joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402070
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b4b0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x45e044]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.Qt5Core.dll_public:_static_class_QUuid___cdecl_QUuid::createUuid_void_]
add esp, 4
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
call dword [sym.imp.Qt5Core.dll_public:_class_QString___thiscall_QUuid::toString_void_]
mov esi, eax
push 4
push str.__
mov dword [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [ebp - 0x24], eax
push 0
push 0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QRegExp::constructor_class_QString_const___enum_Qt::CaseSensitivity__enum_QRegExp::PatternSyntax_]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call dword [sym.imp.Qt5Core.dll_public:_class_QString____thiscall_QString::remove_class_QRegExp_const__]
push eax
lea ecx, [ebx + 0xc]
call dword [sym.imp.Qt5Core.dll_public:_class_QString____thiscall_QString::operator_class_QString_const__]
lea ecx, [ebp - 0x28]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QRegExp::destructor_void_]
lea ecx, [ebp - 0x24]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
push 0x443d78
lea ecx, [ebx + 0x10]
mov byte [ebx + 0x30], 0
mov dword [ebx + 0x18], 0xffffffff
mov dword [ebx + 0x1c], 0xffffffff
call dword [sym.imp.Qt5Core.dll_public:_class_QString____thiscall_QString::operator_char_const__]
push str.Khng_xc_nh
lea ecx, [ebx + 0x14]
call dword [sym.imp.Qt5Core.dll_public:_class_QString____thiscall_QString::operator_char_const__]
push 0x443c41
lea ecx, [ebx + 8]
call dword [sym.imp.Qt5Core.dll_public:_class_QString____thiscall_QString::operator_char_const__]
mov esi, dword [ebx + 0x28]
lea edi, [ebx + 0x28]
mov ecx, edi
push dword [esi + 4]
push edi
call fcn.00401b00
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
lea esi, [ebx + 0x20]
mov ecx, esi
mov dword [edi + 4], 0
call dword [sym.imp.Qt5Core.dll_public:_bool___thiscall_QJsonArray::isEmpty_void_const]
test al, al
jne 0x4021ad
mov edi, dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QJsonArray::removeAt_int_]
mov ebx, dword [sym.imp.Qt5Core.dll_public:_int___thiscall_QJsonArray::size_void_const]
mov ecx, esi
call ebx
dec eax
mov ecx, esi
push eax
call edi
mov ecx, esi
call dword [sym.imp.Qt5Core.dll_public:_bool___thiscall_QJsonArray::isEmpty_void_const]
test al, al
je 0x402197
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a26f
mov esp, ebp
pop ebp
ret
Function at 0x407800
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c702
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x45e044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
call fcn.004021d0
mov eax, dword [eax]
cmp eax, dword [0x460464]
je 0x407936
push dword [esi + 8]
lea ecx, [ebp - 0x24]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QMessageBox::constructor_class_QWidget__]
push str.X_l_thng_tin_tht_bi
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QMessageBox::setWindowTitle_class_QString_const__]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
push str.QLabelmin_width:_350px_
lea ecx, [ebp + 8]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QWidget::setStyleSheet_class_QString_const__]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
push str.Gp_li_trong_qu_trnh_x_l_thng_tin
lea ecx, [ebp + 8]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [ebp + 8]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QMessageBox::setText_class_QString_const__]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
push 0x444570
lea ecx, [ebp + 8]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QMessageBox::setInformativeText_class_QString_const__]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
push ecx
mov ecx, esp
push 0x400
call fcn.00407310
lea ecx, [ebp - 0x24]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QMessageBox::setStandardButtons_class_QFlags_enum_QMessageBox::StandardButton__]
push 0x400
lea ecx, [ebp - 0x24]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QMessageBox::setDefaultButton_enum_QMessageBox::StandardButton_]
lea ecx, [ebp - 0x24]
call dword [sym.imp.Qt5Widgets.dll_public_virtual:_int___thiscall_QDialog::exec_void_]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4088a0
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, ecx
inc dword [edi + 0x10]
cmp dword [edi + 0x10], 2
jg 0x4088d5
push 0
push 0x45e0d8
push 0x45e790
push 0
push ebp
call sub.VCRUNTIME140.dll___RTDynamicCast
add esp, 0x14
mov ecx, eax
call fcn.0040bd80
test al, al
je 0x408908
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x40890f
push ecx
mov ecx, ebp
mov esi, esp
call fcn.004021d0
add eax, 4
mov ecx, esi
push eax
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov ecx, ebx
call fcn.00419ff0
mov ecx, edi
call fcn.00407a10
mov ecx, ebp
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QObject::deleteLater_void_]
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x408b50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43cb02
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x45e044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ecx + 8]
lea ecx, [ebp - 0x28]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QMessageBox::constructor_class_QWidget__]
push str.Khi_ng_tht_bi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QMessageBox::setWindowTitle_class_QString_const__]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
push str.QLabelmin_width:_350px_
lea ecx, [ebp - 0x10]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QWidget::setStyleSheet_class_QString_const__]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
push str.Gp_li_trong_qu_trnh_xc_thc_phin_bn
lea ecx, [ebp - 0x10]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QMessageBox::setText_class_QString_const__]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
push 0x444570
lea ecx, [ebp - 0x10]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QMessageBox::setInformativeText_class_QString_const__]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
push ecx
mov ecx, esp
push 0x400
call fcn.00407310
lea ecx, [ebp - 0x28]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QMessageBox::setStandardButtons_class_QFlags_enum_QMessageBox::StandardButton__]
push 0x400
lea ecx, [ebp - 0x28]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QMessageBox::setDefaultButton_enum_QMessageBox::StandardButton_]
lea ecx, [ebp - 0x28]
call dword [sym.imp.Qt5Widgets.dll_public_virtual:_int___thiscall_QDialog::exec_void_]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x40f620
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e205
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x45e044]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
push 0x40
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], esi
call fcn.00412a40
movups xmm0, xmmword [str.BufferedTransformation:_this_object_doesnt_allow_input]
mov edi, eax
mov dword [ebp - 0x18], 0x37
mov eax, 0x3f
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x14], eax
movups xmmword [edi], xmm0
movups xmm0, xmmword [0x4461dc]
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [0x4461ec]
movups xmmword [edi + 0x20], xmm0
mov eax, dword [0x4461fc]
mov dword [edi + 0x30], eax
mov ax, word [0x446200]
mov word [edi + 0x34], ax
mov al, byte [0x446202]
mov byte [edi + 0x36], al
mov byte [edi + 0x37], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
mov dword [esi], vtable.CryptoPP::Exception.0
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 0
push 0x40
mov byte [ebp - 4], 1
mov dword [esi + 0x10], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call fcn.00412a40
mov dword [esi + 0x10], eax
mov ecx, 0x3f
movups xmm0, xmmword [edi]
inc ecx
push ecx
movups xmmword [eax], xmm0
push edi
movups xmm0, xmmword [edi + 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [edi + 0x20]
movups xmmword [eax + 0x20], xmm0
movq xmm0, qword [edi + 0x30]
movq qword [eax + 0x30], xmm0
mov dword [esi + 0x20], 0x37
mov dword [esi + 0x24], 0x3f
mov esi, dword [ebp - 0x2c]
mov dword [esi], vtable.CryptoPP::NotImplemented.0
call fcn.0043a261
add esp, 8
mov dword [esi], vtable.CryptoPP::InputRejecting_class_CryptoPP::BufferedTransformation_::InputRejected.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a26f
mov esp, ebp
pop ebp
ret
Function at 0x40f7f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e205
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x45e044]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
push 0x40
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], esi
call fcn.00412a40
movups xmm0, xmmword [str.BufferedTransformation:_this_object_doesnt_allow_input]
mov edi, eax
mov dword [ebp - 0x18], 0x37
mov eax, 0x3f
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x14], eax
movups xmmword [edi], xmm0
movups xmm0, xmmword [0x4461dc]
