joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6406c420
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [ecx]
mov edx, dword [eax + 0x38]
push esi
mov esi, dword [ecx + 4]
call edx
test al, al
jne 0x6405b6f1
push str.QNativeSocketEngine::hasPendingDatagrams___was_called_on_an_uninitialized_socket_device
call dword [sym.imp.QtCore4.dll_void___cdecl_qWarning_char_const__]
add esp, 4
xor al, al
pop esi
ret
cmp dword [esi + 0x5c], 0
jne 0x6405b709
push str.QNativeSocketEngine::hasPendingDatagrams___was_called_in_QAbstractSocket::UnconnectedState
call dword [sym.imp.QtCore4.dll_void___cdecl_qWarning_char_const__]
add esp, 4
xor al, al
pop esi
ret
cmp dword [esi + 0x60], 1
je 0x6405b721
push str.QNativeSocketEngine::hasPendingDatagrams___was_called_by_a_socket_other_than_QAbstractSocket::UdpSocket
call dword [sym.imp.QtCore4.dll_void___cdecl_qWarning_char_const__]
add esp, 4
xor al, al
pop esi
ret
mov ecx, esi
pop esi
jmp 0x6406c420
sub esp, 0x9c
mov eax, dword [0x640df444]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push ebp
push esi
push edi
push 0x80
xor ebx, ebx
lea eax, [esp + 0x2c]
push ebx
push eax
mov esi, ecx
mov dword [esp + 0x24], 0x80
call sub.MSVCR90.dll_memset
mov ebp, dword [sym.imp.WS2_32.dll_WSARecvFrom]
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x1f]
mov dword [esp + 0x30], ecx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esi + 0x7c]
lea edx, [esp + 0x30]
push edx
push 1
lea eax, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x44], 1
mov dword [esp + 0x40], ebx
mov dword [esp + 0x38], 2
call ebp
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp edi, 0xffffffff
jne 0x6406c4f9
cmp eax, 0x2738
je 0x6406c4f9
cmp eax, 0x2746
jne 0x6406c4de
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esi + 0x7c]
lea edx, [esp + 0x30]
push edx
push 1
lea eax, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x38], ebx
call ebp
mov al, bl
mov ecx, dword [esp + 0xa8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.64082938
add esp, 0x9c
ret
mov al, 1
jmp 0x6406c4e0
Function at 0x6406c5d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0xa4
mov eax, dword [0x640df444]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
mov ebp, dword [esp + 0xb0]
push esi
push edi
push 0x80
mov esi, ecx
xor edi, edi
lea ecx, [esp + 0x34]
push edi
push ecx
mov dword [esp + 0x28], eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push edi
push edi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esi + 0x7c]
lea edx, [esp + 0x24]
push edx
push 1
lea eax, [esp + 0x44]
mov dword [esp + 0x48], ebp
mov ebp, dword [esp + 0xd8]
push eax
push ecx
mov dword [esp + 0x48], 0x80
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x44], edi
mov dword [esp + 0x34], edi
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x6406c6a9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2738
jne 0x6406c695
mov edx, dword [esp + 0xc0]
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp eax, edx
jl 0x6406c68d
jg 0x6406c687
cmp ecx, ebp
jbe 0x6406c68d
mov dword [esp + 0x18], edx
jmp 0x6406c6b1
mov ebp, ecx
mov dword [esp + 0x18], eax
jmp 0x6406c6b1
push 0x13
push 7
mov ecx, esi
call fcn.6405aa70
or ebp, 0xffffffff
mov dword [esp + 0x18], ebp
jmp 0x6406c6b1
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x18], edi
mov edx, dword [esi + 0x7c]
mov edi, ebx
mov ebx, dword [esp + 0x1c]
push edx
lea esi, [esp + 0x34]
call fcn.6406b780
mov ecx, dword [esp + 0xb4]
mov edx, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.64082938
add esp, 0xa4
ret 0x14
Function at 0x6406c6f0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x48
mov eax, dword [0x640df444]
xor eax, esp
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x4c]
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
push esi
push edi
mov esi, ecx
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x7c]
lea edx, [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x70]
push edx
push eax
xor ebp, ebp
push ecx
lea ecx, [esp + 0x48]
lea edi, [esp + 0x38]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
call fcn.6406b8b0
mov eax, dword [esp + 0x70]
mov edx, eax
add esp, 0x10
or edx, dword [esp + 0x64]
je 0x6406c753
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
jmp 0x6406c757
mov dword [esp + 0x24], ebp
mov edx, dword [esp + 0x14]
push ebp
push ebp
push edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [esi + 0x7c]
push ebp
lea ecx, [esp + 0x2c]
push ecx
push 1
lea edx, [esp + 0x3c]
push edx
push eax
mov dword [esp + 0x3c], ebp
call dword [sym.imp.WS2_32.dll_WSASendTo]
cmp eax, 0xffffffff
jne 0x6406c7dc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, esi
cmp eax, 0x2738
je 0x6406c7b9
push 0x12
push 7
call fcn.6405aa70
pop edi
pop esi
or eax, 0xffffffff
pop ebp
or edx, eax
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.64082938
add esp, 0x48
ret 0x14
push 0x11
push 6
call fcn.6405aa70
pop edi
pop esi
or eax, 0xffffffff
pop ebp
or edx, eax
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.64082938
add esp, 0x48
ret 0x14
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor edx, edx
call fcn.64082938
add esp, 0x48
ret 0x14

Function at 0x6406c800
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [ecx + 0x7c]
push esi
push edi
push 0
push 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x14], edx
lea edx, [esp + 0x20]
push edx
push 1
lea eax, [esp + 0x1c]
push eax
or esi, 0xffffffff
push ecx
or edi, esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, esi
jne 0x6406c874
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x6406c881
add eax, 0xffffd8bb
cmp eax, 1
ja 0x6406c89b
xor esi, esi
xor edi, edi
mov edx, edi
pop edi
mov eax, esi
pop esi
add esp, 8
ret 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x6406c895
or edi, 0xffffffff
mov esi, 0xfffffffe
mov edx, edi
pop edi
mov eax, esi
pop esi
add esp, 8
ret 0xc
mov esi, dword [esp + 0x14]
xor edi, edi
mov edx, edi
pop edi
mov eax, esi
pop esi
add esp, 8
ret 0xc
Function at 0x6406c8b0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x214
push ebx
mov bl, byte [esp + 0x220]
push esi
push edi
mov edi, ecx
test bl, bl
je 0x6406c96a
mov ecx, dword [edi + 0x80]
test ecx, ecx
je 0x6406c96a
cmp byte [ecx + 0x10], 0
je 0x6406c96a
push 0
mov byte [esp + 0x13], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QSocketNotifier::setEnabled_bool_]
push 0x104
lea eax, [esp + 0x1c]
push 0
push eax
call sub.MSVCR90.dll_memset
mov ecx, dword [esp + 0x230]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov esi, dword [edi + 0x7c]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x1c], eax
imul eax, eax, 0x3e8
mov edx, ecx
sub edx, eax
imul edx, edx, 0x3e8
add esp, 0xc
xor eax, eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], edx
test bl, bl
je 0x6406c974
test ecx, ecx
setl al
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
dec eax
and eax, ecx
push eax
push 0
push 0
push edx
push 0
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
jmp 0x6406c9c6
mov byte [esp + 0xf], 0
jmp 0x6406c8ef
test ecx, ecx
setl al
lea ecx, [esp + 0x10]
lea edx, [esp + 0x11c]
mov dword [esp + 0x120], esi
mov dword [esp + 0x11c], 1
dec eax
and eax, ecx
push eax
push edx
lea eax, [esp + 0x20]
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jle 0x6406c9c6
mov edx, dword [edi + 0x7c]
lea ecx, [esp + 0x11c]
push ecx
push edx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x6406c9c6
dec esi
cmp byte [esp + 0xf], 0
je 0x6406c9db
mov ecx, dword [edi + 0x80]
push 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QSocketNotifier::setEnabled_bool_]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x214
ret 8
Function at 0x6406c9f0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x318
push ebx
mov bl, byte [esp + 0x324]
push ebp
mov ebp, dword [sym.imp.QtCore4.dll_public:_void___thiscall_QSocketNotifier::setEnabled_bool_]
