joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e1aa070
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x28]
mov esi, 0x6e2f6570
mov ecx, 3
mov edi, eax
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp + 0xc], 0
je 0x6e1aa0c4
mov dword [esp + 0xc], 0x100000
mov dword [esp + 8], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_CreatePipe
sub esp, 0x10
test eax, eax
jne 0x6e1aa140
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 0xc], 0x100000
mov dword [esp + 8], eax
lea eax, [ebx + 4]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_CreatePipe
sub esp, 0x10
test eax, eax
je 0x6e1aa0b9
call sub.KERNEL32.dll_GetCurrentProcess
mov edi, eax
mov esi, dword [ebp - 0x1c]
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
test eax, eax
je 0x6e1aa0b9
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
call sub.KERNEL32.dll_GetCurrentProcess
mov edi, eax
mov esi, dword [ebp - 0x1c]
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
add ebx, 4
jmp 0x6e1aa110

Function at 0x6e1ab478
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
call fcn.6e1aaefc
lea ebx, [ebp - 0x70]
mov esi, 0x6e2f6520
mov ecx, 0x11
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov edx, dword [eax + 8]
test edx, edx
jne 0x6e1ab564
xor esi, esi
lea edx, [ebp - 0x1c]
mov dword [esp], edx
call method.QString.utf16___const
lea edx, [ebp - 0x2c]
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x410
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessW
sub esp, 0x28
test eax, eax
setne bl
je 0x6e1ab53f
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push edi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x6e1ab53f
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x1c]
lock dec dword [eax]
setne dl
test dl, dl
jne 0x6e1ab557
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call method.QString.free_QString::Data_
mov al, bl
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call method.QString.utf16___const
mov esi, eax
jmp 0x6e1ab4b5
Function at 0x6e1ac7e8
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov edx, dword [ebx + 4]
mov esi, dword [edx + 0x5c]
cmp esi, 0xffffffff
je 0x6e1ac894
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebx]
mov dword [esp + 4], edi
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 8], ecx
mov dword [esp], ebx
mov dword [ebp - 0x44], edx
call dword [eax + 0x1c]
test al, al
mov edx, dword [ebp - 0x44]
jne 0x6e1ac854
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp], ebx
call dword [eax + 0x1c]
xor esi, esi
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp], esi
call sub.KERNEL32.dll_SetEndOfFile
push ecx
test eax, eax
mov edx, dword [ebp - 0x44]
je 0x6e1ac834
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x3c]
cmp ecx, edx
jl 0x6e1ac874
jle 0x6e1ac8cc
mov edi, dword [ebp - 0x40]
mov ecx, edx
mov dword [esp + 4], edi
mov dword [esp + 8], ecx
mov dword [esp], ebx
call dword [eax + 0x1c]
mov esi, 1
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov ecx, dword [edx + 0x70]
cmp ecx, 0xffffffff
je 0x6e1ac8d4
mov eax, dword [edx + 0x58]
test eax, eax
je 0x6e1ac990
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
mov esi, eax
cmp esi, 0xffffffff
jne 0x6e1ac80c
xor esi, esi
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
cmp edi, dword [ebp - 0x40]
jbe 0x6e1ac874
jmp 0x6e1ac86f
mov eax, dword [edx + 0x58]
test eax, eax
jne 0x6e1ac8a7
add edx, 0x10
mov dword [esp], edx
mov dword [ebp - 0x44], edx
call fcn.6e1a37a0
test al, al