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [0x4461ec]
movups xmmword [edi + 0x20], xmm0
mov eax, dword [0x4461fc]
mov dword [edi + 0x30], eax
mov ax, word [0x446200]
mov word [edi + 0x34], ax
mov al, byte [0x446202]
mov byte [edi + 0x36], al
mov byte [edi + 0x37], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
mov dword [esi], vtable.CryptoPP::Exception.0
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 0
push 0x40
mov byte [ebp - 4], 1
mov dword [esi + 0x10], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call fcn.00412a40
mov dword [esi + 0x10], eax
mov ecx, 0x3f
movups xmm0, xmmword [edi]
inc ecx
push ecx
movups xmmword [eax], xmm0
push edi
movups xmm0, xmmword [edi + 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [edi + 0x20]
movups xmmword [eax + 0x20], xmm0
movq xmm0, qword [edi + 0x30]
movq qword [eax + 0x30], xmm0
mov dword [esi + 0x20], 0x37
mov dword [esi + 0x24], 0x3f
mov esi, dword [ebp - 0x2c]
mov dword [esi], vtable.CryptoPP::NotImplemented.0
call fcn.0043a261
add esp, 8
mov dword [esi], vtable.CryptoPP::InputRejecting_class_CryptoPP::Filter_::InputRejected.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a26f
mov esp, ebp
pop ebp
ret
Function at 0x416b50
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f615
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x45e044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QObject::constructor_class_QObject__]
mov dword [edi], vtable.LGApiProcess.0
lea ecx, [edi + 0xc]
mov eax, dword [0x4603a4]
push 0x4603a8
mov dword [ebp - 4], 0
mov dword [edi + 8], eax
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
push 0
push 0x443c41
mov byte [ebp - 4], 1
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [edi + 0x10], eax
lea ecx, [edi + 0x18]
mov dword [edi + 0x14], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [edi + 0x1c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [edi + 0x20]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::constructor_void_]
lea ecx, [edi + 0x24]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::constructor_void_]
lea ecx, [edi + 0x28]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::constructor_void_]
lea ecx, [edi + 0x2c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::constructor_void_]
lea ecx, [edi + 0x30]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [edi + 0x34]
mov byte [ebp - 4], 9
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QJsonDocument::constructor_void_]
lea ecx, [edi + 0x38]
mov byte [ebp - 4], 0xa
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QJsonDocument::constructor_void_]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41d450
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44072e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x45e044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov ecx, dword [edi + 8]
push esi
call dword [sym.imp.Qt5Core.dll_public:_class_QByteArray____thiscall_QByteArray::operator_class_QByteArray_const__]
mov eax, dword [edi + 8]
mov ecx, edi
push 0x21
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov eax, dword [edi]
call dword [eax + 0x30]
mov eax, dword [esi]
lea ecx, [ebp - 0x1c]
push dword [eax + 4]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QVariant::constructor_int_]
push eax
push 1
mov ecx, edi
mov dword [ebp - 4], 0
call dword [sym.imp.Qt5Network.dll_protected:_void___thiscall_QNetworkReply::setHeader_enum_QNetworkRequest::KnownHeaders__class_QVariant_const__]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QVariant::destructor_void_]
mov esi, dword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QTimer::singleShot_int__class_QObject_const___char_const__]
push str.2readyRead__
push edi
push 0
call esi
push str.2finished__
push edi
push 0
call esi
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x41d500
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440767
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x45e044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.Qt5Core.dll__toUtf8_QString__QGBE_AVQByteArray__XZ]
mov esi, eax
mov ecx, dword [edi + 8]
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_class_QByteArray____thiscall_QByteArray::operator_class_QByteArray_const__]
mov ecx, dword [edi + 8]
push 0x21
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x30]
mov eax, dword [esi]
lea ecx, [ebp - 0x20]
push dword [eax + 4]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QVariant::constructor_int_]
push eax
push 1
mov ecx, edi
mov byte [ebp - 4], 1
call dword [sym.imp.Qt5Network.dll_protected:_void___thiscall_QNetworkReply::setHeader_enum_QNetworkRequest::KnownHeaders__class_QVariant_const__]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QVariant::destructor_void_]
mov esi, dword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QTimer::singleShot_int__class_QObject_const___char_const__]
push str.2readyRead__
push edi
push 0
call esi
push str.2finished__
push edi
push 0
call esi
add esp, 0x18
lea ecx, [ebp - 0x10]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x436b50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
mov edx, dword [esp + 0x10]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebx, ebx
push edi
cmp eax, 4
jb 0x436b88
mov edi, eax
shr edi, 2
nop
mov ecx, dword [esi]
sub eax, 4
xor ecx, dword [edx]
add esi, 4
or ebx, ecx
add edx, 4
sub edi, 1
jne 0x436b70
mov dword [esp + 0x24], eax
mov edi, ebx
mov ecx, ebx
shr edi, 8
xor ebp, ebp
or edi, ebx
shr ecx, 0x10
and edi, 0xff00
or edi, ecx
movzx ecx, bl
shr edi, 8
or edi, ecx
mov dword [esp + 0x10], edi
test eax, eax
je 0x436c77
cmp eax, 8
jb 0x436c5c
mov ebx, eax
lea ecx, [edx + 4]
mov edi, esi
and ebx, 0xfffffff8
sub edi, edx
xorps xmm4, xmm4
mov dword [esp + 0x14], edi
xorps xmm3, xmm3
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
nop dword [eax]
movd xmm2, dword [esi + ebp]
lea ecx, [ecx + 8]
movd xmm1, dword [ecx - 0xc]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
add ebp, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [ecx - 8]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [eax + ecx - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp ebp, ebx
jb 0x436be0
mov eax, dword [esp + 0x24]
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
or edi, ecx
cmp ebp, eax
jae 0x436c77
sub esi, edx
lea ebx, [edx + ebp]
sub eax, ebp
movzx edx, byte [ebx + esi]
lea ebx, [ebx + 1]
movzx ecx, byte [ebx - 1]
xor edx, ecx
or edi, edx
sub eax, 1
jne 0x436c63
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x436c90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x1c
test eax, eax
je 0x436dd7
mov edx, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x28]
push edi
cmp eax, 4
jb 0x436cd3
mov edi, eax
shr edi, 2
mov ecx, dword [edx]
sub eax, 4
xor ecx, dword [ebx]
add edx, 4
mov dword [esi], ecx
add ebx, 4
add esi, 4
sub edi, 1
jne 0x436cb8
mov dword [esp + 0x38], eax
push ebp
xor ebp, ebp
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], ebx
test eax, eax
je 0x436dd3
cmp eax, 0x40
jb 0x436db8
lea ecx, [ebx - 1]
lea edi, [esi - 1]
add ecx, eax
add edi, eax
cmp esi, ecx
ja 0x436d05
cmp edi, ebx
jae 0x436db8
lea ecx, [edx - 1]
add ecx, eax
cmp esi, ecx
ja 0x436d16
cmp edi, edx
jae 0x436db8
mov ecx, eax
lea edi, [esi + 0x20]
mov eax, esi
mov dword [esp + 0x18], edi
sub eax, ebx
and ecx, 0xffffffc0
mov dword [esp + 0x20], eax
mov edi, edx
sub edi, ebx
mov dword [esp + 0x28], ecx
mov eax, edx
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x18]
lea ecx, [ebx + 0x10]
sub eax, esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
movups xmm0, xmmword [ecx - 0x10]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [edx + ebp]
lea edi, [edi + 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x40]
movups xmmword [edi - 0x60], xmm1
movups xmm1, xmmword [eax + ecx - 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x30]
movups xmmword [esi + ecx - 0x40], xmm1
movups xmm1, xmmword [ebx + edi - 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x20]
movups xmmword [edi - 0x40], xmm1
movups xmm1, xmmword [edx + ebp + 0x30]
add ebp, 0x40
pxor xmm1, xmm0
movups xmmword [edi - 0x30], xmm1
cmp ebp, dword [esp + 0x28]
jb 0x436d51
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x28], ebp
cmp ebp, eax
jae 0x436dd3
sub edx, ebx
lea edi, [ebx + ebp]
sub esi, ebx
sub eax, ebp
mov cl, byte [edi + edx]
lea edi, [edi + 1]
xor cl, byte [edi - 1]
mov byte [edi + esi - 1], cl
sub eax, 1
jne 0x436dc1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x43af51
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43af90
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43af90
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43af90
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43af90
cmp dword [ecx + 0x74], 0xe
jbe 0x43af90
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret