joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100417de
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x20c]
push esi
xor ebx, ebx
mov edi, ecx
push ebx
push eax
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x414]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0x418], ebx
lea eax, [ebp - 0x418]
mov esi, ebx
push eax
push 0x20019
push ebx
push 0x10006e58
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004190b
lea eax, [ebp - 0x420]
mov dword [ebp - 0x41c], ebx
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x420], 0x208
push eax
lea eax, [ebp - 0x41c]
push eax
push ebx
push 0x10003f08
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100418ed
cmp dword [ebp - 0x41c], 2
jne 0x100418ed
push 0x104
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x100418ed
lea eax, [ebp - 0x414]
mov edx, 0x104
push eax
lea ecx, [ebp - 0x20c]
call fcn.1000b82d
test eax, eax
js 0x100418ed
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100418d6
sub ecx, edx
sar ecx, 1
je 0x100418ed
lea esi, [ebp - 0x20c]
cmp dword [ebp - 0x418], ebx
je 0x10041907
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x418], ebx
test esi, esi
jne 0x10041910
mov esi, 0x10006e2c
push 1
push ebx
push edi
push esi
push 0x10005004
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret
Function at 0x10042f90
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
and dword [esp + 0xc], esi
and dword [esp + 8], esi
push edi
xor edi, edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edi
cmp dword [ebp + 0x10], esi
je 0x10043113
cmp dword [ebp + 0xc], esi
je 0x10043113
mov ecx, ebx
call fcn.10046af8
test eax, eax
jne 0x10042fdc
mov eax, 0x80070005
jmp 0x10043144
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x1c]
xor edi, edi
inc edi
push eax
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x14], edi
call fcn.1003607a
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
cmp esi, 0xffffffff
je 0x1004312a
test eax, eax
js 0x1004312a
mov ecx, dword [ebx + 4]
mov edx, esi
call fcn.100340fd
test eax, eax
je 0x1004312a
mov edx, dword [ebp + 0x10]
lea eax, [esp + 0x18]
mov ecx, dword [ebp + 0xc]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.10036449
test eax, eax
je 0x1004310d
mov edi, dword [esp + 0xc]
jmp 0x1004306a
push 0x10
push dword [esp + 0x14]
mov edx, esi
push 0
call fcn.100341d2
test eax, eax
je 0x1004310d
mov ecx, dword [ebx + 4]
mov edx, esi
call fcn.100340fd
test eax, eax
je 0x1004310d
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x10]
cmp dword [eax + 0x84], edi
jb 0x10043041
push 0
push 0
push dword [eax + 0x8c]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x18]
cmp eax, 0xffffffff
je 0x100430a1
push dword [esp + 0xc]
mov edx, edi
mov ecx, esi
call fcn.10035fcf
jmp 0x100430a3
xor eax, eax
test eax, eax
je 0x1004311b
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0xc]
push 0
push 0
mov eax, dword [eax + 0x10]
push 0
push esi
mov dword [eax + 0x88], ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
mov dword [eax + 0x90], ecx
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10043100
and dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
push 0
push eax
push 0xa4
push dword [esp + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10043102
xor eax, eax
test eax, eax
je 0x1004311b
and dword [esp + 0x14], 0
jmp 0x1004311b
mov edi, dword [esp + 0x18]
jmp 0x1004311b
mov dword [esp + 0x14], 0x80070057
test edi, edi
je 0x10043126
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [esp + 0x10]
test esi, esi
je 0x10043135
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x10043140
mov ecx, ebx
call fcn.10046b1c
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1005a966
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, ecx
push 0x4c
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], esi
push eax
mov ebx, edx
call sub.msvcrt.dll_memset
push 0x2c
pop edi
xor eax, eax
push edi
push eax
lea eax, [ebp - 0x30]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0x30], edi
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowPlacement]
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [ebp - 0x28], 1
je 0x1005a9d2
lea esi, [ebp - 0x14]
lea edi, [ebp - 0x7c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x80]
xor edi, edi
push edi
push edi
push 0x130b
push 0x64
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x80], edi
test ebx, ebx
je 0x1005a9ff
mov eax, dword [ebx + 0x2a8]
test eax, eax
jne 0x1005aa04
mov eax, SysReAllocStringLen
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x88], edi
push ecx
lea ecx, [ebp - 0x80]
push ecx
push edi
