joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d588
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408d3c
mov dword [ebp - 0x14], eax
cmp dword [0x45a418], esi
jne 0x40d67b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d608
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d75b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d75b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d75b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x45a418], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x45a41c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x45a420], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45a428], eax
test eax, eax
je 0x40d678
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45a424], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d6a0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d693
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d6b5
push 4
pop eax
jmp 0x40d75d
cmp dword [ebp - 0x14], esi
je 0x40d6b5
push dword [0x45a418]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d69a
mov eax, dword [0x45a424]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d713
cmp dword [0x45a428], edi
je 0x40d713
push eax
call ebx
push dword [0x45a428]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d713
test eax, eax
je 0x40d713
call ecx
test eax, eax
je 0x40d708
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d708
test byte [ebp - 8], 1
jne 0x40d713
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d743
mov eax, dword [0x45a41c]
cmp eax, edi
je 0x40d740
push eax
call ebx
test eax, eax
je 0x40d740
call eax
mov esi, eax
test esi, esi
je 0x40d740
mov eax, dword [0x45a420]
cmp eax, edi
je 0x40d740
push eax
call ebx
test eax, eax
je 0x40d740
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x45a418]
call ebx
test eax, eax
je 0x40d75b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d75d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040f0
mov esp, ebp
pop ebp
ret
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45b030]
jne 0x401116
repz ret
jmp fcn.00401d81

Function at 0x409ddd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406a6e
and dword [ebp - 4], 0
cmp dword [0x45d898], 0
mov ebx, eax
jne 0x409e8e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409f3f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409f3f
push eax
call fcn.004069fc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45d898], eax
call esi
push eax
call fcn.004069fc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45d89c], eax
call esi
push eax
call fcn.004069fc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45d8a0], eax
call esi
push eax
call fcn.004069fc
pop ecx
mov dword [0x45d8a8], eax
test eax, eax
je 0x409e8e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004069fc
pop ecx
mov dword [0x45d8a4], eax
mov eax, dword [0x45d8a4]
cmp eax, ebx
je 0x409ee6
cmp dword [0x45d8a8], ebx
je 0x409ee6
push eax
call fcn.00406a77
push dword [0x45d8a8]
mov esi, eax
call fcn.00406a77
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409ee6
test edi, edi
je 0x409ee6
call esi
test eax, eax
je 0x409edd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409edd
test byte [ebp - 0xc], 1
jne 0x409ee6
or dword [ebp + 0x10], 0x200000
jmp 0x409f1f
mov eax, dword [0x45d89c]
cmp eax, ebx
je 0x409f1f
push eax
call fcn.00406a77
pop ecx
test eax, eax
je 0x409f1f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409f1f
mov eax, dword [0x45d8a0]
cmp eax, ebx
je 0x409f1f
push eax
call fcn.00406a77
pop ecx
test eax, eax
je 0x409f1f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45d898]
call fcn.00406a77
pop ecx
test eax, eax
je 0x409f3f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409f41
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cc30
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x45b030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2c3b11c]
push ebx
mov ebx, dword [0x2c3af68]
push esi
mov esi, dword [0x45c050]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40cc71
push str.lefovuweceh
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2c3b11c]
mov dword [0x45d9f4], esi
cmp eax, 0x114e
jne 0x40cc9b
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.durinarusunavabaxomoyowev
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2c3b11c]
cmp eax, 0x2f
jne 0x40ccbd
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
call fcn.0040cba0
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40673a
pop dword [ebp - 0x34]
mov eax, 0x40673a
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x5b1ec952
sub dword [ebp - 0x44], 0xccc8407
mov dword [ebp - 0x40], 0xb71b3bad
sub dword [ebp - 0x40], 0x84e7ef68
mov dword [ebp - 0x3c], 0xec05e929
sub dword [ebp - 0x3c], 0x9fb9a4fb
mov dword [ebp - 0x38], 0x81d8473d
sub dword [ebp - 0x38], 0x81d8473d
lea eax, [ebp - 0x44]
push eax
mov eax, 0x53b7880
add eax, 0xfb050884
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x91b7fb0e
add dword [ebp - 0x44], 0xe2ba6e48
mov dword [ebp - 0x40], 0xec6d5fab
sub dword [ebp - 0x40], 0xab00fe36
mov dword [ebp - 0x3c], 0x8fed4ee3
add dword [ebp - 0x3c], 0xd3821d89
mov dword [ebp - 0x38], 0x80522f6f
sub dword [ebp - 0x38], 0x80522f6f
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x35bdd
push 0
call eax
mov ecx, 0x3874f99d
add ecx, 0xc78b474a
xor edi, edi
add edi, eax
mov esi, 0x46e400
add esi, dword [ebp - 0x34]
mov ebx, 0x2e6b4233
sub dword [ebp - 8], esi
mov edx, dword [esi]
xor dword [ebp - 0xc], edi
add edx, ebx
mov dword [edi], edx
add dword [ebp - 0x28], esi
add edi, 4
add esi, 0x24d06bb9
add esi, 0xdb2f944b
loop 0x406848
add eax, 0xf66f
xor ebx, ebx
add ebx, eax
add eax, 0x363c0d47
sub eax, 0x363c0d42
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x64001e40
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x64093da5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QObject::constructor_class_QObject__]
xor ebx, ebx
lea edi, [esi + 0xc]
push esi
mov ecx, edi
mov dword [esp + 0x20], ebx
mov dword [esi], vtable.QFtpDTP.0
mov dword [esi + 8], ebx
call sym.QtNetwork4.dll_public:_void___thiscall_QTcpServer::constructor_class_QObject__
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x14], ecx
lea ecx, [esi + 0x18]
mov byte [esp + 0x1c], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [esi + 0x3c]
mov byte [esp + 0x1c], 2
mov byte [esi + 0x30], bl
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::constructor_void_]
push str.QFtpDTP_active_state_server
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 3
mov byte [esi + 0x38], bl
mov dword [esi + 0x34], ebx
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QLatin1String::constructor_char_const__]
push eax
lea ecx, [esp + 0x2c]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QLatin1String_const__]
lea edx, [esp + 0x28]
push edx
mov ecx, edi
mov byte [esp + 0x20], 4
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QObject::setObjectName_class_QString_const__]
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 3
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
push 3
push str.1setupSocket__
push str.2newConnection__
push edi
mov ecx, esi
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QObject::connect_class_QObject_const___char_const___char_const___enum_Qt::ConnectionType_const]
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x6401b630
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x64097407
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
push 0x40802
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QObjectPrivate::constructor_int_]
mov eax, dword [esp + 0x28]
xor ebx, ebx
push eax
lea ecx, [esi + 0x50]
mov dword [esp + 0x24], ebx
mov dword [esi], vtable.QHttpNetworkConnectionPrivate.0
mov dword [esi + 0x4c], ebx
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov cx, word [esp + 0x2c]
mov dl, byte [esp + 0x30]
mov word [esi + 0x54], cx
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 1
mov byte [esi + 0x56], dl
mov dword [esi + 0x58], 6
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_void_]
mov edi, eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_void_]
mov ebp, eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 3
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_void_]
push edi
push ebp
push ebx
push eax
push 2
lea ecx, [esi + 0x60]
mov byte [esp + 0x34], 4
call sym.QtNetwork4.dll_public:_void___thiscall_QNetworkProxy::constructor_enum_QNetworkProxy::ProxyType__class_QString_const___unsigned_short_int__class_QString_const___class_QString_const__
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 6
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 7
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 8
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov eax, dword [sym.imp.QtCore4.dll_struct_QListData::Data_QListData::shared_null]
mov ecx, eax
mov dword [esi + 0x64], eax
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::ref_void_]
mov ecx, dword [sym.imp.QtCore4.dll_struct_QListData::Data_QListData::shared_null]
mov byte [esp + 0x20], 9
mov dword [esi + 0x68], ecx
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::ref_void_]
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov edi, dword [esi + 0x58]
xor ecx, ecx
mov eax, edi
mov edx, 0x70
mul edx
seto cl
mov byte [esp + 0x20], 0xb
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.64093166
add esp, 4
mov dword [esp + 0x30], eax
mov byte [esp + 0x20], 0xc
cmp eax, ebx
je 0x6401b789
push fcn.6401aed0
push 0x6401ead0
push edi
lea ebx, [eax + 4]
push 0x70
push ebx
mov dword [eax], edi
call fcn.640932ea
mov eax, esi
mov dword [esi + 0x5c], ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x6401d680
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x640977d0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x58]
xor eax, eax
test edx, edx
jle 0x6401d6d0
mov ecx, dword [esi + 0x5c]
mov edi, dword [esp + 0x38]
add ecx, 8
jmp 0x6401d6c0
cmp dword [ecx], edi
je 0x6401d765
inc eax
add ecx, 0x70
cmp eax, edx
jl 0x6401d6c0
push str.Called_with_unknown_socket_object.
call dword [sym.imp.QtCore4.dll_void___cdecl_qFatal_char_const__]
add esp, 4
xor edi, edi
lea ecx, [esi + 0x64]
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QListData::isEmpty_void_const]
test al, al
jne 0x6401d76c
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + 0x64]
call fcn.6401d580
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 4]
cmp byte [eax + 0x10c], 0
mov dword [esp + 0x30], 0
jne 0x6401d71e
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.6401b900
mov ecx, dword [esi + 0x5c]
imul edi, edi, 0x70
lea eax, [esp + 0x10]
push eax
lea ecx, [ecx + edi + 0x14]
call fcn.64015e70
mov edx, dword [esi + 0x5c]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
mov dword [edx + edi + 0x1c], eax
mov dword [esp + 0x30], 0xffffffff
call fcn.64015db0
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 4
mov edi, eax
jmp 0x6401d6e0
lea ecx, [esi + 0x68]
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QListData::isEmpty_void_const]
test al, al
jne 0x6401d7f1
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esi + 0x68]
call fcn.6401d580
mov edx, dword [esp + 0x24]
mov eax, dword [edx + 4]
cmp byte [eax + 0x10c], 0
mov dword [esp + 0x30], 1
jne 0x6401d7aa
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.6401b900
mov edx, dword [esi + 0x5c]
imul edi, edi, 0x70
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [edx + edi + 0x14]
call fcn.64015e70
mov ecx, dword [esp + 0x24]
mov eax, dword [esi + 0x5c]
mov dword [eax + edi + 0x1c], ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.64015db0
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 4
Function at 0x64022450
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x64098095
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QUrl::constructor_class_QUrl_const__]
mov ecx, dword [esp + 0x38]
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QUrl::setFragment_class_QString_const__]
push ecx
mov dword [esp + 0x18], esp
mov eax, esp
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x10]
mov dword [eax], 0x62
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray___thiscall_QUrl::toEncoded_class_QFlags_enum_QUrl::FormattingOption__]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 2
mov dword [esp + 0x1c], 0x640ab2e0
call fcn.64021f30
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov byte [esp + 0x2c], 3
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::constructor_class_QByteArray_const__]
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 1
mov byte [esp + 0x28], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::destructor_void_]
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::destructor_void_]
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QUrl::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
Function at 0x64024f50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x640986b1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x2c]
push eax
lea ecx, [esp + 0x30]
call sym.QtNetwork4.dll_public:_void___thiscall_QAuthenticator::constructor_class_QAuthenticator_const__
mov ecx, dword [esp + 0x30]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_class_QByteArray_const__]
lea edx, [esp + 0xc]
push edx
push 0xa
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 1
call sym.QtNetwork4.dll_public:_void___thiscall_QNetworkRequest::setAttribute_enum_QNetworkRequest::Attribute__class_QVariant_const__
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
mov ecx, dword [esp + 0x34]
mov eax, dword [esi]
mov eax, dword [eax + 0x2c]
mov edi, dword [esi + 4]
push ecx
lea edx, [esp + 0x30]
push edx
push 6
mov ecx, esi
call eax
mov edi, dword [edi + 4]
mov esi, eax
mov eax, dword [esi + 4]
add eax, 0xac
cmp dword [eax], edi
je 0x64024ff4
push edi
push eax
call dword [sym.imp.QtCore4.dll_public:_static_void___cdecl_QMetaObject::changeGuard_class_QObject____class_QObject__]
add esp, 8
push 3
push str.1_q_replyFinished__
push str.2finished__
push esi
mov ecx, edi
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QObject::connect_class_QObject_const___char_const___char_const___enum_Qt::ConnectionType_const]
push 3
push str.1_q_replySslErrors_QList_QSslError__
push str.2sslErrors_QList_QSslError__
push esi
mov ecx, edi
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QObject::connect_class_QObject_const___char_const___char_const___enum_Qt::ConnectionType_const]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call sym.QtNetwork4.dll_public:_void___thiscall_QNetworkRequest::destructor_void_
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 0xc
Function at 0x64027560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64098cfd
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 1
test esi, esi
je 0x640275cb
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 8]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::constructor_class_QByteArray_const__]
mov ecx, dword [esp + 0x2c]
push ecx
lea ecx, [esi + 0xc]
mov byte [esp + 0x20], 2
call fcn.640273d0
mov eax, esi
jmp 0x640275cd
xor eax, eax
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
inc dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10

Function at 0x64029910
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x640990f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.64028bc0
xor ebx, ebx
lea ecx, [esi + 0x20]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.QNetworkAccessFileBackend.0
mov dword [esi + 0x1c], ebx
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QFile::constructor_void_]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x6402b260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x640990f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.64028bc0
lea eax, [esi + 0x1c]
xor ebx, ebx
mov dword [esi], vtable.QNetworkAccessFtpBackend.0
push eax
mov dword [esp + 0x1c], ebx
mov dword [eax], ebx
call dword [sym.imp.QtCore4.dll_public:_static_void___cdecl_QMetaObject::addGuard_class_QObject___]
add esp, 4
or eax, 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov word [esi + 0x3c], bx
mov dword [esi + 0x40], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret