joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64062840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x640a10bc
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 1
test esi, esi
je 0x640628aa
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 8]
call sym.QtNetwork4.dll_public:_void___thiscall_QHostAddress::constructor_class_QHostAddress_const__
mov ecx, dword [esp + 0x2c]
push ecx
lea ecx, [esi + 0xc]
mov byte [esp + 0x20], 2
call sym.QtNetwork4.dll_public:_void___thiscall_QHostAddress::constructor_class_QHostAddress_const__
mov eax, esi
jmp 0x640628ac
xor eax, eax
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
inc dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10

Function at 0x64063f20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x640a14fd
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 1
test esi, esi
je 0x64063f8b
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 8]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov ecx, dword [esp + 0x2c]
push ecx
lea ecx, [esi + 0xc]
mov byte [esp + 0x20], 2
call sym.QtNetwork4.dll_public:_void___thiscall_QAuthenticator::constructor_class_QAuthenticator_const__
mov eax, esi
jmp 0x64063f8d
xor eax, eax
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
inc dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10
Function at 0x64076db0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x640a392b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [ecx + 4]
lea ecx, [esi + 0x58]
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QString::isEmpty_void_const]
test al, al
jne 0x64076e09
push str.QLocalServer::listen___called_when_already_listening
call dword [sym.imp.QtCore4.dll_void___cdecl_qWarning_char_const__]
add esp, 4
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 4
mov edi, dword [esp + 0x2c]
mov ecx, edi
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QString::isEmpty_void_const]
test al, al
je 0x64076ee1
push str.QLocalServer::listen
lea ecx, [esp + 0x1c]
mov dword [esi + 0x6c], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QLatin1String::constructor_char_const__]
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QLatin1String_const__]
mov byte [esp + 0x2c], 0x20
mov eax, dword [esp + 0x2c]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QChar::constructor_struct_QLatin1Char_]
push 0
lea ecx, [esp + 0x18]
push 0x640b17f0
push ecx
call sym.QtNetwork4.dll_public:_static_class_QString___cdecl_QLocalServer::tr_char_const___char_const__
add esp, 0xc
lea edx, [esp + 0x2c]
push edx
push 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, eax
mov byte [esp + 0x34], 1
call dword [sym.imp.QtCore4.dll_public:_class_QString___thiscall_QString::arg_class_QString_const___int__class_QChar_const__]
push eax
lea ecx, [esi + 0x68]
mov byte [esp + 0x28], 2
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_class_QString__]
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 4
push edi
mov ecx, esi
call fcn.6407d300
lea ecx, [esi + 0x58]
test al, al
jne 0x64076f15
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::clear_void_]
lea ecx, [esi + 0x5c]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::clear_void_]
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 4
push edi
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_class_QString_const__]
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 4
Function at 0x64079750
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x640ed630]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
push 2
mov dword [esi], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x640797a4
push str.QTcpSocketAPI:_WinSock_v2.0_initialization_failed.
