joyce8/EMBER2024-capa huggingface dataset:
Function at 0x670058c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6715cee9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x30]
mov byte [eax + 0x14], 0
mov ecx, dword [esp + 0x30]
mov ebx, 1
push 0x28
mov dword [esp + 0x28], ebx
call sym.QtCore_Ad_4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov ecx, dword [esp + 0x30]
cmp byte [ecx + 0x14], 0
je 0x6700591b
push 0x20
call sym.QtCore_Ad_4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov edi, dword [esp + 0x34]
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 8]
xor esi, esi
test ecx, ecx
jle 0x670059cf
test esi, esi
je 0x67005987
push 0xffffffffffffffff
lea edx, [esp + 0x38]
push 0x67162a34
push edx
call sym.QtCore_Ad_4.dll_public:_static_class_QString___cdecl_QString::fromAscii_char_const___int_
add esp, 0xc
mov ecx, dword [esp + 0x30]
push eax
mov byte [esp + 0x28], 2
call sym.QtCore_Ad_4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___class_QString_const__
mov eax, dword [esp + 0x34]
mov byte [esp + 0x24], bl
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x67005976
mov edx, dword [esp + 0x34]
push edx
call sym.QtCore_Ad_4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov ecx, dword [esp + 0x30]
cmp byte [ecx + 0x14], 0
je 0x67005987
push 0x20
call sym.QtCore_Ad_4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov eax, dword [edi]
mov ecx, dword [eax + 8]
add ecx, esi
mov edx, dword [eax + ecx*4 + 0x14]
push edx
push ecx
mov ecx, dword [esp + 0x38]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [esp + 0x38]
add dword [eax + 0xc], ebx
lea edx, [esp + 0x18]
mov dword [esp + 0x20], esp
push edx
call sym.QtCore_Ad_4.dll_class_QDebug___cdecl_operator___class_QDebug__class_QObject_const__
add esp, 0xc
lea ecx, [esp + 0x10]
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QDebug::destructor_void_
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 8]
add esi, ebx
cmp esi, ecx
jl 0x67005931
mov ecx, dword [esp + 0x30]
push 0x29
call sym.QtCore_Ad_4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov ecx, dword [esp + 0x30]
cmp byte [ecx + 0x14], 0
je 0x670059ef
push 0x20
call sym.QtCore_Ad_4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov ecx, dword [esp + 0x30]
mov byte [ecx + 0x14], bl
mov ecx, dword [esp + 0x30]
push 0x20
call sym.QtCore_Ad_4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov dword [esi], eax
add dword [eax + 0xc], ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], ebx
mov byte [esp + 0x24], 0
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QDebug::destructor_void_
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x6700c1b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6714e348
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
fld qword [edi + 0x90]
mov ebx, dword [edi + 4]
fld qword [edi + 0xa8]
mov eax, dword [ebx]
fld qword [esp + 0x34]
sub esp, 8
fsub st(2)
lea ecx, [edi + 0xb0]
fxch st(1)
lea edx, [edi + 0x98]
fsubrp st(2)
fdivrp st(1)
fstp qword [esp]
push ecx
push edx
mov edx, dword [eax + 0x40]
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebx
call edx
mov eax, dword [edi + 0x70]
mov ecx, dword [edi + 0x74]
mov edx, dword [edi + 0x78]
mov ebp, dword [esp + 0x14]
lea esi, [edi + 0x70]
mov dword [esi], ebp
mov ebp, dword [esp + 0x18]
mov dword [esi + 4], ebp
mov ebp, dword [esp + 0x1c]
mov dword [esi + 8], ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
mov dword [esi + 0xc], ebp
mov dword [esp + 0x1c], edx
mov edx, dword [ebx]
mov eax, dword [edx + 0x3c]
push esi
mov ecx, ebx
mov dword [esp + 0x30], 0
call eax
mov ecx, dword [0x672589a8]
test ecx, ecx
jne 0x6700c286
push 0x67162c70
mov ecx, edi
call sym.QtCore_Ad_4.dll_public:_int___thiscall_QObjectPrivate::signalIndex_char_const__const
mov edx, eax
mov ecx, 0x672589a8
xor eax, eax
lock cmpxchg dword [ecx], edx
mov eax, dword [0x672589a8]
cmp eax, 0x40
jae 0x6700c2b7
mov ecx, eax
and ecx, 0x1f
mov edx, 1
shl edx, cl
shr eax, 5
test dword [edi + eax*4 + 0x34], edx
jne 0x6700c2b7
cmp dword [sym.QtCore_Ad_4.dll_struct_QSignalSpyCallbackSet_qt_signal_spy_callback_set], 0
jne 0x6700c2b7
cmp dword [0x67258cd0], 0
je 0x6700c2e8
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call sym.QtCore_Ad_4.dll_protected:_bool___thiscall_QVariant::cmp_class_QVariant_const__const
test al, al
jne 0x6700c2e8
lea ecx, [esp + 0x34]
push ecx
push 0
push sym.QtCore_Ad_4.dll_struct_QMetaObject_const_QVariantAnimation::staticMetaObject
push ebx
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], esi
call sym.QtCore_Ad_4.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QVariant::destructor_void_
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x67013450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6714b30d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
push ebx
lea ecx, [esi + 4]
mov dword [esi], 1
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QMutex::constructor_enum_QMutex::RecursionMode_
lea ecx, [esi + 8]
mov dword [esp + 0x18], ebx
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QWaitCondition::constructor_void_
mov dword [esi + 0xc], sym.QtCore_Ad_4.dll_struct_QListData::Data_QListData::shared_null
mov eax, sym.QtCore_Ad_4.dll_struct_QListData::Data_QListData::shared_null
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [esp + 0x20]
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 2
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], edx
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QWaitCondition::constructor_void_
lea ecx, [esi + 0x38]
mov byte [esp + 0x18], 3
mov dword [esi + 0x34], ebx
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QtConcurrent::ResultStoreBase::constructor_void_
lea ecx, [esi + 0x5c]
push ebx
mov byte [esp + 0x1c], 4
mov byte [esi + 0x54], bl
mov dword [esi + 0x58], ebx
call fcn.67016630
mov dword [esi + 0x60], sym.QtCore_Ad_4.dll_struct_QString::Data_QString::shared_null
mov eax, sym.QtCore_Ad_4.dll_struct_QString::Data_QString::shared_null
mov ecx, 1
lock xadd dword [eax], ecx
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], 6
mov dword [esi + 0x64], ebx
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QElapsedTimer::invalidate_void_
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x67015370
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x6701537c
jmp sym.QtCore_Ad_4.dll_public:_void___thiscall_QFutureInterfaceBase::waitForResume_void_
ret
Function at 0x67018760
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x6714ba49
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov eax, dword [0x672589d4]
cmp eax, ebx
je 0x670187a6
mov ecx, dword [esp + 0x2c]
push ecx
push esi
call eax
add esp, 8
jmp 0x670187d1
mov edx, dword [esp + 0x2c]
mov edi, dword [sym.imp.MSVCR100.dll___iob_func]
push edx
push 0x67163904
call edi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call edi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fflush]
add esp, 0x10
cmp esi, 3
je 0x67018809
cmp esi, 1
jne 0x67018802
lea eax, [esp + 0x10]
push str.QT_FATAL_WARNINGS
push eax
call sym.QtCore_Ad_4.dll_class_QByteArray___cdecl_qgetenv_char_const__
add esp, 8
mov dword [esp + 0x20], ebx
mov ebx, esi
mov ecx, eax
mov dword [esp + 0x14], ebx
call sym.QtCore_Ad_4.dll_public:_bool___thiscall_QByteArray::isNull_void_const
test al, al
je 0x67018809
mov byte [esp + 0x28], 0
jmp 0x6701880e
mov byte [esp + 0x28], 1
mov dword [esp + 0x20], 0xffffffff
test bl, 1
je 0x67018835
mov ecx, dword [esp + 0x10]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x67018835
mov eax, dword [esp + 0x10]
push eax
call sym.QtCore_Ad_4.dll_void___cdecl_qFree_void__
add esp, 4
cmp byte [esp + 0x28], 0
je 0x67018844
push 1
call dword [sym.imp.MSVCR100.dll_exit]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x67019300
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x67258980]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [0x672589dc]
