joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440480
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4404a0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x4404bb
mov eax, 0xffffffff
jmp 0x4404be
add eax, 0xa
push eax
call fcn.004082b0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x440501
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x4404f0
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x5c5d5e5f
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0x58fa0f70
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x58fa0f70]
xor edx, ecx
mov esi, edx
not esi
and esi, 0x31
and edx, 0xce
sub edx, esi
inc dl
mov byte [esp + ecx - 0x58fa0f70], dl
inc ecx
cmp ecx, 0x58fa0f77
jne 0x440570
mov esi, dword [esp]
mov ecx, dword [0x44d05c]
test ecx, ecx
je 0x4405f1
xor edx, edx
mov ebx, dword [0x44d060]
cmp dword [ebx + edx*8], 0x3174e150
je 0x4405c0
inc edx
cmp ecx, edx
jne 0x4405b0
jmp 0x4405f1
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x4405f1
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44d064]
mov edi, eax
call fcn.0043df70
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.004082c0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x440630
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x44064b
mov eax, 0xffffffff
jmp 0x44064e
add eax, 0xa
push eax
call fcn.004082b0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x440691
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x440680
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x5c5d5e5f
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
mov ecx, 0x58fa0f70
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x58fa0f50]
xor edx, ecx
mov esi, edx
not esi
and esi, 0x31
and edx, 0xce
sub edx, esi
inc dl
mov byte [esp + ecx - 0x58fa0f50], dl
inc ecx
cmp ecx, 0x58fa0f77
jne 0x440700
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44d05c]
test ecx, ecx
je 0x440789
xor edx, edx
mov ebx, dword [0x44d060]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1ce638e1
je 0x440760
inc edx
cmp ecx, edx
jne 0x440750
jmp 0x440789
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x440789
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x44d064]
mov ebx, eax
call fcn.0043df70
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.004082c0
add esp, 4
test edi, edi
je 0x44079c
mov eax, dword [esp + 0x40]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4407b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x5c5d5e5f
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x58fa0f70
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x58fa0f70]
xor edx, eax
mov ecx, edx
not ecx
and ecx, 0x31
and edx, 0xce
sub edx, ecx
inc dl
mov byte [esp + eax - 0x58fa0f70], dl
inc eax
cmp eax, 0x58fa0f77
jne 0x4407e0
mov eax, dword [esp]
mov edx, dword [0x44d05c]
test edx, edx
je 0x440858
xor ebx, ebx
mov ecx, dword [0x44d060]
nop
cmp dword [ecx + ebx*8], 0x9c142cda
je 0x440830
inc ebx
cmp edx, ebx
jne 0x440820
jmp 0x440858
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x440858
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x44d064]
call fcn.0043df70
add esp, 0x20
test edi, edi
je 0x440862
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x44086e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x440880
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x5c5d5e5f
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x58fa0f70
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x58fa0f70]
xor ebx, eax
mov edi, ebx
not edi
and edi, 0x31
and ebx, 0xce
sub ebx, edi
inc bl
mov byte [esp + eax - 0x58fa0f70], bl
inc eax
cmp eax, 0x58fa0f77
jne 0x4408b0
mov eax, dword [esp]
mov ebx, dword [0x44d05c]
test ebx, ebx
je 0x44092e
xor ebp, ebp
mov edi, dword [0x44d060]
nop
cmp dword [edi + ebp*8], 0x5b126fe8
je 0x440900
inc ebp
cmp ebx, ebp
jne 0x4408f0
jmp 0x44092e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x44092e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44d064]
call fcn.0043df70
add esp, 0x30
cmp eax, 0x103
jne 0x4409d9
mov dword [esp], 0x5c5d5e5f
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x58fa0f70
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x58fa0f70]
xor ecx, eax
mov edx, ecx
not edx
and edx, 0x31
and ecx, 0xce
sub ecx, edx
inc cl
mov byte [esp + eax - 0x58fa0f70], cl
inc eax
cmp eax, 0x58fa0f77
jne 0x440960
mov eax, dword [esp]
mov ecx, dword [0x44d05c]
test ecx, ecx
je 0x4409d1
xor edx, edx
mov edi, dword [0x44d060]
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x4409b0
inc edx
cmp ecx, edx
jne 0x4409a0
jmp 0x4409d1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x4409d1
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44d064]
call fcn.0043df70
add esp, 0x18
test eax, eax
js 0x4409d9
mov eax, dword [esp + 8]
test esi, esi
je 0x4409ec
xor ecx, ecx
cmp eax, 0xc0000011
je 0x4409ea
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x5c5d5e5f
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x58fa0f70
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x58fa0f70]
xor ebx, eax
mov edi, ebx
not edi
and edi, 0x31
and ebx, 0xce
sub ebx, edi
inc bl
mov byte [esp + eax - 0x58fa0f70], bl
inc eax
cmp eax, 0x58fa0f77
jne 0x440a30
mov eax, dword [esp]
mov ebx, dword [0x44d05c]
test ebx, ebx
je 0x440aae
xor ebp, ebp
mov edi, dword [0x44d060]
nop
cmp dword [edi + ebp*8], 0xa2545bf7
je 0x440a80
inc ebp
cmp ebx, ebp
jne 0x440a70
jmp 0x440aae
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x440aae
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44d064]
call fcn.0043df70
add esp, 0x30
cmp eax, 0x103
jne 0x440b59
mov dword [esp], 0x5c5d5e5f
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x58fa0f70
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x58fa0f70]
xor ecx, eax
mov edx, ecx
not edx
and edx, 0x31
and ecx, 0xce
sub ecx, edx
inc cl
mov byte [esp + eax - 0x58fa0f70], cl
inc eax
cmp eax, 0x58fa0f77
jne 0x440ae0
mov eax, dword [esp]
mov ecx, dword [0x44d05c]
test ecx, ecx
je 0x440b51
xor edx, edx
mov edi, dword [0x44d060]
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x440b30
inc edx
cmp ecx, edx
jne 0x440b20
jmp 0x440b51
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x440b51
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44d064]
call fcn.0043df70
add esp, 0x18
test eax, eax
js 0x440b59
mov eax, dword [esp + 8]
test esi, esi
je 0x440b63
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
xor ebx, ebx
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x440b90
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 8], bx
add ebx, 2
mov word [esp + 0xa], bx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x5c5d5e5f
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x58fa0f70
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x58fa0f70]
xor ebx, eax
mov edi, ebx
not edi
and edi, 0x31
and ebx, 0xce
sub ebx, edi
inc bl
mov byte [esp + eax - 0x58fa0f70], bl
inc eax
cmp eax, 0x58fa0f77
jne 0x440c00
mov eax, dword [esp]
mov edi, dword [0x44d05c]
test edi, edi
je 0x440c72
xor ebx, ebx
mov ebp, dword [0x44d060]
nop
cmp dword [ebp + ebx*8], 0x40915fe0
je 0x440c51
inc ebx
cmp edi, ebx
jne 0x440c40
jmp 0x440c72
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x440c72
lea eax, [esp + 0x10]
push esi
push eax
push edx
push ecx
push 0x10
push edi
push dword [0x44d064]
call fcn.0043df70
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x98a68c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x98a6b3
call fcn.0092cbf8
mov dword [eax], esi
call fcn.0092cbe5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0092d83a
mov eax, esi
jmp 0x98a708
test dword [ebp + 0xc], 0xfffffff9
jne 0x98a699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x98a6e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0092cc0b
pop ecx
call fcn.0092cbe5
mov eax, dword [eax]
jmp 0x98a708
test al, 0x10
jne 0x98a706
test al, 1
je 0x98a706
test byte [ebp + 0xc], 2
je 0x98a706
call fcn.0092cbf8
mov dword [eax], 5
call fcn.0092cbe5
mov dword [eax], 0xd
jmp 0x98a6d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4012af
Capabilities:
Hide graphical window

Disassembly:
push ebp
push 0x10000
push 0x1000
push 1
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x403d14], eax
push 0x64
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 0x30
push eax
mov dword [eax], ecx
add eax, 0x4c
mov ebp, eax
mov eax, 0x400000
mov dword [0x403d10], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x4011a6
mov dword [ebp - 0x24], str.cognomen
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor eax, eax
push eax
push dword [0x403d10]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.invocatory
push str.cognomen
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403d18], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401379
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401360
mov eax, dword [0x403d14]
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
pop ebp
ret 0x10

Function at 0x401499
