joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6246d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00624730

Function at 0x624730
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x6ee820]
test esi, esi
jle 0x62481d
mov edi, dword [0x6ee824]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x624764
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x624816
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x624750
mov dword [esp], eax
mov ebx, eax
call fcn.00625060
mov edi, eax
test eax, eax
je 0x62485a
lea ebx, [esi + esi*2]
mov esi, dword [0x6ee824]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.00625160
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [0x6ee824]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x62483a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x62480f
sub eax, 0x40
and eax, 0xffffffbf
je 0x62480f
mov eax, dword [esp + 0x20]
mov dword [esp + 8], 0x40
add ebx, dword [0x6ee824]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x624824
add dword [0x6ee820], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x62476e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.006246d0
mov eax, dword [0x6ee824]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.006246d0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.006246d0
lea esi, [esi]
Function at 0x624cd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6ee838
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6ee830]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x624d25
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x624d1e
test esi, esi
je 0x624d1e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x624d00
mov dword [esp], 0x6ee838
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x624f80
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx eax, word [edx + 0x14]
movzx esi, word [edx + 6]
lea eax, [edx + eax + 0x18]
test esi, esi
je 0x624fb8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x624fae
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x624fba
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x624fa0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x10048211
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test ax, si
test eax, eax
pushfd
lea esp, [esp + 0xc]
je 0x100560cd
sub dh, dh
jmp 0x1005b53f
lea esp, [esp + 0x50]
ja 0x10076a41
jmp 0x10078333
xor al, 0xd
cmc
neg al
jmp 0x1005a87b
xor dh, ch
pushal
sbb dx, 0x44d1
lea edx, [0xbc4dc32]
mov edx, dword [esi + 0x78]
cmc
test edx, edx
push dword [esp]
lea esp, [esp + 0x24]
je 0x100560cd
ror ch, cl
rol cx, 0xe
mov ch, 0x73
cmc
add edx, eax
xor cx, di
jae 0x100788ac
mov ecx, dword [esi + 0x7c]
pushfd
pushal
cmc
pushfd
add ecx, edx
push 0xea2c3c9f
call fcn.1005ce20
neg al
pushfd
cmp al, byte [edi]
lahf
lea eax, [ecx - 0x2a87ae49]
pushal
lea edi, [edi + 1]
jmp 0x100562c9
pushfd
jmp 0x10076a2c
dec dl
neg dx
mov esi, dword [eax + 0x3c]
and dl, al
rcl dh, cl
add esi, eax
movsx dx, al
je 0x10059758
mov edx, dword [esi + 0x78]
call fcn.10079486
jmp 0x10056a56
lea esp, [esp + 4]
jb 0x1007873b
pushal
pushal
cmp byte [edi - 1], 0
call fcn.100560b4
add al, 0xf4
jmp 0x10059644
mov byte [esp], ah
dec al
mov byte [esp + 4], 0xb
test bh, 3
cmp sp, dx
jmp 0x10059dd9
pushfd
jmp 0x1005c892
sbb ch, 0x51
adc ch, dh
mov ecx, dword [esi + 0x7c]
cmc
pushal
add ecx, edx
cmc
pushal
cmc
call fcn.10079876
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2b710140
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2210250f
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x404780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov edi, dword [esp + 0x30]
add ecx, 8
mov dword [esp], edi
call fcn.0051fbb0
sub esp, 4
movzx eax, byte [esi + 0x14]
test al, 1
je 0x4047ae
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x4047b8
jmp 0x404863
shr eax, 1
test eax, eax
je 0x404863
movzx eax, byte [edi]
test al, 1
je 0x4047c7
mov eax, dword [edi + 4]
mov edi, dword [edi + 8]
jmp 0x4047ca
inc edi
shr eax, 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
movsd xmm0, qword [esp + 0x18]
movsd qword [esp + 4], xmm0
lea edi, [esp + 0xc]
mov dword [esp], edi
call fcn.004b8c20
lea ebx, [esi + 0x20]
test byte [esi + 0x20], 1
je 0x404811
mov eax, dword [esi + 0x28]
mov byte [eax], 0
mov dword [esi + 0x24], 0
test byte [esi + 0x20], 1
je 0x404811
mov eax, dword [esi + 0x28]
mov dword [esp], eax
call fcn.0051c570
mov eax, dword [esp + 0x14]
mov dword [ebx + 8], eax
movsd xmm0, qword [esp + 0xc]
movsd qword [ebx], xmm0
mov byte [esp + 0xc], 0x14
mov dword [esp + 0xd], 0x656e6567
mov dword [esp + 0x11], 0x69746172
mov word [esp + 0x15], 0x676e
mov byte [esp + 0x17], 0
mov dword [esp], edi
mov ecx, esi
call fcn.00403dc0
sub esp, 4
test byte [esp + 0xc], 1
je 0x404863
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0051c570
add esp, 0x20
pop esi
pop edi
pop ebx
ret 4
Function at 0x4313d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 8], edx
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 0x118]
lea ebp, [edi + 0x120]
mov dword [edi + 0x120], 0x3020100
cmp eax, 2
mov esi, 1
cmovb eax, esi
mov edx, 0x3020100
cmp eax, 8
jb 0x4314f3
lea edx, [eax - 8]
mov esi, edx
shr esi, 3
inc esi
cmp edx, 8
jae 0x431430
mov ebx, esi
movdqa xmm0, xmmword [0x869550]
mov edx, 1
jmp 0x4314b6
mov ebx, esi
and esi, 0xfffffffe
movdqa xmm0, xmmword [0x869550]
mov edx, 0x55
movdqa xmm1, xmmword [0x869560]
movdqa xmm2, xmmword [0x869570]
movdqa xmm3, xmmword [str.________________4444444444444444________________NO_ERROR]
movdqa xmm4, xmmword [0x869590]
movdqa xmm5, xmmword [0x8695a0]
nop word [eax + eax]
movdqa xmm6, xmm0
paddd xmm6, xmm1
movdqa xmm7, xmm0
paddd xmm7, xmm2
movdqu xmmword [edi + edx*4 - 0x30], xmm6
movdqu xmmword [edi + edx*4 - 0x20], xmm7
movdqa xmm6, xmm0
paddd xmm6, xmm3
movdqa xmm7, xmm0
paddd xmm7, xmm4
movdqu xmmword [edi + edx*4 - 0x10], xmm6
movdqu xmmword [edi + edx*4], xmm7
paddd xmm0, xmm5
add edx, 0x10
add esi, 0xfffffffe
jne 0x431470
add edx, 0xffffffac
mov esi, eax
and esi, 0xfffffff8
test bl, 1
je 0x4314e0
movdqa xmm1, xmmword [0x869560]
paddd xmm1, xmm0
paddd xmm0, xmmword [0x869570]
movdqu xmmword [ebp + edx*4], xmm1
movdqu xmmword [ebp + edx*4 + 0x10], xmm0
cmp eax, esi
je 0x43150f
imul edx, esi, 0x4040404
add edx, 0x3020100
or esi, 1
add edx, 0x4040404
inc eax
nop word [eax + eax]
mov dword [ebp + esi*4], edx
inc esi
add edx, 0x4040404
cmp eax, esi
jne 0x431500
mov eax, dword [esp + 8]
test eax, eax
je 0x43152b
mov dword [esp], ebp
lea edx, [edi + 0x11f]
cmp eax, 1
jne 0x431532
xor esi, esi
xor ebx, ebx
jmp 0x4315aa
xor ebx, ebx
jmp 0x4315dc
and eax, 0xfffffffe
mov dword [esp + 0xc], eax
xor esi, esi
xor ebx, ebx
mov dword [esp + 4], edx
nop word cs:[eax + eax]
mov edi, ecx
movzx ebp, byte [ecx + esi]
mov ecx, dword [esp]
movzx eax, byte [ecx + ebp]
mov byte [edi + esi], al
mov byte [edx], al
lea eax, [ebp + 1]
push eax
push edx
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
add esp, 0xc
or ebx, ebp
movzx ebp, byte [edi + esi + 1]
mov edx, dword [esp]
movzx eax, byte [edx + ebp]
mov byte [edi + esi + 1], al
mov ecx, dword [esp + 4]
mov byte [ecx], al
lea eax, [ebp + 1]
push eax
push dword [esp + 8]
push edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov edx, dword [esp + 0x10]
add esp, 0xc
or ebx, ebp
mov ecx, edi
add esi, 2
cmp dword [esp + 0xc], esi
jne 0x431550
test byte [esp + 8], 1
je 0x4315d5
mov edi, edx
mov edx, ecx
movzx ebp, byte [ecx + esi]
mov ecx, dword [esp]
movzx eax, byte [ecx + ebp]
mov byte [edx + esi], al
mov byte [edi], al
lea eax, [ebp + 1]
push eax
push edi
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
add esp, 0xc
or ebx, ebp
shr ebx, 2
mov edi, dword [esp + 0x24]
mov dword [edi + 0x118], ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442170
Capabilities:
Create pipe

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, edx
mov edi, ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, esp
lea edx, [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4421ff
mov ebx, dword [esp + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], 0
mov ebp, dword [esp]
mov dword [esp], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4421d8
push 0
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x44225c
mov eax, dword [edi]
mov dword [edi], ebx
test eax, eax
je 0x4421e8
mov ecx, edi
push eax
call fcn.0046fea0
mov eax, dword [esi]
mov dword [esi], ebp
test eax, eax
je 0x4421f8
mov ecx, esi
push eax
call fcn.0046fea0
mov al, 1
jmp 0x4422df
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.004bbe60
add esp, 8
test byte [esp + 8], 1
je 0x44222d
mov eax, dword [esp + 0x10]
jmp 0x442231
lea eax, [esp + 9]
push eax
push str.adb:_CreatePipe_failed:__s_n
push esi
call fcn.00476b90
add esp, 0xc
test byte [esp + 8], 1
je 0x4422dd
push dword [esp + 0x10]
call fcn.0051c570
add esp, 4
jmp 0x4422dd
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.004bbe60
add esp, 8
test byte [esp + 8], 1
je 0x44228a
mov eax, dword [esp + 0x10]
jmp 0x44228e
lea eax, [esp + 9]
push eax
push ebx
push str.adb:_cannot_make_handle_0x_p_non_inheritable:__s_n
push esi
call fcn.00476b90
add esp, 0x10
test byte [esp + 8], 1
je 0x4422b1
push dword [esp + 0x10]
call fcn.0051c570
add esp, 4
mov dword [esp + 0x18], 0
test ebp, ebp
je 0x4422c7
lea ecx, [esp + 0x18]
push ebp
call fcn.0046fea0
mov dword [esp + 0x14], 0
test ebx, ebx
je 0x4422dd
lea ecx, [esp + 0x14]
push ebx
call fcn.0046fea0
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x448860
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
movzx ebx, byte [ebp]
test bl, 1
mov dword [esp], ecx
je 0x44887f
mov ebx, dword [ebp + 4]
mov ebp, dword [ebp + 8]
jmp 0x448882
inc ebp
shr ebx, 1
mov eax, ebx
mov ecx, ebp
mov edx, ebx
cmp ebx, 4
jb 0x448912
lea edx, [ebx - 4]
test dl, 4
jne 0x4488c1
imul eax, dword [ebp], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
imul eax, ebx, 0x5bd1e995
xor eax, ecx
lea ecx, [ebp + 4]
mov esi, edx
cmp edx, 4
jae 0x4488cc
jmp 0x448912
mov esi, ebx
mov ecx, ebp
mov eax, ebx
cmp edx, 4
jb 0x448912
mov edx, esi
nop
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
imul esi, dword [ecx + 4], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 8
add edx, 0xfffffff8
cmp edx, 3
ja 0x4488d0
cmp edx, 1
je 0x448938
cmp edx, 2
mov edi, dword [esp]
je 0x44892d
cmp edx, 3
jne 0x448946
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
jmp 0x44893b
mov edi, dword [esp]
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x448a9b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov esi, eax
shr esi, 0xf
xor esi, eax
mov eax, ecx
shr eax, 1
and eax, 0x55555555
mov edx, ecx
sub edx, eax
mov eax, edx
and eax, 0x33333333
shr edx, 2
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [esp + 0xc], eax
cmp eax, 1
mov dword [esp + 4], ecx
ja 0x4489ad