call dword [sym.imp.QtCore4.dll_void___cdecl_qWarning_char_const__]
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.64093178
add esp, 0x194
ret
mov ecx, dword [esp + 0x194]
mov dword [esi], 0x20
mov eax, esi
pop esi
xor ecx, esp
call fcn.64093178
add esp, 0x194
ret

Function at 0x64079a33
Capabilities:
Set socket configuration

Disassembly:
mov ecx, dword [ecx + 4]
jmp 0x64079a30
sub esp, 8
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x38]
call edx
test al, al
je 0x64079b24
mov edx, dword [esp + 0x10]
xor eax, eax
mov ecx, 0xffff
cmp edx, 0xa
ja case.default.0x64079a5c
jmp dword [edx*4 + 0x64079b30]
mov eax, 0x1002
jmp case.default.0x64079a5c
mov eax, 0x1001
jmp case.default.0x64079a5c
mov eax, 0x20
jmp case.default.0x64079a5c
mov ecx, dword [esp + 0x14]
push eax
push eax
lea edx, [esp + 0x18]
push edx
mov edx, dword [esi + 0x78]
push 4
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
push eax
push 4
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x1c]
push ecx
push 0x8004667e
push edx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
je 0x64079b1e
mov al, 1
pop esi
add esp, 8
ret 8
mov eax, 4
jmp case.default.0x64079a5c
mov eax, 0xfffffffb
jmp case.default.0x64079a5c
mov eax, 0x100
jmp case.default.0x64079a5c
mov ecx, 6
lea eax, [ecx - 5]
jmp case.default.0x64079a5c
mov eax, 8
jmp case.default.0x64079a5c
cmp dword [esi + 0x60], 1
mov eax, 0xa
jne 0x64079b05
lea ecx, [eax + 0x1f]
jmp case.default.0x64079a5c
cmp dword [esi + 0x60], 1
mov eax, 0xb
jne 0x64079b05
lea ecx, [eax + 0x1e]
jmp case.default.0x64079a5c
xor ecx, ecx
push 4
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esi + 0x78]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x64079ab6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor al, al
pop esi
add esp, 8
ret 8
Function at 0x6407c150
Capabilities:
Read file on windows
Read pipe

Disassembly:
push 0xffffffffffffffff
push 0x640a4149
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea esp, [esp]
mov ecx, dword [esi + 0x90]
mov edi, dword [esi + 4]
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x6407c1a7
mov ebp, dword [esp + 0x18]
jmp 0x6407c1db
cmp byte [esi + 0xde], 0
jne 0x6407c1d9
mov ecx, edi
mov byte [esi + 0xde], 1
call dword [sym.imp.QtCore4.dll_protected:_void___thiscall_QIODevice::readChannelFinished_void_]
cmp dword [esi + 0xd0], 0
jne 0x6407c1d9
push str.1_q_pipeClosed__
push edi
push 0
call dword [sym.imp.QtCore4.dll_public:_static_void___cdecl_QTimer::singleShot_int__class_QObject___char_const__]
add esp, 0xc
xor ebp, ebp
cmp byte [esi + 0xde], 0
jne 0x6407c300
test ebp, ebp
jne 0x6407c1f1
mov ebp, 0x1000
mov ecx, dword [esi + 0xb0]
mov edi, dword [esi + 0xb4]
mov edx, ecx
or edx, edi
je 0x6407c22a
mov ebx, dword [esi + 0xcc]
mov eax, ebx
cdq
sub ecx, eax
sbb edi, edx
xor eax, eax
cmp eax, edi
jl 0x6407c22a
jg 0x6407c21c
cmp ebp, ecx
jbe 0x6407c22a
mov ebp, dword [esi + 0xb0]
sub ebp, ebx
je 0x6407c300
push ebp
lea ecx, [esi + 0xb8]
call fcn.6400e2a0
mov edx, dword [esi + 0x90]
lea ecx, [esi + 0x94]
push ecx
push 0
push ebp
push eax
push edx
mov byte [esi + 0xdc], 1
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x6407c26d
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xe9
je 0x6407c2f0
dec eax
jne 0x6407c295
mov ecx, esi
call fcn.6407c050
cmp byte [esi + 0xdc], 0
je 0x6407c180
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
sub eax, 0x2fb
je 0x6407c300
push str.QLocalSocketPrivate::startAsyncRead
lea ecx, [esp + 0x20]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QLatin1String::constructor_char_const__]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QLatin1String_const__]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x2c], 0
call fcn.6407b2a0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov ecx, dword [esi + 4]
mov byte [esi + 0xde], 1
call dword [sym.imp.QtCore4.dll_protected:_void___thiscall_QIODevice::readChannelFinished_void_]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x6407d830
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x640a43a3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], 1
cmp eax, 5
ja case.default.0x6407d86b
jmp dword [eax*4 + 0x6407d8dc]
push str.Organization
jmp 0x6407d89a
push str.CommonName
jmp 0x6407d89a
push str.CountryName
jmp 0x6407d89a
push str.LocalityName
jmp 0x6407d89a
push str.OrganizationalUnitName
jmp 0x6407d89a
push str.StateOrProvinceName
lea ecx, [esp + 0x24]
call dword [sym.imp.QtCore4.dll_public:_class_QDebug____thiscall_QDebug::operator___char_const__]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov dword [esi], eax
inc dword [eax + 0xc]
lea ecx, [esp + 0x20]
mov dword [esp + 8], 1
mov byte [esp + 0x14], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QDebug::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x6407eef0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x640a476c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], 0
mov eax, dword [esi]
push eax
call dword [sym.imp.QtCore4.dll_public:_static_class_QMutex____cdecl_QMutexPool::globalInstanceGet_void_const__]
add esp, 4
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QMutexLocker::constructor_class_QMutex__]
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
cmp dword [ecx + 0x3c], 0
mov dword [esp + 0x24], 1
jne 0x6407ef96
cmp dword [eax + 0x1c], 0
je 0x6407ef96
mov edx, dword [eax + 0x1c]
push edx
call fcn.6408e080
push eax
lea eax, [esp + 0x18]
push eax
call fcn.6407ed10
mov ecx, dword [esi]
mov edi, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ecx + 0xc], edi
mov dword [eax], edx
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x6407ef96
lea ecx, [eax + 0x34]
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::deref_void_]
test al, al
jne 0x6407ef96
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x14]
call fcn.6407de30
mov ebx, dword [esp + 0x30]
lea edx, [esp + 0x30]
push edx
call fcn.6407d6e0
add esp, 4
mov ecx, dword [esi]
mov edi, dword [esp + 0x2c]
push eax
push edi
lea ecx, [ecx + 0xc]
mov byte [esp + 0x2c], 2
call fcn.6407e120
mov eax, 1
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], eax
mov byte [esp + 0x24], al
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QMutexLocker::destructor_void_]
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
Function at 0x640830e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x640a5348
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
push 8
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], 0
test edi, edi
je 0x64083154
lea ecx, [esp + 0xc]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::constructor_void_]
push 0
push eax
lea ecx, [edi + 4]
mov byte [esp + 0x28], 1
call sym.QtNetwork4.dll_public:_void___thiscall_QSslCertificate::constructor_class_QByteArray_const___enum_QSsl::EncodingFormat_
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 3
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::destructor_void_]
mov eax, edi
jmp 0x64083156
xor eax, eax
mov dword [esi], eax
mov ecx, dword [esp + 0x28]
mov dword [eax], ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 4
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::constructor_void_]
push 0
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 5
call sym.QtNetwork4.dll_public:_void___thiscall_QSslCertificate::constructor_class_QByteArray_const___enum_QSsl::EncodingFormat_
mov ecx, dword [esi]
push eax
add ecx, 4
mov byte [esp + 0x24], 6
call sym.QtNetwork4.dll_public:_class_QSslCertificate____thiscall_QSslCertificate::operator_class_QSslCertificate_const__
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 5
call sym.QtNetwork4.dll_public:_void___thiscall_QSslCertificate::destructor_void_
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 4
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 4
Function at 0x64083330
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x640a53f4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
push ecx
mov ebx, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], ebx
call sym.QtNetwork4.dll_public:_void___thiscall_QSslError::constructor_enum_QSslError::SslError_
lea edx, [esp + 0xc]
push edx
mov ecx, eax
mov byte [esp + 0x24], 2
call sym.QtNetwork4.dll_public:_class_QString___thiscall_QSslError::errorString_void_
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call dword [sym.imp.QtCore4.dll_public:_class_QDebug____thiscall_QDebug::operator___class_QString_const__]
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov eax, dword [esp + 0x10]
mov byte [esp + 0x20], bl
mov esi, eax
test eax, eax
je 0x640833c5
lea ecx, [eax + 4]
call sym.QtNetwork4.dll_public:_void___thiscall_QSslCertificate::destructor_void_
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esi], eax
add dword [eax + 0xc], ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], ebx
mov byte [esp + 0x20], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QDebug::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x64087280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x640a5be1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 4]
cmp byte [esi + 0x130], 0
jne 0x640872ba
mov ecx, esi
call fcn.64086760
cmp dword [esi + 0x180], 0
mov byte [esi + 0x130], 0
jne 0x640872de
push ecx
mov ecx, dword [esp + 0x3c]
mov eax, esp
mov dword [eax], ecx
mov ecx, esi
mov dword [esp + 0x10], esp
call fcn.640867e0
lea edx, [esp + 0xc]
push edx
mov ecx, edi
call sym.QtNetwork4.dll_public:_class_QNetworkProxy___thiscall_QAbstractSocket::proxy_void_
mov ecx, dword [esi + 0x180]
push eax
mov dword [esp + 0x2c], 0
call sym.QtNetwork4.dll_public:_void___thiscall_QAbstractSocket::setProxy_class_QNetworkProxy_const__
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call sym.QtNetwork4.dll_public:_void___thiscall_QNetworkProxy::destructor_void_
push str._q_user_agent
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call dword [sym.imp.QtCore4.dll_public:_class_QVariant___thiscall_QObject::property_char_const__]
mov ecx, dword [esi + 0x180]
push eax
push str._q_user_agent
mov dword [esp + 0x30], 1
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QObject::setProperty_char_const___class_QVariant_const__]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::destructor_void_]
push ecx
mov ecx, dword [esp + 0x3c]
mov eax, esp
mov dword [eax], ecx
mov ecx, edi
mov dword [esp + 0x10], esp
call dword [sym.imp.QtCore4.dll_public_virtual:_bool___thiscall_QIODevice::open_class_QFlags_enum_QIODevice::OpenModeFlag__]
mov edx, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x34]
mov eax, esp
mov dword [eax], edx
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], esp
push eax
push ecx
mov ecx, dword [esi + 0x180]
call sym.QtNetwork4.dll_public:_void___thiscall_QAbstractSocket::connectToHost_class_QString_const___unsigned_short_int__class_QFlags_enum_QIODevice::OpenModeFlag__
mov ecx, dword [esi + 0x180]
call sym.QtNetwork4.dll_public:_int___thiscall_QAbstractSocket::socketDescriptor_void_const
mov dword [esi + 0xc0], eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0xc
Function at 0x64091910
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x640a6a59
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x640ed630]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
push eax
lea edx, [esp + 0x40]
mov dword [esp + 0x18], edx
lea edx, [esp + 0x48]
push 4
mov dword [esp + 0x24], edx
lea edx, [esp + 0x58]
push 0x640ed590
push ecx
mov dword [esp + 0x40], 2
mov dword [esp + 0x1c], 0
mov dword [esp + 0x34], edx
call dword [sym.imp.QtCore4.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___]
mov ecx, dword [esp + 0x48]
add esp, 0x10
mov byte [esp + 0x30], 1
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::deref_void_]
test al, al
jne 0x640919c7
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0xc]
lea edx, [eax + ecx*4 + 0x14]
mov ecx, dword [eax + 8]
push edx
lea edx, [eax + ecx*4 + 0x14]
push edx
lea ecx, [esp + 0x40]
mov esi, eax
call fcn.64014630
push esi
call dword [sym.imp.QtCore4.dll_void___cdecl_qFree_void__]
add esp, 4
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov esi, dword [esp + 0x4c]
mov edi, dword [esp + 0x48]
mov dword [esp + 0x30], 0xffffffff
test esi, esi
je 0x64091a24
lea ecx, [esi + 8]
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::deref_void_]
test al, al
jne 0x64091a0d
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
test al, al
jne 0x64091a0d
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esi + 4]
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::deref_void_]
test al, al
jne 0x64091a24
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 0x20
Function at 0x64093178
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x640ed630]
jne 0x64093182
repz ret
jmp fcn.6409388b

Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748