joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490c38
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x490c70
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048ec86
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048ec5e
jmp 0x490c7c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4924ad
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4924ef
call fcn.004989c9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4924ef
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4924e6
xor eax, eax
jmp 0x4924f7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004924fd
pop edi
pop esi
pop ebx
ret 4

Function at 0x498ef9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x498f27
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x498f45
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00498e5f
jmp 0x498f45
mov eax, dword [esi + 0x14]
test eax, eax
je 0x498f45
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00498e5f
test edi, edi
mov eax, edi
jne 0x498f2f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x49b7e4
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x49b80c
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x49b81d
push 2
call edi
test ax, ax
jge 0x49b81d
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0049026e
cmp dword [esi + 0x30], ebx
jne 0x49b8f7
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.0049026e
cmp eax, dword [esp + 0x34]
jne 0x49b8f7
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x49b893
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x49b8d8
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x49b8f7
cmp eax, 0x205
je 0x49b8f7
cmp eax, 0x201
je 0x49b8f7
cmp eax, 0x204
je 0x49b8f7
cmp eax, ebx
jne 0x49b8be
cmp dword [esp + 0x1c], 0x1b
je 0x49b8f7
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x4f4b20]
jbe 0x49b8ed
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x49b850
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x4010e6
Capabilities:
Terminate process

Disassembly:
jmp 0x4a14e1
push 0x14
push 0x599660
call fcn.00401b22
push 1
call fcn.004035c1
pop ecx
test al, al
je 0x4a140e
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00403882
mov byte [ebp - 0x24], al
mov eax, dword [0x5aacd8]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4a140e
test eax, eax
jne 0x4a132c
mov dword [0x5aacd8], ecx
push 0x4bca78
push 0x4bc668
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4a130f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4a13fe
push 0x4bc564
push section..rdata
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x5aacd8], 2
jmp 0x4a1331
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00402568
pop ecx
call fcn.00401339
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4a1362
push esi
call fcn.00402027
pop ecx
test al, al
je 0x4a1362
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [section..00cfg]
call esi
call fcn.004011c2
mov esi, eax
cmp dword [esi], edi
je 0x4a1380
push esi
call fcn.00402027
pop ecx
test al, al
je 0x4a1380
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_narrow_environment
mov edi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argv
mov esi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
push edi
push esi
push dword [eax]
call fcn.00403850
add esp, 0xc
mov esi, eax
call fcn.00403a0d
test al, al
je 0x4a1415
test bl, bl
jne 0x4a13b3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push 0
push 1
call fcn.004025db
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4a13fe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.004028e2
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.00404197
jmp 0x4a12a2

Function at 0x40129e
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x491660
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x49167a
add ecx, 0x10
call fcn.0040423c
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x4916bd
push dword [0x5aab88]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4916ac
mov edx, dword [eax + 4]
test edx, edx
je 0x4916ac
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x4916c0
inc ecx
cmp ecx, 6
jl 0x4916a0
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x60]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x4016a4
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x454630
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x45464a
add ecx, 8
call fcn.00403c83
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x45468d
push dword [0x5aab88]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45467c
mov edx, dword [eax + 4]
test edx, edx
je 0x45467c
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x454690
inc ecx
cmp ecx, 6
jl 0x454670
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x98]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x401a28
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x4915e0
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0x4915f1
mov dword [esi + 8], 0
mov edi, dword [esi + 4]
test edi, edi
je 0x49162e
push dword [0x5aab88]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49161d
mov edx, dword [eax + 4]
test edx, edx
je 0x49161d
xor ecx, ecx
cmp dword [edx + ecx*4], 0
je 0x491631
inc ecx
cmp ecx, 2
jl 0x491611
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [esi + 4], 0
pop edi
pop esi
ret
mov al, byte [edi + 0x2c]
mov byte [edi], al
mov dword [edx + ecx*4], edi
pop edi
mov dword [esi + 4], 0
pop esi
ret