lea edx, [ecx - 1]
and edx, esi
jmp 0x4489bb
mov edx, esi
cmp esi, ecx
jb 0x4489bb
mov eax, esi
xor edx, edx
div dword [esp + 4]
mov eax, dword [edi]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x448a9b
mov edi, dword [eax]
test edi, edi
mov eax, 0
je 0x448a9d
mov dword [esp], edx
mov eax, dword [esp + 4]
dec eax
mov dword [esp + 8], eax
jmp 0x448a06
and eax, dword [esp + 8]
cmp eax, edx
jne 0x448a9b
mov edi, dword [edi]
test edi, edi
je 0x448a9b
mov eax, dword [edi + 4]
cmp eax, esi
jne 0x448a60
movzx edx, byte [edi + 8]
mov eax, edx
shr eax, 1
mov ecx, eax
test dl, 1
je 0x448a1f
mov ecx, dword [edi + 0xc]
cmp ecx, ebx
jne 0x4489fc
lea ecx, [edi + 9]
test dl, 1
je 0x448a2e
mov ecx, dword [edi + 0x10]
jne 0x448a80
test ebx, ebx
je 0x448a97
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [edi + ecx + 9]
cmp dl, byte [ebp + ecx]
jne 0x4489fc
inc ecx
cmp eax, ecx
jne 0x448a40
jmp 0x448a97
cmp dword [esp + 0xc], 1
mov edx, dword [esp]
jbe 0x4489f0
mov ecx, dword [esp + 4]
cmp eax, ecx
jb 0x4489f4
xor edx, edx
div ecx
mov eax, edx
mov edx, dword [esp]
jmp 0x4489f4
test ebx, ebx
je 0x448a97
push ebx
push ebp
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4489fc
mov eax, edi
jmp 0x448a9d
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x449640
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x230
mov esi, dword [ebp + 8]
lea ebx, [esp + 0x24]
push 0x208
push 0
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
sub esp, 8
mov dword [esp + 0x10], ebx
movaps xmm0, xmmword [0x86da90]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4496b8
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov eax, esp
push eax
push ebx
call fcn.004bc1c0
add esp, 8
test al, al
je 0x4496da
mov eax, dword [esp + 8]
mov dword [esi + 8], eax
movsd xmm0, qword [esp]
movsd qword [esi], xmm0
jmp 0x449700
mov edi, eax
mov eax, dword [0x86159c]
test byte [eax], 1
jne 0x44970a
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
jmp 0x449700
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
test byte [esp], 1
je 0x449700
push dword [esp + 8]
call fcn.0051c570
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
push 1
call fcn.004b9f30
add esp, 8
test al, al
je 0x4496c4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
sub esp, 0x14
movaps xmm0, xmmword [0x86daa0]
movups xmmword [esp + 4], xmm0
mov dword [esp], str.packages_modules_adb_adb_utils.cpp
lea ebx, [esp + 0x34]
mov ecx, ebx
call fcn.004b9f90
mov ecx, ebx
call fcn.004b9f60
mov ebx, eax
lea eax, [esp + 0x14]
push edi
push eax
call fcn.004bbe60
add esp, 8
test byte [esp + 0x14], 1
je 0x44976b
mov eax, dword [esp + 0x1c]
jmp 0x44976f
lea eax, [esp + 0x15]
mov edi, esp
push eax
push str.SHGetFolderPathW_failed:__s
push edi
call fcn.004ba8a0
add esp, 0xc
push edi
push ebx
call fcn.00402f30
add esp, 8
test byte [esp], 1
je 0x44979c
push dword [esp + 8]
call fcn.0051c570
add esp, 4
test byte [esp + 0x14], 1
je 0x4497af
push dword [esp + 0x1c]
call fcn.0051c570
add esp, 4
lea ecx, [esp + 0x20]
call fcn.004ba060
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
jmp 0x4496c4
Function at 0x449cf0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, edx
mov esi, ecx
mov ebp, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 1
call ebp
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
push 2
call ebp
add esp, 4
mov ebx, eax
mov eax, esp
push eax
call fcn.004b89d0
add esp, 4
movzx eax, byte [esp]
test al, 1
je 0x449d37
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
jmp 0x449d3d
shr eax, 1
lea ecx, [esp + 1]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
