joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442208
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x45cc4c]
cmp byte [eax + 0xc], 0
je 0x442375
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44236e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x460544], 0
jne 0x44225c
push 0x44237c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x442384
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x460544], eax
cmp dword [0x45c594], 0
jne 0x442357
push 0x442394
call sub.kernel32.dll_LoadLibraryA
mov dword [0x45c594], eax
cmp dword [0x45c594], 0
je 0x442357
push 0x4423a0
mov eax, dword [0x45c594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x460548], eax
push 0x4423b0
mov eax, dword [0x45c594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46054c], eax
push 0x4423c4
mov eax, dword [0x45c594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x460550], eax
push 0x4423dc
mov eax, dword [0x45c594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x460554], eax
push 0x4423f4
mov eax, dword [0x45c594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x460558], eax
push 0x442408
mov eax, dword [0x45c594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46055c], eax
push 0x442420
mov eax, dword [0x45c594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x460560], eax
push 0x442438
mov eax, dword [0x45c594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x460564], eax
push 0x442454
mov eax, dword [0x45c594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x460568], eax
push 0x442460
mov eax, dword [0x45c594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46056c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442375
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x4479bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x447a10]
test si, 4
je 0x4479d1
or bl, 1
test si, 8
je 0x4479db
or bl, 4
test si, 1
je 0x4479e5
or bl, 8
test si, 2
je 0x4479ef
or bl, 0x10
test si, 0x10
je 0x4479f9
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x447a08
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x447a14
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x447a50]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x447a2e
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x447a3d
or bl, 4
test esi, 0x20000000
je 0x447a48
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44f104
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44f116
add esp, 0xfffffff0
call fcn.00403b5c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419f90
mov eax, dword [0x45c8f4]
mov dword [eax + 4], ebx
mov dword [eax], 0x44f4a8
mov eax, dword [0x45c900]
mov dword [eax + 4], ebx
mov dword [eax], 0x44f4b4
mov eax, ebx
call fcn.0044f4c0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411d8c]
call fcn.00403820
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411d8c]
call fcn.00403820
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411d8c]
call fcn.00403820
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411d8c]
call fcn.00403820
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411d8c]
call fcn.00403820
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44af58
push eax
push 0
push 0
mov eax, dword [0x45ca5c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41db04]
call fcn.0041f024
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41db04]
call fcn.0041f024
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41db04]
call fcn.0041f024
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044f8f0
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44f7c0
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44f7c0
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44f7c0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44f253
call fcn.00403bb4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44f5a4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44f74f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44f730
mov dl, 1
mov eax, dword [0x4121b0]
call fcn.00403820
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404664
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44f71f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00442564
test al, al
je 0x44f712
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44f760
lea eax, [ebp - 0x254]
call fcn.004091ec
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44f712
xor eax, eax
push ebp
push 0x44f70b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44f798
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44f6f4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004048d4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44f6f4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004048d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f712
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44f615
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.00415e90
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f756
lea eax, [ebp - 0x260]
call fcn.00404664
ret

Function at 0x4500c8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x46057c]
cmp byte [eax + 0xad], 0
jne 0x450139
cmp dword [0x460594], 0
jne 0x4500fa
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x450084
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x460594], eax
cmp dword [0x460590], 0
jne 0x450115
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x460590], eax
cmp dword [0x460598], 0
jne 0x450139
push esp
push 0
push 0
push 0x450028
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x460598], eax
pop edx
ret
Function at 0x45030c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x450323
add esp, 0xfffffff0
call fcn.00403b5c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419f90
mov eax, dword [0x45ca40]
cmp word [eax + 2], 0
jne 0x45034b
mov eax, dword [0x45ca40]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00451dbc
mov eax, dword [0x45caf0]
cmp word [eax + 2], 0
jne 0x450365
mov eax, dword [0x45caf0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00451fc8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411d8c]
call fcn.00403820
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411d8c]
call fcn.00403820
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x411d8c]
call fcn.00403820
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x41e2e0]
call fcn.00424128
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x45051c
mov eax, dword [0x45c95c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004244fc
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x452688
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45c95c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c8fc
test eax, eax
je 0x45046c
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408ba4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c930
test eax, eax
je 0x450480
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004048d4
mov byte [ebx + 0xd4], 0
push ebx
push 0x45191c
call fcn.0041b10c
mov dword [ebx + 0xc8], eax
mov eax, dword [0x45c854]
cmp byte [eax], 0
jne 0x4504d1
mov eax, ebx
call fcn.00450660
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00452864
mov eax, ebx
call fcn.004533c4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x450511
call fcn.00403bb4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4508e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46057c]
cmp dword [eax + 0x30], 0
je 0x45098a
cmp dword [ebx + 0x94], 0
jne 0x450984
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x450870
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x450984
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45094a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x450984
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414138
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x450959
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4516a4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4516d9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404754
jmp 0x4516e6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004046b8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x452a48
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x452ab6
mov eax, esi
call fcn.0043d2d8
test al, al
je 0x452ab6
mov eax, dword [ebx + 0x84]
call fcn.0043cfdc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x452ab6
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x452aaa
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043cfdc
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00435474
jmp 0x452ab6
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00452884
pop esi
pop ebx
ret
Function at 0x402310
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x4c
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__fstati64]
cmp eax, 0xffffffff
je 0x4023b0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
test eax, eax
mov dword [ebx], ebp
mov dword [ebx + 4], eax
js 0x4023bd
mov dword [esp], ebp
call sub.msvcrt.dll_malloc
test eax, eax
mov edi, eax
je 0x4023bd
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll__read
mov edx, dword [ebx + 4]
mov ecx, eax
xor eax, dword [ebx]
sar ecx, 0x1f
xor edx, ecx
or edx, eax
jne 0x402382
mov dword [esp], esi
call sub.msvcrt.dll__close
add esp, 0x4c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov ebp, dword [eax]
mov dword [esp], esi
call sub.msvcrt.dll__close
mov dword [esp], edi
call sub.msvcrt.dll_free
call ebx
mov dword [eax], ebp
add esp, 0x4c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], 0xffffffff
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov ebp, dword [eax]
mov dword [esp], esi
call sub.msvcrt.dll__close
jmp 0x40239c

Function at 0x4023e0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, edx
sub esp, 0x18
mov dword [esp + 4], 0x8000
mov dword [esp], eax
call sub.msvcrt.dll__open
cmp eax, 0xffffffff
je 0x402406
add esp, 0x18
mov edx, ebx
pop ebx
jmp fcn.00402310
add esp, 0x18
xor eax, eax
pop ebx
ret
Function at 0x4029d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x1bc
test ecx, ecx
je 0x402ab0
lea eax, [ebp - 0x19c]
mov dword [esp], eax
mov dword [ebp - 0x1ac], eax
call fcn.00407d30
lea eax, [ebp - 0x1a1]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1a0]
mov dword [esp], eax
call fcn.0046fc80
lea ecx, [ebp - 0x1a0]
sub esp, 8
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0x2f
call fcn.00446700
mov edx, dword [ebp - 0x1a0]
mov edx, dword [edx - 0xc]
sub esp, 8
mov ecx, edx
sub ecx, eax
cmp eax, edx
ja 0x402b06
mov dword [esp + 4], ecx
lea ecx, [ebp - 0x1a0]
mov dword [esp], eax
mov dword [esp + 8], 0
call fcn.0046fa80
mov eax, dword [ebp - 0x1a0]
sub esp, 0xc
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 0x10], edi
mov dword [esp + 4], str._s_.._.._.._target_product__s__s
mov dword [esp], ebx
call fcn.00426240
mov eax, dword [ebp - 0x1a0]
lea esi, [eax - 0xc]
cmp esi, 0x4ab030
jne 0x402ae7
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.ANDROID_PRODUCT_OUT
call sub.msvcrt.dll_getenv
test eax, eax
je 0x402b12
cmp byte [eax], 0
je 0x402b12
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp], ebx
mov dword [esp + 4], str._s__s
call fcn.00426240
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
sub eax, 4
call fcn.0049fe48
test eax, eax
jg 0x402aa1
lea eax, [ebp - 0x1a1]
mov ecx, esi
mov dword [esp], eax
call fcn.0046e550
push eax
jmp 0x402aa1
mov dword [esp], 0x4ac339
call fcn.004993a0
mov dword [esp], str.neither__p_product_specified_nor_ANDROID_PRODUCT_OUT_set
call fcn.00407490
nop

Function at 0x403260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x220
lea ebx, [ebp - 0x210]
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub eax, 1
sub esp, 8
cmp eax, 0x102
ja 0x4032d0
lea esi, [ebp - 0x10c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], str.fastboot
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
sub esp, 0x10
test eax, eax
je 0x403300
mov dword [esp], esi
mov dword [esp + 4], str.wbTD
call sub.msvcrt.dll_fopen
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str.GetTempPath_failed__error__ld_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00440af0
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str.GetTempFileName_failed__error__ld_n
mov dword [esp + 8], eax
jmp 0x4032e2
Function at 0x405c80
Capabilities:
Get socket status

Disassembly:
push ebp
mov eax, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x13c
mov dword [ebp - 0x130], ecx
mov ecx, dword [ebp + 8]
mov byte [eax + 8], 0
test ecx, ecx
jle 0x405d70
mov ebx, dword [eax + 4]
cmp ebx, 0xffffffff
je 0x405d80
mov eax, ecx
mov edx, 0x10624dd3
imul edx
mov eax, ecx
sar eax, 0x1f
mov dword [ebp - 0x118], ebx
lea edi, [ebp - 0x124]
mov dword [ebp - 0x11c], 1
lea esi, [ebp - 0x11c]
sar edx, 6
sub edx, eax
mov eax, ebx
mov ebx, dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x124], edx
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x3e8
mov dword [ebp - 0x120], ecx
add eax, 1
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call ebx
sub esp, 0x14
cmp eax, 0xffffffff
mov edx, eax
je 0x405d48
test eax, eax
jne 0x405d38
mov eax, dword [ebp - 0x130]
mov byte [eax + 8], 1
cmp edx, 1
sete al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [ebp - 0x12c], eax
call dword [sym.imp.msvcrt.dll__errno]
mov edx, dword [ebp - 0x12c]
cmp dword [eax], 4
jne 0x405d38
mov eax, dword [ebp - 0x130]
mov eax, dword [eax + 4]
jmp 0x405d00
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 4
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x40ce90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
sub esp, 0x3c
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ebx, dword [0x4c0f68]
movzx ecx, al
mov dword [esp + 0x2c], eax
lea eax, [ecx + 3]
sar eax, 2
lea eax, [eax*4 + 8]
movzx edx, ax
mov eax, dword [edi]
mov word [esp + 0x1e], dx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
lea eax, [eax + edx - 1]
xor edx, edx
div ebx
xor edx, edx
mov ebp, eax
mov eax, dword [esp + 0x18]
div ebx
cmp eax, ebp
je 0x40cf60
test esi, esi
je 0x40cf66
movzx eax, word [esi + 4]
imul ebx, ebp
sub ax, word [esp + 0x18]
add eax, ebx
mov word [esi + 4], ax
mov esi, dword [0x4c0f68]
imul esi, ebp
mov dword [edi], esi
mov eax, dword [esp + 0x50]
add esi, dword [esp + 0x24]
mov dword [esi], eax
movzx eax, word [esp + 0x1e]
mov word [esi + 4], ax
movzx eax, byte [esp + 0x2c]
mov byte [esi + 6], al
movzx eax, byte [esp + 0x28]
mov byte [esi + 7], al
lea eax, [esi + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x20]
add dword [edi], eax
add esp, 0x3c
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov esi, dword [esp + 0x18]
jmp 0x40cf16
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], str.add_dentry
mov dword [esp + 4], str.critical_error:__s:_no_prev_n
add eax, 0x40
mov dword [esp], eax
call fcn.0040ce60
mov dword [esp + 4], 1
mov dword [esp], 0x4c0fa0
call sub.msvcrt.dll_longjmp
lea esi, [esi]
Function at 0x4103d0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
ret

Function at 0x4105b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
movzx eax, word [esp + 8]
test ebx, ebx
je 0x4105df
add ebx, edx
add edx, 1
mov ecx, eax
xor cl, byte [edx - 1]
shr ax, 8
movzx ecx, cl
xor ax, word [ecx + ecx + 0x4b0a40]
cmp edx, ebx
jne 0x4105c4
pop ebx
ret

Function at 0x412cd0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x1c
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
test esi, esi
jne 0x412cfa
jmp 0x412d24
je 0x412d30
add ebx, eax
add ebp, eax
cmp esi, ebx
jbe 0x412d24
mov eax, esi
sub eax, ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov dword [esp], edi
call sub.msvcrt.dll__read
test eax, eax
jns 0x412cf0
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
add esp, 0x1c
pop ebx
pop esi
pop edi
neg eax
pop ebp
ret
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
mov eax, 0xffffffea
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4130e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
test ebx, ebx
not eax
je 0x41310e
add ebx, edx
add edx, 1
mov ecx, eax
xor cl, byte [edx - 1]
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4b0fe0]
cmp edx, ebx
jne 0x4130f5
not eax
pop ebx
ret
Function at 0x414ba0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x4bf568]
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
test eax, eax
je 0x414bd0
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp eax
mov dword [esp], str.ANDROID_WRAPSIM
call sub.msvcrt.dll_getenv
test eax, eax
je 0x414bf0
mov edi, 0x4b16bc
mov ecx, 2
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x414c15
mov dword [0x4bf568], 0x4141d0
mov eax, 0x4141d0
mov dword [0x4bf564], 0x414140
mov dword [0x4bf560], 0x414aa0
jmp 0x414bb8
mov dword [0x4bf568], sub.msvcrt.dll__open
mov eax, sub.msvcrt.dll__open
mov dword [0x4bf564], 0x440770
mov dword [0x4bf560], 0x414170
jmp 0x414bb8