Function at 0x401f69
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x454590
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x4545aa
add ecx, 8
call fcn.00402ae0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x4545ed
push dword [0x5aab88]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4545dc
mov edx, dword [eax + 4]
test edx, edx
je 0x4545dc
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x4545f0
inc ecx
cmp ecx, 6
jl 0x4545d0
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x90]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x4029be
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x4916f0
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x491721
mov ecx, dword [eax + 0x3c]
lea esi, [eax + 0x18]
test ecx, ecx
je 0x49171a
mov edx, dword [ecx]
cmp ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [esi + 0x24], 0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x491761
push dword [0x5aab88]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x491750
mov edx, dword [eax + 4]
test edx, edx
je 0x491750
mov eax, 4
cmp dword [edx + eax*4], 0
je 0x491764
inc eax
cmp eax, 6
jl 0x491744
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov cl, byte [esi + 0x58]
mov byte [esi], cl
mov dword [edx + eax*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x402a6d
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x4917a0
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x4917ba
add ecx, 0x18
call fcn.0040423c
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x4917fd
push dword [0x5aab88]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4917ec
mov edx, dword [eax + 4]
test edx, edx
je 0x4917ec
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x491800
inc ecx
cmp ecx, 6
jl 0x4917e0
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x68]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x402e9b
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x491c00
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x491c1a
add ecx, 8
call fcn.00403f62
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x491c5d
push dword [0x5aab88]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x491c4c
mov edx, dword [eax + 4]
test edx, edx
je 0x491c4c
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x491c60
inc ecx
cmp ecx, 6
jl 0x491c40
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x88]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x402f4f
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x4919d0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x491a2a
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x491a04
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x491a04
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x491a04
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebx + 0x64]
add ebx, 0x40
test ecx, ecx
je 0x491a23
mov edx, dword [ecx]
cmp ecx, ebx
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebx + 0x24], 0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x491a6d
push dword [0x5aab88]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x491a5c
mov edx, dword [eax + 4]
test edx, edx
je 0x491a5c
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x491a71
inc ecx
cmp ecx, 6
jl 0x491a50
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
ret
mov al, byte [esi + 0x88]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
ret
Function at 0x403076
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x491ac0
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x491ada
add ecx, 8
call fcn.00401f7d
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x491b1d
push dword [0x5aab88]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x491b0c
mov edx, dword [eax + 4]
test edx, edx
je 0x491b0c
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x491b20
inc ecx
cmp ecx, 6
jl 0x491b00
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x88]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x403189
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x491830
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x491861
mov ecx, dword [eax + 0x44]
lea esi, [eax + 0x20]
test ecx, ecx
je 0x49185a
mov edx, dword [ecx]
cmp ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [esi + 0x24], 0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x4918a1
push dword [0x5aab88]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x491890
mov edx, dword [eax + 4]
test edx, edx
je 0x491890
mov eax, 4
cmp dword [edx + eax*4], 0
je 0x4918a4
inc eax
cmp eax, 6
jl 0x491884
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov cl, byte [esi + 0x60]
mov byte [esi], cl
mov dword [edx + eax*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x40392c
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x4918e0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x49193a
mov esi, dword [ebx + 0x64]
test esi, esi
je 0x491914
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x491914
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x491914
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebx + 0x5c]
add ebx, 0x38
test ecx, ecx
je 0x491933
mov edx, dword [ecx]
cmp ecx, ebx
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebx + 0x24], 0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x49197d
push dword [0x5aab88]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49196c
mov edx, dword [eax + 4]
test edx, edx
je 0x49196c
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x491981
inc ecx
cmp ecx, 6
jl 0x491960
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
ret
mov al, byte [esi + 0x80]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
ret
Function at 0x403a0d
Capabilities:
Parse pe header

Disassembly:
jmp 0x4a1b55
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4a1b95
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4a1b95
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4a1b95
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4a1b95
cmp dword [ecx + 0x74], 0xe
jbe 0x4a1b95
cmp dword [ecx + 0xe8], 0
je 0x4a1b95
mov al, 1
ret
xor al, al
ret

Function at 0x403a17
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x491ca0
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x491cba
add ecx, 8
call fcn.00404089
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x491cfd
push dword [0x5aab88]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x491cec
mov edx, dword [eax + 4]
test edx, edx
je 0x491cec
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x491d00
inc ecx
cmp ecx, 6
jl 0x491ce0
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x90]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x403df5
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x491b60
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x491b7a
add ecx, 8
call fcn.00402775
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x491bbd
push dword [0x5aab88]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x491bac
mov edx, dword [eax + 4]
test edx, edx
je 0x491bac
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x491bc0
inc ecx
cmp ecx, 6
jl 0x491ba0
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x90]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x413770
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5ded
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5a0fe0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x14], 0
movq qword [ebp - 0x24], xmm0
mov word [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], eax
test ebx, ebx
je 0x4138bf
nop
test bl, 1
je 0x4138b3
add eax, 0x41
push eax
lea eax, [ebp - 0x18]
push 0x4bdfe8
push eax
call fcn.004020ef
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push str.._s
push eax
call fcn.0040266c
add esp, 0x18
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x4138b0
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov edi, eax
lea eax, [ebp - 0x44]
push eax
push 0xc
lea eax, [ebp - 0x30]
push eax
push 0
push 0
push 0x2d1080
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4138a9
lea ecx, [ebp - 0x38]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
mov dl, byte [ebp - 0x34]
mov ecx, dword [esi + 4]
add dl, 0x41
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], 0
mov byte [ebp - 0x40], dl
mov dword [ebp - 0x3c], eax
cmp ecx, dword [esi + 8]
je 0x41388d
mov byte [ecx], dl
mov eax, dword [ebp - 0x3c]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x38]
push eax
add ecx, 8
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
add dword [esi + 4], 0xc
jmp 0x413899
lea eax, [ebp - 0x40]
push eax
push ecx
mov ecx, esi
call fcn.00412f20
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x34]
inc eax
shr ebx, 1
mov dword [ebp - 0x34], eax
jne 0x4137d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00402315
mov esp, ebp
pop ebp
ret 4
Function at 0x49e0b3
Capabilities:
Check for software breakpoints

Disassembly:
jmp fcn.0041c280
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x49e0bc
mov eax, dword [ebp + 0x10]
cmp eax, 0xa
ja case.default.0x49dffa
jmp dword [eax*4 + 0x49e118]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [eax + 8]
push dword [eax + 4]
call fcn.004011d1
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [eax + 8]
push dword [eax + 4]
call fcn.0040319d
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [eax + 4]
call fcn.00401d61
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [eax + 4]
call fcn.00401811
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [eax + 8]
push dword [eax + 4]
call fcn.004033dc
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [eax + 8]
push dword [eax + 4]
call fcn.00403599
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [eax + 8]
push dword [eax + 4]
call fcn.004020e5
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [eax + 4]
call fcn.00401dcf
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [eax + 4]
call fcn.0040389b
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [eax + 8]
push dword [eax + 4]
call fcn.004019e2
pop ebp
ret
mov ecx, dword [ebp + 8]
pop ebp
jmp 0x403a9e
cmp eax, 0xa
jne case.default.0x49dffa
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov eax, dword [eax]
cmp eax, fcn.004011d1
jne 0x49e0da
mov dword [ecx], 0
pop ebp
ret
cmp eax, fcn.0040319d
jne 0x49e0e9
mov dword [ecx], 1
pop ebp
ret
cmp eax, fcn.00401d61
jne 0x49e0f8
mov dword [ecx], 2
pop ebp
ret
cmp eax, fcn.00401811
jne 0x49e107
mov dword [ecx], 3
pop ebp
ret
cmp eax, fcn.004033dc
jne case.default.0x49dffa
mov dword [ecx], 4
pop ebp
ret
Function at 0x401f00
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 8
mov dword [ebp - 4], ebx
mov eax, str.Mozilla_5.0__Linux__U__Android_4.1.1__zh_cn__MI_2S_Build_JRO03L__AppleWebKit_534.30__KHTML__like_Gecko__Version_4.0_Mobile_Safari_534.30
push eax
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
test ebx, ebx
je 0x401f2c
push ebx
call fcn.004112d0
add esp, 4
pop eax
mov ebx, dword [ebp - 4]
mov dword [ebx], eax
push 0x1e
push dword [ebp + 8]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov esp, ebp
pop ebp
ret 4