sub esp, 0xc
movsd xmm0, qword [esp + 0x24]
movsd qword [esp + 4], xmm0
lea eax, [esp + 0x18]
mov dword [esp], eax
call fcn.004b8c20
add esp, 0xc
test byte [esp + 0xc], 1
je 0x449d70
mov eax, dword [esp + 0x14]
jmp 0x449d74
lea eax, [esp + 0xd]
push eax
push 0x86dc48
push ebx
call fcn.00476b90
add esp, 0xc
test byte [esp + 0xc], 1
je 0x449d96
push dword [esp + 0x14]
call fcn.0051c570
add esp, 4
mov ebx, dword [esp + 0x34]
test byte [esp], 1
je 0x449dac
push dword [esp + 8]
call fcn.0051c570
add esp, 4
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push ebx
push edi
push eax
call fcn.00476a30
add esp, 0xc
test esi, esi
je 0x449deb
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov edi, eax
push esi
call fcn.00479500
add esp, 4
push eax
push str.:__s
push edi
call fcn.00476b90
add esp, 0xc
push 2
call ebp
add esp, 4
push eax
push 0xa
call fcn.00476c00
add esp, 8
push 2
call ebp
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word cs:[eax + eax]
Function at 0x459710
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
movzx ebx, byte [ebp]
test bl, 1
mov dword [esp], ecx
je 0x45972f
mov ebx, dword [ebp + 4]
mov ebp, dword [ebp + 8]
jmp 0x459732
inc ebp
shr ebx, 1
mov eax, ebx
mov ecx, ebp
mov edx, ebx
cmp ebx, 4
jb 0x4597c2
lea edx, [ebx - 4]
test dl, 4
jne 0x459771
imul eax, dword [ebp], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
imul eax, ebx, 0x5bd1e995
xor eax, ecx
lea ecx, [ebp + 4]
mov esi, edx
cmp edx, 4
jae 0x45977c
jmp 0x4597c2
mov esi, ebx
mov ecx, ebp
mov eax, ebx
cmp edx, 4
jb 0x4597c2
mov edx, esi
nop
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
imul esi, dword [ecx + 4], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 8
add edx, 0xfffffff8
cmp edx, 3
ja 0x459780
cmp edx, 1
je 0x4597e8
cmp edx, 2
mov edi, dword [esp]
je 0x4597dd
cmp edx, 3
jne 0x4597f6
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
jmp 0x4597eb
mov edi, dword [esp]
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x45994b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov esi, eax
shr esi, 0xf
xor esi, eax
mov eax, ecx
shr eax, 1
and eax, 0x55555555
mov edx, ecx
sub edx, eax
mov eax, edx
and eax, 0x33333333
shr edx, 2
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [esp + 0xc], eax
cmp eax, 1
mov dword [esp + 4], ecx
ja 0x45985d
lea edx, [ecx - 1]
and edx, esi
jmp 0x45986b
mov edx, esi
cmp esi, ecx
jb 0x45986b
mov eax, esi
xor edx, edx
div dword [esp + 4]
mov eax, dword [edi]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x45994b
mov edi, dword [eax]
test edi, edi
mov eax, 0
je 0x45994d
mov dword [esp], edx
mov eax, dword [esp + 4]
dec eax
mov dword [esp + 8], eax
jmp 0x4598b6
and eax, dword [esp + 8]
cmp eax, edx
jne 0x45994b
mov edi, dword [edi]
test edi, edi
je 0x45994b
mov eax, dword [edi + 4]
cmp eax, esi
jne 0x459910
movzx edx, byte [edi + 8]
mov eax, edx
shr eax, 1
mov ecx, eax
test dl, 1
je 0x4598cf
mov ecx, dword [edi + 0xc]
cmp ecx, ebx
jne 0x4598ac
lea ecx, [edi + 9]
test dl, 1
je 0x4598de
mov ecx, dword [edi + 0x10]
jne 0x459930
test ebx, ebx
je 0x459947
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [edi + ecx + 9]
cmp dl, byte [ebp + ecx]
jne 0x4598ac
inc ecx
cmp eax, ecx
jne 0x4598f0
jmp 0x459947
cmp dword [esp + 0xc], 1
mov edx, dword [esp]
jbe 0x4598a0
mov ecx, dword [esp + 4]
cmp eax, ecx
jb 0x4598a4
xor edx, edx
div ecx
mov eax, edx
mov edx, dword [esp]
jmp 0x4598a4
test ebx, ebx
je 0x459947
push ebx
push ebp
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4598ac
mov eax, edi
jmp 0x45994d
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4