joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4077f0
Capabilities:
Get socket status

Disassembly:
push ebp
mov eax, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x13c
mov dword [ebp - 0x130], ecx
mov ecx, dword [ebp + 8]
mov byte [eax + 8], 0
test ecx, ecx
jle 0x4078e0
mov ebx, dword [eax + 4]
cmp ebx, 0xffffffff
je 0x4078f0
mov eax, ecx
mov edx, 0x10624dd3
imul edx
mov eax, ecx
sar eax, 0x1f
mov dword [ebp - 0x118], ebx
lea edi, [ebp - 0x124]
mov dword [ebp - 0x11c], 1
lea esi, [ebp - 0x11c]
sar edx, 6
sub edx, eax
mov eax, ebx
mov ebx, dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x124], edx
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x3e8
mov dword [ebp - 0x120], ecx
add eax, 1
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call ebx
sub esp, 0x14
cmp eax, 0xffffffff
mov edx, eax
je 0x4078b8
test eax, eax
jne 0x4078a8
mov eax, dword [ebp - 0x130]
mov byte [eax + 8], 1
cmp edx, 1
sete al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [ebp - 0x12c], eax
call dword [sym.imp.msvcrt.dll__errno]
mov edx, dword [ebp - 0x12c]
cmp dword [eax], 4
jne 0x4078a8
mov eax, dword [ebp - 0x130]
mov eax, dword [eax + 4]
jmp 0x407870
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 4
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x40e2c0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x1c
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
test esi, esi
jne 0x40e2ea
jmp 0x40e314
je 0x40e320
add ebx, eax
add ebp, eax
cmp esi, ebx
jbe 0x40e314
mov eax, esi
sub eax, ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov dword [esp], edi
call sub.msvcrt.dll__read
test eax, eax
jns 0x40e2e0
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
add esp, 0x1c
pop ebx
pop esi
pop edi
neg eax
pop ebp
ret
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
mov eax, 0xffffffea
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40e6d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
test ebx, ebx
not eax
je 0x40e6fe
add ebx, edx
add edx, 1
mov ecx, eax
xor cl, byte [edx - 1]
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4ba880]
cmp edx, ebx
jne 0x40e6e5
not eax
pop ebx
ret
Function at 0x425380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24c
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00479d20
lea eax, [ebp - 0x248]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__fstati64]
cmp eax, 0xffffffff
je 0x4253ea
cmp dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x230]
jle 0x42543b
mov ecx, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00479c40
sub esp, 4
lea ebx, [ebp - 0x218]
mov dword [esp + 8], 0x200
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov edi, eax
je 0x425423
test eax, eax
jle 0x42542e
mov ecx, dword [ebp + 0xc]
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00478cc0
sub esp, 8
jmp 0x4253f0
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x4253f0
test edi, edi
sete al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
jl 0x4253ea
cmp eax, 0
ja 0x4253dc
jmp 0x4253ea

Function at 0x425650
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], edx
test eax, eax
je 0x4256f6
mov eax, dword [sym.imp.msvcrt.dll__errno]
lea ebx, [ebp - 0x2c]
mov dword [ebp - 0x48], eax
nop
lea esi, [esi]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov edi, eax
mov esi, edx
mov eax, dword [ebp + 8]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 0x10], 0
mov dword [ebp - 0x24], edi
mov dword [esp], eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
lea edx, [ebp - 0x30]
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x425720
mov ecx, dword [ebp - 0x30]
cmp ecx, 0xffffffff
je 0x425703
test ecx, ecx
jle 0x425714
mov eax, ecx
cdq
add dword [ebp + 0xc], ecx
add dword [ebp - 0x40], ecx
adc dword [ebp - 0x3c], edx
sub dword [ebp + 0x10], ecx
jne 0x425680
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [sym.imp.msvcrt.dll__errno]
call edx
cmp dword [eax], 4
je 0x42568a
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
call eax
mov edx, dword [ebp - 0x44]
mov dword [eax], 5
jmp 0x425709
Function at 0x4276f0
Capabilities:
Create directory

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__mktemp]
test eax, eax
je 0x427720
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__mkdir]
cmp eax, 0xffffffff
je 0x427720
mov eax, ebx
add esp, 0x18
pop ebx
ret
xor eax, eax
jmp 0x427715

Function at 0x428a10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
lea eax, [ebp - 0x8c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x88]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8c], pe_nt_image_headers32
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getsockname]
sub esp, 0xc
test eax, eax
jne 0x428a62
movzx eax, word [ebp - 0x86]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ntohs]
sub esp, 4
movzx eax, ax
leave
ret
mov eax, 0xffffffff
leave
ret

Function at 0x428a70
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x50
call fcn.00428d00
test al, al
jne 0x428a90
mov eax, 0xffffffff
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0
mov dword [esp], 0x17
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
cmp eax, 0xffffffff
mov ebx, eax
je 0x428a81
lea eax, [ebp - 0x2c]
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 0
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xfffffffb
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
call esi
sub esp, 0x14
cmp eax, 0xffffffff
je 0x428bc0
lea eax, [ebp - 0x28]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 0x29
mov dword [esp], ebx
call esi
sub esp, 0x14
cmp eax, 0xffffffff
je 0x428bc0
xor eax, eax
mov dword [ebp + eax - 0x24], 0
add eax, 4
cmp eax, 0x1c
jb 0x428b2c
mov eax, 0x17
mov word [ebp - 0x24], ax
movzx eax, word [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
mov eax, dword [0x4bfbb0]
sub esp, 4
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [0x4bfbb4]
mov dword [ebp - 0x18], eax
mov eax, dword [0x4bfbb8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x4bfbbc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_bind]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x428bc0
cmp dword [ebp + 0xc], 1
je 0x428ba6
mov eax, ebx
jmp 0x428a86
mov dword [esp + 4], 4
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_listen]
sub esp, 8
cmp eax, 0xffffffff
jne 0x428b9f
nop
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
jmp 0x428a81
Function at 0x428be0
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
call fcn.00428d00
test al, al
jne 0x428c00
mov eax, 0xffffffff
mov ebx, dword [ebp - 4]
leave
ret
xor eax, eax
mov dword [ebp + eax - 0x28], 0
add eax, 4
cmp eax, 0x20
jb 0x428c02
mov eax, dword [ebp + 0x10]
lea ebx, [ebp - 0x38]
mov dword [esp + 8], 0x4bfa04
mov dword [esp + 4], 0x10
mov dword [esp], ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], 0
mov dword [esp + 0xc], eax
call fcn.0044ae60
lea eax, [ebp - 0x3c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
sub esp, 0x10
test eax, eax
mov eax, dword [ebp - 0x3c]
jne 0x428cc9
test eax, eax
je 0x428bf0
mov edx, dword [eax + 0xc]
mov dword [esp + 8], edx
mov edx, dword [eax + 8]
mov dword [esp + 4], edx
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
cmp eax, 0xffffffff
mov ebx, eax
je 0x428cee
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 0x10]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x18]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x428ce2
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, ebx
sub esp, 4
jmp 0x428bf5
test eax, eax
je 0x428bf0
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
sub esp, 4
jmp 0x428bf0
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
mov eax, dword [ebp - 0x3c]
jmp 0x428cd1
Function at 0x42ae0b
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
jne 0x42ae1e
jmp 0x42af52
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0042a63c
cmp eax, 1
jne 0x42af4a
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea edx, [ebp - 0x4f]
mov ebx, 0x43
mov eax, 0
mov ecx, edx
and ecx, 1
test ecx, ecx
je 0x42ae96
mov byte [edx], al
add edx, 1
sub ebx, 1
mov ecx, edx
and ecx, 2
test ecx, ecx
je 0x42aea8
mov word [edx], ax
add edx, 2
sub ebx, 2
mov ecx, ebx
shr ecx, 2
mov edi, edx
rep stosd dword es:[edi], eax
mov edx, edi
mov ecx, ebx
and ecx, 2
test ecx, ecx
je 0x42aec2
mov word [edx], ax
add edx, 2
and ebx, 1
mov ecx, ebx
test ecx, ecx
je 0x42aed0
mov byte [edx], al
add edx, 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x42af00
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x42af17
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x42aefc
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x42af35
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.msvcrt.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x42bec4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x42bd39
mov dword [esp], 0x4cb1b4
call fcn.0042b49f
mov eax, dword [0x4af418]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x42bf0b
mov eax, dword [ebp - 0x20]
jmp 0x42c056
call fcn.0042ad14
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x42bf22
cmp dword [ebp - 0x20], 0
jne 0x42bf2c
mov eax, 0
jmp 0x42c056
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0042ae0b
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x42bffe
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x4af418]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x42c053
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42c11a
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.0042bec4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.0042bd5c
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x42c173
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_longjmp
mov eax, dword [0x4af418]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42c29d
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x42c205
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x42c1c2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0042ac30
mov dword [ebp - 0x10], 0
mov eax, dword [0x4af418]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x42c29d
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x42c235
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x42c29d
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0042ac30
mov dword [ebp - 0x10], 0
mov eax, dword [0x4af418]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__endthreadex]
call eax
Function at 0x436e30
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00436e90

Function at 0x436e90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x4cb560]
test eax, eax
jle 0x436f93
mov edx, dword [0x4cb564]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x436ec1
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x436f36
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x436eb0
mov dword [esp], esi
call fcn.00437770
test eax, eax
mov edi, eax
je 0x436fba
lea esi, [ebx + ebx*2]
mov ebx, dword [0x4cb564]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.00437860
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x4cb564]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x436f9a
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x436f40
add dword [0x4cb560], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x436f2f
cmp eax, 0x80
je 0x436f2f
cmp eax, 8
je 0x436f2f
mov eax, dword [ebp - 0x28]
add esi, dword [0x4cb564]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x436f2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00436e30
xor ebx, ebx
jmp 0x436ecb
mov eax, dword [0x4cb564]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00436e30
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00436e30
lea esi, [esi]

Function at 0x437690
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4376c8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4376be
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4376ca
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4376b0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x439990
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], 1
mov dword [esp + 8], ebx
pop ebx
jmp fcn.00439360
Function at 0x445c50
Capabilities:
Query environment variable

Disassembly:
push ebp
sub ecx, 1
push edi
mov ebp, edx
push esi
mov esi, 1
push ebx
mov ebx, 0x66666667
sub esp, 0x2c
mov dword [esp + 0x1c], eax
mov eax, ecx
mov edi, dword [esp + 0x40]
sar eax, 0x1f
mov dword [esp + 0x14], eax
mov eax, ecx
imul ebx
mov dword [esp + 0x10], ecx
sar ecx, 0x1f
sar edx, 2
mov ebx, edx
sub ebx, ecx
je 0x445ca3
mov ecx, 0x66666667
mov eax, ebx
add esi, 1
imul ecx
sar ebx, 0x1f
sar edx, 2
sub edx, ebx
mov ebx, edx
jne 0x445c90
mov eax, dword [edi + 0x28]
cmp eax, 0xffffffff
je 0x445d18
mov edx, dword [edi + 8]
cmp eax, esi
cmovge esi, eax
lea eax, [esi + 2]
cmp edx, eax
jg 0x445d11
mov dword [edi + 8], 0xffffffff
mov eax, dword [esp + 0x1c]
mov ecx, 1
mov edx, ebp
mov dword [esp], edi
add esi, 1
call fcn.004455c0
mov eax, dword [edi + 0x28]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 4]
mov edx, eax
and eax, 0x20
or edx, 0x1c0
or eax, 0x45
mov dword [edi + 4], edx
mov edx, edi
call fcn.00445210
mov eax, dword [esp + 0x10]
mov ecx, edi
add dword [edi + 8], esi
mov edx, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00445990
sub edx, eax
mov dword [edi + 8], edx
jmp 0x445cc1
mov edx, dword [0x4af4ac]
cmp edx, 0xffffffff
je 0x445d41
test edx, edx
mov eax, 2
jne 0x445d39
call fcn.0044ab30
and eax, 1
neg eax
add eax, 3
mov dword [edi + 0x28], eax
jmp 0x445cab
mov dword [esp], str.PRINTF_EXPONENT_DIGITS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x445d67
movsx eax, byte [eax]
xor edx, edx
sub eax, 0x30
cmp eax, 2
setbe dl
mov dword [0x4af4ac], edx
jmp 0x445d23
xor edx, edx
jmp 0x445d5f

Function at 0x47da80
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ecx, edi
call fcn.0047d900
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebp, eax
je 0x47dac0
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x47da91
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x4a9e80
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp], str.ANDROID_PRODUCT_OUT
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4a9e9e
cmp byte [eax], 0
jne 0x4a9eaa
mov dword [esp], str.ANDROID_PRODUCT_OUT_not_set
call fcn.00408fc0
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp], ebx
mov dword [esp + 4], str._s__s
call fcn.00426ee0
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x16f937a9
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x25fc77b3
nop
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219