joyce8/EMBER2024-capa huggingface dataset:
Function at 0x670077a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x446], cl
mov edx, dword [ebp - 0xbfc]
sub edx, dword [ebp - 0x494]
mov dword [ebp - 0x19a8], edx
mov dword [ebp - 0xee8], 0
push edi
push eax
add esp, 4
jmp 0x670077cf
sub edi, 0x12f7a
pop edi
push eax
push ecx
add esp, 4
or eax, 0xa013
or eax, 0x6f0b
xor eax, 0x3c4
xor eax, 0x8f03
pop eax
mov byte [ebp - 0xb5c], 0x56
mov byte [ebp - 0xb5b], 0x69
mov byte [ebp - 0xb5a], 0x72
mov byte [ebp - 0xb59], 0x74
mov byte [ebp - 0xb58], 0x75
mov byte [ebp - 0xb57], 0x61
mov byte [ebp - 0xb56], 0x6c
mov byte [ebp - 0xb55], 0x50
mov byte [ebp - 0xb54], 0x72
mov byte [ebp - 0xb53], 0x6f
mov byte [ebp - 0xb52], 0x74
mov byte [ebp - 0xb51], 0x65
mov byte [ebp - 0xb50], 0x63
mov byte [ebp - 0xb4f], 0x74
test dword [ecx + 0x74fffff4], esi
mov byte [ebp - 0xb4e], 0
push eax
and eax, 0x10e1d
jmp 0x6700786a
xor eax, 0x50bd
sub eax, 0x24ce
pop eax
push edx
push ebx
add esp, 4
sub edx, 0x15506
add edx, 0x1752f
xor edx, 0x15952
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1f48], eax
mov ecx, dword [ebp - 0x1f48]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1f4c], edx
mov eax, dword [ebp - 0x1f4c]
mov dword [ebp - 0x1928], eax
push edx
add edx, 0x178a5
pop edx
push ecx
push ecx

Function at 0x670078df
Capabilities:
Get number of processors

Disassembly:
push edi
call 0x670078df
add byte [edx + eax*2], dh
dec edi
dec esi
inc edi
cmp byte [edi], dh
xor al, 0x83
les eax, [ebx + ebp*8]
add esi, dword [esi]
cmp cl, byte [eax + 0x5f]
cmp dword [ebp - 0x1928], 0
jne 0x67007900
mov dword [ebp - 0x394], 0
jmp 0x67007ba7
mov ecx, dword [ebp - 0x1928]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xec4], eax
push ecx
push ebx
add esp, 4
sub ecx, 0x151a
xor ecx, 0xdc30
and ecx, 0xa3e0
pop ecx
push esi
xor esi, 0x33fa
xor esi, 0x9414
and esi, 0xbb61
or esi, 0x328c
pop esi
cmp dword [ebp - 0xec4], 0
jne 0x6700795c
mov dword [ebp - 0x394], 0
jmp 0x67007ba7
mov ecx, dword [ebp - 0xec4]
mov dword [ebp - 0x5d4], ecx
push ebx
call 0x67007976
add byte [edx], dh
dec ebp
xor eax, 0x3b4e4733
add esp, 4
pop ebx
push edx
call fcn.6700798a
push ecx
push eax
add esp, 4
and ecx, 0x61df
or ecx, 0x5b69
add ecx, 0x87df
pop ecx
push esi

Function at 0x67007b2d
Capabilities:
Get number of processors

Disassembly:
add al, ch
pop es
add byte [eax], al
add byte [eax], al
inc edi
inc edi
xor eax, dword ds:[ecx - 0x7d]
les eax, [ebx + ebx*2]
pop ebx
mov ecx, dword [ebp - 0x5d4]
mov dword [ebp - 0x394], ecx
jmp 0x67007ba7

Function at 0x67007b30
Capabilities:
Get number of processors

Disassembly:
add al, ch
pop es
add byte [eax], al
add byte [eax], al
inc edi
inc edi
xor eax, dword ds:[ecx - 0x7d]
les eax, [ebx + ebx*2]
pop ebx
mov ecx, dword [ebp - 0x5d4]
mov dword [ebp - 0x394], ecx
jmp 0x67007ba7
Function at 0x67007b5c
Capabilities:
Get number of processors

Disassembly:
push ebp
shr byte [ebx], 0xca
mov dword [ebp - 0x1930], ecx
jmp 0x67007af6
cmp dword [ebp - 0x1930], 0
jne 0x67007b3f
push esi
push edi
add edi, 0xcf95
pop edi
push eax
push eax
add esp, 4
call 0x67007b5c
add byte [eax], al
cmp al, 0x4c
cmp byte [0x3e4d4845], bh
inc esi
add esp, 4
jmp 0x67007b64
pop eax
push edx
push esi
add esp, 4
and edx, 0x18526
pop edx
mov edx, dword [ebp - 0x5d4]
mov eax, dword [edx]
mov dword [ebp - 0x5d4], eax
mov ecx, dword [ebp - 0x5d4]
cmp ecx, dword [ebp - 0xec4]
je 0x67007b9d
mov edx, dword [ebp - 0x5d4]
cmp dword [edx + 0x30], 0
jne 0x67007968
mov dword [ebp - 0x394], 0

Function at 0x67007bc0
Capabilities:
Get number of processors

Disassembly:
jmp 0x67007bc6
or esi, 0xc6b
pop esi
push ecx
push eax
add esp, 4
xor ecx, 0x4c75
pop ecx
cmp dword [ebp - 0x394], 0
jne 0x670084de
mov eax, 0x6b
mov word [ebp - 0x1ae4], ax
mov ecx, 0x65
mov word [ebp - 0x1ae2], cx
mov edx, 0x72
mov word [ebp - 0x1ae0], dx
mov eax, 0x6e
mov word [ebp - 0x1ade], ax
mov ecx, 0x65
mov word [ebp - 0x1adc], cx
mov edx, 0x6c
mov word [ebp - 0x1ada], dx
invalid
invalid

Function at 0x67007c30
Capabilities:
Get number of processors

Disassembly:
add byte [eax], al
add byte [esi - 0x77], ah
test dword [eax], ebp
in eax, 0xff
invalid

Function at 0x67007c70
Capabilities:
Get number of processors

Disassembly:
mov dword [ebp - 0x1ace], edx
xor eax, eax
mov word [ebp - 0x1acc], ax
push edx
push eax
add esp, 4
xor edx, 0xc4aa
add edx, 0x15ab9
pop edx
push ecx
sub ecx, 0x3ff9
pop ecx
push eax
push esi
add esp, 4
xor eax, 0x4fa4
pop eax
push ebx
push eax
add esp, 4
jmp sym.Qt5Core.dll_private:_void___thiscall_QVector_class_QPoint_::copyConstruct_class_QPoint_const___class_QPoint_const___class_QPoint__

Function at 0x67007cb0
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
pop ebx
mov byte [ebp - 0xafc], 0x4c
mov byte [ebp - 0xafb], 0x6f
mov byte [ebp - 0xafa], 0x61
mov byte [ebp - 0xaf9], 0x64
mov byte [ebp - 0xaf8], 0x4c
mov byte [ebp - 0xaf7], 0x69
mov byte [ebp - 0xaf6], 0x62
mov byte [ebp - 0xaf5], 0x72
mov byte [ebp - 0xaf4], 0x61
Function at 0x6700804b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [ebp - 0xaf3], 0x72
mov byte [ebp - 0xaf2], 0x79
mov byte [ebp - 0xaf1], 0x57
mov byte [ebp - 0xaf0], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1f50], ecx
mov edx, dword [ebp - 0x1f50]
mov eax, dword [edx + 0x30]
inc edx
xor byte [ecx - 0x1f537b], cl
dec dword [ebx - 0x1f5373]
dec dword [ecx - 0x193373]
call dword [edi + 0x56]
add esp, 4
call 0x67007d48
add byte [ebp + 0x4e], al
cmp al, byte ss:[esi + edi + 0x4f]
inc eax
inc esi
add esp, 4
or edi, 0x1284a
jmp 0x67007d57
and edi, 0x64b4
pop edi
push ebx
and ebx, 0x1873
jecxz 0x67007dd5
sbb byte [eax], al
add byte [ebx - 0x7d], bl
mov ebp, 0xffffe6cc
add byte [ebp + 0xf], dh
mov dword [ebp - 0x894], 0
jmp 0x67008025
mov edx, dword [ebp - 0x1934]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xed0], ecx
push esi
push edx
add esp, 4
jmp 0x67008031
add esi, 0x33c3
jmp 0x6700803c
call 0x6700804b
add byte [edx], bh
cmp eax, 0x373c433c
inc eax
inc edx
xor eax, 0x5e04c483
push ecx
and ecx, 0xc994
pop ecx
cmp dword [ebp - 0x894], 0
jne 0x670080a1
push edi
push ebx
add esp, 4
call 0x67008074
add byte [edi], bh
dec ecx
xor eax, 0x4846414d
add esp, 4
pop edi
push ecx
and ecx, 0xe369
or ecx, 0x79c8
xor ecx, 0x7a5b
add ecx, 0x13a95
pop ecx
mov dword [ebp - 0xbf8], 0
jmp 0x67008bc9
push ebx
jmp 0x670080ab
pop ebx
push eax
sub eax, 0x63e6
pop eax
push edx
jmp 0x670080be
pop edx
push edx
xor edx, 0x10e56
sub edx, 0x83e0
add edx, 0x71d1
pop edx
mov ecx, dword [ebp - 0x894]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3d0], edx
mov dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x3d0]
dec dword [ecx - 0x197f7b]
inc dword [ebx - 0x197f43]
inc dword [eax]
invalid
Function at 0x67008892
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push edx
add esp, 4
jmp 0x67008833
add edi, 0x99bc
pop edi
push edi
or edi, 0xdda0
or edi, 0x10f54
call 0x67008857
add byte [edi + 0x33], cl
inc ecx
inc ebp
dec ecx
aas
dec esi
dec esp
add esp, 4
pop edi
mov ecx, dword [ebp - 0x394]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3cc], edx
push esi
sub esi, 0xeaf7
sub esi, 0x8e5a
and esi, 0x16710
pop esi
push ecx
add ecx, 0x10132
sal dword [edx], 1
add dword [eax], eax
call 0x67008892
add byte [edi + 0x49], al
inc ecx
cmp al, 0x43
inc ecx
add esp, 4
add ecx, 0x10492
pop ecx
mov dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x199c], eax
cmp dword [ebp - 0x199c], 0
jne 0x670088cc
mov ecx, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], ecx
jmp 0x67008bbd
mov edx, dword [ebp - 0x199c]
mov eax, dword [ebp - 0x3cc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x19a0], eax
jne 0x670088f4
mov ecx, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], ecx
jmp 0x67008bbd
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x19a0]
dec dword [ebx - 0x7687feac]
xchg ebp, eax
pop esp
out 0xff, al
inc dword [ebx - 0x19a343]
inc dword [eax]
jne 0x67008926
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], eax
jmp 0x67008bbd
mov ecx, dword [ebp - 0x3cc]
add ecx, dword [ebp - 0x19a4]
mov dword [ebp - 0x8a8], ecx
jne 0x6700894b
mov edx, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], edx
jmp 0x67008bbd
mov eax, dword [ebp - 0x8a8]
mov ecx, dword [ebp - 0x3cc]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x1f74], ecx
mov edx, dword [ebp - 0x8a8]
mov eax, dword [ebp - 0x3cc]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1f78], eax
mov ecx, dword [ebp - 0x8a8]
mov edx, dword [ebp - 0x3cc]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1f7c], edx
mov dword [ebp - 0x8ac], 0
jmp 0x670089a5
mov ecx, dword [ebp - 0x8a8]
mov edx, dword [ebp - 0x8ac]
cmp edx, dword [ecx + 0x18]
jae 0x67008bb1
mov eax, dword [ebp - 0x8ac]
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], eax
invalid
lea esp, [eax]
Function at 0x6700e140
Capabilities:
Encode data using xor

Disassembly:
stc
add eax, 0x4c88705
add al, 6
push es
push es
outsd dx, dword [esi]
mov esp, dword [esi + 0x40505f9]
push es
push es
push es
or eax, dword [ecx + 0x6c]
insb byte es:[edi], dx
stc
pop esp
outsd dx, dword [esi]
xchg ebx, eax
cmpsb byte [esi], byte es:[edi]
stc
add eax, 0x6060405
push es
xor edi, eax
cmp esi, edx
salc
adc eax, 0xf9a69bb5
add eax, 0x9e9b8f05
in eax, 5
add eax, 0xe59e9b91
sahf
in eax, 5
add eax, 0xe59a9b8f
add eax, 0x9a8b7105
in eax, 5
add eax, 0x5e8b3f0b
sahf
in eax, 5
add eax, 0xe59a9b8f
add eax, 0x9a8b7105
in eax, 5
add eax, 0x5e8b3f0b
add dword [0x19891505], eax
js 0x6700e163
push es
pop ecx
xchg ecx, edi
inc edx
push 0xd1870607
push es
xchg ecx, edx
and byte [ecx - 0x678f9fa], ch
dec esi
inc edi
push es
push es
popal
pop ebp
pop ecx
mov edx, ecx
or al, byte [edi + 0x6e4e4cd]
push es
xchg ebp, esi
dec ecx
or eax, 0xcd870606
ja 0x6700e10b
pop es
push es
xchg ebp, esi
push edx
xchg ebx, eax
push es
push es
mov ebx, eax
dec esi
inc dword [0x3d7b0605]
pop ebp
xchg ebp, esi
pushal
jl 0x6700e1a5
push es
xchg ebp, edi
xor eax, 0x870606fe
aad 0xc5
ja 0x6700e1b0
xchg ebp, edx
lds esi, [edi + 6]
push es
push esi
push edi
mov edx, ecx
or al, byte [edi + 0x75dd3ee]
push es
xchg esi, ebp
clc
loope 0x6700e1c2
push es
xchg esi, esp
cmp eax, 0x87060750
out 0x1a, al
sbb eax, 0xef5e0606
push es
xchg esi, esp
sbb bl, byte [0xef5e0606]
cmpsd dword [esi], dword es:[edi]
ja 0x6700e1d5
push es
push esi
xchg esi, ebp
inc edx
jae 0x6700e1dc
push es
xchg esi, ebp
sub eax, 0x870606c8
out 0x7d, al
sahf
xchg esi, esp
jge 0x6700e17e
push es
push es
xchg esi, esp
scasb al, byte es:[edi]
aaa
push es
push es
pop esi
push esi
pop esp
mov edx, ecx
or al, byte [edi + 0x78344c6]
inc esp
add dword [edi], 6
xchg esi, ecx
loope 0x6700e274
push es
push es
xchg esi, esi
fcmovne st(0), st(2)
push es
push es
add eax, 0xf1a29391
add eax, 0x9e938f05
int1
add eax, 0x9e9b9105
int1
add eax, 0xd29b8f05
inc dword [0x4e8b9105]
inc dword [0xd68b8f05]
jecxz 0x6700e29d
add eax, 0x8dee8756
xchg ebp, eax
push es
push es
pop esi
pop ebp
pop esp
mov edx, ecx
or al, byte [edi + 0x69cfbf5]
push es
xchg ebp, edi
outsb dx, byte [esi]
jp 0x6700e2b8
push es
out dx, al
adc byte [esi], al
push es
push es
push es
dec esi
push ecx
dec ebp
push ecx
cmp byte [esi], bh
inc ebp

Function at 0x67024640
Capabilities:
Execute syscall

Disassembly:
dec edi
push esi
dec esp
mov edx, ecx
or al, byte [edi + 0x7500eec]
push es
adc eax, 0x4e69bbd
add eax, 0x7bd88b05
push ds
adc eax, 0x3be8bbd
add eax, 0x93bd1505
out 4, al
add eax, 0x8fc73105
mov edi, dword [esi - 0xefafa13]
invalid
Function at 0x6702a480
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6722a316
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x67463180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.6702ad30
push dword [0x6746202c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x6702a562
cmp byte [ebp + 8], al
je 0x6702a562
push 0x40
call fcn.67226c32
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x6702a4f3
push 1
mov ecx, eax
call fcn.67026ae0
mov edi, eax
mov dword [ebp - 0x14], eax
jmp 0x6702a4f8
xor edi, edi
mov dword [ebp - 0x14], edi
push edi
push dword [0x6746202c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 8
mov dword [ebp - 4], 1
call fcn.67226c32
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x6702a52b
push edi
mov ecx, eax
call fcn.670268a0
jmp 0x6702a52d
xor eax, eax
mov dword [ebp - 0x18], eax
mov ecx, edi
mov eax, dword [ebp - 0x18]
mov dword [edi + 0x20], eax
mov dword [ebp - 4], 0xffffffff
call fcn.670271b0
mov byte [edi + 0x3e], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi + 0x24], eax
mov eax, dword [sym.Qt5Core.dll_class_QBasicAtomicPointer_class_QThread__QCoreApplicationPrivate::theMainThread]
test eax, eax
jne 0x6702a576
mov eax, dword [edi + 0x20]
mov dword [sym.Qt5Core.dll_class_QBasicAtomicPointer_class_QThread__QCoreApplicationPrivate::theMainThread], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [edi + 0x20]
push eax
push dword [ebp - 0x14]
call fcn.6702add0
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6702a900
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x6702b040
Capabilities:
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x6723d958
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x67463180]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 4]
lea ebx, [esi + 0x40]
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x6702b082
mov ecx, ebx
call sym.Qt5Core.dll_public:_void___thiscall_QMutex::lock_void_
or ebx, 1
mov dword [esp + 0x10], ebx
cmp byte [esi + 0x4a], 0
mov dword [esp + 0x1c], 0
je 0x6702b0c9
test bl, 1
je 0x6702b0a6
and ebx, 0xfffffffe
mov ecx, ebx
mov dword [esp + 0x10], ebx
and ecx, 0xfffffffe
call sym.Qt5Core.dll_public:_void___thiscall_QMutex::unlock_void_
push 0xffffffffffffffff
mov ecx, edi
call sym.Qt5Core.dll_public:_bool___thiscall_QThread::wait_unsigned_long_int_
test ebx, ebx
je 0x6702b0c9
test bl, 1
jne 0x6702b0c9
mov ecx, ebx
and ecx, 0xfffffffe
call sym.Qt5Core.dll_public:_void___thiscall_QMutex::lock_void_
or ebx, 1
mov dword [esp + 0x10], ebx
cmp byte [esi + 0x48], 0
jne 0x6702b1a9
lea eax, [esi + 0x60]
mov word [esi + 0x48], 1
push eax
push 4
push edi
push 0x6702b1f0
push dword [esi + 0x54]
mov word [esi + 0x4b], 0
push 0
mov dword [esi + 0x50], 0
call dword [0x67248364]
add esp, 0x18
mov dword [esi + 0x5c], eax
test eax, eax
jne 0x6702b127
call dword [0x67248360]
push str.QThread::start:_Failed_to_create_thread
push dword [eax]
call sym.Qt5Core.dll_void___cdecl_qErrnoWarning_int__char_const__
add esp, 8
mov word [esi + 0x48], 0x100
jmp 0x6702b1a9
mov eax, dword [esp + 0x24]
mov dword [esi + 0x58], eax
cmp eax, 6
ja case.default.0x6702b133
jmp dword [eax*4 + 0x6702b1d0]
mov eax, 0xfffffff1
jmp 0x6702b173
mov eax, 0xfffffffe
jmp 0x6702b173
or eax, 0xffffffff
jmp 0x6702b173
xor eax, eax
jmp 0x6702b173
mov eax, 1
jmp 0x6702b173
mov eax, 2
jmp 0x6702b173
mov eax, 0xf
jmp 0x6702b173
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push eax
push dword [esi + 0x5c]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x6702b18e
push str.QThread::start:_Failed_to_set_thread_priority
call sym.Qt5Core.dll_void___cdecl_qErrnoWarning_char_const__
add esp, 4
push dword [esi + 0x5c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x6702b1a9
push str.QThread::start:_Failed_to_resume_new_thread
call sym.Qt5Core.dll_void___cdecl_qErrnoWarning_char_const__
add esp, 4
test bl, 1
je 0x6702b1b8
and ebx, 0xfffffffe
mov ecx, ebx
call sym.Qt5Core.dll_public:_void___thiscall_QMutex::unlock_void_
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x6702c180
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6722a4e9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67463180]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
lea eax, [esp + 0x30]
mov dword [esp + 0x24], 1
push eax
lea ecx, [esp + 0x1c]
call sym.Qt5Core.dll_public:_void___thiscall_QDebugStateSaver::constructor_class_QDebug__
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x30]
push str.QBitArray_
mov byte [esp + 0x28], 2
mov byte [eax + 0x14], 0
call sym.Qt5Core.dll_public:_class_QDebug____thiscall_QDebug::operator___char_const__
mov ebp, dword [esp + 0x34]
xor edi, edi
mov ebx, dword [ebp]
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
shl ecx, 3
movsx eax, byte [eax + ebx]
sub ecx, eax
mov eax, dword [esp + 0x30]
test ecx, ecx
jle 0x6702c2a4
mov esi, edi
mov ecx, edi
sar esi, 3
and ecx, 7
add esi, dword [ebx + 0xc]
mov edx, 1
shl edx, cl
mov ecx, eax
test byte [esi + ebx + 1], dl
je 0x6702c224
push 0x31
jmp 0x6702c226
push 0x30
call sym.Qt5Core.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov eax, dword [esp + 0x30]
cmp byte [eax + 0x14], 0
je 0x6702c242
push 0x20
mov ecx, eax
call sym.Qt5Core.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov eax, dword [esp + 0x30]
inc edi
mov ecx, edi
and ecx, 0x80000003
jns 0x6702c252
dec ecx
or ecx, 0xfffffffc
inc ecx
jne 0x6702c28a
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
shl edx, 3
movsx ecx, byte [ecx + esi]
sub edx, ecx
cmp edi, edx
jge 0x6702c28a
push 0x20
mov ecx, eax
call sym.Qt5Core.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov eax, dword [esp + 0x30]
cmp byte [eax + 0x14], 0
je 0x6702c28a
push 0x20
mov ecx, eax
call sym.Qt5Core.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov eax, dword [esp + 0x30]
mov ebx, dword [ebp]
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 4]
shl edx, 3
movsx ecx, byte [ecx + ebx]
sub edx, ecx
cmp edi, edx
jl 0x6702c204
push 0x29
mov ecx, eax
call sym.Qt5Core.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov eax, dword [esp + 0x30]
cmp byte [eax + 0x14], 0
je 0x6702c2c4
push 0x20
mov ecx, eax
call sym.Qt5Core.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov dword [esi], eax
inc dword [eax + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 1
mov byte [esp + 0x24], 1
call sym.Qt5Core.dll_public:_void___thiscall_QDebugStateSaver::destructor_void_
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 0
call sym.Qt5Core.dll_public:_void___thiscall_QDebug::destructor_void_
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x6702c870
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
lea ebx, [esp + 8]
push edi
mov edi, ecx
mov edx, dword [esi]
mov ecx, dword [edi]
mov eax, dword [edx + 0xc]
movsx eax, byte [eax + edx]
mov edx, dword [edx + 4]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x14], edx
movsx eax, byte [eax + ecx]
mov ecx, dword [ecx + 4]
shl ecx, 3
sub ecx, eax
lea eax, [esp + 0x14]
cmp ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, edi
cmovge eax, ebx
push dword [eax]
call sym.Qt5Core.dll_public:_void___thiscall_QBitArray::resize_int_
mov ecx, dword [edi]
mov eax, dword [ecx]
cmp eax, 1
je 0x6702c8c7
test eax, eax
jne 0x6702c8cd
cmp dword [ecx + 0xc], 0x10
je 0x6702c8eb
xor eax, eax
mov edx, 1
test dword [ecx + 8], 0x80000000
cmovne eax, edx
push eax
mov eax, dword [ecx + 4]
mov ecx, edi
inc eax
push eax
call sym.Qt5Core.dll_private:_void___thiscall_QByteArray::reallocData_unsigned_int__class_QFlags_enum_QArrayData::AllocationOption__
mov edx, dword [esi]
mov ecx, dword [edi]
lea esi, [edx + 1]
add esi, dword [edx + 0xc]
mov eax, dword [ecx + 0xc]
mov edx, dword [edx + 4]
inc eax
dec edx
add eax, ecx
test edx, edx
jle 0x6702c912
mov cl, byte [esi]
lea esi, [esi + 1]
xor byte [eax], cl
lea eax, [eax + 1]
dec edx
test edx, edx
jg 0x6702c903
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x6702d350
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x672359d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67463180]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x18], 0
mov ecx, dword [eax]
mov edi, dword [ecx + 4]
add edi, dword [ecx + 0xc]
mov ebp, dword [ecx + 0xc]
add edi, ecx
add ebp, ecx
mov esi, ebp
cmp ebp, edi
je 0x6702d3af
mov ebx, dword [esp + 0x34]
lea esp, [esp]
movzx eax, byte [esi]
mov al, byte [eax + ebx]
cmp byte [esi], al
jne 0x6702d3d3
inc esi
cmp esi, edi
jne 0x6702d3a0
mov eax, dword [esp + 0x2c]
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov dword [ecx], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp esi, edi
je 0x6702d3af
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
mov dword [eax], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov eax, dword [ecx]
mov dword [esp + 0x24], 0
cmp eax, 1
je 0x6702d3f8
test eax, eax
jne 0x6702d3fe
cmp dword [ecx + 0xc], 0x10
je 0x6702d422
xor eax, eax
mov edx, 1
test dword [ecx + 8], 0x80000000
cmovne eax, edx
push eax
mov eax, dword [ecx + 4]
lea ecx, [esp + 0x18]
inc eax
push eax
call sym.Qt5Core.dll_private:_void___thiscall_QByteArray::reallocData_unsigned_int__class_QFlags_enum_QArrayData::AllocationOption__
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0xc]
add edx, ecx
mov eax, edx
sub eax, ebp
xor ebp, ebp
add esi, eax
mov eax, dword [ecx + 4]
add eax, edx
xor edx, edx
mov edi, eax
sub edi, esi
cmp esi, eax
cmova edi, ebp
test edi, edi
je 0x6702d454
movzx eax, byte [esi]
lea esi, [esi + 1]
inc edx
mov al, byte [eax + ebx]
mov byte [esi - 1], al
cmp edx, edi
jne 0x6702d443
mov esi, dword [esp + 0x2c]
mov eax, dword [sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null]
mov dword [esi], ecx
test eax, eax
je 0x6702d47b
cmp eax, 0xffffffff
je 0x6702d48c
mov ecx, sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
or eax, 0xffffffff
lock xadd dword [ecx], eax
setne al
test al, al
jne 0x6702d48c
push 4
push 1
push sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData___unsigned_int__unsigned_int_
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x6702f4d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, 0xffff
push edi
mov edi, dword [esp + 0xc]
test esi, esi
je 0x6702f51b
mov cl, byte [edi]
lea edi, [edi + 1]
movzx edx, cl
mov ecx, eax
xor ecx, edx
shr ax, 4
and ecx, 0xf
shr edx, 4
xor ax, word [ecx*2 + 0x6724b9a0]
movzx eax, ax
xor edx, eax
shr ax, 4
and edx, 0xf
xor ax, word [edx*2 + 0x6724b9a0]
movzx eax, ax
dec esi
jne 0x6702f4e3
pop edi
not eax
pop esi
ret