mov edx, dword [ebp - 0x44]
jne 0x6e1ac8bd
lea esi, [ebp - 0x1c]
mov dword [esp + 4], edx
mov dword [esp], esi
call fcn.6e1a2f14
push edx
mov dword [esp + 4], esi
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call method.QFile.QFile_QString_const_
mov dword [esp], esi
call method.QString.QString__
mov dword [ebp - 0x20], 3
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
lea ecx, [ebp - 0x2c]
mov dword [esp], ecx
call method.QFile.open_QFlags_QIODevice::OpenModeFlag__
test al, al
je 0x6e1ac99f
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x3c]
mov dword [esp + 8], eax
lea ecx, [ebp - 0x2c]
mov dword [esp], ecx
call method.QFile.resize_long_long_
mov esi, eax
test al, al
jne 0x6e1ac97f
lea edi, [ebp - 0x24]
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], edi
call method.QIODevice.errorString___const
push eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0xc
mov dword [esp], ebx
call method.QAbstractFileEngine.setError_QFile::FileError__QString_const_
mov dword [esp], edi
call method.QString.QString__
lea ecx, [ebp - 0x2c]
mov dword [esp], ecx
call fcn.6e164700
jmp 0x6e1ac849
mov dword [esp], ecx
call sub.msvcrt.dll__get_osfhandle
mov esi, eax
jmp 0x6e1ac8b4
lea ecx, [ebp - 0x2c]
mov dword [esp], ecx
call fcn.6e164700
xor esi, esi
jmp 0x6e1ac849
Function at 0x6e1ad1ec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [edi], sym.QtCore4.dll_QListData::shared_null
lock inc dword [sym.QtCore4.dll_QListData::shared_null]
setne al
call sub.KERNEL32.dll_GetLogicalDrives
mov edx, dword [0x6e2f6580]
mov dword [ebp - 0x1c], edx
mov ebx, eax
and ebx, 0x3ffffff
je 0x6e1ad290
lea esi, [ebp - 0x24]
jmp 0x6e1ad233
mov al, byte [ebp - 0x1c]
shr ebx, 1
je 0x6e1ad290
inc eax
mov byte [ebp - 0x1c], al
test bl, 1
je 0x6e1ad228
mov dword [esp + 4], 0xffffffff
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.6e11c044
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov dword [esp], esi
call method.QFileInfo.QFileInfo_QString_const_
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.6e246370
mov dword [esp], esi
call method.QFileInfo.QFileInfo__
mov eax, dword [ebp - 0x20]
lock dec dword [eax]
setne dl
test dl, dl
jne 0x6e1ad228
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call method.QString.free_QString::Data_
mov al, byte [ebp - 0x1c]
shr ebx, 1
jne 0x6e1ad22f
mov eax, edi
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret 4
Function at 0x6e1b4928
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28c
mov edi, edx
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lock inc dword [eax]
setne dl
mov eax, dword [ebp - 0x20]
cmp dword [eax + 8], 2
je 0x6e1b4a98
lea ebx, [ebp - 0x20]
lea esi, [ebp - 0x24]
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.6e1ad7bc
push eax
mov dword [esp], esi
call method.QString.utf16___const
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesW
push ecx
mov esi, eax
mov eax, dword [ebp - 0x24]
lock dec dword [eax]
setne dl
test dl, dl
je 0x6e1b49d0
cmp esi, 0xffffffff
je 0x6e1b49e0
test edi, edi
je 0x6e1b4990
cmp esi, 0xffffffff
setne byte [edi]
cmp esi, 0xffffffff
je 0x6e1b4a90
shr esi, 4
mov eax, esi
and eax, 1
mov edx, dword [ebp - 0x20]
lock dec dword [edx]
setne cl
test cl, cl
jne 0x6e1b49c5
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
mov byte [ebp - 0x280], al
call method.QString.free_QString::Data_
mov al, byte [ebp - 0x280]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call method.QString.free_QString::Data_
cmp esi, 0xffffffff
jne 0x6e1b4986
call sub.KERNEL32.dll_GetLastError
cmp eax, 5
je 0x6e1b49ef
cmp eax, 0x20
jne 0x6e1b4986
mov dword [esp + 4], ebx
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.6e1ad7bc
push edx
jmp 0x6e1b4a17
mov dword [esp + 4], 1
lea eax, [ebp - 0x28]
mov dword [esp], eax
call method.QString.chop_int_
mov word [ebp - 0x1c], 0x5c
mov dword [esp + 8], 1
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call method.QString.endsWith_QChar_const__Qt::CaseSensitivity__const
test al, al
jne 0x6e1b4a04
mov word [ebp - 0x1a], 0x3a
mov dword [esp + 8], 1
lea eax, [ebp - 0x1a]
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call method.QString.endsWith_QChar_const__Qt::CaseSensitivity__const
test al, al
je 0x6e1b4af8
mov byte [ebp - 0x279], 0
lea eax, [ebp - 0x28]
mov dword [esp], eax
call method.QString.QString__
cmp byte [ebp - 0x279], 0
je 0x6e1b4986
mov esi, dword [ebp - 0x278]
jmp 0x6e1b4986
xor eax, eax
jmp 0x6e1b49a1
mov edx, dword [eax + 0xc]
cmp word [edx + 2], 0x3a
jne 0x6e1b494e
mov ecx, dword [eax]
cmp ecx, 1
je 0x6e1b4ae8
mov dword [esp], 3
lea ebx, [ebp - 0x20]
call method.QString.grow_int_
mov dword [esp + 4], eax
mov dword [esp], ebx
call method.QString.realloc_int_
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 8]
mov word [edx + ecx*2], 0x5c
inc ecx
mov dword [eax + 8], ecx
mov word [edx + ecx*2], 0
jmp 0x6e1b4951
cmp dword [eax + 4], 2
jle 0x6e1b4aad
mov cl, 2
lea ebx, [ebp - 0x20]
jmp 0x6e1b4ad1
lea eax, [ebp - 0x28]
mov dword [esp], eax
call method.QString.utf16___const
lea edx, [ebp - 0x278]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileW
sub esp, 8
cmp eax, 0xffffffff
je 0x6e1b4a63
mov dword [esp], eax
call sub.KERNEL32.dll_FindClose
push eax
mov byte [ebp - 0x279], 1
jmp 0x6e1b4a6a
Function at 0x6e1b4b64
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov esi, dword [ebp + 0xc]
lea ebx, [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.6e1a37c4
push ecx
mov dword [esp], ebx
call method.QString.utf16___const
mov dword [esp], eax
call sub.KERNEL32.dll_DeleteFileW
push edx
test eax, eax
setne bl
mov eax, dword [ebp - 0xc]
lock dec dword [eax]
setne dl
test dl, dl
jne 0x6e1b4bb0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call method.QString.free_QString::Data_
test bl, bl
jne 0x6e1b4bc2
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 4], 2
mov dword [esi], eax
mov al, bl
lea esp, [ebp - 8]
pop ebx
pop esi
leave
ret

Function at 0x6e1b4be0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
lea esi, [ebp - 0x20]
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.6e1a37c4
push edx
mov dword [esp], esi
call method.QString.utf16___const
mov edi, eax
lea ebx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.6e1a37c4
push eax
mov dword [esp], ebx
call method.QString.utf16___const
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.KERNEL32.dll_MoveFileW
sub esp, 8
mov ebx, eax
mov eax, dword [ebp - 0x1c]
lock dec dword [eax]
setne dl
test dl, dl
je 0x6e1b4c7c
mov eax, dword [ebp - 0x20]
lock dec dword [eax]
setne dl
test dl, dl
jne 0x6e1b4c57
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call method.QString.free_QString::Data_
test ebx, ebx
setne bl
jne 0x6e1b4c6f
call sub.KERNEL32.dll_GetLastError
mov edx, dword [ebp + 0x10]
mov dword [edx + 4], 2
mov dword [edx], eax
mov al, bl
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call method.QString.free_QString::Data_
jmp 0x6e1b4c3f

Function at 0x6e1b4ca8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
