joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x4203c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x4203d6
pop dword [ebp - 0x30]
mov eax, 0x7193befb
sub eax, 0x7151bb25
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xa1cba862
sub dword [ebp - 0x40], 0x53796317
mov dword [ebp - 0x3c], 0x70e53c8d
sub dword [ebp - 0x3c], 0x3eb1f048
mov dword [ebp - 0x38], 0x97387236
sub dword [ebp - 0x38], 0x4aec2e08
mov dword [ebp - 0x34], 0xe63ef3a
sub dword [ebp - 0x34], 0xe63ef3a
lea eax, [ebp - 0x40]
push eax
mov eax, 0x9c9ac02a
add eax, 0x63a7704a
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x97ac33a
add dword [ebp - 0x40], 0x6af7a61c
mov dword [ebp - 0x3c], 0x719e8c0f
add dword [ebp - 0x3c], 0xcfcdd566
mov dword [ebp - 0x38], 0xa28c9cb2
add dword [ebp - 0x38], 0xc0e2cfba
mov dword [ebp - 0x34], 0xaf84edfa
sub dword [ebp - 0x34], 0xaf84edfa
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x40ed2
push 0
call eax
mov ecx, 0x8a086275
add ecx, 0x75f7f176
xor edi, edi
add edi, eax
mov ebx, 0xe64eef62
add ebx, 0x19f4549e
add ebx, dword [ebp - 0x30]
mov edx, 0xdc612d57
add edx, 0xe7579fa9
xor dword [ebp - 0x28], ecx
mov esi, dword [ebx]
mov dword [ebp - 0x10], 0x2c52c68a
sub esi, edx
sub dword [ebp - 0x18], 0xe349d7b4
mov dword [edi], esi
mov dword [ebp - 0x20], 0xe67f2361
add edi, 0xd6845ced
add edi, 0x297ba317
add ebx, 4
loop 0x4204f5
add eax, 0xe093ffbb
add eax, 0x1f6d42c4
mov ebx, eax
add eax, 5
mov ecx, 0xf5c104c3
sub ecx, 0xf58104c3
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x5e6070
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.004b216c
mov eax, dword [0x66a140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x66f8e0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x5e6248
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x5e6197
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x5e6197
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x5e6175
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x5e60f9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5e6201
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x5e6268
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x5e6243
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x5e6268
jmp 0x5e60d2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3972
mov esp, ebp
pop ebp
ret
Function at 0x5e6300
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.004b216c
mov eax, dword [0x66a140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x66f8e0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x5e64eb
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x5e6436
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x5e6436
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x5e6412
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x5e6389
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5e64a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x5e650b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x5e64e6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x5e650b
jmp 0x5e6362
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3972
mov esp, ebp
pop ebp
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x411014
Capabilities:
Terminate process

Disassembly:
jmp 0x413250
jmp fcn.00413290
cmp ecx, dword [0x41702c]
jne 0x41325a
repz ret
jmp 0x411082
Function at 0x404bd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, edx
mov ebx, ecx
push str.ANDROID_PRODUCT_OUT
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x404d28
cmp byte [eax], 0
mov esi, eax
je 0x404d28
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
cmp eax, 0xfffffff0
jae 0x404d32
mov ecx, eax
cmp eax, 0xb
mov dword [esp + 0x14], edi
jae 0x404c45
mov eax, ecx
lea edi, [esp + 1]
add al, cl
test ecx, ecx
mov byte [esp], al
jne 0x404c72
jmp 0x404c81
mov dword [esp + 0x10], ebx
mov ebx, ecx
add ebx, 0x10
and ebx, 0xfffffff0
push ebx
mov edi, ecx
call fcn.00417780
mov ecx, edi
add esp, 4
