + 8], eax
call fcn.67028df0
mov eax, dword [esi + 8]
mov dword [ebp - 0x1c], eax
mov al, byte [esi + 0xc]
mov byte [ebp - 0x18], al
mov dword [ebp - 4], 1
mov ecx, dword [edi]
mov edx, dword [ecx + 8]
mov eax, dword [ecx + 4]
and edx, 0x7fffffff
mov ecx, dword [ecx]
inc eax
cmp ecx, 1
je 0x67089743
test ecx, ecx
jne 0x67089747
cmp eax, edx
jbe 0x6708976b
mov esi, dword [edi]
cmp edx, eax
sbb ecx, ecx
and ecx, 8
cmp eax, edx
jbe 0x6708975a
mov eax, dword [esi + 4]
inc eax
jmp 0x67089762
mov eax, dword [esi + 8]
and eax, 0x7fffffff
push ecx
push eax
mov ecx, edi
call fcn.6708fef0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
shl ecx, 4
add ecx, dword [eax + 0xc]
add ecx, eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ecx + 8], eax
mov al, byte [ebp - 0x18]
mov byte [ecx + 0xc], al
lea ecx, [ebp - 0x24]
mov eax, dword [edi]
mov dword [ebp - 0x20], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
inc dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
call fcn.670873e0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
or eax, 0x10000
push eax
call fcn.67087a00
lea edi, [ebx + 4]
mov esi, eax
push 0
mov ecx, edi
call fcn.67018f20
push edi
lea ecx, [ebx + 8]
mov dword [eax], esi
call fcn.6708ec20
push dword [ebp + 8]
lea ecx, [ebx + 0x34]
mov dword [ebx + 0x2c], 1
call fcn.6708ec20
mov dword [ebx + 0x30], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x670a7ba0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x2c
mov eax, dword [0x674c7008]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x670a7c51
push 8
lea eax, [esp + 8]
push eax
push 0x1014
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x670a7c49
mov ax, word [esp + 4]
cmp ax, 0x31
je 0x670a7c49
cmp ax, 0x30
jne 0x670a7c01
mov dword [esi + 4], 1
mov eax, 1
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.67284a63
add esp, 0x2c
ret
cmp ax, 0x32
je 0x670a7c2d
push 0xb
lea eax, [esp + 0x18]
push eax
push 0x13
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x670a7c49
movzx ecx, word [esp + 0x14]
movzx eax, word [esp + 4]
add ecx, 2
cmp eax, ecx
jne 0x670a7c49
mov dword [esi + 4], 2
mov eax, 2
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.67284a63
add esp, 0x2c
ret
mov eax, 3
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x2c]
pop esi
xor ecx, esp
call fcn.67284a63
add esp, 0x2c
ret