test eax, eax
jne 0x670193dd
lea eax, [esp]
push eax
mov dword [0x672589dc], 0x10
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x10]
sub eax, 0
je 0x670193d3
dec eax
je 0x670193b6
mov ecx, dword [esp + 4]
cmp ecx, 5
jae 0x6701935d
mov eax, 0x10
jmp 0x670193d8
mov eax, dword [esp + 8]
jne 0x67019386
test eax, eax
jne 0x6701936e
mov eax, 0x20
jmp 0x670193d8
cmp eax, 1
jne 0x6701937a
mov eax, 0x30
jmp 0x670193d8
cmp eax, 2
jne 0x670193a0
mov eax, 0x40
jmp 0x670193d8
cmp ecx, 6
jne 0x670193a0
test eax, eax
jne 0x67019394
lea eax, [ecx + 0x7a]
jmp 0x670193d8
cmp eax, 1
jne 0x670193a0
mov eax, 0x90
jmp 0x670193d8
push eax
push ecx
push str.Qt:_Untested_Windows_version__d._d_detected_
call sym.QtCore_Ad_4.dll_void___cdecl_qWarning_char_const__
add esp, 0xc
mov eax, 0xf0
jmp 0x670193d8
mov eax, dword [esp + 8]
cmp eax, 0x5a
jne 0x670193c6
mov eax, 4
jmp 0x670193d8
xor ecx, ecx
cmp eax, 0xa
sete cl
lea eax, [ecx + 2]
jmp 0x670193d8
mov eax, 1
mov dword [0x672589dc], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.67149782
add esp, 0x118
ret
Function at 0x67021bb0
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [sym.QtCore_Ad_4.dll_class_QMutexPool__qt_global_mutexpool], 0
jne 0x67021bc8
call sym.QtCore_Ad_4.dll_public:_static_class_QMutexPool____cdecl_QMutexPool::instance_void_
mov dword [sym.QtCore_Ad_4.dll_class_QMutexPool__qt_global_mutexpool], eax
jmp fcn.67023840
ret

Function at 0x67022620
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6714c8c3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x24]
xor ebx, ebx
mov edi, sym.QtCore_Ad_4.dll_struct_QVectorData_QVectorData::shared_null
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], edi
mov ecx, edi
mov edx, 1
lock xadd dword [ecx], edx
lea eax, [esi + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], eax
mov dword [eax], sym.QtCore_Ad_4.dll_struct_QListData::Data_QListData::shared_null
mov ecx, sym.QtCore_Ad_4.dll_struct_QListData::Data_QListData::shared_null
mov edx, 1
lock xadd dword [ecx], edx
push ebx
lea ecx, [eax + 0x10]
mov byte [esp + 0x20], 1
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QMutex::constructor_enum_QMutex::RecursionMode_
mov byte [esi + 0x30], 1
mov dword [esi + 0x34], edi
mov eax, 1
lock xadd dword [edi], eax
mov byte [esi + 0x38], bl
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x670236e0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x67023840
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x6714ca9e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
or esi, 0xffffffff
cmp dword [0x67256664], esi
jne 0x67023901
test byte [0x67258a48], 1
jne 0x670238a6
or dword [0x67258a48], 1
push 0
mov ecx, 0x67258a44
mov dword [esp + 0x18], 0
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QMutex::constructor_enum_QMutex::RecursionMode_
push 0x67161200
call fcn.67149851
add esp, 4
mov dword [esp + 0x14], esi
push 0x67258a44
lea ecx, [esp + 0xc]
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QMutexLocker::constructor_class_QMutex__
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x67256664], eax
mov eax, dword [esp + 8]
test al, 1
je 0x67023901
and eax, 0xfffffffe
mov ecx, eax
mov eax, dword [ecx]
test byte [eax + 4], 1
je 0x670238ea
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QMutex::unlock_void_
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
mov esi, eax
xor edx, edx
mov eax, 1
lock cmpxchg dword [esi], edx
cmp eax, 1
je 0x67023901
call sym.QtCore_Ad_4.dll_private:_void___thiscall_QMutex::unlockInternal_void_
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x67024910
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x6714c7c8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [0x67258a40]
test byte [eax + 4], 1
je 0x6702494a
mov ecx, 0x67258a40
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QMutex::lock_void_
jmp 0x6702496a
mov edx, eax
mov ecx, 1
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
sete al
test al, al