or ebx, 1
mov dword [esp + 8], eax
mov edi, eax
mov dword [esp], ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ecx
push ecx
push esi
push edi
mov esi, ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, esi
add esp, 0xc
mov byte [edi + ecx], 0
mov ecx, esp
push 0x52114f
call fcn.0041dba0
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x18], xmm0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
movzx eax, byte [edx]
test al, 1
je 0x404cc9
mov eax, dword [edx + 4]
mov edx, dword [edx + 8]
jmp 0x404ccc
inc edx
shr eax, 1
lea ecx, [esp + 0x18]
push eax
push edx
call fcn.0041d950
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
movsd xmm0, qword [eax]
movsd qword [ebx], xmm0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax], 0
test byte [esp + 0x18], 1
je 0x404d0c
push dword [esp + 0x20]
call fcn.00417920
add esp, 4
test byte [esp], 1
je 0x404d1e
push dword [esp + 8]
call fcn.00417920
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push str.ANDROID_PRODUCT_OUT_not_set
call fcn.00423770
mov ecx, esp
call fcn.0041ce60
nop dword [eax]
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov edx, dword [ebp + 8]
mov ecx, esp
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
call fcn.00404bd0
test byte [esp], 1
jne 0x404d88
lea eax, [esp + 1]
push 0x8000
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__open
add esp, 8
mov esi, eax
jmp 0x404da5
mov edi, dword [esp + 8]
push 0x8000
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__open
add esp, 8
mov esi, eax
push edi
call fcn.00417920
add esp, 4
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret 4
Function at 0x407e60
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push eax
mov edi, dword [esp + 0x10]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call esi
add esp, 4
push str.fastboot:_usage:
push eax
call fcn.0040cce0
add esp, 8
lea eax, [esp + 0x14]
mov dword [esp], eax
push 2
call esi
add esp, 4
push dword [esp]
push edi
push eax
call fcn.0040cf90
add esp, 0xc
push 2
call esi
add esp, 4
push 0x520af4
push eax
call fcn.0040cce0
add esp, 8
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop dword [eax]
Function at 0x40a490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ecx, dword [0x5494f4]
mov byte [esp + 4], 0x14
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 5], 0x746f6c73
mov dword [esp + 9], 0x756f632d
mov word [esp + 0xd], 0x746e
mov byte [esp + 0xf], 0
lea eax, [esp + 0x10]
lea edx, [esp + 4]
push 0
push eax
push edx
call fcn.00460360
test eax, eax
je 0x40a50e
test byte [esp + 4], 1
je 0x40a50a
push dword [esp + 0xc]
call fcn.00417920
add esp, 4
xor esi, esi
jmp 0x40a556
test byte [esp + 0x10], 1
je 0x40a51b
mov eax, dword [esp + 0x18]
jmp 0x40a51f
lea eax, [esp + 0x11]
lea ecx, [esp + 0x1c]
push 0x7fffffff
push 0x80000000
push ecx
push eax
call fcn.0040cd20
add esp, 0x10
test byte [esp + 4], 1
mov ebx, eax
je 0x40a54c
push dword [esp + 0xc]
call fcn.00417920
add esp, 4
xor esi, esi
test bl, bl
je 0x40a556
mov esi, dword [esp + 0x1c]
test byte [esp + 0x10], 1
je 0x40a569
push dword [esp + 0x18]
call fcn.00417920
add esp, 4
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
Function at 0x40dc80
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x40dd8a
movsx eax, byte [esi]
mov edi, ecx
cmp eax, 0x5b
jg 0x40dd3f
cmp eax, 0x24
je 0x40dd64
cmp eax, 0x28
jne 0x40dd8a
lea eax, [esi + 1]
cmp eax, ebx
je 0x40dd8a
cmp byte [eax], 0x3f
jne 0x40dd8a
lea eax, [esi + 2]
cmp eax, ebx
je 0x40dd8a
movsx eax, byte [eax]
cmp eax, 0x21
je 0x40de1f
cmp eax, 0x3d
jne 0x40dd8a
xorps xmm0, xmm0
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
call fcn.0040e9b0
mov eax, dword [edi + 0xc]
add esi, 3
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], eax
push ebx
push esi
call fcn.0040d360
mov ecx, dword [esp + 0x20]
mov esi, eax
mov dword [esp + 0xc], ecx
mov ecx, edi
push dword [edi + 0x10]
push 0
jmp 0x40de6b
cmp eax, 0x5c
je 0x40dd96
cmp eax, 0x5e
jne 0x40dd8a
push 8
call fcn.00417780
add esp, 4
mov ecx, dword [edi + 0x24]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov dword [eax], 0x5233d8
jmp 0x40dd7d
push 8
call fcn.00417780
add esp, 4
mov ecx, dword [edi + 0x24]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov dword [eax], 0x523414
mov dword [ecx + 4], eax
inc esi
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 4]
mov dword [edi + 0x24], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea eax, [esi + 1]
cmp eax, ebx
je 0x40dd8a
mov al, byte [eax]
cmp al, 0x42
je 0x40dddd
cmp al, 0x62
jne 0x40dd8a
push 0x18
call fcn.00417780
add esp, 4
mov ebx, eax
mov eax, dword [edi + 0x24]
lea ecx, [ebx + 8]
mov eax, dword [eax + 4]
mov dword [ebx + 4], eax
mov dword [ebx], 0x523450
push edi
call fcn.00428240
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x14], 0
jmp 0x40de11
push 0x18
call fcn.00417780
add esp, 4
mov ebx, eax
mov eax, dword [edi + 0x24]
lea ecx, [ebx + 8]
mov eax, dword [eax + 4]
mov dword [ebx + 4], eax
mov dword [ebx], 0x523450
push edi
call fcn.00428240
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x14], 1
mov eax, dword [edi + 0x24]
add esi, 2
mov dword [eax + 4], ebx
jmp 0x40dd81
xorps xmm0, xmm0
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
call fcn.0040e9b0
mov eax, dword [edi + 0xc]
add esi, 3
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], eax
push ebx
push esi
call fcn.0040d360
mov ecx, dword [esp + 0x20]
mov esi, eax
mov dword [esp + 0xc], ecx
mov ecx, edi
push dword [edi + 0x10]
push 1
lea eax, [esp + 0x18]
push eax
call fcn.0040ea10
mov eax, dword [esp + 0xc]
add dword [edi + 0x10], eax
cmp esi, ebx
je 0x40de94
cmp byte [esi], 0x29
jne 0x40de94
lea ecx, [esp + 0x10]
inc esi
call fcn.0040cc70
jmp 0x40dd8a
call fcn.0040eaa0
int3
Function at 0x421b40
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
mov dword [esp + 0xc], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0047f020
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea esi, [esi]

Function at 0x421ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x549f00]
test eax, eax
jle 0x421cb0
mov edx, dword [0x549f04]
xor ebx, ebx
mov ecx, dword [edx + 0xc]
cmp ecx, esi
ja 0x421bd1
mov edi, dword [edx + 0x10]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x421c4a
add ebx, 1
add edx, 0x14
cmp ebx, eax
jne 0x421bc0
mov dword [esp], esi
call fcn.0047f180
test eax, eax
mov edi, eax
je 0x421cd7
lea esi, [ebx + ebx*4]
mov ebx, dword [0x549f04]
shl esi, 2
add ebx, esi
mov dword [ebx + 0x10], eax
mov dword [ebx], 0
call fcn.0047f270
add eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x549f04]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x421cb7
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x421c52
add dword [0x549f00], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x421c43
cmp eax, 0x80
je 0x421c43
cmp eax, 8
je 0x421c43
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
add esi, dword [0x549f04]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x421c43
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00421b40
nop
lea esi, [esi]
xor ebx, ebx
jmp 0x421bdb
mov eax, dword [0x549f04]
mov eax, dword [eax + esi + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00421b40
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00421b40
mov esi, esi
lea edi, [edi]
Function at 0x4225a0
Capabilities:
Get common file path

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20c
mov edi, ecx
lea ebx, [esp + 4]
push 0x208
push 0
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x42261d
mov esi, eax
cmp eax, 0x104
jae 0x422715
cmp word [esp + esi*2 + 2], 0x5c
jne 0x4225eb
mov word [esp + esi*2 + 2], 0
mov dword [edi + 4], 0
mov dword [edi], 0
mov dword [edi + 8], 0
push edi
push ebx
call fcn.0047f640
add esp, 8
test al, al
je 0x422803
mov eax, edi
add esp, 0x20c
pop esi
pop edi
pop ebx
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, esp
nop word cs:[eax + eax]
nop
mov ecx, esi
push 0xffffffffffffffff
push 0
push 6
push 0x71
push str.system_libbase_file.cpp
call fcn.00481460
mov ecx, esi
call fcn.00481430
push 0xe
push 0x5243f0
push eax
call fcn.004234b0
add esp, 0xc
push 6
push 0x5243ff
push eax
call fcn.004234b0
add esp, 0xc
push 1
push 0x524406
push eax
call fcn.004234b0
add esp, 0xc
push 2
push 0x524408
push eax
call fcn.004234b0
add esp, 0xc
push 1
push 0x524406
push eax
call fcn.004234b0
add esp, 0xc
push 3
push 0x52440b
push eax
call fcn.004234b0
add esp, 0xc
push 9
push 0x52440f
push eax
call fcn.004234b0
add esp, 0xc
mov ecx, eax
push 0
call fcn.0048d370
push 6
push str.__0ul
push eax
call fcn.004234b0
add esp, 0xc
mov ecx, eax
push 0
call fcn.0048d370
push 2
push 0x524420
push eax
call fcn.004234b0
add esp, 0xc
push 0x1c
push str.GetTempPathW_failed__error:
push eax
call fcn.004234b0
add esp, 0xc
mov edi, eax
call ebx
mov ecx, edi
push eax
call fcn.0048d370
mov ecx, esi
call fcn.00481540
jmp 0x422630
mov edi, esp
nop word [eax + eax]
mov ecx, edi
push 0xffffffffffffffff
push 0
push 6
push 0x72
push str.system_libbase_file.cpp
call fcn.00481460
mov ecx, edi
call fcn.00481430
push 0xe
push 0x5243f0
push eax
call fcn.004234b0
add esp, 0xc
push 6
push 0x5243ff
push eax
call fcn.004234b0
add esp, 0xc
push 1
push 0x524406
push eax
call fcn.004234b0
add esp, 0xc
push 1
push 0x524440
push eax
call fcn.004234b0
add esp, 0xc
push 1
push 0x524406
push eax
call fcn.004234b0
add esp, 0xc
push 0x14
push str.std::size_tmp_dir_w_
push eax
call fcn.004234b0
add esp, 0xc
push 9
push 0x52440f
push eax
call fcn.004234b0
add esp, 0xc
mov ecx, eax
push esi
call fcn.0048d370
push 0x17
push str.__std::size_tmp_dir_w_
push eax
call fcn.004234b0
add esp, 0xc
mov ecx, eax
push 0x104
call fcn.0048ceb0
push 2
push 0x524420
push eax
call fcn.004234b0
add esp, 0xc
push 0x13
push str.path_truncated_to:
push eax
call fcn.004234b0
add esp, 0xc
mov ecx, eax
push esi
call fcn.0048d370
mov ecx, edi
call fcn.00481540
jmp 0x422720
mov esi, esp
mov ecx, esi
push 0xffffffffffffffff
push 0
push 6
push 0x7b
push str.system_libbase_file.cpp
call fcn.00481460
mov ecx, esi
call fcn.00481430
push 0x3c
push str.Check_failed:_android::base::WideToUTF8_tmp_dir_w__tmp_dir_
push eax
call fcn.004234b0
add esp, 0xc
push 1
push 0x524406
push eax
call fcn.004234b0
add esp, 0xc
push 0x1f
push str.path_cant_be_converted_to_utf8
push eax
call fcn.004234b0
add esp, 0xc
mov ecx, esi
call fcn.00481540
jmp 0x422611
Function at 0x422bd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x240
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 8]
test byte [esi], 1
jne 0x422bf1
mov word [esi], 0
jmp 0x422bfe
mov ecx, dword [esi + 8]
mov byte [ecx], 0
mov dword [esi + 4], 0
mov edi, dword [eax]
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
push eax
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat32i64]
add esp, 8
cmp eax, 0xffffffff
je 0x422c3b
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
cmp eax, 1
sbb ecx, 0
jl 0x422c3b
mov ecx, esi
push eax
call fcn.0041d6f0
lea ebx, [esp + 0x3c]
jmp 0x422c5b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
jne 0x422c83
push 0x200
push ebx
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
cmp eax, 0xffffffff
je 0x422c50
test eax, eax
jle 0x422c7e
mov ecx, esi
push eax
push ebx
call fcn.0041d950
jmp 0x422c5b
sete al
jmp 0x422c85
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x422ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov ebp, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea ebx, [esp + 0x14]
test esi, esi
je 0x422f2c
nop word [eax + eax]
push esi
push edi
push dword [ebx]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
cmp eax, 0xffffffff
jne 0x422f10
call ebp
cmp dword [eax], 4
je 0x422ef0
jmp 0x422f25
mov ecx, eax
add edi, eax
xor eax, eax
test ecx, ecx
mov edx, ecx
cmovle edx, eax
sub esi, edx
test ecx, ecx
jg 0x422ee6
jmp 0x422f27
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, 1
jmp 0x422f27