joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40107b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
xor eax, eax
lea edi, [ebp - 0x2b]
and dword [ebp - 4], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 0x2c], 0x52
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x67
mov byte [ebp - 0x29], 0x51
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x79
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x45
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x18], 0x41
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x33
mov byte [ebp - 0x11], 0x32
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x6c
jmp 0x401124
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 8], eax
jmp 0x401156
test eax, eax
je 0x4011a6
jmp 0x401174
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x4011a6
jmp 0x4011c0
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x401466
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
jmp 0x40147f
movzx eax, word [ebp + 0x10]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
mov dword [ebp + 0x14], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x4014ef
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, ebx
je 0x4014ef
lea eax, [ebp - 4]
push ebx
push eax
push esi
push dword [ebp + 0x14]
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 1
pop ebx
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x100053e2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1000f15c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x27
push esi
push edi
lea esi, [ebp + 8]
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x18]
jae 0x1000540e
xor eax, eax
jmp 0x100054b5
push 4
lea eax, [esi + 2]
push eax
push dword [ebp - 0x14]
mov word [esi], 0x7b
call fcn.100053ad
test eax, eax
jl 0x10005407
push 2
lea eax, [esi + 0x14]
push eax
movzx eax, word [ebp - 0x10]
push eax
mov word [esi + 0x12], 0x2d
call fcn.100053ad
test eax, eax
jl 0x10005407
push 2
lea eax, [esi + 0x1e]
push eax
movzx eax, word [ebp - 0xe]
push eax
mov word [esi + 0x1c], 0x2d
call fcn.100053ad
test eax, eax
jl 0x10005407
push ebx
mov word [esi + 0x26], 0x2d
xor edi, edi
lea ebx, [esi + 0x28]
movzx eax, byte [ebp + edi - 0xc]
push 1
push ebx
push eax
call fcn.100053ad
test eax, eax
jl 0x100054c5
inc edi
add ebx, 4
cmp edi, 2
jl 0x10005465
mov word [esi + 0x30], 0x2d
xor ebx, ebx
lea edi, [esi + 0x32]
movzx eax, byte [ebp + ebx - 0xa]
push 1
push edi
push eax
call fcn.100053ad
test eax, eax
jl 0x100054c5
inc ebx
add edi, 4
cmp ebx, 6
jl 0x1000548b
and word [esi + 0x4c], 0
push 0x27
mov word [esi + 0x4a], 0x7d
pop eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000c020
leave
ret 0x18
xor eax, eax
jmp 0x100054b4

Function at 0x1000875a
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x1505
jmp 0x1000877b
push eax
call dword [sym.imp.MSVCR80.dll_towupper]
imul edi, edi, 0x21
movzx eax, ax
xor edi, eax
inc esi
pop ecx
inc esi
movzx eax, word [esi]
test ax, ax
jne 0x10008769
mov eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x1000878b
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x1505
jmp 0x100087b6
mov ecx, dword [ebp + 0xc]
dec dword [ebp + 0xc]
test ecx, ecx
je 0x100087be
push eax
call dword [sym.imp.MSVCR80.dll_towupper]
imul edi, edi, 0x21
movzx eax, ax
xor edi, eax
inc esi
pop ecx
inc esi
movzx eax, word [esi]
test ax, ax
jne 0x1000879a
mov eax, edi
pop edi
pop esi
pop ebp
ret 8

Function at 0x100092fa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
push edi
push 0
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esi]
cmp ecx, 1
je 0x10009329
cmp ecx, 7
je 0x10009329
cmp ecx, 2
jne 0x1000933e
test eax, eax
jne 0x1000933e
test edi, edi
je 0x1000933e
mov ecx, dword [edi]
test ecx, ecx
je 0x1000933e
lea eax, [ecx + ecx]
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x10009d6d
Capabilities:
Query environment variable

Disassembly:
push 0x218
mov eax, 0x1000cfa9
call fcn.1000c02f
xor esi, esi
cmp dword [0x1000f134], esi
je 0x10009d9a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x10009e6f
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0x200
mov dword [ebp - 4], esi
mov ebx, dword [ebp + 0x10]
add ebx, ebx
push ebx
lea ecx, [ebp - 0x224]
call fcn.10009642
cmp eax, esi
mov dword [ebp - 0x14], eax
jne 0x10009df0
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x224], esi
je 0x10009dec
push dword [ebp - 0x224]
call fcn.10004f2a
pop ecx
mov dword [ebp - 0x224], esi
xor eax, eax
jmp 0x10009e6f
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.10009504
test eax, eax
jge 0x10009e09
xor edi, edi
jmp 0x10009e46
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp dword [ebp + 0x10], esi
mov edi, eax
je 0x10009e46
cmp edi, ebx
ja 0x10009e46
cmp edi, esi
je 0x10009e3c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push dword [ebp - 0x14]
push esi
push esi
call fcn.1000937e
mov edi, eax
dec edi
jmp 0x10009e46
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x10009e46
mov word [eax], si
push dword [ebp - 0x10]
call fcn.10004f2a
pop ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x224], esi
je 0x10009e6d
push dword [ebp - 0x224]
call fcn.10004f2a
pop ecx
mov dword [ebp - 0x224], esi
mov eax, edi
call fcn.1000c107
ret 0xc

Function at 0x1000c004
Capabilities:
Access peb ldr_data

Disassembly:
push esi
push ebx
push edx
sub esi, esi
add esi, 0x30
mov ebx, dword fs:[esi]
push ds
push ecx
mov ecx, dword [ebx + 8]
dec ebx
mov edx, dword [ebx + 0xd]
lea esi, [edx]
add esi, 0xc
mov ebx, dword [esi]
push edi
Function at 0x402a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x23c
lea ebx, [ebp - 0x220]
mov dword [ebp - 0x228], 0x2e626461
mov dword [ebp - 0x224], 0x676f6c
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub eax, 1
sub esp, 8
cmp eax, 0x102
ja 0x402af1
lea edi, [ebp - 0x22c]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [ebp - 0x22c], 0x51af3c
call fcn.0042d8f0
test al, al
je 0x402b1f
mov ecx, esi
mov dword [esp], edi
call fcn.004e0e20
lea ecx, [ebp - 0x228]
mov ebx, ecx
sub esp, 4
mov eax, dword [ebx]
add ebx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x402a93
mov eax, edx
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea eax, [ebx + 2]
cmove ebx, eax
add dl, dl
sbb ebx, 3
sub ebx, ecx
mov dword [esp + 4], ebx
mov dword [esp], ecx
mov ecx, esi
call fcn.004dfb20
mov eax, dword [ebp - 0x22c]
lea ebx, [eax - 0xc]
sub esp, 8
cmp ebx, 0x51af30
jne 0x402b2b
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x22c]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0042d220
mov eax, dword [ebp - 0x22c]
mov dword [esp], str.cannot_retrieve_temporary_file_path:__s_n
mov dword [esp + 4], eax
call fcn.00410010
mov dword [esp], str.cannot_convert_temporary_file_path_from_UTF_16_to_UTF_8
call fcn.00410070
sub eax, 4
call fcn.00511ff0
test eax, eax
jg 0x402ae7
lea eax, [ebp - 0x22d]
mov ecx, ebx
mov dword [esp], eax
call fcn.004df650
push eax
jmp 0x402ae7
Function at 0x40f990
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0x4c
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
sub esp, 0x10
test eax, eax
je 0x40fa78
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
lea ecx, [edx - 1]
cmp ecx, 0xfffffffd
mov dword [ebp - 0x20], eax
mov eax, edx
mov dword [ebp - 0x24], edx
jbe 0x40fad0
mov edx, dword [esi]
mov dword [ebp - 0x24], 0
mov dword [esi], eax
test edx, edx
je 0x40fa19
mov dword [esp], edx
mov ecx, esi
call fcn.00422e10
sub esp, 4
mov eax, dword [edi]
mov ebx, 1
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], 0
test eax, eax
mov dword [edi], edx
je 0x40fa52
mov dword [esp], eax
mov ecx, edi
call fcn.00422e10
sub esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40fa52
mov dword [esp], eax
lea ecx, [ebp - 0x20]
call fcn.00422e10
sub esp, 4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], 0
test eax, eax
je 0x40fa6e
mov dword [esp], eax
lea ecx, [ebp - 0x24]
call fcn.00422e10
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0042d220
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.Cannot_create_pipe:__s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00428b20
mov eax, dword [ebp - 0x1c]
lea ebx, [eax - 0xc]
cmp ebx, 0x51af30
jne 0x40fb58
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x3c], edx
call fcn.0040f930
mov edx, dword [ebp - 0x3c]
test al, al
mov ebx, eax
jne 0x40fb7d
mov dword [ebp - 0x3c], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0042d220
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 4], str.Cannot_make_handle_0x_p_non_inheritable:__s_n
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], edx
add eax, 0x40
mov dword [esp], eax
call fcn.00428b20
mov eax, dword [ebp - 0x1c]
lea esi, [eax - 0xc]
cmp esi, 0x51af30
je 0x40fa3d
sub eax, 4
call fcn.00512c08
test eax, eax
jg 0x40fa3d
lea eax, [ebp - 0x2d]
mov ecx, esi
mov dword [esp], eax
call fcn.004df650
push eax
jmp 0x40fa3d
sub eax, 4
call fcn.00512c08
test eax, eax
jg 0x40fabe
lea eax, [ebp - 0x20]
mov ecx, ebx
mov dword [esp], eax
xor ebx, ebx
call fcn.004df650
push edx
jmp 0x40fac0
mov eax, dword [ebp - 0x24]
jmp 0x40f9fd
Function at 0x41eb30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
test byte [0x551030], 8
jne 0x41ebbb
mov dword [esp], 8
call fcn.00510970
mov edx, dword [ebp + 8]
mov dword [eax], 0x41efc0
mov dword [eax + 4], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x41e720
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
test eax, eax
je 0x41eba7
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x52329c
mov dword [esp], str.cannot_create_local_socket__s_thread
call fcn.00410070
call fcn.0042bec0
cmp eax, 2
jg 0x41eb42
mov esi, dword [sym.imp.msvcrt.dll__errno]
lea ebx, [ebp - 0x20]
call esi
mov edi, dword [eax]
lea eax, [ebp - 0x1c]
mov dword [esp], eax
mov dword [esp + 8], 0x52329c
mov dword [esp + 4], str.transport:_local__s_init
call fcn.0042cf00
mov ecx, ebx
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x135
mov dword [esp], str.system_core_adb_transport_local.cpp
call fcn.0042bf90
mov ecx, ebx
sub esp, 0x14
call fcn.0042c110
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edx - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.0050a5a0
mov ecx, ebx
call fcn.0042c1a0
mov eax, dword [ebp - 0x1c]
mov dword [esp], ebx
lea ecx, [eax - 0xc]
call fcn.004df670
push eax
call esi
mov dword [eax], edi
jmp 0x41eb42
Function at 0x425070
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, 0x7f000001
mov eax, dword [esp + 4]
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
jmp fcn.00424100