jne 0x6702496a
mov ecx, 0x67258a40
call sym.QtCore_Ad_4.dll_private:_void___thiscall_QMutex::lockInternal_void_
mov ebx, 0x67258a40
or ebx, 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x67258a34]
jne 0x6702499c
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x67024a48
lea eax, [esp + 0x20]
push eax
mov ecx, str.Xh_gXh_g
call fcn.6704f4e0
lea ecx, [esp + 0x24]
push ecx
mov ecx, 0x6725666c
call fcn.6704f4e0
cmp dword [0x67258a34], 0
jne 0x67024a3b
cmp dword [0x67258a38], 0
jne 0x67024a21
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [str.Xh_gXh_g]
mov dword [0x67258a38], eax
mov eax, dword [edx]
cmp eax, 1
je 0x67024a03
mov eax, dword [str.Xh_gXh_g]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
push ecx
push edx
mov ecx, str.Xh_gXh_g
call fcn.67105eb0
mov eax, dword [str.Xh_gXh_g]
push 0x67258a38
push 1
add eax, 0x10
push eax
mov ecx, str.Xh_gXh_g
call fcn.67024120
mov ebx, dword [esp + 0xc]
push 0x67258a34
push 0
push 0
push 0x67024640
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x67024a48
mov ecx, dword [0x67258a38]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esp + 0x18], 0xffffffff
test bl, 1
je 0x67024a90
and ebx, 0xfffffffe
mov ecx, ebx
mov eax, dword [ecx]
test byte [eax + 4], 1
je 0x67024a79
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QMutex::unlock_void_
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
mov esi, eax
mov eax, 1
xor edx, edx
lock cmpxchg dword [esi], edx
cmp eax, 1
je 0x67024a90
call sym.QtCore_Ad_4.dll_private:_void___thiscall_QMutex::unlockInternal_void_
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x67025fd0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
push edi
mov edi, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
movsx edx, byte [ecx]
mov ecx, dword [edi]
add eax, eax
add eax, eax
add eax, eax
sub eax, edx
mov edx, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
movsx edx, byte [edx]
add ecx, ecx
add ecx, ecx
add ecx, ecx
sub ecx, edx
mov dword [esp + 0x10], eax
cmp ecx, eax
mov dword [esp + 8], ecx
lea eax, [esp + 0x10]
jl 0x67026013
lea eax, [esp + 8]
mov eax, dword [eax]
push eax
mov ecx, edi
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QBitArray::resize_int_
mov eax, dword [edi]
mov ecx, dword [eax]
cmp ecx, 1
jne 0x67026030
mov eax, dword [edi]
lea edx, [eax + 0x10]
cmp dword [eax + 0xc], edx
je 0x6702603d
mov eax, dword [edi]
mov ecx, dword [eax + 8]
push ecx
mov ecx, edi
call sym.QtCore_Ad_4.dll_private:_void___thiscall_QByteArray::realloc_int_
mov ecx, dword [esi]
mov esi, dword [ecx + 0xc]
mov edx, dword [edi]
mov ecx, dword [ecx + 8]
mov eax, dword [edx + 0xc]
dec ecx
inc eax
inc esi
test ecx, ecx
jle 0x6702605c
mov dl, byte [esi]
xor byte [eax], dl
dec ecx
inc esi
inc eax
test ecx, ecx
jg 0x67026051
mov eax, edi
pop edi
pop esi
pop ecx
ret 4

Function at 0x670266b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov eax, 0xffff
test edx, edx
je 0x670266fa
push edi
mov cl, byte [esi]
mov edi, eax
movzx ecx, cl
xor edi, ecx
shr ax, 4
and edi, 0xf
xor ax, word [edi*2 + 0x67165f90]
shr ecx, 4
movzx eax, ax
xor ecx, eax
shr ax, 4
and ecx, 0xf
xor ax, word [ecx*2 + 0x67165f90]
inc esi
dec edx
movzx eax, ax
jne 0x670266c3
pop edi
not eax
pop esi
ret

Function at 0x670289d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x67154dc8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
call sym.QtCore_Ad_4.dll_private:_class_QByteArray___thiscall_QByteArray::nulTerminated_void_
mov ebp, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
mov eax, dword [ecx + 0xc]
push 0
push ebp
push edx
push eax
mov dword [esp + 0x30], 0
call sym.QtCore_Ad_4.dll_public:_static_long_long___int64____cdecl_QLocalePrivate::bytearrayToLongLong_char_const___int__bool___bool__
mov edi, eax
mov eax, dword [esp + 0x20]
add esp, 0x10
mov esi, edx
mov dword [esp + 0x20], 0xffffffff
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x67028a48
mov edx, dword [esp + 0x10]
push edx
call sym.QtCore_Ad_4.dll_void___cdecl_qFree_void__
add esp, 4
mov eax, edi
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
jl 0x67028a6b
jg 0x67028a5d
cmp edi, 0x80000000
jb 0x67028a6b
test esi, esi
jl 0x67028a79
jg 0x67028a6b
cmp edi, 0x7fffffff
jbe 0x67028a79
test ebp, ebp
je 0x67028a73
mov byte [ebp], 0
xor eax, eax
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 8
Function at 0x67028a90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x67154dc8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
call sym.QtCore_Ad_4.dll_private:_class_QByteArray___thiscall_QByteArray::nulTerminated_void_
mov ebp, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
mov eax, dword [ecx + 0xc]
push 0
push ebp
push edx
push eax
mov dword [esp + 0x30], 0
call sym.QtCore_Ad_4.dll_public:_static_long_long___int64____cdecl_QLocalePrivate::bytearrayToLongLong_char_const___int__bool___bool__
mov edi, eax
mov eax, dword [esp + 0x20]
add esp, 0x10
mov esi, edx
mov dword [esp + 0x20], 0xffffffff
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x67028b08
mov edx, dword [esp + 0x10]
push edx
call sym.QtCore_Ad_4.dll_void___cdecl_qFree_void__
add esp, 4
mov eax, edi
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
jl 0x67028b2b
jg 0x67028b1d
cmp edi, 0xffff8000
jb 0x67028b2b
test esi, esi
jl 0x67028b39
jg 0x67028b2b
cmp edi, 0x7fff
jbe 0x67028b39
test ebp, ebp
je 0x67028b33
mov byte [ebp], 0
xor eax, eax
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 8
Function at 0x6702cc70
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [ecx]
mov edx, dword [eax]
push esi
xor esi, esi
sub edx, esi
je 0x6702ccec
dec edx
je 0x6702ccbc
dec edx
jne 0x6702cd0e
mov dword [eax + 0x20], esi
mov dword [eax + 0x24], esi
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov ecx, dword [ecx]
add ecx, 0xa0
pop esi
jmp sym.QtCore_Ad_4.dll_public:_void___thiscall_QByteArray::clear_void_
mov dword [eax + 0x18], esi
mov dword [eax + 0x1c], esi
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov ecx, dword [ecx]
add ecx, 0xa0
pop esi
jmp sym.QtCore_Ad_4.dll_public:_void___thiscall_QByteArray::clear_void_
mov dword [eax + 0x10], 0x67452301
mov dword [eax + 0x14], 0xefcdab89
mov dword [eax + 0x18], 0x98badcfe
mov dword [eax + 0x1c], 0x10325476
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov ecx, dword [ecx]
add ecx, 0xa0
pop esi
jmp sym.QtCore_Ad_4.dll_public:_void___thiscall_QByteArray::clear_void_
Function at 0x67031d80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6714d26c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67258980]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
or edi, 0xffffffff
mov dword [esi], vtable.QDateTimeParser.0
mov dword [esi + 4], edi
xor ebx, ebx
mov dword [esi + 8], ebx
mov eax, sym.QtCore_Ad_4.dll_struct_QString::Data_QString::shared_null
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov dword [esp + 0x20], ebx
mov dword [esi + 0x14], sym.QtCore_Ad_4.dll_struct_QVectorData_QVectorData::shared_null
mov ecx, sym.QtCore_Ad_4.dll_struct_QVectorData_QVectorData::shared_null
mov edx, 1
lock xadd dword [ecx], edx
mov dword [esi + 0x48], sym.QtCore_Ad_4.dll_struct_QListData::Data_QListData::shared_null
mov ecx, sym.QtCore_Ad_4.dll_struct_QListData::Data_QListData::shared_null
mov edx, 1
lock xadd dword [ecx], edx
mov dword [esi + 0x4c], eax
mov ecx, 1
lock xadd dword [eax], ecx
lea ecx, [esi + 0x50]
mov byte [esp + 0x20], 3
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QLocale::constructor_void_
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x28]
push ecx
mov dword [esi + 0x54], edx
mov byte [esi + 0x58], bl
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], eax
call sym.QtCore_Ad_4.dll_public:_static_class_QLocale___cdecl_QLocale::system_void_
add esp, 4
push eax
lea ecx, [esi + 0x50]
call sym.QtCore_Ad_4.dll_public:_void___thiscall_QAtomicInt::constructor_class_QAtomicInt_const__
mov eax, 0x12000
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8