joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7c7c3d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x7cf3b8
cmp edx, dword [eax]
je 0x7c7c5f
add eax, 8
inc ecx
cmp eax, 0x7cf448
jl 0x7c7c50
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x7cf3b8]
jne 0x7c7d8d
mov eax, dword [0xbd0d14]
cmp eax, 1
je 0x7c7d67
test eax, eax
jne 0x7c7c90
cmp dword [0x7cf2e4], 1
je 0x7c7d67
cmp edx, 0xfc
je 0x7c7d8d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x7c7cc7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.007c8620
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.007c8ab0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x7c7d0a
lea eax, [ebp - 0x1a4]
push eax
call fcn.007c8ab0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x7cc904
push edi
call fcn.007ca980
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.007c8620
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.007c8630
lea eax, [ebp - 0xa0]
push 0x7cc8e4
push eax
call fcn.007c8630
push dword [esi + 0x7cf3bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.007c8630
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.007ca8f4
add esp, 0x2c
pop edi
jmp 0x7c7d8d
lea eax, [ebp + 8]
lea esi, [esi + 0x7cf3bc]
push 0
push eax
push dword [esi]
call fcn.007c8ab0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x415b20
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0x4c
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
sub esp, 0x10
test eax, eax
je 0x415c08
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
lea ecx, [edx - 1]
cmp ecx, 0xfffffffd
mov dword [ebp - 0x20], eax
mov eax, edx
mov dword [ebp - 0x24], edx
jbe 0x415c60
mov edx, dword [esi]
mov dword [ebp - 0x24], 0
mov dword [esi], eax
test edx, edx
je 0x415ba9
mov dword [esp], edx
mov ecx, esi
call fcn.0042f4e0
sub esp, 4
mov eax, dword [edi]
mov ebx, 1
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], 0
test eax, eax
mov dword [edi], edx
je 0x415be2
mov dword [esp], eax
mov ecx, edi
call fcn.0042f4e0
sub esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x415be2
mov dword [esp], eax
lea ecx, [ebp - 0x20]
call fcn.0042f4e0
sub esp, 4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], 0
test eax, eax
je 0x415bfe
mov dword [esp], eax
lea ecx, [ebp - 0x24]
call fcn.0042f4e0
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0043c720
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.adb:_CreatePipe_failed:__s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.004342f0
mov eax, dword [ebp - 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, 0x55c3f0
jne 0x415ce6
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x3c], edx
call fcn.00415980
mov edx, dword [ebp - 0x3c]
test al, al
mov ebx, eax
jne 0x415d09
mov dword [ebp - 0x3c], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0043c720
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 4], str.adb:_cannot_make_handle_0x_p_non_inheritable:__s_n
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], edx
add eax, 0x40
mov dword [esp], eax
call fcn.004342f0
mov eax, dword [ebp - 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, 0x55c3f0
je 0x415bcd
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x415bcd
lea eax, [ebp - 0x2d]
mov dword [esp], eax
call fcn.0051c400
push eax
jmp 0x415bcd
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x415c4e
lea eax, [ebp - 0x20]
xor ebx, ebx
mov dword [esp], eax
call fcn.0051c400
push edx
jmp 0x415c50
mov eax, dword [ebp - 0x24]
jmp 0x415b8d
Function at 0x41c3b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24c
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x220]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x28
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
sub esp, 0x14
test eax, eax
mov edi, eax
js 0x41c455
lea eax, [ebp - 0x224]
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [ebp - 0x224], 0x55c3fc
call fcn.0043cde0
test al, al
je 0x41c447
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x224], 0x55c3fc
mov dword [ebx], eax
mov eax, 0x55c3fc
lea ecx, [eax - 0xc]
cmp ecx, 0x55c3f0
jne 0x41c565
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebx], 0x55c3fc
mov eax, dword [ebp - 0x224]
jmp 0x41c42e
test byte [0x599058], 1
je 0x41c555
call fcn.0043bc50
cmp eax, 2
jg 0x41c555
mov eax, dword [sym.imp.msvcrt.dll__errno]
lea esi, [ebp - 0x22c]
mov dword [ebp - 0x240], eax
call eax
mov edx, dword [eax]
lea eax, [ebp - 0x228]
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [ebp - 0x23c], edx
call fcn.0043c720
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x224]
mov dword [esp], edx
mov dword [esp + 4], str.SHGetFolderPathW_failed:__s
mov dword [ebp - 0x244], edx
mov dword [esp + 8], eax
call fcn.0043c360
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0xec
mov dword [esp], str.system_core_adb_adb_utils.cpp
call fcn.0043b390
mov ecx, esi
sub esp, 0x14
call fcn.0043b510
mov ecx, dword [ebp - 0x224]
mov edi, dword [ecx - 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], edi
call fcn.00549c40
mov ecx, esi
call fcn.0043b580
mov ecx, dword [ebp - 0x224]
mov dword [esp], esi
sub ecx, 0xc
call fcn.0051c420
mov edx, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x228]
sub ecx, 0xc
push eax
mov dword [esp], edx
call fcn.0051c420
mov eax, dword [ebp - 0x240]
push edx
call eax
mov edx, dword [ebp - 0x23c]
mov dword [eax], edx
mov dword [ebx], 0x55c3fc
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x41c43d
lea eax, [ebp - 0x228]
mov dword [esp], eax
call fcn.0051c400
push ecx
jmp 0x41c43d
Function at 0x41c7f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x23c
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x220]
mov dword [ebp - 0x228], 0x2e626461
mov dword [ebp - 0x224], 0x676f6c
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub eax, 1
sub esp, 8
cmp eax, 0x102
ja 0x41c8d2
lea edi, [ebp - 0x22c]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [ebp - 0x22c], 0x55c3fc
call fcn.0043cde0
test al, al
je 0x41c900
mov ecx, esi
mov dword [esp], edi
call fcn.0051dbd0
lea ecx, [ebp - 0x228]
mov ebx, ecx
sub esp, 4
mov eax, dword [ebx]
add ebx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x41c874
mov eax, edx
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea eax, [ebx + 2]
cmove ebx, eax
add dl, dl
sbb ebx, 3
sub ebx, ecx
mov dword [esp], ecx
mov ecx, esi
mov dword [esp + 4], ebx
call fcn.0051c8d0
mov eax, dword [ebp - 0x22c]
lea ecx, [eax - 0xc]
sub esp, 8
cmp ecx, 0x55c3f0
jne 0x41c90c
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x22c]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0043c720
mov eax, dword [ebp - 0x22c]
mov dword [esp], str.cannot_retrieve_temporary_file_path:__s_n
mov dword [esp + 4], eax
call fcn.004161e0
mov dword [esp], str.cannot_convert_temporary_file_path_from_UTF_16_to_UTF_8
call fcn.00416240
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x41c8c8
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call fcn.0051c400
push eax
jmp 0x41c8c8
Function at 0x430950
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, 0x7f000001
mov eax, dword [esp + 4]
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
jmp fcn.0042ec60

Function at 0x430970
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
mov edx, dword [esp + 0xc]
xor ecx, ecx
mov eax, dword [esp + 4]
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
jmp fcn.0042ec60
Function at 0x431760
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov edx, str.adb_getsockname
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 8]
call fcn.0042d810
test eax, eax
je 0x4317b0
cmp dword [eax], 0x565d38
jne 0x4317b0
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getsockname]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x431872
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x599058], 0x80
jne 0x4317d4
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov dword [eax], 9
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0043bc50
mov ebx, dword [sym.imp.msvcrt.dll__errno]
cmp eax, 2
jg 0x4317bf
call ebx
mov esi, dword [ebp + 8]
mov edi, dword [eax]
lea eax, [ebp - 0x1c]
mov dword [esp + 8], esi
lea esi, [ebp - 0x20]
mov dword [esp], eax
mov dword [esp + 4], str.adb_getsockname:_invalid_fd__d
call fcn.0043c360
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x3d6
mov dword [esp], str.system_core_adb_sysdeps_win32.cpp
call fcn.0043b390
mov ecx, esi
sub esp, 0x14
call fcn.0043b510
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edx - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.00549c40
mov ecx, esi
call fcn.0043b580
mov eax, dword [ebp - 0x1c]
mov dword [esp], esi
lea ecx, [eax - 0xc]
call fcn.0051c420
push ecx
call ebx
mov dword [eax], edi
jmp 0x4317bf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test byte [0x599058], 0x80
mov ebx, eax
je 0x431955
call fcn.0043bc50
cmp eax, 2
jg 0x431955
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
mov eax, dword [eax]
mov dword [esp + 4], ebx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.0043c720
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
mov esi, dword [ebp + 8]
mov dword [esp], edx
mov dword [esp + 4], str.adb_getsockname:_setsockopt_on_fd__d_failed:__s_n
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
lea esi, [ebp - 0x24]
mov dword [ebp - 0x30], edx
call fcn.0043c360
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x3df
mov dword [esp], str.system_core_adb_sysdeps_win32.cpp
call fcn.0043b390
mov ecx, esi
sub esp, 0x14
call fcn.0043b510
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx - 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], edx
call fcn.00549c40
mov ecx, esi
call fcn.0043b580
mov ecx, dword [ebp - 0x1c]
mov dword [esp], esi
sub ecx, 0xc
call fcn.0051c420
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x20]
lea ecx, [esi - 0xc]
push eax
mov dword [esp], edx
call fcn.0051c420
push edx
call edi
mov edi, dword [ebp - 0x2c]
mov dword [eax], edi
mov eax, ebx
call fcn.0042d980
mov eax, 0xffffffff
jmp 0x4317a8
Function at 0x4322b0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov edx, str.set_file_block_mode
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
call fcn.0042d810
test eax, eax
je 0x432305
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x432305
cmp dword [eax], 0x565d38
je 0x432408
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov dword [eax], pe_nt_image_headers32
test byte [0x599058], 0x80
jne 0x4323b4
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov dword [eax], 9
test byte [0x599058], 0x80
je 0x4322fb
call fcn.0043bc50
cmp eax, 2
jg 0x4322fb
call ebx
mov esi, dword [ebp + 8]
mov edi, dword [eax]
lea eax, [ebp - 0x1c]
mov dword [esp + 8], esi
lea esi, [ebp - 0x20]
mov dword [esp + 4], str.Setting_nonblocking_on_bad_file_descriptor__d
mov dword [esp], eax
call fcn.0043c360
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x444
mov ecx, esi
mov dword [esp], str.system_core_adb_sysdeps_win32.cpp
call fcn.0043b390
mov ecx, esi
sub esp, 0x14
call fcn.0043b510
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edx - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.00549c40
mov ecx, esi
call fcn.0043b580
mov eax, dword [ebp - 0x1c]
mov dword [esp], esi
lea ecx, [eax - 0xc]
call fcn.0051c420
push eax
call ebx
mov dword [eax], edi
jmp 0x4322fb
call fcn.0043bc50
cmp eax, 2
jg 0x4322fb
call ebx
mov esi, dword [ebp + 8]
mov edi, dword [eax]
lea eax, [ebp - 0x1c]
mov dword [esp + 8], esi
lea esi, [ebp - 0x20]
mov dword [esp + 4], str.Setting_nonblocking_on_non_socket__d
mov dword [esp], eax
call fcn.0043c360
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x453
jmp 0x432367
lea edx, [ebp - 0x24]
xor ebx, 1
mov dword [esp + 8], edx
movzx ebx, bl
mov dword [esp + 4], 0x8004667e
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x24], ebx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, eax
sub esp, 0xc
test edx, edx
mov eax, 1
je 0x4322fd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
call fcn.0042d980
test byte [0x599058], 0x80
je 0x4322fb
call fcn.0043bc50
cmp eax, 2
jg 0x4322fb
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
mov ecx, dword [ebp + 8]
mov edi, dword [eax]
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], ebx
lea ebx, [ebp - 0x20]
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], str.Setting__d_nonblocking_failed___d_
call fcn.0043c360
mov ecx, ebx
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44d
mov dword [esp], str.system_core_adb_sysdeps_win32.cpp
call fcn.0043b390
mov ecx, ebx
sub esp, 0x14
call fcn.0043b510
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edx - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.00549c40
mov ecx, ebx
call fcn.0043b580
mov eax, dword [ebp - 0x1c]
mov dword [esp], ebx
lea ecx, [eax - 0xc]
call fcn.0051c420
push edx
call esi
mov dword [eax], edi
xor eax, eax
jmp 0x4322fd
Function at 0x434420
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
mov eax, esi
call fcn.0042e5c0
test eax, eax
je 0x434470
mov edx, ebp
mov ecx, esi
imul edx, ebx
mov dword [esp], eax
mov eax, edi
call fcn.00433fa0
cmp eax, 0xffffffff
je 0x434464
add esp, 0x1c
xor edx, edx
div ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp sub.msvcrt.dll_fwrite

Function at 0x43a740
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24c
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.0051d930
lea eax, [ebp - 0x248]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__fstati64]
cmp eax, 0xffffffff
je 0x43a7aa
cmp dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x230]
jle 0x43a7fb
mov ecx, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0051d850
sub esp, 4
lea ebx, [ebp - 0x218]
mov dword [esp + 8], 0x200
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov edi, eax
je 0x43a7e3
test eax, eax
jle 0x43a7ee
mov ecx, dword [ebp + 0xc]
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0051c8d0
sub esp, 8
jmp 0x43a7b0
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x43a7b0
test edi, edi
sete al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
jl 0x43a7aa
cmp eax, 0
ja 0x43a79c
jmp 0x43a7aa
Function at 0x44a800
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], edi
mov dword [esp], eax
call sym.adb.exe_AES_set_encrypt_key
test eax, eax
js 0x44aa1e
mov edx, dword [edi + 0xf0]
mov eax, edi
lea ebp, [edx*4]
test ebp, ebp
jle 0x44a899
shl edx, 4
mov ecx, edi
add edx, edi
xor ebx, ebx
mov dword [esp + 0xc], edi
nop
lea esi, [esi]
mov esi, dword [ecx]
add ebx, 4
add ecx, 0x10
mov eax, dword [edx]
sub edx, 0x10
mov dword [ecx - 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [edx + 0x10], esi
mov esi, dword [ecx - 0xc]
mov dword [ecx - 0xc], eax
mov eax, dword [edx + 0x18]
mov dword [edx + 0x14], esi
mov esi, dword [ecx - 8]
mov dword [ecx - 8], eax
mov eax, dword [edx + 0x1c]
mov dword [edx + 0x18], esi
mov esi, dword [ecx - 4]
mov dword [ecx - 4], eax
mov dword [edx + 0x1c], esi
mov esi, ebp
sub esi, ebx
cmp ebx, esi
jl 0x44a850
mov eax, dword [esp + 0xc]
mov edx, dword [edi + 0xf0]
mov ecx, 1
cmp edx, 1
mov ebp, ecx
jle 0x44aa1c
lea esi, [esi]
add eax, 0x10
mov ebx, dword [eax]
add ebp, 1
movzx edx, bl
mov esi, ebx
movzx edx, byte [edx*4 + 0x56c3e0]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x56c3e0]
mov edx, dword [edx*4 + 0x56abe0]
xor edx, dword [esi*4 + 0x56b7e0]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x56c3e0]
movzx esi, cl
movzx esi, byte [esi*4 + 0x56c3e0]
xor edx, dword [esi*4 + 0x56b3e0]
xor edx, dword [ebx*4 + 0x56afe0]
mov ebx, dword [eax + 4]
mov dword [eax], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x56c3e0]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x56c3e0]
mov edx, dword [edx*4 + 0x56abe0]
xor edx, dword [esi*4 + 0x56b7e0]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x56c3e0]
movzx esi, cl
movzx esi, byte [esi*4 + 0x56c3e0]
xor edx, dword [esi*4 + 0x56b3e0]
xor edx, dword [ebx*4 + 0x56afe0]
mov ebx, dword [eax + 8]
mov dword [eax + 4], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x56c3e0]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x56c3e0]
mov edx, dword [edx*4 + 0x56abe0]
xor edx, dword [esi*4 + 0x56b7e0]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x56c3e0]
movzx esi, cl
movzx esi, byte [esi*4 + 0x56c3e0]
xor edx, dword [esi*4 + 0x56b3e0]
xor edx, dword [ebx*4 + 0x56afe0]
mov ebx, dword [eax + 0xc]
mov dword [eax + 8], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x56c3e0]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x56c3e0]
mov edx, dword [edx*4 + 0x56abe0]
xor edx, dword [esi*4 + 0x56b7e0]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x56c3e0]
movzx esi, cl
movzx esi, byte [esi*4 + 0x56c3e0]
xor edx, dword [esi*4 + 0x56b3e0]
xor edx, dword [ebx*4 + 0x56afe0]
mov dword [eax + 0xc], edx
cmp dword [edi + 0xf0], ebp
jg 0x44a8b0
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x44ab20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x60]
mov ebx, dword [esp + 0x54]
sub eax, 8
cmp eax, 0x7fffffef
ja 0x44ac3a
test byte [esp + 0x60], 7
jne 0x44ac3a
test ebx, ebx
mov eax, 0x56aa80
cmove ebx, eax
mov eax, dword [esp + 0x58]
lea edi, [esp + 0x20]
add eax, 8
mov edx, eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x60]
mov dword [esp], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], eax
call sub.msvcrt.dll_memmove
mov eax, dword [ebx]
mov dword [esp + 0x14], 1
mov dword [esp + 0x1c], 6
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x60]
shr eax, 3
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x18]
mov esi, 1
mov ebx, dword [esp + 0x14]
mov ecx, dword [ebp]
add esi, 1
add ebp, 8
mov eax, dword [esp + 0x50]
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 4]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], edi
mov dword [esp + 0x2c], ecx
call sym.adb.exe_AES_encrypt
mov ecx, ebx
shr ecx, 8
xor byte [esp + 0x26], cl
mov ecx, ebx
shr ecx, 0x10
xor byte [esp + 0x25], cl
mov ecx, ebx
shr ecx, 0x18
xor byte [esp + 0x24], cl
mov ecx, dword [esp + 0x28]
xor byte [esp + 0x27], bl
add ebx, 1
mov dword [ebp - 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [ebp - 4], ecx
cmp dword [esp + 0x10], esi
jae 0x44abb0
mov eax, dword [esp + 0x10]
add dword [esp + 0x14], eax
sub dword [esp + 0x1c], 1
jne 0x44aba3
mov eax, dword [edi]
mov edx, dword [esp + 0x58]
mov dword [edx], eax
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov eax, dword [esp + 0x60]
add eax, 8
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x44ac32
Function at 0x44ac50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x60]
mov ebx, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
lea edx, [esi - 0x10]
cmp edx, 0x7fffffef
ja 0x44ad83
test esi, 7
jne 0x44ad83
mov edx, dword [esp + 0x54]
lea ecx, [esi - 8]
mov dword [esp + 0x1c], ecx
lea ebp, [esp + 0x20]
test edx, edx
mov edx, 0x56aa80
cmovne edx, dword [esp + 0x54]
add eax, 8
shr esi, 3
mov dword [esp + 0x54], edx
mov edx, dword [eax - 8]
mov dword [esp + 0x20], edx
mov edx, dword [eax - 4]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x24], edx
call sub.msvcrt.dll_memmove
lea eax, [esi - 1]
mov dword [esp + 0xc], eax
lea eax, [esi + esi*2]
lea eax, [eax + eax - 6]
mov dword [esp + 0x10], eax
lea eax, [ebx + esi*8 - 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 6
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
nop
mov edx, edi
mov eax, edi
shr edx, 8
sub esi, 8
xor byte [esp + 0x26], dl
mov edx, edi
shr edx, 0x10
xor byte [esp + 0x25], dl
mov edx, edi
shr edx, 0x18
sub edi, 1
xor byte [esp + 0x24], dl
mov edx, dword [esi + 8]
xor byte [esp + 0x27], al
mov eax, dword [esp + 0x50]
mov dword [esp + 0x28], edx
mov edx, dword [esi + 0xc]
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov dword [esp], ebp
mov dword [esp + 0x2c], edx
call sym.adb.exe_AES_decrypt
mov edx, dword [esp + 0x28]
mov dword [esi + 8], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0xc], edx
sub ebx, 1
jne 0x44acf0
mov eax, dword [esp + 0xc]
sub dword [esp + 0x10], eax
sub dword [esp + 0x14], 1
jne 0x44ace3
mov eax, dword [esp + 0x54]
mov dword [esp + 8], 8
mov dword [esp], ebp
mov dword [esp + 4], eax
call sym.adb.exe_CRYPTO_memcmp
test eax, eax
jne 0x44ad83
mov eax, dword [esp + 0x1c]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x3c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x44ad90
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
cmp dword [esp + 0x10], 1
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
je 0x44adb4
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
jmp sym.adb.exe_AES_decrypt
jmp sym.adb.exe_AES_encrypt