joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ef40
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x45ef68
mov eax, dword [eax + 0x2c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
sete al
test al, al
je 0x45ef68
xor al, al
pop esi
ret 0xc
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45ef78
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
push ebx
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
push ecx
mov edx, ebx
mov dword [esi + 4], eax
mov eax, dword [esp + 0x14]
or edx, 4
push edx
push eax
push 0
push esi
push 0x45ee30
mov byte [esi + 0xc], 0
call fcn.0041f067
test eax, eax
mov dword [esi + 8], eax
je 0x45efce
test bl, 4
mov dword [eax + 0x28], 0
jne 0x45efce
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
cmp dword [esi + 8], eax
pop ebx
setne al
pop esi
ret 0xc
Function at 0x462570
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x4625a2
lea esp, [esp]
test cl, 3
je 0x4625a2
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4747b8]
add ecx, 1
sub esi, 1
jne 0x462580
cmp esi, 0x20
push ebx
push edi
jb 0x46278c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x474bb8]
xor edx, dword [ebx*4 + 0x474fb8]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4747b8]
add ecx, 4
xor edx, dword [eax*4 + 0x4753b8]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x474bb8]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x474fb8]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4747b8]
add ecx, 4
xor eax, dword [edx*4 + 0x4753b8]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x474bb8]
xor edx, dword [ebx*4 + 0x474fb8]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4747b8]
xor edx, dword [eax*4 + 0x4753b8]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x474bb8]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x474fb8]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4747b8]
xor eax, dword [edx*4 + 0x4753b8]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x474bb8]
xor edx, dword [ebx*4 + 0x474fb8]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4747b8]
xor edx, dword [eax*4 + 0x4753b8]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x474bb8]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x474fb8]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4747b8]
and edx, 0xff
xor eax, dword [edx*4 + 0x4753b8]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x474bb8]
xor edx, dword [ebx*4 + 0x474fb8]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4747b8]
add ecx, 4
xor edx, dword [eax*4 + 0x4753b8]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x474bb8]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x474fb8]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4747b8]
and edx, 0xff
xor eax, dword [edx*4 + 0x4753b8]
sub edi, 1
jne 0x4625b2
cmp esi, 4
jb 0x4627d9
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x474bb8]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x474fb8]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4747b8]
and eax, 0xff
xor edi, dword [eax*4 + 0x4753b8]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x462796
test esi, esi
pop edi
pop ebx
je 0x4627fd
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4747b8]
add ecx, 1
sub esi, 1
jne 0x4627e0
not eax
pop esi
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5a8866a1
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x54cc13cb
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10003b09
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x28
push 0x2c9288
call 0x10008ee0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov esi, 0x14c
cmp word [eax + 4], si
jne 0x10003b35
add eax, 0x78
jmp 0x10003b3a
add eax, 0x88
mov esi, dword [eax]
add esi, ecx
cmp dword [eax], edx
je 0x10003c28
cmp dword [eax + 4], edx
je 0x10003c28
cmp dword [esi + 0x1c], edx
je 0x10003c28
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x28], eax
cmp eax, edx
je 0x10003c28
mov eax, dword [esi + 0x1c]
add eax, ecx
mov dword [ebp - 0x30], eax
cmp dword [esi + 0x24], edx
je 0x10003c18
mov edi, dword [esi + 0x24]
add edi, ecx
mov dword [ebp - 0x38], edi
mov ebx, dword [esi + 0x20]
add ebx, ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jae 0x10003c28
and dword [ebp - 0x1c], 0
xor eax, eax
inc eax
je 0x10003ba9
movzx ecx, word [edi]
add ecx, dword [esi + 0x10]
cmp eax, ecx
jmp 0x10003bda
mov eax, dword [ebx]
add eax, ecx
mov dword [ebp - 0x2c], eax
xor ecx, ecx
inc ecx
je 0x10003bc7
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10003be3
push ecx
push eax
call dword [0x2c9094]
test eax, eax
jmp 0x10003bda
push eax
call dword [0x2c9034]
mov edx, dword [ebp - 0x2c]
call fcn.100062b9
xor ecx, ecx
cmp ecx, eax
jne 0x10003be3
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0
je 0x10003c02
movzx eax, word [edi]
mov ecx, dword [ebp - 0x30]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x20], eax
xor eax, eax
je 0x10003c28
mov ecx, dword [ebx]
add ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x10003c28
add ebx, 4
mov dword [ebp - 0x34], ebx
inc edi
inc edi
mov dword [ebp - 0x38], edi
inc dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
jmp 0x10003b8a
mov dword [ebp - 0x20], eax
jmp 0x10003c28
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
call 0x10008f1b
ret 4

Function at 0x100060b4
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x100062b9
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
test edx, edx
je 0x100062fe
or eax, 0xffffffff
test esi, esi
je 0x100062fa
push edi
mov cl, byte [edx]
movzx edi, al
movzx ecx, cl
xor edi, ecx
and edi, 0xf
shr eax, 4
xor eax, dword [edi*4 + 0x2c9238]
shr ecx, 4
mov edi, eax
and edi, 0xf
xor ecx, edi
shr eax, 4
xor eax, dword [ecx*4 + 0x2c9238]
dec esi
inc edx
test esi, esi
jne 0x100062c8
pop edi
not eax
jmp 0x10006300
xor eax, eax
not eax
pop esi
ret
Function at 0x10006e69
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [edx + 0x3c]
add eax, edx
movzx ecx, word [eax + 0x14]
sub esp, 0x14
push esi
movzx esi, word [eax + 6]
push edi
xor edi, edi
lea eax, [ecx + eax + 0x18]
xor ecx, ecx
cmp dword [eax + 4], edi
jne 0x10006e95
cmp dword [eax], 0x7373622e
jne 0x10006e95
mov ecx, eax
add eax, 0x28
dec esi
je 0x10006e9f
test ecx, ecx
je 0x10006e86
test ecx, ecx
je 0x10006ebd
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x10006eb9
mov ecx, dword [ecx + 0x10]
test ecx, ecx
je 0x10006eb9
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jmp 0x10006ec0
push 0xb
jmp 0x10006ebf
push 2
pop edi
mov eax, edi
test edi, edi
jne 0x10006f8c
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 4]
and esi, 0xfff
neg esi
sbb esi, esi
shr eax, 0xc
neg esi
add esi, eax
mov eax, dword [ebp - 0xc]
lea edi, [eax + edx]
mov eax, esi
push ebx
shl eax, 0xc
push eax
mov dword [ebp - 0x14], edi
call fcn.10003fdc
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x10006f88
push dword [ebp - 4]
push edi
push ebx
call fcn.10005dd2
and dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
add esp, 0xc
test esi, esi
jbe 0x10006f62
mov eax, ebx
sub eax, edi
mov dword [ebp - 8], ebx
lea edi, [eax + ecx + 0x2cb690]
mov ebx, 0x1000
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
lea eax, [eax + ecx - 0x7e47c82f]
push 1
push eax
mov eax, ebx
call fcn.10007ff0
mov ecx, dword [edi + 0xc]
sub ecx, dword [edi + 8]
add dword [ebp - 8], ebx
add ecx, dword [edi + 4]
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jb 0x10006f2e
mov ebx, dword [ebp - 0x10]
lea eax, [ecx - 0x43175ac3]
test eax, eax
jne 0x10006f7d
sub ebx, dword [ebp - 0x14]
mov dword [0x2ca344], ecx
mov dword [0x2ca348], ebx
jmp 0x10006f8b
push ebx
call fcn.10006dda
xor eax, eax
inc eax
jmp 0x10006f8b
push 8
pop eax
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10029ff0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x1002a019
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1002a02f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1002a026
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x1002a062
nop
cmp esi, ecx
jae 0x1002a026
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x1002a050
cmp esi, ecx
jae 0x1002a026
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1002a110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.1005d3e7
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x1002a200
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x1002a200
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1002a200
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1002a200
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x1002a194
cmp esi, ecx
jae 0x1002a200
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x1002a182
cmp esi, ecx
jae 0x1002a200
cmp word [esi], 0
je 0x1002a200
mov eax, dword [ebx]
mov ecx, 1
movzx edi, word [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x1002a1bc
push edi
mov ecx, ebx
call fcn.1002a570
movzx ecx, word [esi]
lea eax, [esi + 2]
push ecx
push eax
push edi
push dword [ebx]
call fcn.10049e8c
add esp, 0x10
cmp eax, 0x50
ja case.0x1002a1db.1
movzx eax, byte [eax + 0x1002a230]
jmp dword [eax*4 + 0x1002a220]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x1002a210
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.1005d220
push 0x80070057
call fcn.1002a780
call fcn.1005d206
nop
loop 0x1002a1c3
add dl, byte [eax]
or esp, dword [edx - 0x5de5effe]
add dl, byte [eax]
sbb ah, byte [edx + 0x3001002]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add ah, cl
int3
Function at 0x1002a290
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
xor cl, cl
test eax, eax
je 0x1002a38d
test eax, 0xffff0000
jne 0x1002a38d
push esi
push edi
movzx edi, ax
push edi
call fcn.1005d3e7
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x1002a389
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x1002a389
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1002a389
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1002a389
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x1002a329
cmp esi, ecx
jae 0x1002a389
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x1002a317
cmp esi, ecx
jae 0x1002a389
cmp word [esi], 0
je 0x1002a389
mov eax, dword [ebx]
mov ecx, 1
movzx edi, word [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x1002a351
push edi
mov ecx, ebx
call fcn.1002a570
movzx ecx, word [esi]
lea eax, [esi + 2]
push ecx
push eax
push edi
push dword [ebx]
call fcn.10049e8c
add esp, 0x10
cmp eax, 0x50
ja case.0x1002a370.1
movzx eax, byte [eax + 0x1002a3bc]
jmp dword [eax*4 + 0x1002a3ac]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x1002a3a0
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
pop edi
mov cl, 1
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.1005d206
call fcn.1005d220
push 0x80070057
call fcn.1002a780
nop
ja 0x1002a351
add dl, byte [eax]
wait
mov dword [-1550446590], eax
add dl, byte [eax]
xchg esi, eax
mov dword [50335746], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add ah, cl
int3
Function at 0x1002c610
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x100a2d20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x418]
push edi
push 0x400
push 0
push eax
mov edi, ecx
call fcn.1006d400
add esp, 0xc
mov dword [ebp - 8], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x18]
movups xmmword [ebp - 0x18], xmm0
call fcn.1003b3d0
push dword [edi + 0x80]
push 0x69
push str.AdbSocketConnect::WriteToClient
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x418]
push str._s_t__d__d___INFO____s:_d__writeToClient_with_client_id___d_n
push eax
call fcn.10007cc0
lea ecx, [ebp - 0x418]
add esp, 0x20
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002c692
sub ecx, edx
lea eax, [ebp - 0x418]
push ecx
push eax
call fcn.1003b520
mov eax, esi
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002c6b0
push 0
sub eax, edx
push eax
push esi
push dword [edi + 0x80]
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100699c7
mov esp, ebp
pop ebp
ret 4

Function at 0x1002c7d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x100a2d20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x418]
push 0x400
push 0
push eax
mov esi, ecx
call fcn.1006d400
add esp, 0xc
mov dword [ebp - 8], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x18]
movups xmmword [ebp - 0x18], xmm0
call fcn.1003b3d0
push dword [esi + 0x80]
push 0x81
push str.AdbSocketConnect::ReadFromClient
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x418]
push str._s_t__d__d___INFO____s:_d__readFromClient_with_client_id___d_n
push eax
call fcn.10007cc0
lea eax, [ebp - 0x418]
add esp, 0x20
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002c855
sub eax, edx
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.1003b520
add esp, 8
push 0
push dword [ebp + 0xc]
push edi
push dword [esi + 0x80]
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100699c7
mov esp, ebp
pop ebp
ret 8
Function at 0x1002ce80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100a2d20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x1c], ebx
push edi
mov dword [ebp - 0x14], 0
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x1002cf6a
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1002cf6a
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
test eax, eax
je 0x1002cedd
cmp dword [ebp - 0x18], 0
jbe 0x1002cedd
push 2
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
shr eax, 1
test al, 1
lea eax, [ebp - 0x14]
je 0x1002cf42
lea ebx, [esi + 0x174]
push ebx
push eax
push edi
push dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1002cf26
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1002cf26
mov edi, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 1
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [esi + 8]
call edi
test eax, eax
je 0x1002cf16
mov eax, dword [ebp - 0x14]
add dword [esi + 0x134], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100699c7
mov esp, ebp
pop ebp
ret 0xc
push 0
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x14]
add dword [esi + 0x134], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100699c7
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100699c7
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1002cf80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x1002d02e
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1002d02e
push 0
lea ecx, [ebp - 4]
mov dword [ebp + 0xc], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
test eax, eax
je 0x1002cfc8
cmp dword [ebp - 4], 0
jbe 0x1002cfc8
push 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
shr eax, 1
test al, 1
je 0x1002d00c
lea eax, [esi + 0x188]
push eax
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1002cffb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1002d02e
add dword [esi + 0x138], edi
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0xc]
add dword [esi + 0x138], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1002d190
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi + 0x144], 0
jne 0x1002d2ca
cmp dword [esi + 0x150], 0
jne 0x1002d2ca
cmp dword [esi + 0x15c], 0
jne 0x1002d2ca
mov eax, dword [esi + 4]
push edi
mov edi, eax
mov byte [esi + 0x13c], 1
shr edi, 4
and edi, 4
test al, 1
je 0x1002d1f4
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x1002e8c0
push 0
push 0
call fcn.1004a733
add esp, 0x18
mov dword [esi + 0x144], eax
test byte [esi + 4], 0x10
je 0x1002d217
lea eax, [ebp - 8]
push eax
push edi
push esi
push 0x1002e900
push 0
push 0
call fcn.1004a733
add esp, 0x18
mov dword [esi + 0x150], eax
test byte [esi + 4], 0x20
je 0x1002d23a
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push 0x1002e920
push 0
push 0
call fcn.1004a733
add esp, 0x18
mov dword [esi + 0x15c], eax
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test cl, 1
je 0x1002d264
mov eax, dword [ebp - 4]
mov dword [esi + 0x148], eax
mov eax, dword [esi + 0x144]
test eax, eax
je 0x1002d29c
test cl, cl
jns 0x1002d264
push 1
push eax
call edi
mov ecx, dword [esi + 4]
test cl, 0x10
je 0x1002d287
mov eax, dword [ebp - 8]
mov dword [esi + 0x154], eax
test eax, eax
je 0x1002d29c
test cl, cl
jns 0x1002d287
push 1
push dword [esi + 0x150]
call edi
mov ecx, dword [esi + 4]
test cl, 0x20
je 0x1002d2c0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x160], eax
test eax, eax
jne 0x1002d2b2
push 0x1f4
mov ecx, esi
call fcn.1002d2e0
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
test cl, cl
jns 0x1002d2c0
push 1
push dword [esi + 0x15c]
call edi
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4