push esi
push edi
mov edi, ecx
test bl, bl
je 0x6406cb80
mov ecx, dword [edi + 0x80]
test ecx, ecx
je 0x6406cb80
cmp byte [ecx + 0x10], 0
je 0x6406cb80
push 0
mov byte [esp + 0x17], 1
call ebp
push 0x104
lea eax, [esp + 0x124]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
test bl, bl
mov ebx, 1
je 0x6406ca63
mov ecx, dword [edi + 0x7c]
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ecx
push 0x104
lea edx, [esp + 0x228]
push 0
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
cmp byte [esp + 0x334], 0
mov dword [esp + 0x1c], 0
je 0x6406caa5
mov eax, dword [edi + 0x7c]
mov dword [esp + 0x224], ebx
mov dword [esp + 0x228], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x32c]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x14], eax
imul eax, eax, 0x3e8
mov edx, ecx
sub edx, eax
imul edx, edx, 0x3e8
xor eax, eax
test ecx, ecx
setl al
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], edx
lea edx, [esp + 0x1c]
dec eax
and eax, ecx
push eax
push edx
mov edx, dword [edi + 0x7c]
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x12c]
push ecx
add edx, ebx
push edx
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jle 0x6406cb1f
mov ecx, dword [edi + 0x7c]
lea eax, [esp + 0x1c]
push eax
push ecx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x6406cb1f
sub esi, ebx
cmp byte [esp + 0x13], 0
je 0x6406cb2f
mov ecx, dword [edi + 0x80]
push ebx
call ebp
test esi, esi
jle 0x6406cb71
mov eax, dword [edi + 0x7c]
lea edx, [esp + 0x120]
push edx
push eax
call sub.WS2_32.dll___WSAFDIsSet
mov edx, dword [esp + 0x338]
test eax, eax
setne cl
lea eax, [esp + 0x224]
mov byte [edx], cl
mov ecx, dword [edi + 0x7c]
push eax
push ecx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
mov eax, dword [esp + 0x33c]
setne dl
mov byte [eax], dl
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x318
ret 0x14
mov byte [esp + 0x13], 0
jmp 0x6406ca32
Function at 0x6406cba0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, ecx
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x38]
push esi
push edi
xor esi, esi
mov dword [esp + 0x18], eax
xor edi, edi
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x38]
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea eax, [esi + edx]
push 1
lea edx, [esp + 0x30]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x7c]
push edx
push eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], 0
call dword [sym.imp.WS2_32.dll_WSASend]
add esi, dword [esp + 0x10]
adc edi, 0
cmp eax, 0xffffffff
je 0x6406cc11
cmp esi, dword [esp + 0x3c]
jne 0x6406cbc0
cmp edi, dword [esp + 0x40]
je 0x6406cca5
jmp 0x6406cbc0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x6406cca5
cmp eax, 0x2747
jne 0x6406cc7c
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
sub eax, esi
sbb ecx, edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x24], 0xc000
mov dword [esp + 0x28], 0
js 0x6406cc6a
jg 0x6406cc58
cmp eax, 0xc000
jbe 0x6406cc6a
lea eax, [esp + 0x24]
mov edx, dword [eax + 4]
mov ebx, dword [eax]
mov dword [esp + 0x14], edx
jmp 0x6406cbc0
lea eax, [esp + 0x2c]
mov edx, dword [eax + 4]
mov ebx, dword [eax]
mov dword [esp + 0x14], edx
jmp 0x6406cbc0
cmp eax, 0x2745
jl 0x6406cca5
cmp eax, 0x2746
jg 0x6406cca5
push 0x14
or esi, 0xffffffff
push 7
mov ecx, ebp
or edi, esi
call fcn.6405aa70
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
mov edx, dword [eax + 0x50]
call edx
mov edx, edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
Function at 0x6406dbd0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push 0xffffffffffffffff
push 0x640914d9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x640df444]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea esp, [esp]
mov ecx, dword [esi + 0x90]
mov edi, dword [esi + 4]
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x6406dc27
mov ebp, dword [esp + 0x18]
jmp 0x6406dc5b
cmp byte [esi + 0xde], 0
jne 0x6406dc59
mov ecx, edi
mov byte [esi + 0xde], 1
call dword [sym.imp.QtCore4.dll_protected:_void___thiscall_QIODevice::readChannelFinished_void_]
cmp dword [esi + 0xd0], 0
jne 0x6406dc59
push str.1_q_pipeClosed__
push edi
push 0
call dword [sym.imp.QtCore4.dll_public:_static_void___cdecl_QTimer::singleShot_int__class_QObject___char_const__]
add esp, 0xc
xor ebp, ebp
cmp byte [esi + 0xde], 0
jne 0x6406dd82
test ebp, ebp
jne 0x6406dc71
mov ebp, 0x1000
mov ecx, dword [esi + 0xb0]
mov edi, dword [esi + 0xb4]
mov edx, ecx
or edx, edi
je 0x6406dcaa
mov ebx, dword [esi + 0xcc]
mov eax, ebx
cdq
sub ecx, eax
sbb edi, edx
xor eax, eax
cmp eax, edi
jl 0x6406dcaa
jg 0x6406dc9c
cmp ebp, ecx
jbe 0x6406dcaa
mov ebp, dword [esi + 0xb0]
sub ebp, ebx
je 0x6406dd82
push ebp
lea ecx, [esi + 0xb8]
call fcn.6400dd70
mov edx, dword [esi + 0x90]
lea ecx, [esi + 0x94]
push ecx
push 0
push ebp
push eax
push edx
mov byte [esi + 0xdc], 1
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x6406dcef
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xe9
je 0x6406dd72
sub eax, 1
jne 0x6406dd17
mov ecx, esi
call fcn.6406dad0
cmp byte [esi + 0xdc], 0
je 0x6406dc00
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
sub eax, 0x2fb
je 0x6406dd82
push str.QLocalSocketPrivate::startAsyncRead
lea ecx, [esp + 0x20]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QLatin1String::constructor_char_const__]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QLatin1String_const__]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x2c], 0
call fcn.6406cdb0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov ecx, dword [esi + 4]
mov byte [esi + 0xde], 1
call dword [sym.imp.QtCore4.dll_protected:_void___thiscall_QIODevice::readChannelFinished_void_]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x6406f490
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x640917a3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x640df444]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], 1
cmp eax, 5
ja case.default.0x6406f4cb
jmp dword [eax*4 + 0x6406f53c]
push str.Organization
jmp 0x6406f4fa
push str.CommonName
jmp 0x6406f4fa
push str.CountryName
jmp 0x6406f4fa
push str.LocalityName
jmp 0x6406f4fa
push str.OrganizationalUnitName
jmp 0x6406f4fa
push str.StateOrProvinceName
lea ecx, [esp + 0x24]
call dword [sym.imp.QtCore4.dll_public:_class_QDebug____thiscall_QDebug::operator___char_const__]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov dword [esi], eax
inc dword [eax + 0xc]
lea ecx, [esp + 0x20]
mov dword [esp + 8], 1
mov byte [esp + 0x14], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QDebug::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x64070c90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64091b2b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x640df444]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], 0
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
cmp dword [ecx + 0x3c], 0
jne 0x64070d30
cmp dword [eax + 0x1c], 0
je 0x64070d30
mov edx, dword [eax + 0x1c]
push 0
push 0
push edx
call fcn.6407ecb0
add esp, 4
push eax
call fcn.6407ecf0
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.640708b0
add esp, 0x10
mov ecx, dword [esi]
push eax
add ecx, 0xc
mov dword [esp + 0x20], 1
call fcn.64070560
mov eax, dword [esp + 0xc]
mov byte [esp + 0x1c], 0
test eax, eax
je 0x64070d30
lea ecx, [eax + 0x34]
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::deref_void_]
test al, al
jne 0x64070d30
mov edx, dword [esp + 0xc]
push edx
lea ecx, [esp + 0x10]
call fcn.6406fc70
mov ecx, dword [esp + 0x28]
push 0xffffffffffffffff
call dword [sym.imp.QtCore4.dll_public:_char_const____thiscall_QByteArray::operator_char_const__void_const]
push eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QString::fromLatin1_char_const___int_]
add esp, 0xc
mov esi, dword [esi]
mov edi, dword [esp + 0x24]
push eax
push edi
lea ecx, [esi + 0xc]
mov dword [esp + 0x24], 2
call fcn.64070050
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], 1
mov byte [esp + 0x1c], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 8
Function at 0x64074cc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x640927d4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x640df444]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
push ecx
mov ebx, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], ebx
call sym.QtNetwork4.dll_public:_void___thiscall_QSslError::constructor_enum_QSslError::SslError_
lea edx, [esp + 0xc]
push edx
mov ecx, eax
mov byte [esp + 0x24], 2
call sym.QtNetwork4.dll_public:_class_QString___thiscall_QSslError::errorString_void_
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call dword [sym.imp.QtCore4.dll_public:_class_QDebug____thiscall_QDebug::operator___class_QString_const__]
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov eax, dword [esp + 0x10]
mov byte [esp + 0x20], bl
mov esi, eax
test eax, eax
je 0x64074d55
lea ecx, [eax + 4]
call sym.QtNetwork4.dll_public:_void___thiscall_QSslCertificate::destructor_void_
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esi], eax
add dword [eax + 0xc], ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], ebx
mov byte [esp + 0x20], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QDebug::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x64078640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64092eb1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x640df444]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 4]
cmp byte [esi + 0x130], 0
jne 0x6407867a
mov ecx, esi
call fcn.64077c10
cmp dword [esi + 0x178], 0
mov byte [esi + 0x130], 0
jne 0x6407869e
push ecx
mov ecx, dword [esp + 0x3c]
mov eax, esp
mov dword [eax], ecx
mov ecx, esi
mov dword [esp + 0x10], esp
call fcn.64077c60
lea edx, [esp + 0xc]
push edx
mov ecx, edi
call sym.QtNetwork4.dll_public:_class_QNetworkProxy___thiscall_QAbstractSocket::proxy_void_
mov ecx, dword [esi + 0x178]
push eax
mov dword [esp + 0x2c], 0
call sym.QtNetwork4.dll_public:_void___thiscall_QAbstractSocket::setProxy_class_QNetworkProxy_const__
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call sym.QtNetwork4.dll_public:_void___thiscall_QNetworkProxy::destructor_void_
push str._q_user_agent
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call dword [sym.imp.QtCore4.dll_public:_class_QVariant___thiscall_QObject::property_char_const__]
mov ecx, dword [esi + 0x178]
push eax
push str._q_user_agent
mov dword [esp + 0x30], 1
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QObject::setProperty_char_const___class_QVariant_const__]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
push ecx
mov ecx, dword [esp + 0x3c]
mov eax, esp
mov dword [eax], ecx
mov ecx, edi
mov dword [esp + 0x10], esp
call dword [sym.imp.QtCore4.dll_public_virtual:_bool___thiscall_QIODevice::open_class_QFlags_enum_QIODevice::OpenModeFlag__]
mov edx, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x34]
mov eax, esp
mov dword [eax], edx
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], esp
push eax
push ecx
mov ecx, dword [esi + 0x178]
call sym.QtNetwork4.dll_public:_void___thiscall_QAbstractSocket::connectToHost_class_QString_const___unsigned_short_int__class_QFlags_enum_QIODevice::OpenModeFlag__
mov ecx, dword [esi + 0x178]
call sym.QtNetwork4.dll_public:_int___thiscall_QAbstractSocket::socketDescriptor_void_const
mov dword [esi + 0xc0], eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0xc
Function at 0x64082938
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x640df444]
jne 0x64082942
repz ret
jmp fcn.64083068

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x597e10ea
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1c5b33ab
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x74373d45
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x301d4e05
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219