push 0xf003f
push edi
push edi
push edi
push 0x10007698
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1005aa45
push 0x4c
lea eax, [ebp - 0x7c]
push eax
push 3
push edi
push 0x100076f0
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x80], edi
je 0x1005aa53
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x63
push esi
mov dword [ebp - 0x84], edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push edi
mov esi, eax
push 0x147
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
lea edx, [ebp - 0x84]
mov ecx, esi
call fcn.10031469
mov esi, dword [ebp - 0x84]
test esi, esi
je 0x1005aaca
test ebx, ebx
je 0x1005aa98
mov edx, dword [ebx + 0x2a8]
test edx, edx
jne 0x1005aa9d
mov edx, SysReAllocStringLen
mov ecx, esi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1005aaa4
sub ecx, edi
sar ecx, 1
push ecx
push esi
push 1
push 0x10007478
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret
Function at 0x10061c77
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
or dword [esp + 0xc], 0xffffffff
push ebx
push esi
push edi
xor esi, esi
mov dword [esp + 0x20], edx
push esi
push esi
push 0x1032
push dword [ebp + 8]
mov dword [esp + 0x3c], ecx
mov ebx, esi
mov dword [esp + 0x34], esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x28], eax
mov edi, esi
mov dword [esp + 0x14], edi
test eax, eax
jg 0x10061cc2
mov eax, 0x80004005
jmp 0x10061e27
mov dword [esp + 0x1c], esi
test ebx, ebx
js 0x10061e18
push 2
push dword [esp + 0x1c]
mov dword [esp + 0x14], esi
push 0x100c
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp + 8]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x24]
push eax
mov dword [esp + 0x20], eax
call fcn.10060dc1
mov ebx, eax
test ebx, ebx
js 0x10061dc7
cmp dword [esp + 0xc], 0
je 0x10061dc7
test edi, edi
je 0x10061d32
mov ecx, edi
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10061d1c
sub ecx, edx
sar ecx, 1
lea esi, [ecx*2 + 4]
mov ecx, dword [esp + 0xc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x24]
jne 0x10061d39
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 6
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 0x10], eax
test eax, eax
je 0x10061db9
shr esi, 1
test edi, edi
je 0x10061d85
push edi
mov edx, esi
mov ecx, eax
call fcn.1000b82d
mov ecx, dword [esp + 0x10]
mov edx, esi
push 0x10006cb0
call fcn.10022e38
mov eax, dword [esp + 0x10]
push dword [esp + 0xc]
mov edx, esi
mov ecx, eax
call fcn.10022e38
mov edx, esi
mov esi, dword [esp + 0x10]
push 0x10006cb0
mov ecx, esi
call fcn.10022e38
test edi, edi
je 0x10061db1
lea ecx, [esp + 0x14]
call fcn.10037062
mov edi, esi
mov dword [esp + 0x14], edi
jmp 0x10061dbe
mov ebx, 0x8007000e
lea ecx, [esp + 0xc]
call fcn.10037062
mov eax, dword [esp + 0x1c]
inc eax
push 0
mov dword [esp + 0x20], eax
pop esi
cmp eax, dword [esp + 0x28]
jl 0x10061cc6
test ebx, ebx
js 0x10061e18
test edi, edi
je 0x10061e25
mov ecx, edi
call fcn.100250dd
push dword [esp + 0x2c]
mov esi, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x10061e25
test edi, edi
je 0x10061e25
lea ecx, [esp + 0x14]
call fcn.10037062
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10062190
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x20c]
mov esi, 0x208
mov dword [ebp - 0x418], ebx
push esi
push ebx
push eax
mov edi, ecx
mov dword [ebp - 0x41c], ebx
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x414]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0x420], ebx
lea eax, [ebp - 0x418]
push eax
push 0x20019
push ebx
push 0x10007748
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100622ab
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x41c], 0x104
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
push 0x10007790
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x420], 2
mov esi, eax
jne 0x1006227a
push 0x104
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x414]
mov edx, 0x104
push eax
lea ecx, [ebp - 0x20c]
call fcn.1000b82d
test esi, esi
jne 0x100622ab
lea esi, [ebp - 0x20c]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x10062287
sub esi, ecx
sar esi, 1
je 0x100622ab
lea eax, [ebp - 0x20c]
mov edx, 0x104
push eax
mov ecx, edi
call fcn.1000b82d
cmp dword [ebp - 0x418], 0
pop edi
pop esi
pop ebx
je 0x100622c3
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10087900
mov esp, ebp
pop ebp
ret
Function at 0x10063130
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x1c
push 0x40
mov dword [ebp - 4], edx
mov ebx, ecx
mov edi, 0x80004005
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1006319e
mov eax, dword [ebp - 4]
xor ecx, ecx
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
lea eax, [ebp - 8]
push eax
push ecx
push esi
push 0x10063090
push ecx
push ecx
mov dword [ebp - 8], ecx
mov dword [esi], ebx
mov dword [esi + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1006319e
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100631b7
push 0x30
mov edx, 0x10c3
mov ecx, ebx
call fcn.10060325
test esi, esi
je 0x100631b7
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1006425f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [0x1008b1e4]
push edi
mov edi, edx
push dword [edi + 4]
movzx eax, word [edi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x10064302
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x10064301
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x100642fa
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
mov dword [ebp - 8], eax
test eax, eax
je 0x100642fa
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x100642ed
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
mov dword [esi], 0x10001fd0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
jmp 0x100642ef
xor esi, esi
lea ecx, [ebp - 8]
mov dword [edi + 0x18], esi
call int.1000b34b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
mov eax, dword [edi + 0x18]
neg eax
pop edi
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x64001e60
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x64095065
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x640ee650]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QObject::constructor_class_QObject__]
xor ebx, ebx
lea edi, [esi + 0xc]
push esi
mov ecx, edi
mov dword [esp + 0x20], ebx
mov dword [esi], vtable.QFtpDTP.0
mov dword [esi + 8], ebx
call sym.QtNetwork4.dll_public:_void___thiscall_QTcpServer::constructor_class_QObject__
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x14], ecx
lea ecx, [esi + 0x18]
mov byte [esp + 0x1c], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [esi + 0x3c]
mov byte [esp + 0x1c], 2
mov byte [esi + 0x30], bl
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::constructor_void_]
push str.QFtpDTP_active_state_server
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 3
mov byte [esi + 0x38], bl
mov dword [esi + 0x34], ebx
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QLatin1String::constructor_char_const__]
push eax
lea ecx, [esp + 0x2c]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QLatin1String_const__]
lea edx, [esp + 0x28]
push edx
mov ecx, edi
mov byte [esp + 0x20], 4
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QObject::setObjectName_class_QString_const__]
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 3
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
push 3
push str.1setupSocket__
push str.2newConnection__
push edi
mov ecx, esi
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QObject::connect_class_QObject_const___char_const___char_const___enum_Qt::ConnectionType_const]
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x64007676
Capabilities:
Access peb ldr_data
Get process heap flags
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [0x640ed2f0]
mov dword [esp], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov esi, edx
xor eax, eax
mov esi, dword [esi]
cmp esi, edx
je 0x640076d8
mov edi, dword [esi + 0x30]
movzx ebp, word [edi]
test bp, bp
je 0x640076cc
add edi, 2
xor ebx, ebx
lea ecx, [ebp - 0x41]
cmp cx, 0x1a
jae 0x640076ba
add ebp, 0x20
movzx ecx, bp
add ebx, ecx
movzx ebp, word [edi]
add edi, 2
test bp, bp
jne 0x640076ae
jmp 0x640076ce
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x64007698
mov ebx, dword [esi + 0x18]
jmp 0x640076da
xor ebx, ebx
mov ecx, dword [0x640ed2f8]
mov edx, dword [0x640ed328]
mov dword [esp + 4], edx
mov edx, dword [0x640ed320]
mov esi, dword [ebx + 0x3c]
add esi, ebx
mov edx, dword [esi + edx*8 + 0x78]
mov ebp, dword [ebx + edx + 0x20]
add ebp, ebx
mov esi, dword [ebx + edx + 0x1c]
mov dword [esp + 0x10], esi
mov edx, dword [ebx + edx + 0x24]
mov dword [esp + 0xc], edx
mov dword [esp], ebx

Function at 0x64007790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc byte [ecx], al
stc
mov edx, dword [esp + 0xc]
add edx, edi
movzx eax, word [edx + eax*2]
mov eax, dword [ecx + eax*4]
add eax, edi
push dword [0x640ed314]
push 0
call eax
mov dword [esp + 0x10], eax
mov eax, dword [0x640ed2f8]
mov ecx, dword [0x640ed324]
mov dword [esp + 4], ecx
mov ecx, dword [0x640ed320]
mov edx, dword [edi + 0x3c]
add edx, edi
mov ecx, dword [edx + ecx*8 + 0x78]
mov edx, dword [edi + ecx + 0x20]
mov ecx, cr0
cli
mov esi, dword [edi + ecx + 0x1c]
mov dword [esp + 0xc], esi
mov ecx, dword [edi + ecx + 0x24]
mov dword [esp + 8], ecx
xor ebp, ebp
mov esi, dword [edx + ebp*4]
add esi, edi
xor ebx, ebx
xor ecx, ecx
dec ecx
mov edi, ebx
cmp byte [esi + ecx + 1], 0
lea ecx, [ecx + 1]
lea ebx, [ebx + 1]
jne 0x640077b0
xor ebx, ebx
test ecx, ecx
je 0x640077d1
imul ebx, eax
movzx ecx, byte [esi]
add ebx, ecx
inc esi
dec edi
jne 0x640077c5
cmp ebx, dword [esp + 4]
je 0x640077dd
inc ebp
mov edi, dword [esp]
jmp 0x640077a6
mov edi, dword [esp]
mov ecx, dword [esp + 0xc]
add ecx, edi
mov eax, dword [esp + 8]
add eax, edi
movzx eax, word [eax + ebp*2]
mov ecx, dword [ecx + eax*4]
add ecx, edi
push 0x104
mov ebx, dword [esp + 0x14]
push ebx
push 0
add bh, bh
ror dword [ebx + 0xed31c0d], 1
mov edx, dword fs:[0x640ed33c]
Function at 0x64008270
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64095cc9
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x640ee650]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x68]
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QListData::isEmpty_void_const]
test al, al
jne 0x640082b8
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 4
lea ecx, [esi + 0x50]
call sym.QtNetwork4.dll_public:_enum_QAbstractSocket::SocketState___thiscall_QAbstractSocket::state_void_
cmp eax, 3
jne 0x640082e1
cmp dword [esi + 0x60], 1
jne 0x640082e1
mov eax, dword [esp + 0x2c]
push eax
lea ecx, [esi + 0x68]
call fcn.64004150
mov ecx, esi
call fcn.64007800
jmp 0x64008337
xor edi, edi
push edi
lea ecx, [esp + 0x10]
push str.Not_connected
push ecx
call sym.QtNetwork4.dll_public:_static_class_QString___cdecl_QFtp::tr_char_const___char_const__
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
push 2
lea edx, [esp + 0x40]
push 0x640ed014
push esi
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 4
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edx
call dword [sym.imp.QtCore4.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___]
add esp, 0x1c
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 4
Function at 0x64017630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ecx + 4]
mov dl, byte [esp + 4]
mov byte [eax + 0x116], dl
mov eax, dword [eax + 0xb8]
mov dword [esp + 4], ecx
mov ecx, dword [eax + 4]
jmp fcn.6401a0f0
Function at 0x6401bc10
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x64098807
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x640ee650]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
push 0x40805
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QObjectPrivate::constructor_int_]
mov eax, dword [esp + 0x28]
xor ebx, ebx
push eax
lea ecx, [esi + 0x50]
mov dword [esp + 0x24], ebx
mov dword [esi], vtable.QHttpNetworkConnectionPrivate.0
mov dword [esi + 0x4c], ebx
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov cx, word [esp + 0x2c]
mov dl, byte [esp + 0x30]
mov word [esi + 0x54], cx
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 1
mov byte [esi + 0x56], dl
mov dword [esi + 0x58], 6
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_void_]
mov edi, eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_void_]
mov ebp, eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 3
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_void_]
push edi
push ebp
push ebx
push eax
push 2
lea ecx, [esi + 0x60]
mov byte [esp + 0x34], 4
call sym.QtNetwork4.dll_public:_void___thiscall_QNetworkProxy::constructor_enum_QNetworkProxy::ProxyType__class_QString_const___unsigned_short_int__class_QString_const___class_QString_const__
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 6
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 7
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 8
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov eax, dword [sym.imp.QtCore4.dll_struct_QListData::Data_QListData::shared_null]
mov ecx, eax
mov dword [esi + 0x64], eax
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::ref_void_]
mov ecx, dword [sym.imp.QtCore4.dll_struct_QListData::Data_QListData::shared_null]
mov byte [esp + 0x20], 9
mov dword [esi + 0x68], ecx
call dword [sym.imp.QtCore4.dll_public:_bool___thiscall_QBasicAtomicInt::ref_void_]
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov edi, dword [esi + 0x58]
xor ecx, ecx
mov eax, edi
mov edx, 0x70
mul edx
seto cl
mov byte [esp + 0x20], 0xb
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.640943e6
add esp, 4
mov dword [esp + 0x30], eax
mov byte [esp + 0x20], 0xc
cmp eax, ebx
je 0x6401bd69
push fcn.6401b4b0
push 0x6401f0d0
push edi
lea ebx, [eax + 4]
push 0x70
push ebx
mov dword [eax], edi
call fcn.6409456a
mov eax, esi
mov dword [esi + 0x5c], ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc