joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67004f55
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x334
mov dword [ebp - 0x1c], 0x67268e36
mov dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x2e0]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], 0x18
mov eax, dword [ebp - 0x134]
mov eax, dword fs:[eax]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
add eax, 0xc
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0x310], eax

Function at 0x67009050
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67151e6e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x672699e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.67007af0
mov dword [esi], vtable.QObjectPrivate.0
mov eax, dword [edi + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esi + 0x1c], eax
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [edi + 0x20]
mov dword [esi + 0x20], edx
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x28], ecx
mov edx, dword [edi + 0x2c]
mov dword [esi + 0x2c], edx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x38]
mov dword [esi + 0x38], edx
mov eax, dword [edi + 0x3c]
lea ecx, [esi + 0x3c]
mov byte [esp + 0x18], 1
mov dword [ecx], eax
mov edx, 1
lock xadd dword [eax], edx
mov eax, dword [ecx]
test byte [eax + 0xc], 1
jne 0x670090f5
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
push edx
push eax
call fcn.67004b80
mov eax, dword [edi + 0x40]
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 2
mov dword [ecx], eax
mov edx, 1
lock xadd dword [eax], edx
mov eax, dword [ecx]
test byte [eax + 0x10], 1
jne 0x6700911c
mov eax, dword [eax + 4]
push eax
call fcn.67007a30
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x44], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x44], edx
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x6700ca10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67155b08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x672699e0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
fld qword [edi + 0x90]
mov ebx, dword [edi + 4]
fld qword [edi + 0xa8]
mov eax, dword [ebx]
fld qword [esp + 0x34]
sub esp, 8
fsub st(2)
lea ecx, [edi + 0xb0]
fxch st(1)
lea edx, [edi + 0x98]
fsubrp st(2)
fdivrp st(1)
fstp qword [esp]
push ecx
push edx
mov edx, dword [eax + 0x40]
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebx
call edx
mov eax, dword [edi + 0x70]
mov ecx, dword [edi + 0x74]
mov edx, dword [edi + 0x78]
mov ebp, dword [esp + 0x14]
lea esi, [edi + 0x70]
mov dword [esi], ebp
mov ebp, dword [esp + 0x18]
mov dword [esi + 4], ebp
mov ebp, dword [esp + 0x1c]
mov dword [esi + 8], ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
mov dword [esi + 0xc], ebp
mov dword [esp + 0x1c], edx
mov edx, dword [ebx]
mov eax, dword [edx + 0x3c]
push esi
mov ecx, ebx
mov dword [esp + 0x30], 0
call eax
mov ecx, dword [0x67269a08]
test ecx, ecx
jne 0x6700cae6
push 0x6716ac68
mov ecx, edi
call sym.QtCore4.dll_public:_int___thiscall_QObjectPrivate::signalIndex_char_const__const
mov edx, eax
mov ecx, 0x67269a08
xor eax, eax
lock cmpxchg dword [ecx], edx
mov eax, dword [0x67269a08]
cmp eax, 0x40
jae 0x6700cb17
mov ecx, eax
and ecx, 0x1f
mov edx, 1
shl edx, cl
shr eax, 5
test dword [edi + eax*4 + 0x34], edx
jne 0x6700cb17
cmp dword [sym.QtCore4.dll_struct_QSignalSpyCallbackSet_qt_signal_spy_callback_set], 0
jne 0x6700cb17
cmp dword [0x67269d50], 0
je 0x6700cb48
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call sym.QtCore4.dll_protected:_bool___thiscall_QVariant::cmp_class_QVariant_const__const
test al, al
jne 0x6700cb48
lea ecx, [esp + 0x34]
push ecx
push 0
push sym.QtCore4.dll_struct_QMetaObject_const_QVariantAnimation::staticMetaObject
push ebx
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], esi
call sym.QtCore4.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call sym.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x67013dc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6715274d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x672699e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
push ebx
lea ecx, [esi + 4]
mov dword [esi], 1
call sym.QtCore4.dll_public:_void___thiscall_QMutex::constructor_enum_QMutex::RecursionMode_
lea ecx, [esi + 8]
mov dword [esp + 0x18], ebx
call sym.QtCore4.dll_public:_void___thiscall_QWaitCondition::constructor_void_
mov dword [esi + 0xc], sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov eax, sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [esp + 0x20]
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 2
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], edx
call sym.QtCore4.dll_public:_void___thiscall_QWaitCondition::constructor_void_
lea ecx, [esi + 0x38]
mov byte [esp + 0x18], 3
mov dword [esi + 0x34], ebx
call sym.QtCore4.dll_public:_void___thiscall_QtConcurrent::ResultStoreBase::constructor_void_
lea ecx, [esi + 0x5c]
push ebx
mov byte [esp + 0x1c], 4
mov byte [esi + 0x54], bl
mov dword [esi + 0x58], ebx
call fcn.67016f20
mov dword [esi + 0x60], sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov eax, sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov ecx, 1
lock xadd dword [eax], ecx
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], 6
mov dword [esi + 0x64], ebx
call sym.QtCore4.dll_public:_void___thiscall_QElapsedTimer::invalidate_void_
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x67015c60
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x67015c6c
jmp sym.QtCore4.dll_public:_void___thiscall_QFutureInterfaceBase::waitForResume_void_
ret
Function at 0x670196e0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x67152ef9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x672699e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov eax, dword [0x67269a34]
cmp eax, ebx
je 0x67019726
mov ecx, dword [esp + 0x2c]
push ecx
push esi
call eax
add esp, 8
jmp 0x67019751
mov edx, dword [esp + 0x2c]
mov edi, dword [sym.imp.MSVCR100.dll___iob_func]
push edx
push 0x6716b8fc
call edi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call edi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fflush]
add esp, 0x10
cmp esi, 3
je 0x67019789
cmp esi, 1
jne 0x67019782
lea eax, [esp + 0x10]
push str.QT_FATAL_WARNINGS
push eax
call sym.QtCore4.dll_class_QByteArray___cdecl_qgetenv_char_const__
add esp, 8
mov dword [esp + 0x20], ebx
mov ebx, esi
mov ecx, eax
mov dword [esp + 0x14], ebx
call sym.QtCore4.dll_public:_bool___thiscall_QByteArray::isNull_void_const
test al, al
je 0x67019789
mov byte [esp + 0x28], 0
jmp 0x6701978e
mov byte [esp + 0x28], 1
mov dword [esp + 0x20], 0xffffffff
test bl, 1
je 0x670197b5
mov ecx, dword [esp + 0x10]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x670197b5
mov eax, dword [esp + 0x10]
push eax
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
cmp byte [esp + 0x28], 0
je 0x670197c4
push 1
call dword [sym.imp.MSVCR100.dll_exit]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x67019f10
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x672699e0]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [0x67269a44]
test eax, eax
jne 0x67019ffc
lea eax, [esp]
push eax
mov dword [0x67269a44], 0x10
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x10]
sub eax, 0
je 0x67019ff2
dec eax
je 0x67019fd5
mov ecx, dword [esp + 4]
cmp ecx, 5
jae 0x67019f70
mov eax, 0x10
jmp 0x67019ff7
mov eax, dword [esp + 8]
jne 0x67019f99
test eax, eax
jne 0x67019f81
mov eax, 0x20
jmp 0x67019ff7
cmp eax, 1
jne 0x67019f8d
mov eax, 0x30
jmp 0x67019ff7
cmp eax, 2
jne 0x67019fbf
mov eax, 0x40
jmp 0x67019ff7
cmp ecx, 6
jne 0x67019fbf
test eax, eax
jne 0x67019fa7
lea eax, [ecx + 0x7a]
jmp 0x67019ff7
cmp eax, 1
jne 0x67019fb3
mov eax, 0x90
jmp 0x67019ff7
cmp eax, 2
jne 0x67019fbf
mov eax, 0xa0
jmp 0x67019ff7
push eax
push ecx
push str.Qt:_Untested_Windows_version__d._d_detected_
call sym.QtCore4.dll_void___cdecl_qWarning_char_const__
add esp, 0xc
mov eax, 0xf0
jmp 0x67019ff7
mov eax, dword [esp + 8]
cmp eax, 0x5a
jne 0x67019fe5
mov eax, 4
jmp 0x67019ff7
xor ecx, ecx
cmp eax, 0xa
sete cl
lea eax, [ecx + 2]
jmp 0x67019ff7
mov eax, 1
mov dword [0x67269a44], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.671509a6
add esp, 0x118
ret
Function at 0x6701b200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67153168
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x672699e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x10]
call sym.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QChar_
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x30], 0
call fcn.6701b060
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 1
call sym.QtCore4.dll_public:_void___thiscall_QVariant::constructor_class_QString_const__
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x30], 2
call sym.QtCore4.dll_public:_void___thiscall_QSettings::setValue_class_QString_const___class_QVariant_const__
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call sym.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_
mov ecx, dword [esp + 8]
mov byte [esp + 0x28], 0
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x6701b29d
mov eax, dword [esp + 8]
push eax
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x6701b2bf
mov eax, dword [esp + 0xc]
push eax
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov ecx, esi
call sym.QtCore4.dll_public:_bool___thiscall_QSettings::isWritable_void_const
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 0xc
Function at 0x670239f0
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [sym.QtCore4.dll_class_QMutexPool__qt_global_mutexpool], 0
jne 0x67023a08
call sym.QtCore4.dll_public:_static_class_QMutexPool____cdecl_QMutexPool::instance_void_
mov dword [sym.QtCore4.dll_class_QMutexPool__qt_global_mutexpool], eax
jmp fcn.670256c0
ret

Function at 0x670244a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67153f13
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x672699e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x24]
xor ebx, ebx
mov edi, sym.QtCore4.dll_struct_QVectorData_QVectorData::shared_null
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], edi
mov ecx, edi
mov edx, 1
lock xadd dword [ecx], edx
lea eax, [esi + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], eax
mov dword [eax], sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov ecx, sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov edx, 1
lock xadd dword [ecx], edx
push ebx
lea ecx, [eax + 0x10]
mov byte [esp + 0x20], 1
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
call sym.QtCore4.dll_public:_void___thiscall_QMutex::constructor_enum_QMutex::RecursionMode_
mov byte [esi + 0x30], 1
mov dword [esi + 0x34], edi
mov eax, 1
lock xadd dword [edi], eax
mov byte [esi + 0x38], bl
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x67025560
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x670256c0
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x671540be
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x672699e0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
or esi, 0xffffffff
cmp dword [0x672676b8], esi
jne 0x67025781
test byte [0x67269ab0], 1
jne 0x67025726
or dword [0x67269ab0], 1
push 0
mov ecx, 0x67269aac
mov dword [esp + 0x18], 0
call sym.QtCore4.dll_public:_void___thiscall_QMutex::constructor_enum_QMutex::RecursionMode_
push 0x67169280
call fcn.67150b2b
add esp, 4
mov dword [esp + 0x14], esi
push 0x67269aac
lea ecx, [esp + 0xc]
call sym.QtCore4.dll_public:_void___thiscall_QMutexLocker::constructor_class_QMutex__
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x672676b8], eax
mov eax, dword [esp + 8]
test al, 1
je 0x67025781
and eax, 0xfffffffe
mov ecx, eax
mov eax, dword [ecx]
test byte [eax + 4], 1
je 0x6702576a
call sym.QtCore4.dll_public:_void___thiscall_QMutex::unlock_void_
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
mov esi, eax
xor edx, edx
mov eax, 1
lock cmpxchg dword [esi], edx
cmp eax, 1
je 0x67025781
call sym.QtCore4.dll_private:_void___thiscall_QMutex::unlockInternal_void_
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x670267e0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x6715e378
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x672699e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [0x67269aa8]
test byte [eax + 4], 1
je 0x6702681a
mov ecx, 0x67269aa8
call sym.QtCore4.dll_public:_void___thiscall_QMutex::lock_void_
jmp 0x6702683a
mov edx, eax
mov ecx, 1
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
sete al
test al, al
jne 0x6702683a
mov ecx, 0x67269aa8
call sym.QtCore4.dll_private:_void___thiscall_QMutex::lockInternal_void_
mov ebx, 0x67269aa8
or ebx, 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x67269a9c]
jne 0x6702686c
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x67026918
lea eax, [esp + 0x20]
push eax
mov ecx, 0x672676bc
call fcn.670512d0
lea ecx, [esp + 0x24]
push ecx
mov ecx, 0x672676c0
call fcn.670512d0
cmp dword [0x67269a9c], 0
jne 0x6702690b
cmp dword [0x67269aa0], 0
jne 0x670268f1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [sym.QtCore4.dll_struct_QVectorData_QVectorData::shared_null]
mov dword [0x67269aa0], eax
mov eax, dword [edx]
cmp eax, 1
je 0x670268d3
mov eax, dword [sym.QtCore4.dll_struct_QVectorData_QVectorData::shared_null]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
push ecx
push edx
mov ecx, 0x672676bc
call fcn.670ecc00
mov eax, dword [sym.QtCore4.dll_struct_QVectorData_QVectorData::shared_null]
push 0x67269aa0
push 1
add eax, 0x10
push eax
mov ecx, 0x672676bc
call fcn.67025fa0
mov ebx, dword [esp + 0xc]
push 0x67269a9c
push 0
push 0
push 0x67026460
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x67026918
mov ecx, dword [0x67269aa0]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esp + 0x18], 0xffffffff
test bl, 1
je 0x67026960
and ebx, 0xfffffffe
mov ecx, ebx
mov eax, dword [ecx]
test byte [eax + 4], 1
je 0x67026949
call sym.QtCore4.dll_public:_void___thiscall_QMutex::unlock_void_
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
mov esi, eax
mov eax, 1
xor edx, edx
lock cmpxchg dword [esi], edx
cmp eax, 1
je 0x67026960
call sym.QtCore4.dll_private:_void___thiscall_QMutex::unlockInternal_void_
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x67027de0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
push edi
mov edi, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
movsx edx, byte [ecx]
mov ecx, dword [edi]
add eax, eax
add eax, eax
add eax, eax
sub eax, edx
mov edx, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
movsx edx, byte [edx]
add ecx, ecx
add ecx, ecx
add ecx, ecx
sub ecx, edx
mov dword [esp + 0x10], eax
cmp ecx, eax
mov dword [esp + 8], ecx
lea eax, [esp + 0x10]
jl 0x67027e23
lea eax, [esp + 8]
mov eax, dword [eax]
push eax
mov ecx, edi
call sym.QtCore4.dll_public:_void___thiscall_QBitArray::resize_int_
mov eax, dword [edi]
mov ecx, dword [eax]
cmp ecx, 1
jne 0x67027e40
mov eax, dword [edi]
lea edx, [eax + 0x10]
cmp dword [eax + 0xc], edx
je 0x67027e4d
mov eax, dword [edi]
mov ecx, dword [eax + 8]
push ecx
mov ecx, edi
call sym.QtCore4.dll_private:_void___thiscall_QByteArray::realloc_int_
mov ecx, dword [esi]
mov esi, dword [ecx + 0xc]
mov edx, dword [edi]
mov ecx, dword [ecx + 8]
mov eax, dword [edx + 0xc]
dec ecx
inc eax
inc esi
test ecx, ecx
jle 0x67027e6c
mov dl, byte [esi]
xor byte [eax], dl
dec ecx
inc esi
inc eax
test ecx, ecx
jg 0x67027e61
mov eax, edi
pop edi
pop esi
pop ecx
ret 4

Function at 0x670284b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov eax, 0xffff
test edx, edx
je 0x670284fa
push edi
mov cl, byte [esi]
mov edi, eax
movzx ecx, cl
xor edi, ecx
shr ax, 4
and edi, 0xf
xor ax, word [edi*2 + 0x6716df88]
shr ecx, 4
movzx eax, ax
xor ecx, eax
shr ax, 4
and ecx, 0xf
xor ax, word [ecx*2 + 0x6716df88]
inc esi
dec edx
movzx eax, ax
jne 0x670284c3
pop edi
not eax
pop esi
ret
Function at 0x6702a830
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x67154388
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x672699e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
call sym.QtCore4.dll_private:_class_QByteArray___thiscall_QByteArray::nulTerminated_void_
mov ebp, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
mov eax, dword [ecx + 0xc]
push 0
push ebp
push edx
push eax
mov dword [esp + 0x30], 0
call sym.QtCore4.dll_public:_static_long_long___int64____cdecl_QLocalePrivate::bytearrayToLongLong_char_const___int__bool___bool__
mov edi, eax
mov eax, dword [esp + 0x20]
add esp, 0x10
mov esi, edx
mov dword [esp + 0x20], 0xffffffff
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x6702a8a8
mov edx, dword [esp + 0x10]
push edx
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov eax, edi
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
jl 0x6702a8cb
jg 0x6702a8bd
cmp edi, 0x80000000
jb 0x6702a8cb
test esi, esi
jl 0x6702a8d9
jg 0x6702a8cb
cmp edi, 0x7fffffff
jbe 0x6702a8d9
test ebp, ebp
je 0x6702a8d3
mov byte [ebp], 0
xor eax, eax
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 8

Function at 0x6702a8f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x67154388
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x672699e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
call sym.QtCore4.dll_private:_class_QByteArray___thiscall_QByteArray::nulTerminated_void_
mov ebp, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
mov eax, dword [ecx + 0xc]
push 0
push ebp
push edx
push eax
mov dword [esp + 0x30], 0
call sym.QtCore4.dll_public:_static_long_long___int64____cdecl_QLocalePrivate::bytearrayToLongLong_char_const___int__bool___bool__
mov edi, eax
mov eax, dword [esp + 0x20]
add esp, 0x10
mov esi, edx
mov dword [esp + 0x20], 0xffffffff
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x6702a968
mov edx, dword [esp + 0x10]
push edx
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
mov eax, edi
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
jl 0x6702a98b
jg 0x6702a97d
cmp edi, 0xffff8000
jb 0x6702a98b
test esi, esi
jl 0x6702a999
jg 0x6702a98b
cmp edi, 0x7fff
jbe 0x6702a999
test ebp, ebp
je 0x6702a993
mov byte [ebp], 0
xor eax, eax
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 8