lea esi, [ebp - 0x20]
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.6e1a37c4
push ebx
mov dword [esp], esi
call method.QString.utf16___const
mov edi, eax
lea ebx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.6e1a37c4
push ecx
mov dword [esp], ebx
call method.QString.utf16___const
mov dword [esp + 8], 1
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.KERNEL32.dll_CopyFileW
sub esp, 0xc
mov ebx, eax
mov eax, dword [ebp - 0x1c]
lock dec dword [eax]
setne dl
test dl, dl
je 0x6e1b4d4c
mov eax, dword [ebp - 0x20]
lock dec dword [eax]
setne dl
test dl, dl
jne 0x6e1b4d27
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call method.QString.free_QString::Data_
test ebx, ebx
setne bl
jne 0x6e1b4d3f
call sub.KERNEL32.dll_GetLastError
mov edx, dword [ebp + 0x10]
mov dword [edx + 4], 2
mov dword [edx], eax
mov al, bl
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call method.QString.free_QString::Data_
jmp 0x6e1b4d0f
Function at 0x6e1b5058
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24c
mov ebx, dword [ebp + 8]
mov dword [ebx], sym.QtCore4.dll_QString::shared_null
lock inc dword [sym.QtCore4.dll_QString::shared_null]
setne al
lea esi, [ebp - 0x230]
mov dword [esp + 4], esi
mov dword [esp], 0x104
call sub.KERNEL32.dll_GetTempPathW
sub esp, 8
test eax, eax
jne 0x6e1b51b4
mov eax, dword [ebx]
mov edx, dword [eax + 8]
test edx, edx
jne 0x6e1b50e8
lea esi, [ebp - 0x28]
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], str.C:_tmp
mov dword [esp], esi
call method.QString.fromLatin1_char_const__int_
push edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call method.QString.operator_QString_const_
mov eax, dword [ebp - 0x28]
lock dec dword [eax]
setne dl
test dl, dl
je 0x6e1b5208
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret 4
lea esi, [ebp - 0x1a]
jmp 0x6e1b5100
mov dword [esp + 4], 1
mov dword [esp], ebx
call method.QString.chop_int_
mov word [ebp - 0x1a], 0x5c
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], ebx
call method.QString.endsWith_QChar_const__Qt::CaseSensitivity__const
test al, al
jne 0x6e1b50f0
lea esi, [ebp - 0x24]
mov dword [esp + 4], ebx
mov dword [esp], esi
call method.QDir.fromNativeSeparators_QString_const_
push eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call method.QString.operator_QString_const_
mov eax, dword [ebp - 0x24]
lock dec dword [eax]
setne dl
test dl, dl
je 0x6e1b51f8
mov edx, dword [ebx]
mov eax, dword [edx + 8]
test eax, eax
je 0x6e1b50a1
dec eax
jle 0x6e1b50da
mov eax, dword [edx + 0xc]
cmp word [eax + 2], 0x3a
jne 0x6e1b50da
mov ax, word [eax]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call method.QChar.toUpper___const
mov esi, eax
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
test ecx, ecx
jle 0x6e1b5232
mov edx, dword [eax]
dec edx
je 0x6e1b521f
mov dword [esp], ebx
call method.QString.realloc__
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
mov word [edx], si
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret 4
lea edi, [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], edi
call method.QString.fromWCharArray_wchar_t_const__int_
push ecx
mov dword [esp + 4], edi
mov dword [esp], ebx
call method.QString.operator_QString_const_
mov eax, dword [ebp - 0x20]
lock dec dword [eax]
setne dl
test dl, dl
jne 0x6e1b5098
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call method.QString.free_QString::Data_
jmp 0x6e1b5098
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call method.QString.free_QString::Data_
jmp 0x6e1b514b
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call method.QString.free_QString::Data_
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret 4
mov edx, dword [eax + 0xc]
add eax, 0x12
cmp edx, eax
jne 0x6e1b5197
jmp 0x6e1b51a4
mov dword [esp + 4], 0
mov dword [esp], ebx
call method.QString.expand_int_
jmp 0x6e1b519f
Function at 0x6e1b55c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x23c
mov dword [ebp - 0x20], sym.QtCore4.dll_QString::shared_null
lock inc dword [sym.QtCore4.dll_QString::shared_null]
setne al
lea edi, [ebp - 0x22e]
mov dword [esp + 4], edi
mov dword [esp], 0x103
lea ebx, [ebp - 0x20]
call sub.KERNEL32.dll_GetCurrentDirectoryW
sub esp, 8
mov esi, eax
test eax, eax
je 0x6e1b5644
cmp eax, 0x103
jbe 0x6e1b56cc
lea eax, [eax + eax]
mov dword [esp], eax
lea ebx, [ebp - 0x20]
call fcn.6e254944
mov edi, eax
mov dword [esp + 4], eax
mov dword [esp], 0x103
call sub.KERNEL32.dll_GetCurrentDirectoryW
sub esp, 8
test eax, eax
jne 0x6e1b5714
test edi, edi
je 0x6e1b5644
mov dword [esp], edi
call fcn.6e254738
lea esi, [esi]
mov eax, dword [ebp - 0x20]
cmp dword [eax + 8], 1
jle 0x6e1b5693
mov eax, dword [eax + 0xc]
cmp word [eax + 2], 0x3a
jne 0x6e1b5693
mov ax, word [eax]
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x1a]
mov dword [esp], eax
call method.QChar.toUpper___const
mov esi, eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 8]
test ecx, ecx
jle 0x6e1b574c
mov eax, dword [edx]
dec eax
je 0x6e1b5764
mov dword [esp], ebx
call method.QString.realloc__
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
mov word [eax], si
mov byte [esp + 8], 0
mov dword [esp + 4], ebx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.6e1a2974
mov eax, dword [ebp - 0x20]
lock dec dword [eax]
setne dl
test dl, dl
jne 0x6e1b56bf
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call method.QString.free_QString::Data_
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret 4
mov dword [esp + 8], eax
mov dword [esp + 4], edi
lea eax, [ebp - 0x28]
mov dword [esp], eax
lea ebx, [ebp - 0x20]
call method.QString.fromWCharArray_wchar_t_const__int_
push esi
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], ebx
call method.QString.operator_QString_const_
mov eax, dword [ebp - 0x28]
lock dec dword [eax]
setne dl
test dl, dl
jne 0x6e1b5644
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call method.QString.free_QString::Data_
jmp 0x6e1b5644
mov dword [esp + 8], esi
mov dword [esp + 4], edi
lea eax, [ebp - 0x24]
mov dword [esp], eax
lea ebx, [ebp - 0x20]
call method.QString.fromWCharArray_wchar_t_const__int_
push eax
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
mov dword [esp], ebx
call method.QString.operator_QString_const_
lea eax, [ebp - 0x24]
mov dword [esp], eax
call method.QString.QString__
jmp 0x6e1b5635
mov dword [esp + 4], 0
mov dword [esp], ebx
call method.QString.expand_int_
jmp 0x6e1b568a
mov eax, dword [edx + 0xc]
add edx, 0x12
cmp eax, edx
jne 0x6e1b5682
jmp 0x6e1b5690
Function at 0x6e1f88b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov esi, dword [ebp + 0xc]
cmp byte [0x6e345d48], 0
je 0x6e1f8970
test esi, esi
je 0x6e1f89c4
mov dword [esp], 0x6e345d58
call sub.KERNEL32.dll_EnterCriticalSection
push eax
lea ebx, [ebp - 0xc]
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], esi
mov dword [esp], ebx
call method.QString.fromLocal8Bit_char_const__int_
push esi
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
dec edx
je 0x6e1f89b0
mov edx, dword [eax + 8]
inc edx
mov dword [esp], edx
call method.QString.grow_int_
mov dword [esp + 4], eax
mov dword [esp], ebx
call method.QString.realloc_int_
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
mov word [ecx + edx*2], 0xa
inc edx
mov dword [eax + 8], edx
mov word [ecx + edx*2], 0
mov dword [esp], ebx
call method.QString.utf16___const
mov dword [esp], eax
call sub.KERNEL32.dll_OutputDebugStringW
push ecx
mov dword [esp], 0x6e345d58
call sub.KERNEL32.dll_LeaveCriticalSection
push edx
mov eax, dword [ebp - 0xc]
lock dec dword [eax]
setne dl
test dl, dl
jne 0x6e1f8968
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call method.QString.free_QString::Data_
lea esp, [ebp - 8]
pop ebx
pop esi
leave
ret
mov dword [esp], 0x6e345d48
call fcn.6e255e1c
test eax, eax
je 0x6e1f88c8
mov dword [esp], 0x6e345d58
call sub.KERNEL32.dll_InitializeCriticalSection
push edx
mov dword [esp], 0x6e345d48
call fcn.6e255ed0
mov dword [esp], 0x6e1f85e4
call fcn.6e0c1110
jmp 0x6e1f88c8
mov edx, dword [eax + 8]
cmp edx, dword [eax + 4]
jl 0x6e1f891f
jmp 0x6e1f8904
mov esi, 0x6e2fbdc4
jmp 0x6e1f88d0
Function at 0x6e20b7f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebx + 4]
cmp dword [ebx + 0x78], 2
je 0x6e20b818
add esp, 0x7c
pop ebx
pop esi
pop edi
leave
ret
cmp byte [ebx + 0x80], 0
jne 0x6e20b810
cmp byte [ebx + 0x81], 0
jne 0x6e20b810
test eax, eax
jne 0x6e20b920
call method.QThread.currentThread__
mov edi, eax
mov dword [esp], esi
call method.QObject.thread___const
cmp edi, eax
je 0x6e20b92c
mov byte [ebx + 0x81], 1
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], str._q_process
mov dword [esp], esi
call method.QMetaObject.invokeMethod_QObject__char_const__Qt::ConnectionType__QGenericReturnArgument__QGenericArgument__QGenericArgument__QGenericArgument__QGenericArgument__QGenericArgument__QGenericArgument__QGenericArgument__QGenericArgument__QGenericArgu
jmp 0x6e20b810
dec eax
jne 0x6e20b810
jmp 0x6e20b849
mov dword [ebp + 8], ebx
add esp, 0x7c
pop ebx
pop esi
pop edi
leave
jmp fcn.6e20b324

Function at 0x6e20ba80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 4]
cmp dword [ebx + 0x78], 2
jne 0x6e20bac4
test edx, edx
je 0x6e20bae8
test ecx, ecx
je 0x6e20bad8
dec ecx
jne 0x6e20bab0
mov dword [esp + 4], edx
mov dword [esp], ebx
call method.QStateMachinePrivate.postInternalEvent_QEvent_
mov dword [ebp + 0xc], 1
mov dword [ebp + 8], ebx
add esp, 0x14
pop ebx
leave
jmp fcn.6e20b7f8
mov dword [ebp + 8], str.QStateMachine::postEvent:_cannot_post_event_when_the_state_machine_is_not_running
add esp, 0x14
pop ebx
leave
jmp sym.QtCore4.dll_qWarning_char_const__::_
mov dword [esp + 4], edx
mov dword [esp], ebx
call method.QStateMachinePrivate.postExternalEvent_QEvent_
jmp 0x6e20bab0
mov dword [ebp + 8], str.QStateMachine::postEvent:_cannot_post_null_event
add esp, 0x14
pop ebx
leave
jmp sym.QtCore4.dll_qWarning_char_const__::_
Function at 0x6e20dfb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne case.default.0x6e20dfd0
cmp eax, 6
jbe switch.0x6e20dfd0
leave
ret
jmp dword [eax*4 + 0x6e30109c]
mov eax, dword [edx + 4]
mov dword [ebp + 8], eax
leave
jmp fcn.6e20b324
mov eax, dword [edx + 4]
mov dword [ebp + 8], eax
leave
jmp fcn.6e20dc8c
mov dword [ebp + 8], edx
leave
jmp fcn.6e20bafc
mov dword [ebp + 8], edx
leave
jmp fcn.6e202fc4
mov dword [ebp + 8], edx
leave
jmp fcn.6e202d18
mov dword [ebp + 8], edx
leave
jmp fcn.6e202d44
mov eax, dword [edx + 4]
mov dword [ebp + 8], eax
leave
jmp fcn.6e207f88