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x10
mov edx, esi
mov eax, 4
mov esi, 0x401116
mov edi, 0x4035f5
dec ecx
call fcn.00401cc6
mov eax, ecx
push edi
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
call fcn.004013a1
call fcn.00401c72
mov eax, 0x14
mov ecx, 0x78f
mov esi, 0x401192
mov edi, 0x4014e3
call fcn.00401cc6
xor eax, eax
xor eax, 0x17cf0b66
sub eax, 0x4a88926a
fisttp qword [edi - 0x2d]
sbb al, 0xa9
invalid
Function at 0x401b72
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 4]
xor ecx, ecx
add eax, ecx
adc edx, ecx
leave
ret

Function at 0x40260c
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
mov ebx, dword [ecx + 0x34]
push esi
push edi
mov esi, edx
shr edx, 5
lea edi, [ebx + 0x1f]
and esi, 0x1f
shr edi, 5
cmp edx, edi
jae 0x40279a
mov eax, dword [ecx + 0xf4]
lea ecx, [eax + edx*4]
cmp dword [ecx], 0
je 0x40278c
cmp dword [ecx], 0x10000
jae 0x4026ea
cmp dword [ecx], 0x100
jae 0x402692
cmp dword [ecx], 0x10
jae 0x402670
cmp dword [ecx], 4
jae 0x402663
cmp dword [ecx], 2
sbb eax, eax
inc eax
jmp 0x402788
cmp dword [ecx], 8
sbb eax, eax
add eax, 3
jmp 0x402788
cmp dword [ecx], 0x40
jae 0x402682
cmp dword [ecx], 0x20
sbb eax, eax
add eax, 5
jmp 0x402788
cmp dword [ecx], 0x80
sbb eax, eax
add eax, 7
jmp 0x402788
cmp dword [ecx], 0x1000
jae 0x4026c2
cmp dword [ecx], 0x400
jae 0x4026b2
cmp dword [ecx], 0x200
sbb eax, eax
add eax, 9
jmp 0x402788
cmp dword [ecx], 0x800
sbb eax, eax
add eax, 0xb
jmp 0x402788
cmp dword [ecx], 0x4000
jae 0x4026da
cmp dword [ecx], 0x2000
sbb eax, eax
add eax, 0xd
jmp 0x402788
cmp dword [ecx], 0x8000
sbb eax, eax
add eax, 0xf
jmp 0x402788
cmp dword [ecx], 0x1000000
jae 0x40273e
cmp dword [ecx], 0x100000
jae 0x40271c
cmp dword [ecx], 0x40000
jae 0x40270f
cmp dword [ecx], 0x20000
sbb eax, eax
add eax, 0x11
jmp 0x402788
cmp dword [ecx], 0x80000
sbb eax, eax
add eax, 0x13
jmp 0x402788
cmp dword [ecx], 0x400000
jae 0x402731
cmp dword [ecx], 0x200000
sbb eax, eax
add eax, 0x15
jmp 0x402788
cmp dword [ecx], 0x800000
sbb eax, eax
add eax, 0x17
jmp 0x402788
cmp dword [ecx], 0x10000000
jae 0x402768
cmp dword [ecx], 0x4000000
jae 0x40275b
cmp dword [ecx], 0x2000000
sbb eax, eax
add eax, 0x19
jmp 0x402788
cmp dword [ecx], 0x8000000
sbb eax, eax
add eax, 0x1b
jmp 0x402788
cmp dword [ecx], 0x40000000
jae 0x40277d
cmp dword [ecx], 0x20000000
sbb eax, eax
add eax, 0x1d
jmp 0x402788
cmp dword [ecx], 0x80000000
sbb eax, eax
add eax, 0x1f
cmp eax, esi
jae 0x4027a0
xor esi, esi
add ecx, 4
inc edx
cmp edx, edi
jb 0x402631
mov eax, ebx
pop edi
pop esi
pop ebx
ret
shl edx, 5
add eax, edx
jmp 0x40279c

Function at 0x402ede
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 4], edi
jne 0x402f0c
call fcn.0040211d
cmp dword [esi + 4], edi
jne 0x402f05
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 4], eax
mov ecx, esi
call fcn.00402133
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x402f21
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.fstLockSystemMutex:_Mutex_was_abadoned
call fcn.00402029
int3
Function at 0x100033a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ce01
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1004a018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
push edi
mov ecx, esi
call dword [sym.imp.QtCore_Ad_4.dll_public:_void___thiscall_QObject::constructor_class_QObject__]
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [esi + 8]
mov dword [ebp - 4], edi
call dword [sym.imp.QtNetwork_Ad_4.dll_public:_void___thiscall_QNetworkRequest::constructor_class_QUrl_const__]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
mov byte [ebp - 4], 1
mov dword [esi + 0xc], ecx
push edx
lea ecx, [esi + 0x14]
mov dword [esi], vtable.DownloadRequest.0
mov dword [esi + 0x10], edi
call dword [sym.imp.QtCore_Ad_4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 2
call dword [sym.imp.QtCore_Ad_4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov eax, dword [0x1004abd0]
mov dword [esi + 0x30], eax
inc eax
mov dword [0x1004abd0], eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1000b270
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001cb12
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1004a018]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 8], str.text_html
call dword [sym.imp.QtCore_Ad_4.dll_public:_void___thiscall_QString::constructor_class_QLatin1String_const__]
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0x2c], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], str.utf_8
call dword [sym.imp.QtCore_Ad_4.dll_public:_void___thiscall_QString::constructor_class_QLatin1String_const__]
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call dword [sym.imp.QtCore_Ad_4.dll_public:_void___thiscall_QUrl::constructor_void_]
mov eax, dword [sym.imp.QtCore_Ad_4.dll_struct_QByteArray::Data_QByteArray::shared_null]
mov dword [esp + 0x18], eax
mov edx, 1
lock xadd dword [eax], edx
mov dword [esp + 0x28], 2
mov ecx, dword [esi + 0x18]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
lea edx, [esp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
push 1
call eax
test al, al
jne 0x1000b34a
mov dword [esp + 0x28], 5
mov ecx, dword [esp + 0x18]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1000b334
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.QtCore_Ad_4.dll_void___cdecl_qFree_void__]
add esp, 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 4
call dword [sym.imp.QtCore_Ad_4.dll_public:_void___thiscall_QUrl::destructor_void_]
mov byte [esp + 0x28], 3
jmp 0x1000b399
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x14]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.QtWebKit_Ad_4.dll_public:_void___thiscall_QWebView::setContent_class_QByteArray_const___class_QString_const___class_QUrl_const__]
mov dword [esp + 0x28], 8
mov ecx, dword [esp + 0x18]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1000b385
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.QtCore_Ad_4.dll_void___cdecl_qFree_void__]
add esp, 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 7
call dword [sym.imp.QtCore_Ad_4.dll_public:_void___thiscall_QUrl::destructor_void_]
mov byte [esp + 0x28], 6
lea ecx, [esp + 0x10]
call dword [sym.imp.QtCore_Ad_4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.QtCore_Ad_4.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b4d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001ca53
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x1004a018]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x1004a018]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, dword [sym.imp.QtGui_Ad_4.dll_public:_void___thiscall_QKeySequence::constructor_enum_QKeySequence::StandardKey_]
mov edi, ecx
push 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 0xc
call esi
mov dword [esp + 0x80], 0
push 9
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], 0xd
call esi
mov ebx, 0xa
mov byte [esp + 0x80], 1
push ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x28], 0xe
call esi
mov byte [esp + 0x80], 2
push 0xf
lea ecx, [esp + 0x34]
mov dword [esp + 0x30], 0xb
call esi
mov byte [esp + 0x80], 3
push 0xd
lea ecx, [esp + 0x3c]
mov dword [esp + 0x38], 8
call esi
mov byte [esp + 0x80], 4
push 0xe
lea ecx, [esp + 0x44]
mov dword [esp + 0x40], 9
call esi
mov byte [esp + 0x80], 5
push 0xb
lea ecx, [esp + 0x4c]
mov dword [esp + 0x48], 0xf
call esi
mov byte [esp + 0x80], 6
push 0xc
lea ecx, [esp + 0x54]
mov dword [esp + 0x50], 0x10
call esi
mov byte [esp + 0x80], 7
push 0x1a
lea ecx, [esp + 0x5c]
mov dword [esp + 0x58], 0x34
call esi
push 0
push 0
mov byte [esp + 0x88], 8
mov esi, dword [sym.imp.QtGui_Ad_4.dll_public:_void___thiscall_QKeySequence::constructor_int__int__int__int_]
push 0
push 0x1000000
lea ecx, [esp + 0x70]
mov dword [esp + 0x6c], ebx
call esi
push 0
push 0
push 0
mov byte [esp + 0x8c], 9
push 0
lea ecx, [esp + 0x78]
mov dword [esp + 0x74], 0xffffffff
call esi
mov dword [esp + 0x80], ebx
xor ebx, ebx
cmp dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], ebx
je 0x1000b68d
lea eax, [esp + 0x14]
nop
mov eax, dword [eax]
mov ecx, dword [edi + 0x18]
push eax
call dword [sym.imp.QtWebKit_Ad_4.dll_public:_class_QAction____thiscall_QWebPage::action_enum_QWebPage::WebAction_const]
mov esi, eax
test esi, esi
je 0x1000b672
lea ecx, [esp + ebx + 0x18]
push ecx
mov ecx, esi
call dword [sym.imp.QtGui_Ad_4.dll_public:_void___thiscall_QAction::setShortcut_class_QKeySequence_const__]
push 1
mov ecx, esi
call dword [sym.imp.QtGui_Ad_4.dll_public:_void___thiscall_QAction::setEnabled_bool_]
push esi
mov ecx, edi
call dword [sym.imp.QtGui_Ad_4.dll_public:_void___thiscall_QWidget::addAction_class_QAction__]
mov eax, dword [esp + 0x10]
inc eax
lea ebx, [eax*8]
cmp dword [esp + ebx + 0x14], 0xffffffff
mov dword [esp + 0x10], eax
lea eax, [esp + ebx + 0x14]
jne 0x1000b640
push 0x1000b6d0
push 0xb
push 8
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x90], 0xffffffff
call fcn.1001bc10
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.1001ba98
mov esp, ebp
pop ebp
ret