joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412d6e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
lea eax, [ebp - 8]
push esi
push edi
push eax
push 0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x412e43
mov dword [0x4162ac], 0x83
jmp 0x412f04
xor esi, esi
test esi, esi
je 0x412e3e
mov byte [ebp + edi - 0x108], 0
call fcn.004134f8
push 0x3d
call fcn.00413625
test eax, eax
je 0x412dcb
push 0x20
call fcn.00413625
xor edi, edi
lea eax, [ebp - 1]
push eax
call fcn.00413560
test eax, eax
je 0x412e09
push dword [ebp - 1]
call fcn.00413671
test eax, eax
jne 0x412e09
cmp edi, 0x3fff
jae 0x412e07
mov al, byte [ebp - 1]
inc edi
lea ecx, [ebp - 1]
mov byte [edi + 0x41654f], al
push ecx
call fcn.00413560
test eax, eax
jne 0x412dda
jmp 0x412e09
xor esi, esi
test esi, esi
je 0x412e3e
push edi
lea eax, [ebp - 0x108]
mov byte [edi + 0x416550], 0
push 0x416550
push 1
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
je 0x412e3a
mov dword [0x4162ac], 0x84
test esi, esi
jne 0x412e43
call fcn.0041351f
lea eax, [ebp - 1]
push eax
call fcn.00413560
test eax, eax
je 0x412ef2
mov edi, 0x412af8
call fcn.0041361e
push 0x5c
call fcn.00413625
test eax, eax
jne 0x412e6f
mov edi, dword [0x412ac0]
mov esi, 1
mov al, byte [edi]
test al, al
je 0x412e87
inc edi
push eax
call fcn.00413625
test eax, eax
jne 0x412e74
xor esi, esi
test esi, esi
je 0x412e3a
push 0x5c
call fcn.00413625
mov esi, eax
test esi, esi
je 0x412e3e
xor edi, edi
lea eax, [ebp - 1]
push eax
call fcn.00413560
test eax, eax
je 0x412da4
mov ebx, 0x20
cmp byte [ebp - 1], bl
je 0x412da4
push dword [ebp - 1]
call fcn.00413671
test eax, eax
jne 0x412da4
cmp edi, 0xff
jae 0x412da2
mov al, byte [ebp - 1]
inc edi
lea ecx, [ebp - 1]
mov byte [ebp + edi - 0x109], al
push ecx
call fcn.00413560
test eax, eax
jne 0x412eb0
jmp 0x412da4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413560
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
cmp dword [0x416294], 0x200
jne 0x4135ea
lea eax, [esp]
push 0
push eax
push 0x200
push 0x416090
push dword [0x416290]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41359e
mov dword [0x4162ac], 0x82
xor eax, eax
jmp 0x413618
mov dword [0x416294], 0
mov eax, dword [esp]
mov dword [0x41629c], eax
add dword [0x4162a4], eax
cmp dword [0x4162a0], 0
je 0x4135d2
mov eax, dword [0x4162a4]
sub edx, edx
div dword [0x4162a0]
cmp eax, 0x64
jbe 0x4135d7
mov eax, 0x64
cmp eax, dword [0x4162a8]
je 0x4135ea
push eax
mov dword [0x4162a8], eax
call fcn.00412a91
mov eax, dword [0x41629c]
cmp dword [0x416294], eax
mov eax, 0
jge 0x413618
mov eax, dword [0x416294]
mov edx, dword [esp + 8]
mov cl, byte [eax + 0x416090]
mov eax, 1
mov byte [edx], cl
inc dword [0x416294]
add esp, 4
ret 4
Function at 0x413799
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x5b
xor edi, edi
call fcn.00413a97
push dword [ebp + 0xc]
call fcn.0041392b
push 0x41b10c
call fcn.0041392b
mov esi, dword [ebp + 8]
mov ecx, edi
lea eax, [ebp - 4]
inc edi
push eax
push 0x416550
lea edx, [ebp - 0xc]
push edx
lea ebx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
mov dword [ebp - 4], 0x4000
push 0
push ebx
push 0x41a570
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebx, eax
test ebx, ebx
jne 0x41387f
cmp dword [ebp - 0x10], 0
je 0x41380d
push 0x41a570
call fcn.00413949
jmp 0x413814
push 0x40
call fcn.00413a97
push 0x3d
call fcn.00413a97
mov eax, dword [ebp - 0xc]
cmp eax, 1
je 0x413854
cmp eax, 4
je 0x413860
push dword [ebp - 4]
push dword [ebp - 0xc]
push 0x416550
call fcn.004139a4
push 0xa
call fcn.00413a97
cmp dword [0x4162ac], 0x8d
jne 0x4137c0
jmp 0x413922
push 0x416550
call fcn.00413949
jmp 0x413838
cmp dword [ebp - 4], 4
jne 0x413828
push 0x412b14
call fcn.0041392b
push 1
mov eax, dword [0x416550]
push eax
call fcn.00413a49
jmp 0x413838
push 0xa
call fcn.00413a97
cmp ebx, 0x103
je 0x413898
mov dword [0x4162ac], 0x8c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp + 0xc]
mov ebx, 0x100
add edi, eax
mov byte [edi], 0x5c
inc edi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x14], 0
sub ebx, eax
mov eax, dword [ebp - 0x14]
push ebx
push edi
inc dword [ebp - 0x14]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x413911
lea eax, [ebp - 8]
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x413905
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.00413799
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4162ac], 0x8d
jne 0x4138bf
jmp 0x413922
mov dword [0x4162ac], 0x8b
jmp 0x4138bf
cmp eax, 0x103
je 0x413922
mov dword [0x4162ac], 0x8c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x413ae0
Capabilities:
Write file on windows

Disassembly:
sub esp, 4
cmp dword [0x416294], 0
je 0x413b24
lea eax, [esp]
push 0
push eax
push dword [0x416294]
push 0x416090
push dword [0x416290]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x413b1a
mov eax, dword [esp]
cmp dword [0x416294], eax
je 0x413b24
mov dword [0x4162ac], 0x8d
mov dword [0x416294], 0
add esp, 4
ret
Function at 0x413ea8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x5b
xor edi, edi
call fcn.00414078
push dword [ebp + 0xc]
call fcn.00413fdc
push 0x41b10c
call fcn.00413fdc
mov esi, dword [ebp + 8]
cmp dword [0x416010], edi
je 0x413f62
xor ebx, ebx
mov ecx, edi
lea eax, [ebp - 8]
inc edi
push eax
push 0x416550
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x100
mov dword [ebp - 8], 0x4000
push ebx
push eax
push 0x41a570
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x413f62
cmp dword [ebp - 0xc], ebx
je 0x413f22
push 0x41a570
call fcn.00413fdc
jmp 0x413f29
push 0x40
call fcn.00414078
push 0x3d
call fcn.00414078
cmp dword [ebp - 0x14], 1
je 0x413f45
push dword [ebp - 8]
push 0x416550
call fcn.00413fff
jmp 0x413f4f
push 0x416550
call fcn.00413fdc
push 0xa
call fcn.00414078
cmp dword [0x416010], ebx
jne 0x413edd
push 0xa
call fcn.00414078
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp + 0xc]
mov ebx, 0x127
add edi, eax
sub ebx, eax
mov dword [ebp - 0x10], 0
mov byte [edi], 0x5c
inc edi
cmp dword [0x416010], 0
je 0x413fd3
mov eax, dword [ebp - 0x10]
push ebx
push edi
inc dword [ebp - 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x413fd3
lea eax, [ebp - 4]
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x413fca
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.00413ea8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x416010], 0
jne 0x413f92
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x670050d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6713530f
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
push ebx
call sym.QtCore4.dll_public:_void___thiscall_QObject::constructor_class_QObject__
mov dword [esi], vtable.QUnifiedTimer.0
mov dword [esp + 0x18], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
fld qword [0x67155900]
mov eax, sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
fstp qword [esi + 0x38]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], 0x10
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x40], bl
mov dword [esi + 0x44], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov dword [esi + 0x48], eax
mov edx, 1
lock xadd dword [ecx], edx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], eax
mov ecx, 1
lock xadd dword [eax], ecx
lea ecx, [esi + 0x10]
mov byte [esp + 0x18], 5
call sym.QtCore4.dll_public:_void___thiscall_QElapsedTimer::invalidate_void_
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x67005a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x671353f1
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x14], edi
mov esi, dword [esp + 0x30]
mov ebx, 1
push 0x28
mov ecx, esi
mov dword [esp + 0x28], ebx
mov byte [esi + 0x14], 0
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
cmp byte [esi + 0x14], 0
je 0x67005ab6
push 0x20
mov ecx, esi
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov ebp, dword [esp + 0x34]
mov eax, dword [ebp]
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 8]
test ecx, ecx
jle 0x67005b17
test edi, edi
je 0x67005ad9
push 0x67155938
lea ecx, [esp + 0x34]
call sym.QtCore4.dll_public:_class_QDebug____thiscall_QDebug::operator___char_const__
mov eax, dword [ebp]
mov edx, dword [eax + 8]
add edx, edi
mov eax, dword [eax + edx*4 + 0x14]
push eax
push ecx
mov eax, esp
lea ecx, [esp + 0x3c]
mov dword [esp + 0x20], esp
mov dword [eax], esi
add dword [esi + 0xc], ebx
push ecx
call sym.QtCore4.dll_class_QDebug___cdecl_operator___class_QDebug__class_QObject_const__
add esp, 0xc
lea ecx, [esp + 0x34]
call sym.QtCore4.dll_public:_void___thiscall_QDebug::destructor_void_
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
sub edx, dword [eax + 8]
add edi, ebx
cmp edi, edx
jl 0x67005ac7
push 0x29
mov ecx, esi
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
cmp byte [esi + 0x14], 0
je 0x67005b2f
push 0x20
mov ecx, esi
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
push 0x20
mov ecx, esi
mov byte [esi + 0x14], bl
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov edi, dword [esp + 0x2c]
mov dword [edi], esi
add dword [esi + 0xc], ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], ebx
mov byte [esp + 0x24], 0
call sym.QtCore4.dll_public:_void___thiscall_QDebug::destructor_void_
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x67008560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6713588e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.670071b0
mov dword [esi], vtable.QObjectPrivate.0
mov eax, dword [edi + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esi + 0x1c], eax
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [edi + 0x20]
mov dword [esi + 0x20], edx
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x28], ecx
mov edx, dword [edi + 0x2c]
mov dword [esi + 0x2c], edx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x38]
mov dword [esi + 0x38], edx
mov eax, dword [edi + 0x3c]
lea ecx, [esi + 0x3c]
mov byte [esp + 0x18], 1
mov dword [ecx], eax
mov edx, 1
lock xadd dword [eax], edx
mov eax, dword [ecx]
test byte [eax + 0x10], 1
jne 0x67008601
mov eax, dword [eax + 4]
push eax
call fcn.67004680
mov eax, dword [edi + 0x40]
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 2
mov dword [ecx], eax
mov edx, 1
lock xadd dword [eax], edx
mov eax, dword [ecx]
test byte [eax + 0x10], 1
jne 0x67008628
mov eax, dword [eax + 4]
push eax
call fcn.670070d0
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x44], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x44], edx
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov ecx, dword [edi + 0x4c]
mov dword [esi + 0x4c], ecx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x6700bd80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x671359c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
fld qword [edi + 0x90]
mov ebx, dword [edi + 4]
fld qword [edi + 0xa8]
mov eax, dword [ebx]
fld qword [esp + 0x34]
sub esp, 8
fsub st(2)
lea ecx, [edi + 0xb0]
fxch st(1)
lea edx, [edi + 0x98]
fsubrp st(2)
fdivrp st(1)
fstp qword [esp]
push ecx
push edx
mov edx, dword [eax + 0x40]
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebx
call edx
mov eax, dword [edi + 0x70]
mov ecx, dword [edi + 0x74]
mov edx, dword [edi + 0x78]
mov ebp, dword [esp + 0x14]
lea esi, [edi + 0x70]
mov dword [esi], ebp
mov ebp, dword [esp + 0x18]
mov dword [esi + 4], ebp
mov ebp, dword [esp + 0x1c]
mov dword [esi + 8], ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
mov dword [esi + 0xc], ebp
mov dword [esp + 0x1c], edx
mov edx, dword [ebx]
mov eax, dword [edx + 0x3c]
push esi
mov ecx, ebx
mov dword [esp + 0x30], 0
call eax
mov ecx, dword [0x672373a0]
test ecx, ecx
jne 0x6700be56
push 0x67155b60
mov ecx, edi
call sym.QtCore4.dll_public:_int___thiscall_QObjectPrivate::signalIndex_char_const__const
mov edx, eax
mov ecx, 0x672373a0
xor eax, eax
lock cmpxchg dword [ecx], edx
mov eax, dword [0x672373a0]
cmp eax, 0x40
jae 0x6700be87
mov ecx, eax
and ecx, 0x1f
mov edx, 1
shl edx, cl
shr eax, 5
test dword [edi + eax*4 + 0x34], edx
jne 0x6700be87
cmp dword [sym.QtCore4.dll_struct_QSignalSpyCallbackSet_qt_signal_spy_callback_set], 0
jne 0x6700be87
cmp dword [0x67237690], 0
je 0x6700beb8
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call sym.QtCore4.dll_protected:_bool___thiscall_QVariant::cmp_class_QVariant_const__const
test al, al
jne 0x6700beb8
lea ecx, [esp + 0x34]
push ecx
push 0
push sym.QtCore4.dll_struct_QMetaObject_const_QVariantAnimation::staticMetaObject
push ebx
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], esi
call sym.QtCore4.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call sym.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x670134b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67136687
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
push ebx
lea ecx, [esi + 4]
mov dword [esi], 1
call sym.QtCore4.dll_public:_void___thiscall_QMutex::constructor_enum_QMutex::RecursionMode_
lea ecx, [esi + 8]
mov dword [esp + 0x18], ebx
call sym.QtCore4.dll_public:_void___thiscall_QWaitCondition::constructor_void_
mov dword [esi + 0xc], sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov eax, sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x28]
mov byte [esp + 0x18], 2
mov byte [esi + 0x24], bl
call sym.QtCore4.dll_public:_void___thiscall_QWaitCondition::constructor_void_
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 3
mov dword [esi + 0x2c], ebx
call sym.QtCore4.dll_public:_void___thiscall_QtConcurrent::ResultStoreBase::constructor_void_
push ebx
lea ecx, [esi + 0x54]
mov byte [esp + 0x1c], 4
mov byte [esi + 0x4c], bl
mov dword [esi + 0x50], ebx
call fcn.67016740
mov dword [esi + 0x58], sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov eax, sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov ecx, 1
lock xadd dword [eax], ecx
mov dword [esi + 0x5c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x67018fd0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x67137339
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x67237378]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov eax, dword [0x672373c4]
cmp eax, ebx
je 0x67019016
mov ecx, dword [esp + 0x2c]
push ecx
push esi
call eax
add esp, 8
jmp 0x67019041
mov edx, dword [esp + 0x2c]
mov edi, dword [sym.imp.MSVCR80.dll___iob_func]
push edx
push 0x6715684c
call edi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR80.dll_fprintf]
call edi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR80.dll_fflush]
add esp, 0x10
cmp esi, 3
je 0x67019079
cmp esi, 1
jne 0x67019072
lea eax, [esp + 0x10]
push str.QT_FATAL_WARNINGS
push eax
call sym.QtCore4.dll_class_QByteArray___cdecl_qgetenv_char_const__
add esp, 8
mov dword [esp + 0x20], ebx
mov ebx, esi
mov ecx, eax
mov dword [esp + 0x14], ebx
call sym.QtCore4.dll_public:_bool___thiscall_QByteArray::isNull_void_const
test al, al
je 0x67019079
mov byte [esp + 0x28], 0
jmp 0x6701907e
mov byte [esp + 0x28], 1
test bl, 1
mov dword [esp + 0x20], 0xffffffff
je 0x670190a5
mov ecx, dword [esp + 0x10]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x670190a5
mov eax, dword [esp + 0x10]
push eax
call sym.QtCore4.dll_void___cdecl_qFree_void__
add esp, 4
cmp byte [esp + 0x28], 0
je 0x670190b4
push 1
call dword [sym.imp.MSVCR80.dll_exit]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x670198e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x67237378]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [0x672373e4]
test eax, eax
jne 0x670199c1
lea eax, [esp]
push eax
mov dword [0x672373e4], 0x10
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x10]
sub eax, 0
je 0x670199b7
sub eax, 1
je 0x67019998
mov ecx, dword [esp + 4]
cmp ecx, 5
jae 0x6701993f
mov eax, 0x10
jmp 0x670199bc
mov eax, dword [esp + 8]
jne 0x67019968
test eax, eax
jne 0x67019950
mov eax, 0x20
jmp 0x670199bc
cmp eax, 1
jne 0x6701995c
mov eax, 0x30
jmp 0x670199bc
cmp eax, 2
jne 0x67019982
mov eax, 0x40
jmp 0x670199bc
cmp ecx, 6
jne 0x67019982
test eax, eax
jne 0x67019976
lea eax, [ecx + 0x7a]
jmp 0x670199bc
cmp eax, 1
jne 0x67019982
mov eax, 0x90
jmp 0x670199bc
push eax
push ecx
push str.Qt:_Untested_Windows_version__d._d_detected_
call sym.QtCore4.dll_void___cdecl_qWarning_char_const__
add esp, 0xc
mov eax, 0xf0
jmp 0x670199bc
mov eax, dword [esp + 8]
cmp eax, 0x5a
jne 0x670199a8
mov eax, 4
jmp 0x670199bc
xor ecx, ecx
cmp eax, 0xa
sete cl
add ecx, 2
mov eax, ecx
jmp 0x670199bc
mov eax, 1
mov dword [0x672373e4], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.67134048
add esp, 0x118
ret
Function at 0x6701c690
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x6701c63a
cmp dword [eax + 0xc], ebx
je 0x6701c6dd
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.6701c095
sbb byte [ebp + 0x5d3956b7], cl
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x6701c6cb
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x6701c6a6
and eax, 0xffff
push eax
jmp 0x6701c6aa
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.6701c05a
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x6701c884
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x6701c68b
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x6701c62c
call fcn.6701c095
dec ebp
fxch st(6)
mov eax, dword [bx + 0xa0]
add byte [eax], al
cmp eax, ebx
je 0x6701c749

Function at 0x6701c730
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x6701c749
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x6701c744
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
lock add byte [eax], al
cmp edx, 0x3000
jne 0x6701c72e
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x6701c736
cmp edx, ebx
jne 0x6701c884
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x6701c705
add eax, dword [eax + 4]
jmp 0x6701c6f2
mov dword [ebp + 0xc], ebx
jmp 0x6701c754

Function at 0x6701c780
Capabilities:
Inspect section memory permissions

Disassembly:
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
Function at 0x6701c7c0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x6701c76c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x6701c78a
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x6701c7e8
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
add byte [eax], al
invalid
invalid
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x6701c7cf
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x6701c7d8
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x6701c7e2
add ecx, eax
or byte [ecx], 4
invalid
invalid
or dword [eax + eax*2], eax
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x6701c7c4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
jmp dword [esi - 0x75]
dec ebp
or al, 0x66
cmp ecx, dword [eax + 6]
jbe 0x6701c74e
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x6701c835
dec eax
je 0x6701c82c
sub eax, 3
je 0x6701c823
mov dword [ebp - 4], 0x40
jmp 0x6701c852
mov dword [ebp - 4], 4
jmp 0x6701c838
mov dword [ebp - 4], 0x20
jmp 0x6701c838
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x6701c884
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
invalid
invalid
je 0x6701c85f