Function at 0x425090
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
mov edx, dword [esp + 0xc]
xor ecx, ecx
mov eax, dword [esp + 4]
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
jmp fcn.00424100
Function at 0x426000
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov edx, str.adb_getsockname
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 8]
call fcn.00421a00
test eax, eax
je 0x426050
cmp dword [eax], 0x524c10
jne 0x426050
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getsockname]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x426074
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x551030], 0x80
jne 0x426097
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov dword [eax], 9
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test byte [0x551030], 0x80
mov ebx, eax
jne 0x426135
mov eax, ebx
call fcn.00421b60
mov eax, 0xffffffff
jmp 0x426044
call fcn.0042bec0
mov ebx, dword [sym.imp.msvcrt.dll__errno]
cmp eax, 2
jg 0x42605f
call ebx
mov esi, dword [ebp + 8]
mov edi, dword [eax]
lea eax, [ebp - 0x1c]
mov dword [esp + 8], esi
lea esi, [ebp - 0x20]
mov dword [esp], eax
mov dword [esp + 4], str.adb_getsockname:_invalid_fd__d
call fcn.0042cf00
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x45b
mov dword [esp], str.system_core_adb_sysdeps_win32.cpp
call fcn.0042bf90
mov ecx, esi
sub esp, 0x14
call fcn.0042c110
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edx - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.0050a5a0
mov ecx, esi
call fcn.0042c1a0
mov eax, dword [ebp - 0x1c]
mov dword [esp], esi
lea ecx, [eax - 0xc]
call fcn.004df670
push ecx
call ebx
mov dword [eax], edi
jmp 0x42605f
call fcn.0042bec0
cmp eax, 2
lea esi, [esi]
jg 0x426089
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
mov eax, dword [eax]
mov dword [esp + 4], ebx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.0042d220
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
mov esi, dword [ebp + 8]
mov dword [esp], edx
mov dword [esp + 4], str.adb_getsockname:_setsockopt_on_fd__d_failed:__s_n
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
lea esi, [ebp - 0x24]
mov dword [ebp - 0x30], edx
call fcn.0042cf00
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x464
mov dword [esp], str.system_core_adb_sysdeps_win32.cpp
call fcn.0042bf90
mov ecx, esi
sub esp, 0x14
call fcn.0042c110
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx - 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], edx
call fcn.0050a5a0
mov ecx, esi
call fcn.0042c1a0
mov ecx, dword [ebp - 0x1c]
mov dword [esp], esi
sub ecx, 0xc
call fcn.004df670
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x20]
lea ecx, [esi - 0xc]
push eax
mov dword [esp], edx
call fcn.004df670
push edx
call edi
mov edi, dword [ebp - 0x2c]
mov dword [eax], edi
jmp 0x426089
Function at 0x426af0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov edx, str.set_file_block_mode
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
call fcn.00421a00
test eax, eax
je 0x426b30
mov edx, dword [eax + 4]
test edx, edx
je 0x426b30
cmp dword [eax], 0x524c10
je 0x426b43
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], pe_nt_image_headers32
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
lea edx, [ebp - 0xc]
xor ebx, 1
mov dword [esp + 8], edx
movzx ebx, bl
mov dword [esp + 4], 0x8004667e
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, eax
sub esp, 0xc
test edx, edx
mov eax, 1
je 0x426b28
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
call fcn.00421b60
xor eax, eax
jmp 0x426b28
Function at 0x428c50
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
mov eax, esi
call fcn.00422980
test eax, eax
je 0x428ca0
mov edx, ebp
mov ecx, esi
imul edx, ebx
mov dword [esp], eax
mov eax, edi
call fcn.00428860
cmp eax, 0xffffffff
je 0x428c94
add esp, 0x1c
xor edx, edx
div ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004b0f80

Function at 0x4296d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov dword [esp], 8
call fcn.00510970
mov ebx, dword [sym.imp.msvcrt.dll__beginthreadex]
mov dword [eax], 0x42b840
mov dword [eax + 4], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x429110
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
test eax, eax
je 0x4297a3
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], 0
call esi
sub esp, 4
mov dword [esp], 8
call fcn.00510970
mov dword [eax], 0x429240
mov dword [eax + 4], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x429110
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
test eax, eax
je 0x429797
mov dword [esp], 0
call esi
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp], str.cannot_create_power_notification_thread
call fcn.00410070
mov dword [esp], str.cannot_create_device_poll_thread
call fcn.00410070
nop

Function at 0x42c8d0
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov dword [esp], eax
call fcn.0042bed0
mov dword [esp + 0x20], ebx
add esp, 0x18
pop ebx
jmp fcn.0042c520
Function at 0x42db60
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test esi, esi
je 0x42dc6b
xor eax, eax
lea esi, [esi]
cmp esi, 2
jbe 0x42dbf0
movzx ebp, byte [ebx]
add edx, 4
add eax, 4
movzx edi, byte [ebx + 1]
add ebx, 3
shl ebp, 0x10
shl edi, 8
or ebp, edi
movzx edi, byte [ebx - 1]
or ebp, edi
mov edi, ebp
shr edi, 0x12
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, ebp
shr edi, 0xc
and edi, 0x3f
mov byte [edx - 4], cl
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, ebp
shr edi, 6
and edi, 0x3f
mov byte [edx - 3], cl
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 2], cl
mov ecx, ebp
and ecx, 0x3f
sub esi, 3
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 1], cl
jne 0x42db80
mov ecx, edx
jmp 0x42dc2b
movzx ecx, byte [ebx]
shl ecx, 0x10
cmp esi, 2
je 0x42dc33
mov ebx, ecx
shr ecx, 0xc
shr ebx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
mov ecx, 0x3d
mov byte [edx], bl
mov byte [edx + 2], cl
add eax, 4
lea ecx, [edx + 4]
mov byte [edx + 3], 0x3d
mov byte [ecx], 0
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, byte [ebx + 1]
shl ebx, 8
or ebx, ecx
mov ecx, ebx
shr ecx, 0x12
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov ecx, ebx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr ebx, 6
and ebx, 0x3f
mov byte [edx + 1], cl
movzx ecx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x42dc1e
mov ecx, edx
xor eax, eax
jmp 0x42dc2b
Function at 0x43c730
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
test ebx, ebx
je 0x43c75e
xor eax, eax
xor edx, edx
movzx ecx, byte [edi + edx]
xor cl, byte [esi + edx]
add edx, 1
or eax, ecx
cmp edx, ebx
jne 0x43c747
movzx eax, al
pop ebx
pop esi
pop edi
ret
xor eax, eax
jmp 0x43c75a

Function at 0x43c770
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x43c798
mov edx, dword [esp + 8]
mov eax, 0x811c9dc5
add ebx, edx
movzx ecx, byte [edx]
add edx, 1
xor ecx, eax
imul eax, ecx, 0x1000193
cmp edx, ebx
jne 0x43c784
pop ebx
ret
mov eax, 0x811c9dc5
pop ebx
ret