joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00404502
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00404502
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00404502
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00404502
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00404502
mov dword [0x41203c], eax
call fcn.00404502
test eax, eax
jge 0x402550
push 8
call fcn.00404502
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00404502
pop ecx
push 1
call fcn.00404502
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00404502
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00404502
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00404502
jmp 0x402495

Function at 0x404502
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x404511
pop dword [ebp - 0x3c]
mov eax, 0x404511
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x37b32
push 0
mov eax, 0x676355ef
add eax, 0x98dd8ae9
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x41ff
xor edi, edi
add edi, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 0x3c]
mov edx, 0x313aa27a
add dword [ebp - 0x14], 0x28aa1756
mov esi, dword [ebx]
add dword [ebp - 0x18], 0xf7e0c345
add esi, edx
xor dword [ebp - 0x34], 0x4ddf5427
mov dword [edi], esi
mov dword [ebp - 0x18], 0xc382b871
add edi, 0xfa65322c
sub edi, 0xfa653228
add ebx, 0xf0139fcc
add ebx, 0xfec6038
loop 0x40455b
add eax, 0xfacf
xor ebx, ebx
add ebx, eax
add eax, 0x49519759
add eax, 0xb6ae68ac
mov ecx, 0xe8957392
sub ecx, 0xe8557392
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x408898
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42b7a4], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x4088b5
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x4088e3
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x4088be
mov dword [ecx*4 + 0x42b7a0], eax
inc ecx
cmp ecx, 0x100
jne 0x4088b7
jmp 0x4088a9
cmp edx, ebx
je 0x4088fc
inc edx
mov cl, al
shr eax, 8
xor cl, byte [edx - 1]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x42b7a0]
jmp 0x4088e3
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x40225f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021cb
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406350
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 0x401cf5
lea eax, [ebp - 0x104]
push eax
call fcn.00406464
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406890
add esp, 0xc
call fcn.00401d3d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
add edx, 1
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
and eax, 0xff
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret
Function at 0x405e0b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x405e1a
pop dword [ebp - 0x40]
mov eax, 0x405e1a
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x55f41a3
sub dword [ebp - 0x50], 0xb70cfc58
mov dword [ebp - 0x4c], 0x3981d15
sub dword [ebp - 0x4c], 0xd164d0d0
mov dword [ebp - 0x48], 0x9f624580
sub dword [ebp - 0x48], 0x53160152
mov dword [ebp - 0x44], 0x3f7e5e30
add dword [ebp - 0x44], 0xc081a1d0
lea eax, [ebp - 0x50]
push eax
mov eax, 0x92d503e6
sub eax, 0x929493ca
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x531c2f28
add dword [ebp - 0x50], 0x21563a2e
mov dword [ebp - 0x4c], 0x21f198a5
add dword [ebp - 0x4c], 0x1f7ac8d0
mov dword [ebp - 0x48], 0xc117a406
add dword [ebp - 0x48], 0xa257c866
mov dword [ebp - 0x44], 0xea4a0a20
add dword [ebp - 0x44], 0x15b5f5e0
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x1e4d47ec
add eax, 0xe1f32834
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x383c4
push 0
call eax
mov ecx, 0x6b07619
add ecx, 0xf94fd3e2
xor ebx, ebx
add ebx, eax
mov esi, 0x40c800
add esi, dword [ebp - 0x40]
mov edx, 0xd0f3f52f
sub edx, 0x6deab4b1
sub dword [ebp - 0x24], 0x31371537
mov edi, dword [esi]
xor dword [ebp - 0x28], 0x242e58ba
xor edi, edx
xor dword [ebp - 0xc], esi
mov dword [ebx], edi
add dword [ebp - 0x3c], 0xa192b603
add ebx, 4
add esi, 0x8c9dd686
sub esi, 0x8c9dd682
loop 0x405f33
add eax, 0x6afe3a74
add eax, 0x9502e04b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x425d10
Capabilities:
Enumerate process modules

Disassembly:
push ebp
push edi
xor eax, eax
push esi
push ebx
mov ebp, ecx
mov ecx, 0x10a
sub esp, 0x64c
lea ebx, [esp + 0x218]
lea esi, [esp + 0x10]
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, 0x82
mov edi, esi
mov dword [esp + 0x218], 0x428
rep stosd dword es:[edi], eax
mov dword [esp + 4], 0
mov dword [esp], 8
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
cmp eax, 0xffffffff
mov edi, eax
je 0x425d77
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._Module32FirstW_8
sub esp, 8
test eax, eax
jne 0x425dc3
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], ebp
mov dword [esp + 8], 0xffffffff
call dword [method.QString.fromUtf16_unsigned_short_const__int_]
add esp, 0x64c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov dword [esp + 4], ebx
mov dword [esp], edi
call sym._Module32NextW_8
sub esp, 8
test eax, eax
je 0x425d77
mov eax, dword [esp + 0x664]
sub eax, dword [esp + 0x22c]
cmp eax, dword [esp + 0x230]
jae 0x425db0
lea eax, [esp + 0x438]
mov dword [esp + 8], 0x104
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
sub esp, 0xc
mov eax, dword [esp + 0x668]
mov edx, dword [esp + 0x22c]
mov dword [eax], edx
jmp 0x425d77
Function at 0x47f310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ecx + 8]
mov eax, dword [ebx + 0xc]
mov esi, dword [ebx + 8]
cmp eax, esi
je 0x47f440
sub eax, esi
test eax, eax
mov edx, eax
jle 0x47f34d
lea edi, [ebx + 0x10]
add edx, esi
lea eax, [edi + esi*4]
lea esi, [edi + edx*4]
lea esi, [esi]
mov edx, dword [eax]
add eax, 4
xor byte [edx + 4], 1
cmp eax, esi
jne 0x47f340
mov eax, dword [sym.imp.Qt5Core.dll_QArrayData::shared_null]
mov esi, ecx
lea edi, [ecx + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx]
cmp eax, 1
jbe 0x47f37a
mov eax, dword [ecx + 8]
mov ecx, edi
lea ebx, [ebp - 0x3c]
mov eax, dword [eax + 4]
mov dword [esp], eax
call method.QList_BoardInfo_.detach_helper_int_
mov ebx, dword [esi + 8]
sub esp, 4
mov eax, dword [ebx + 0xc]
mov edx, dword [esi + 0xc]
mov ecx, dword [ebx + eax*4 + 0xc]
sub eax, dword [ebx + 8]
mov edx, dword [edx + 0xc]
mov dword [ebp - 0x20], ecx
mov ecx, dword [esi + 0xc]
sub eax, 1
mov dword [ebp - 0x28], eax
sub edx, dword [ecx + 8]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], edx
mov eax, dword [ebx]
cmp eax, 1
jbe 0x47f3bc
mov eax, dword [ebx + 4]
mov ecx, edi
lea ebx, [ebp - 0x3c]
mov dword [esp], eax
call method.QList_BoardInfo_.detach_helper_int_
mov ebx, dword [esi + 8]
sub esp, 4
mov eax, dword [ebx + 8]
mov ecx, esi
mov eax, dword [ebx + eax*4 + 0x10]
lea ebx, [ebp - 0x3c]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], esi
mov dword [esp + 8], ebx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
lea eax, [ebp - 0x38]
mov dword [esp], eax
call dword [method.QAbstractItemModel.dataChanged_QModelIndex_const__QModelIndex_const__QVector_int__const_]
mov eax, dword [ebp - 0x3c]
sub esp, 0xc
mov edx, dword [eax]
test edx, edx
je 0x47f410
cmp edx, 0xffffffff
je 0x47f429
lock sub dword [eax], 1
mov eax, dword [ebp - 0x3c]
jne 0x47f429
lea esi, [esi]
mov dword [esp + 8], 4
mov dword [esp + 4], 4
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4860a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, ecx
sub esp, 0x2c
mov eax, dword [ecx + 8]
mov dword [esp], eax
call method.qrcodegen::QrCode.getFormatBits_qrcodegen::QrCode::Ecc_
lea edi, [eax*8]
or edi, dword [ebp + 8]
mov ecx, 0xa
mov edx, edi
mov esi, esi
lea edi, [edi]
lea ebx, [edx + edx]
sar edx, 9
imul edx, edx, 0x537
xor edx, ebx
sub ecx, 1
jne 0x4860d0
shl edi, 0xa
or edi, edx
xor edi, 0x5412
mov ebx, edi
sar ebx, 0xf
test ebx, ebx
jne 0x48627f
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x1c]
mov eax, edi
mov dword [esp], 8
mov ecx, edx
mov dword [esp + 4], edx
sar eax, cl
mov ecx, esi
and eax, 1
mov dword [esp + 8], eax
call method.qrcodegen::QrCode.setFunctionModule_int__int__bool_
add dword [ebp - 0x1c], 1
sub esp, 0xc
mov edx, dword [ebp - 0x1c]
cmp edx, 6
jne 0x486102
mov eax, edi
mov ecx, esi
mov dword [esp + 4], 7
sar eax, 6
mov dword [esp], 8
and eax, 1
mov dword [esp + 8], eax
call method.qrcodegen::QrCode.setFunctionModule_int__int__bool_
mov eax, edi
sub esp, 0xc
mov ecx, esi
sar eax, 7
mov dword [esp + 4], 8
mov dword [esp], 8
and eax, 1
mov dword [esp + 8], eax
call method.qrcodegen::QrCode.setFunctionModule_int__int__bool_
mov eax, edi
sub esp, 0xc
mov ecx, esi
sar eax, 8
mov dword [esp + 4], 8
mov dword [esp], 7
and eax, 1
mov dword [esp + 8], eax
call method.qrcodegen::QrCode.setFunctionModule_int__int__bool_
mov dword [ebp - 0x1c], 9
sub esp, 0xc
lea esi, [esi]
mov eax, dword [ebp - 0x1c]
mov edx, edi
mov dword [esp + 4], 8
mov ecx, eax
sar edx, cl
mov ecx, esi
and edx, 1
mov dword [esp + 8], edx
mov edx, 0xe
sub edx, eax
mov dword [esp], edx
call method.qrcodegen::QrCode.setFunctionModule_int__int__bool_
add dword [ebp - 0x1c], 1
sub esp, 0xc
mov eax, dword [ebp - 0x1c]
cmp eax, 0xf
jne 0x4861b0
nop
lea esi, [esi]
mov ecx, ebx
mov eax, edi
mov dword [esp + 4], 8
sar eax, cl
mov ecx, esi
and eax, 1
mov dword [esp + 8], eax
mov eax, ebx
add ebx, 1
not eax
add eax, dword [esi + 4]
mov dword [esp], eax
call method.qrcodegen::QrCode.setFunctionModule_int__int__bool_
sub esp, 0xc
cmp ebx, 8
jne 0x4861f0
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, esi
and eax, 1
mov dword [esp + 8], eax
mov eax, dword [esi + 4]
mov dword [esp], 8
lea eax, [ebx + eax - 0xf]
add ebx, 1
mov dword [esp + 4], eax
call method.qrcodegen::QrCode.setFunctionModule_int__int__bool_
sub esp, 0xc
cmp ebx, 0xf
jne 0x486221
mov dword [esp + 8], 1
mov eax, dword [esi + 4]
mov ecx, esi
mov dword [esp], 8
sub eax, 8
mov dword [esp + 4], eax
call method.qrcodegen::QrCode.setFunctionModule_int__int__bool_
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [esp], 8
call sym.___cxa_allocate_exception
mov dword [esp], str.Assertion_error
mov ecx, eax
mov ebx, eax
call sym.std::logic_error::logic_error_char_const_
push eax
mov dword [esp + 8], sym.std::logic_error::logic_error__
mov dword [esp + 4], 0x8b6f28
mov dword [esp], ebx
call sym.___cxa_throw
mov esi, eax
mov dword [esp], ebx
call sym.___cxa_free_exception
mov dword [esp], esi
call sym.__Unwind_Resume
lea esi, [esi]
lea edi, [edi]
Function at 0x4862d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ecx]
cmp ebx, 6
jle 0x486381
mov esi, ebx
mov eax, 0xc
nop
lea esi, [esi]
mov edi, esi
lea edx, [esi + esi]
sar edi, 0xb
imul esi, edi, 0x1f25
xor edx, esi
sub eax, 1
mov esi, edx
jne 0x4862f0
shl ebx, 0xc
mov edi, ecx
or ebx, edx
mov eax, ebx
mov dword [ebp - 0x24], ebx
sar eax, 0x12
test eax, eax
jne 0x486389
xor esi, esi
lea esi, [esi]
mov eax, 0xaaaaaaab
mov ecx, dword [edi + 4]
mul esi
shr edx, 1
lea eax, [edx + edx*2]
mov ebx, edx
mov edx, esi
mov dword [esp + 4], ebx
sub edx, eax
mov eax, dword [ebp - 0x24]
lea edx, [ecx + edx - 0xb]
mov ecx, esi
add esi, 1
sar eax, cl
mov dword [esp], edx
mov ecx, edi
and eax, 1
mov dword [ebp - 0x1c], edx
mov dword [esp + 8], eax
mov dword [ebp - 0x20], eax
call method.qrcodegen::QrCode.setFunctionModule_int__int__bool_
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp], ebx
mov ecx, edi
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call method.qrcodegen::QrCode.setFunctionModule_int__int__bool_
sub esp, 0xc
cmp esi, 0x12
jne 0x486320
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 8
call sym.___cxa_allocate_exception
mov dword [esp], str.Assertion_error
mov ecx, eax
mov ebx, eax
call sym.std::logic_error::logic_error_char_const_
push eax
mov dword [esp + 8], sym.std::logic_error::logic_error__
mov dword [esp + 4], 0x8b6f28
mov dword [esp], ebx
call sym.___cxa_throw
mov esi, eax
mov dword [esp], ebx
call sym.___cxa_free_exception
mov dword [esp], esi
call sym.__Unwind_Resume

Function at 0x486490
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, 0xfffffffe
sub esp, 0x2c
mov dword [esp + 0x18], ecx
mov eax, esi
mov edi, dword [esp + 0x44]
mov ebp, 0xfffffffe
sar eax, 0x1f
mov dword [esp + 0x1c], esi
mov ebx, eax
xor ebx, esi
add edi, esi
mov esi, ebp
mov ebp, dword [esp + 0x40]
sub ebx, eax
mov ecx, esi
mov dword [esp + 4], edi
sar ecx, 0x1f
mov eax, ecx
xor eax, esi
sub eax, ecx
mov ecx, dword [esp + 0x18]
cmp eax, ebx
cmovl eax, ebx
cmp eax, 1
setne al
movzx eax, al
mov dword [esp + 8], eax
lea eax, [esi + ebp]
add esi, 1
mov dword [esp], eax
call method.qrcodegen::QrCode.setFunctionModule_int__int__bool_
sub esp, 0xc
cmp esi, 3
jne 0x4864c0
mov esi, dword [esp + 0x1c]
add esi, 1
cmp esi, 3
jne 0x4864a0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x4a8770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
test eax, eax
je 0x4a8792
cmp eax, 1
jne 0x4a8790
mov ecx, dword [edx + 8]
jmp method.LoginDialog.loadServers__
repz ret
test edx, edx
je 0x4a87a0
mov dword [esp + 4], edx
jmp sym.operator_delete_void_
repz ret
Function at 0x4d0cc0
Capabilities:
Self delete

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea esi, [ebp - 0x20]
sub esp, 0x4c
mov edi, dword [method.QString.fromAscii_helper_char_const__int_]
mov dword [esp + 4], 0xa
mov dword [esp], 0x5ee4bd
call edi
mov dword [esp], esi
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x28]
call dword [method.QFile.QFile_QString_const_]
sub esp, 4
mov ecx, esi
call method.QString.QString__
mov dword [esp], 0xa
lea ecx, [ebp - 0x28]
call dword [method.QFile.open_QFlags_QIODevice::OpenModeFlag__]
sub esp, 4
test al, al
je 0x4d0d5e
mov dword [esp], 0x5ee4cb
lea ecx, [ebp - 0x28]
mov ebx, dword [method.QIODevice.write_char_const_]
call ebx
sub esp, 4
lea ecx, [ebp - 0x28]
mov dword [esp], 0x5ee4d7
call ebx
sub esp, 4
lea ecx, [ebp - 0x28]
mov dword [esp], 0x5ee4f1
call ebx
sub esp, 4
lea ecx, [ebp - 0x28]
mov dword [esp], 0x5ee504
call ebx
sub esp, 4
lea ecx, [ebp - 0x28]
call dword [method.QFileDevice.close__]
mov dword [esp + 4], 2
mov dword [esp], 0x5ee4c8
call edi
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xa
mov dword [esp], 0x5ee4bd
call edi
mov dword [ebp - 0x1c], eax
mov eax, dword [sym.imp.Qt5Core.dll_QListData::shared_null]
cmp dword [eax + 4], 1
mov dword [ebp - 0x2c], eax
jle 0x4d0e20
lea ebx, [ebp - 0x2c]
lea eax, [ebp - 0x1c]
mov dword [esp], esi
mov ecx, ebx
mov dword [ebp - 0x3c], eax
call method.QList_QString_.append_QString_const_
lea eax, [ebp - 0x1c]
sub esp, 4
mov ecx, ebx
mov dword [esp], eax
mov dword [ebp - 0x3c], eax
call method.QList_QString_.append_QString_const_
sub esp, 4
mov dword [esp + 4], 7
mov dword [esp], 0x5ee50d
call edi
lea edi, [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [method.QProcess.startDetached_QString_const__QStringList_const_]
mov ecx, edi
call method.QString.QString__
mov ecx, ebx
call method.QList_QString_.QList__
mov ecx, dword [ebp - 0x3c]
call method.QString.QString__
mov ecx, esi
call method.QString.QString__
call dword [method.QApplication.closeAllWindows__]
call dword [method.QCoreApplication.quit__]
lea ecx, [ebp - 0x28]
call dword [method.QFile.QFile__]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [eax]
lea ebx, [ebp - 0x2c]
mov dword [esp], 2
cmp eax, 1
jbe 0x4d0e50
lea eax, [ebp - 0x1c]
mov ecx, ebx
mov dword [ebp - 0x3c], eax
call method.QList_QString_.detach_helper_int_
sub esp, 4
jmp 0x4d0d9b
lea eax, [ebp - 0x1c]
mov ecx, ebx
mov dword [ebp - 0x3c], eax
call dword [method.QListData.realloc_int_]
jmp 0x4d0e3e
Function at 0x4d3410
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea eax, [ebp - 0x1a8]
mov ebx, ecx
sub esp, 0x1cc
mov dword [esp + 4], eax
mov dword [esp], 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
jne 0x4d35a3
mov esi, eax
mov eax, dword [ebp + 0xc]
mov edi, dword [sym.imp.Qt5Core.dll_QArrayData::shared_null]
xor edx, edx
mov eax, dword [eax]
mov dword [ebp - 0x1bc], edi
cmp eax, edi
mov ecx, dword [eax + 4]
je 0x4d3461
add eax, dword [eax + 0xc]
mov edx, eax
lea edi, [ebp - 0x1ac]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp], edi
call dword [method.QString.toLocal8Bit_helper_QChar_const__int_]
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx]
cmp eax, 1
jbe 0x4d3590
movsx eax, byte [edx + 0xb]
mov ecx, edi
shr eax, 0x1f
mov dword [esp + 4], eax
mov eax, dword [edx + 4]
add eax, 1
mov dword [esp], eax
call dword [method.QByteArray.reallocData_unsigned_int__QFlags_QArrayData::AllocationOption__]
mov eax, dword [ebp - 0x1ac]
sub esp, 8
mov ecx, dword [eax + 0xc]
add eax, ecx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edx, dword [ebp - 0x1ac]
sub esp, 4
mov ecx, dword [edx]
test ecx, ecx
je 0x4d34e0
cmp ecx, 0xffffffff
je 0x4d3505
lock sub dword [edx], 1
mov edx, dword [ebp - 0x1ac]
jne 0x4d3505
lea esi, [esi]
mov dword [ebp - 0x1c0], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], edx
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov eax, dword [ebp - 0x1c0]
test eax, eax
je 0x4d35a3
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
sub esp, 4
test eax, eax
mov edx, eax
je 0x4d353c
mov dword [esp], eax
mov dword [ebp - 0x1c0], eax
call sym._strlen
mov edx, dword [ebp - 0x1c0]
mov esi, eax
mov dword [esp + 4], esi
mov dword [esp], edx
call dword [method.QString.fromLatin1_helper_char_const__int_]
mov dword [ebp - 0x1ac], eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x1ac]
mov dword [ebx], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1ac], eax
mov edx, dword [eax]
test edx, edx
je 0x4d35d0
cmp edx, 0xffffffff
je 0x4d3580
lock sub dword [eax], 1
mov eax, dword [ebp - 0x1ac]
je 0x4d35d0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov ecx, dword [edx + 0xc]
mov eax, edx
cmp ecx, 0x10
jne 0x4d3489
jmp 0x4d34b1
mov dword [esp + 4], 0
mov dword [esp], 0x5ee8e0
call dword [method.QString.fromAscii_helper_char_const__int_]
mov dword [ebx], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov dword [esp], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 2
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8