joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180152760
Capabilities:
Encode data using xor

Disassembly:
push r14
sub rsp, 0x30
mov r14d, edx
mov rdx, qword [rcx]
mov eax, r14d
test rdx, rdx
je 0x180152862
movzx ecx, word [rdx + 0x10]
shl eax, 6
add ecx, eax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x28], rdi
mov eax, r14d
shr eax, 2
add eax, 0x9e3779b9
mov qword [rsp + 0x20], r15
add eax, ecx
xor r15d, r15d
movzx ecx, word [rdx + 0x12]
xor r14d, eax
mov eax, r14d
shl eax, 6
add ecx, eax
mov eax, r14d
add ecx, 0x9e3779b9
shr eax, 2
add eax, ecx
mov rcx, qword [rdx + 8]
xor r14d, eax
movsxd rdi, dword [rcx + 0xc]
movsxd rbx, dword [rcx + 8]
add rdi, 2
add rbx, 2
lea rdi, [rcx + rdi*8]
lea rbx, [rcx + rbx*8]
cmp rbx, rdi
je 0x18015283a
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
nop dword [rax + rax]
mov rsi, qword [rbx]
xor edx, edx
mov rcx, rsi
call sym.Qt5Core.dll_unsigned_int___cdecl_qHash_class_QString_const____ptr64__unsigned_int_
lea rcx, [rsi + 8]
xor edx, edx
mov ebp, eax
call sym.Qt5Core.dll_unsigned_int___cdecl_qHash_class_QString_const____ptr64__unsigned_int_
mov ecx, r15d
rol ebp, 0x10
shl ecx, 6
xor eax, ebp
add eax, ecx
add rbx, 8
mov ecx, r15d
add eax, 0x9e3779b9
shr ecx, 2
add eax, ecx
xor r15d, eax
cmp rbx, rdi
jne 0x1801527f0
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x28]
mov eax, r14d
mov rbx, qword [rsp + 0x40]
mov ecx, r14d
shl eax, 6
add eax, 0x9e3779b9
shr ecx, 2
add eax, r15d
mov r15, qword [rsp + 0x20]
add eax, ecx
xor eax, r14d
add rsp, 0x30
pop r14
ret
Function at 0x180156a70
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rsi, r8
mov r12, rdx
mov rbp, rcx
mov r13, qword [rcx + 0x18]
test r8, r8
js 0x180156bed
xor ebx, ebx
cmp qword [rcx + 0x78], rbx
je 0x180156b4d
mov r15b, 1
nop dword [rax]
nop word [rax + rax]
mov r8, rsi
sub r8, rbx
lea rcx, [rbx + r12]
mov r9, qword [rbp + 0x78]
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rdi, rax
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
setne r14b
test r15b, r15b
je 0x180156b1a
test r14b, r14b
je 0x180156b1a
test rdi, rdi
jne 0x180156b1a
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
xor r15b, r15b
jmp 0x180156b1d
add rbx, rdi
test r14b, r14b
jne 0x180156c54
test rdi, rdi
jne 0x180156b3b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x180156b43
xor ecx, ecx
cmp rbx, rsi
setl cl
test ecx, ecx
jne 0x180156ac0
jmp 0x180156b9b
cmp dword [rcx + 0xa0], 0xffffffff
je 0x180156ba4
nop word [rax + rax]
mov rax, rsi
sub rax, rbx
mov r8d, 0x7fffffff
cmp rax, r8
cmovb r8d, eax
lea rdx, [rbx + r12]
mov ecx, dword [rbp + 0xa0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
movsxd rcx, eax
test eax, eax
jle 0x180156b92
add rbx, rcx
cmp rbx, rsi
jl 0x180156b60
cmp ecx, 0xffffffff
jne 0x180156c54
test rbx, rbx
jne 0x180156c54
mov rbx, 0xffffffffffffffff
mov edx, ebx
lea rcx, [rsp + 0x70]
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QSystemError::stdString_int_
nop
mov r8, rax
lea edx, [rbx + 2]
mov rcx, r13
call sym.Qt5Core.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFileDevice::FileError__class_QString_const____ptr64____ptr64
nop
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax]
test ecx, ecx
je 0x180156be6
cmp ecx, ebx
je 0x180156c54
mov edx, ebx
mov rcx, qword [rsp + 0x70]
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x180156c54
mov rcx, qword [rsp + 0x70]
jmp 0x180156c45
mov edx, 0x16
lea rcx, [rsp + 0x80]
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QSystemError::stdString_int_
nop
mov r8, rax
mov edx, 1
mov rcx, r13
call sym.Qt5Core.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFileDevice::FileError__class_QString_const____ptr64____ptr64
nop
mov rax, qword [rsp + 0x80]
mov ecx, dword [rax]
mov rbx, 0xffffffffffffffff
test ecx, ecx
je 0x180156c3d
cmp ecx, ebx
je 0x180156c54
mov ecx, ebx
mov rax, qword [rsp + 0x80]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x180156c54
mov rcx, qword [rsp + 0x80]
mov r8d, 8
lea edx, [r8 - 6]
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64__
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180157660
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
and dword [rbx + 0x40], 0xfdffffff
cmp dword [rbx + 0xa4], 2
je 0x180157699
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0xa4], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x180185870
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x18]
cmp qword [rcx + 0x78], 0
jne 0x1801859a5
cmp dword [rcx + 0xa0], 0xffffffff
jne 0x1801859a5
mov rcx, qword [rcx + 0x80]
cmp rcx, 0xffffffffffffffff
je 0x18018599c
xor r12d, r12d
mov edi, r12d
mov rbx, r8
mov r8d, 0x2000000
cmp rbx, r8
cmovl r8d, ebp
mov qword [rax - 0x48], r12
lea r9, [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180185939
nop dword [rax]
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x180185934
add rdi, rax
sub rbx, rax
cmp rdi, rbp
jge 0x180185934
mov r8d, 0x2000000
cmp rbx, r8
cmovl r8d, ebx
lea rdx, [rdi + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1801858f0
test rdi, rdi
je 0x180185939
mov rax, rdi
jmp 0x1801859aa
mov edx, 0xffffffff
lea rcx, [rsp + 0x88]
call sym.Qt5Core.dll_class_QString___cdecl_qt_error_string_int_
nop
mov r8, rax
mov edx, 2
mov rcx, r15
call sym.Qt5Core.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFileDevice::FileError__class_QString_const____ptr64____ptr64
nop
mov rax, qword [rsp + 0x88]
mov ecx, dword [rax]
test ecx, ecx
je 0x180185986
cmp ecx, 0xffffffff
je 0x18018599c
mov ecx, 0xffffffff
mov rax, qword [rsp + 0x88]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x18018599c
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rsp + 0x88]
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64__
mov rax, 0xffffffffffffffff
jmp 0x1801859aa
call fcn.1801576c0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1801576c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rbp
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
mov r14, qword [rcx + 0x18]
test r8, r8
js 0x1801577fd
xor ebx, ebx
test r8, r8
je 0x1801577f4
cmp qword [rcx + 0x78], rbx
je 0x18015774f
nop dword [rax]
nop word [rax + rax]
mov r8, rdi
sub r8, rbx
lea rcx, [rbx + rbp]
mov r9, qword [rsi + 0x78]
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rbx, rax
test rax, rax
jne 0x180157741
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x180157749
xor ecx, ecx
cmp rbx, rdi
setl cl
test ecx, ecx
jne 0x180157710
jmp 0x180157791
cmp dword [rcx + 0xa0], 0xffffffff
je 0x180157796
nop dword [rax + rax]
mov rax, rdi
sub rax, rbx
mov r8d, 0x7fffffff
cmp rax, r8
cmovb r8d, eax
lea rdx, [rbx + rbp]
mov ecx, dword [rsi + 0xa0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
test eax, eax
jle 0x180157791
cdqe
add rbx, rax
cmp rbx, rdi
jl 0x180157760
test rbx, rbx
jne 0x1801577f4
mov rbx, 0xffffffffffffffff
mov edx, ebx
lea rcx, [rsp + 0x50]
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QSystemError::stdString_int_
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edx, 2
mov ecx, 4
cmp dword [rax], 0x1c
cmove edx, ecx
mov r8, rdi
mov rcx, r14
call sym.Qt5Core.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFileDevice::FileError__class_QString_const____ptr64____ptr64
nop
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax]
test ecx, ecx
je 0x1801577ed
cmp ecx, ebx
je 0x180157858
mov ecx, ebx
mov rax, qword [rsp + 0x50]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x180157858
mov rcx, qword [rsp + 0x50]
jmp 0x180157849
and dword [rsi + 0x40], 0xffdfffff
jmp 0x180157858
mov edx, 0x16
lea rcx, [rsp + 0x60]
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QSystemError::stdString_int_
nop
mov r8, rax
mov edx, 2
mov rcx, r14
call sym.Qt5Core.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFileDevice::FileError__class_QString_const____ptr64____ptr64
nop
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax]
mov rbx, 0xffffffffffffffff
test ecx, ecx
je 0x180157844
cmp ecx, ebx
je 0x180157858
mov ecx, ebx
mov rax, qword [rsp + 0x60]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x180157858
mov rcx, qword [rsp + 0x60]
mov r8d, 8
lea edx, [r8 - 6]
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64__
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x180163b30
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1805858b8]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r8, qword [rdx]
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 4], 2
jl 0x180163d1b
mov rax, qword [r8 + 0x10]
movzx ecx, word [rax + r8]
lea eax, [rcx - 0x41]
cmp eax, 0x39
ja 0x180163b7c
lea eax, [rcx - 0x5b]
cmp eax, 5
ja 0x180163b92
cmp ecx, 0x7f
jbe 0x180163d1b
call sym.Qt5Core.dll_private:_static_bool___cdecl_QChar::isLetter_helper_unsigned_int_
test al, al
je 0x180163d1b
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
cmp word [rcx + rax + 2], 0x3a
jne 0x180163d1b
movzx ecx, word [rcx + rax]
call sym.Qt5Core.dll_public:_static_unsigned_int___cdecl_QChar::toUpper_unsigned_int_
test ax, ax
je 0x180163d1b
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rdi + 0x20]
cmp rcx, rdx
je 0x180163bd7
cmp word [rcx + 8], ax
je 0x180163d1b
add rcx, 0x10
cmp rcx, rdx
jne 0x180163bc4
movups xmm0, xmmword [str..A:_]
lea rcx, [rsp + 0x90]
mov word [rsp + 0x48], ax
movups xmmword [rsp + 0x88], xmm0
mov word [rsp + 0x90], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x180163d1b
xor ebx, ebx
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0x30], rbx
lea edx, [rax + 0x7e]
mov dword [rsp + 0x28], 0x2000000
lea r8d, [rax + 5]
xor r9d, r9d
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180163c63
lea rdx, [rsp + 0x88]
lea rcx, str.CreateFile__ls_failed.
call sym.Qt5Core.dll_void___cdecl_qErrnoWarning_char_const____ptr64_
jmp 0x180163d13
xorps xmm0, xmm0
mov qword [rsp + 0x58], rbx
xorps xmm1, xmm1
mov dword [rsp + 0x50], gethostname
mov cl, 1
mov dword [rsp + 0x54], 6
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rsi
movdqu xmmword [rsp + 0x78], xmm1
call fcn.180029ec0
mov rcx, rax
mov rax, qword [rax + 0x48]
test rax, rax
jne 0x180163ca7
call fcn.180028ef0
mov rcx, rax
call sym.Qt5Core.dll_public:_struct_HWND______ptr64___cdecl_QEventDispatcherWin32::internalHwnd_void____ptr64
mov rcx, rax
lea rdx, [rsp + 0x50]
xor r8d, r8d
call qword [sym.imp.USER32.dll_RegisterDeviceNotificationW]
mov rcx, rsi
mov qword [rsp + 0x40], rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
jne 0x180163cec
lea rdx, [rsp + 0x88]
lea rcx, str.RegisterDeviceNotification__ls_failed.
call sym.Qt5Core.dll_void___cdecl_qErrnoWarning_char_const____ptr64_
jmp 0x180163d13
mov rdx, qword [rdi + 0x28]
cmp qword [rdi + 0x30], rdx
je 0x180163d05
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdx], xmm0
add qword [rdi + 0x28], 0x10
jmp 0x180163d13
lea r8, [rsp + 0x40]
lea rcx, [rdi + 0x20]
call fcn.180162620
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1802e1ba0
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
ret
Function at 0x18016cad0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x1e0]
test rcx, rcx
je 0x18016cafc
mov qword [rsp + 0x60], rdx
lea rdx, [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rdi + 0x40]
movzx edx, byte [rdi + 0x20]
mov r9, qword [rdi + 0x18]
mov r8, qword [rdi + 0x10]
mov rcx, qword [rdi]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x30], rax
mov eax, dword [rdi + 0x24]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
mov rdx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbx + 0x108]
test eax, eax
setne dil
cmp rcx, 0xffffffffffffffff
je 0x18016cb68
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x108], 0xffffffffffffffff
mov rcx, qword [rbx + 0x148]
cmp rcx, 0xffffffffffffffff
je 0x18016cb86
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x148], 0xffffffffffffffff
mov rcx, qword [rbx + 0x180]
cmp rcx, 0xffffffffffffffff
je 0x18016cba4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x180], 0xffffffffffffffff
mov rbx, qword [rsp + 0x68]
movzx eax, dil
add rsp, 0x50
pop rdi
ret
Function at 0x18016f7c0
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xd8]
mov rbx, rcx
test rax, rax
je 0x18016f805
mov edx, dword [rax + 0x10]
lea rcx, [0x18016e410]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbx + 0xd8]
xor r9d, r9d
xor r8d, r8d
mov ecx, dword [rax + 0x14]
lea edx, [r9 + 0x10]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_PostThreadMessageW]
add rsp, 0x20
pop rbx
ret

Function at 0x18017e1d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov rdi, rdx
mov rbx, rcx
xor eax, eax
mov dword [rbp - 0x50], eax
lea r14, sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov qword [rcx], r14
mov dword [rbp - 0x50], 1
mov qword [rbp + 0x48], rax
lea r9, [rbp + 0x48]
xor r8d, r8d
mov edx, 0x4000
mov rcx, rdi
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x18017e2be
mov esi, 0xffffffff
mov r8d, esi
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x40]
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf16_unsigned_short_int_const____ptr64__int_
nop
mov rcx, qword [rax]
mov qword [rbp - 0x40], rcx
mov qword [rax], r14
mov dword [rbp - 0x50], 9
mov rax, qword [rbp + 0x40]
mov ecx, dword [rax]
test ecx, ecx
je 0x18017e26a
cmp ecx, esi
je 0x18017e27c
mov ecx, esi
mov rax, qword [rbp + 0x40]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x18017e27c
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rbp + 0x40]
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64__
mov rcx, qword [rbx]
mov qword [rbp - 0x48], rcx
mov rax, qword [rbp - 0x40]
mov qword [rbx], rax
mov eax, dword [rcx]
test eax, eax
je 0x18017e2a2
cmp eax, 0xffffffff
je 0x18017e2b4
mov rax, qword [rbp - 0x48]
lock xadd dword [rax], esi
cmp esi, 1
jne 0x18017e2b4
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rbp - 0x48]
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64__
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rbx]
cmp dword [rax + 4], 0
jne 0x18017e341
mov rax, qword [rdi]
cmp rax, qword [0x1804b0a00]
jne 0x18017e301
mov rax, qword [rdi + 8]
cmp rax, qword [0x1804b0a08]
jne 0x18017e301
mov dword [rbp - 0x40], 0x11
lea rax, str.C:_tempqt_common
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x20]
jmp 0x18017e339
mov rax, qword [rdi]
cmp rax, qword [0x1804b0a10]
jne 0x18017e341
mov rax, qword [rdi + 8]
cmp rax, qword [0x1804b0a18]
jne 0x18017e341
mov dword [rbp - 0x40], 0xf
lea rax, str.C:_tempqt_user
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x10], xmm0
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.1800bdc10
mov rax, rbx
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180185870
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
and dword [rbx + 0x40], 0xfdffffff
cmp dword [rbx + 0xa4], 2
je 0x180157699
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0xa4], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x180185870
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x18]
cmp qword [rcx + 0x78], 0
jne 0x1801859a5
cmp dword [rcx + 0xa0], 0xffffffff
jne 0x1801859a5
mov rcx, qword [rcx + 0x80]
cmp rcx, 0xffffffffffffffff
je 0x18018599c
xor r12d, r12d
mov edi, r12d
mov rbx, r8
mov r8d, 0x2000000
cmp rbx, r8
cmovl r8d, ebp
mov qword [rax - 0x48], r12
lea r9, [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180185939
nop dword [rax]
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x180185934
add rdi, rax
sub rbx, rax
cmp rdi, rbp
jge 0x180185934
mov r8d, 0x2000000
cmp rbx, r8
cmovl r8d, ebx
lea rdx, [rdi + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1801858f0
test rdi, rdi
je 0x180185939
mov rax, rdi
jmp 0x1801859aa
mov edx, 0xffffffff
lea rcx, [rsp + 0x88]
call sym.Qt5Core.dll_class_QString___cdecl_qt_error_string_int_
nop
mov r8, rax
mov edx, 2
mov rcx, r15
call sym.Qt5Core.dll_protected:_void___cdecl_QAbstractFileEngine::setError_enum_QFileDevice::FileError__class_QString_const____ptr64____ptr64
nop
mov rax, qword [rsp + 0x88]
mov ecx, dword [rax]
test ecx, ecx
je 0x180185986
cmp ecx, 0xffffffff
je 0x18018599c
mov ecx, 0xffffffff
mov rax, qword [rsp + 0x88]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x18018599c
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rsp + 0x88]
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64__
mov rax, 0xffffffffffffffff
jmp 0x1801859aa
call fcn.1801576c0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180187490
Capabilities:
Copy file

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rsi, r8
mov rax, rdx
mov rdi, rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.180158900
nop
mov rcx, rax
call sym.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64
mov rbx, rax
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.180158900
nop
mov rcx, rax
call sym.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne dil
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax]
mov ebx, 0xffffffff
test ecx, ecx
je 0x18018751d
cmp ecx, ebx
je 0x180187531
mov ecx, ebx
mov rax, qword [rsp + 0x58]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x180187531
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rsp + 0x58]
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64__
nop
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax]
test ecx, ecx
je 0x18018754f
cmp ecx, 0xffffffff
je 0x180187562
mov rax, qword [rsp + 0x20]
lock xadd dword [rax], ebx
cmp ebx, 1
jne 0x180187562
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rsp + 0x20]
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64__
test dil, dil
jne 0x180187581
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], 2
mov rcx, qword [rsp + 0x58]
mov qword [rsi], rcx
movzx eax, dil
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret