joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4018c0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x218
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x214], eax
mov eax, dword [esp + 0x21c]
push ebp
push esi
push eax
mov dword [esp + 0xc], ecx
call sub.WSOCK32.dll_gethostbyname
mov ebp, eax
test ebp, ebp
je 0x401a77
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
je 0x401a77
push ebx
push edi
push 0x100
lea eax, [esp + 0x128]
push 0
push eax
call sub.MSVCR90.dll_memset
push 0x100
lea ecx, [esp + 0x34]
push 0
push ecx
call sub.MSVCR90.dll_memset
add esp, 0x18
xor ebx, ebx
xor esi, esi
jmp 0x401930
cmp esi, 0xf0
jge 0x4019d0
mov edx, dword [ebp + 0xc]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
mov byte [esp + 0x22], al
mov eax, dword [ebx + edx]
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
push ecx
movzx ecx, byte [eax + 1]
push edx
movzx edx, byte [eax]
push ecx
push edx
lea eax, [esp + 0x24]
push str._u._u._u._u
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea edi, [esi + 0xf]
add esp, 0x18
cmp esi, edi
mov ecx, esi
jge 0x4019be
jmp 0x401990
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
shl edx, 4
sub edx, eax
mov eax, ecx
sub eax, edx
mov dl, byte [esp + eax + 0x14]
mov byte [esp + ecx + 0x124], dl
inc ecx
cmp ecx, edi
jl 0x401990
mov eax, dword [ebp + 0xc]
add ebx, 4
cmp dword [ebx + eax], 0
mov esi, edi
jne 0x401930
xor eax, eax
xor esi, esi
lea ecx, [esp + 0x124]
mov bl, 0xd
lea ecx, [ecx]
cmp byte [ecx], 0
je 0x401a27
mov edx, dword [ecx]
mov dword [esp + eax + 0x24], edx
mov edx, dword [ecx + 4]
lea eax, [esp + eax + 0x24]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov dx, word [ecx + 0xc]
mov word [eax + 0xc], dx
mov dl, byte [ecx + 0xe]
mov byte [eax + 0xe], dl
lea eax, [esp + 0x24]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401a10
sub eax, edi
mov byte [esp + eax + 0x24], bl
inc esi
inc eax
add ecx, 0xf
cmp esi, 0xf
jl 0x4019e0
mov edi, dword [esp + 0x10]
push 0x100
push 0
push edi
call sub.MSVCR90.dll_memset
lea eax, [esp + 0x30]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401a42
sub eax, edx
mov esi, eax
cmp esi, 0x100
jle 0x401a5a
mov esi, 0x100
test esi, esi
jle 0x401a6d
push esi
lea eax, [esp + 0x28]
push eax
push edi
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov byte [edi + esi], 0
pop edi
mov al, 1
pop ebx
jmp 0x401a89
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov esi, 0x40751c
call fcn.004011a0
xor al, al
mov ecx, dword [esp + 0x21c]
pop esi
pop ebp
xor ecx, esp
call fcn.0040377c
add esp, 0x218
ret 4
Function at 0x401ab0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x40419e
mov eax, dword fs:[0]
push eax
sub esp, 0x1a4
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x1a0], eax
push esi
push edi
mov eax, dword [0x407018]
xor eax, esp
push eax
lea eax, [esp + 0x1b0]
mov dword fs:[0], eax
lea esi, [ebx + 4]
mov dword [esp + 0x14], ebx
call fcn.004024d0
xor esi, esi
lea edi, [ebx + 8]
mov dword [esp + 0x1b8], esi
call fcn.004022e0
lea edi, [ebx + 0x40]
xor ecx, ecx
mov eax, edi
mov byte [esp + 0x1b8], 1
call fcn.00402550
cmp dword [0x407510], esi
jne 0x401b5d
cmp dword [0x40750c], esi
jne 0x401b5d
lea eax, [esp + 0x1c]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
cmp eax, esi
je 0x401b5d
mov ecx, eax
lea eax, [esp + 0x18]
call fcn.00402550
mov ecx, dword [eax]
push 0x405750
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], ecx
call sub.MSVCR90.dll__CxxThrowException
push esi
push esi
push 1
push esi
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
inc dword [0x407510]
mov dword [ebx], eax
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x28], esi
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x3c], esi
mov dword [ebx + 0x38], esi
mov dword [ebx + 0x14], 0xffffffff
mov eax, ebx
mov ecx, dword [esp + 0x1b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.0040377c
add esp, 0x1b0
ret
Function at 0x401c60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x20
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov edi, dword [0x407518]
mov eax, edi
mov ebx, ecx
call fcn.00401da0
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
mov eax, 2
push 0x27dd
mov word [esp + 0x18], ax
call sub.WSOCK32.dll_htons
push ebx
mov word [esp + 0x1a], ax
call sub.WSOCK32.dll_inet_addr
push 0x10
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x24], eax
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x401ce1
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.00401c40
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0040377c
add esp, 0x20
ret
push 4
lea ecx, [esp + 0x14]
push ecx
push 0x80
push 0xffff
mov edx, 1
mov eax, 0xa
push esi
mov word [esp + 0x24], dx
mov word [esp + 0x26], ax
call sub.WSOCK32.dll_setsockopt
lea edx, [edi + 0x3c]
push edx
push 0
push edi
push 0x4021c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x38], eax
test eax, eax
jne 0x401d4d
push 0x3ea
call fcn.00401c40
push esi
call sub.WSOCK32.dll_closesocket
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0040377c
add esp, 0x20
ret
lea ebx, [edi + 4]
mov eax, ebx
call fcn.00402530
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [edi + 0x18], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], edx
mov dword [edi + 0x24], eax
mov eax, ebx
mov dword [edi + 0x14], esi
call fcn.00402540
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.0040377c
add esp, 0x20
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x43590c74
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x57677ceb
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x41803a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x44a1ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [esi]
movzx edx, word [ebp + 0xc]
mov eax, ecx
shr eax, 3
lea edx, [ecx + edx*8]
and eax, 0x3f
cmp edx, ecx
jae 0x418062
inc dword [esi + 4]
cmp word [ebp + 0xc], 0
mov dword [esi], edx
je 0x4180dd
push ebx
push edi
add dword [ebp + 0xc], 0xffff
mov edx, dword [ebp + 8]
mov dl, byte [edx]
movsx ecx, ax
inc eax
inc dword [ebp + 8]
mov byte [ecx + esi + 0x18], dl
cmp ax, 0x40
jne 0x4180d4
xor edx, edx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x48], 0x10
movzx eax, dx
add eax, esi
movzx edi, byte [eax + 0x1b]
movzx ebx, byte [eax + 0x1a]
shl edi, 8
or edi, ebx
movzx ebx, byte [eax + 0x19]
movzx eax, byte [eax + 0x18]
shl edi, 8
or edi, ebx
shl edi, 8
or edi, eax
mov dword [ecx], edi
add ecx, 4
add edx, 4
dec dword [ebp - 0x48]
jne 0x418096
lea ecx, [esi + 8]
lea eax, [ebp - 0x44]
call fcn.004181b7
xor eax, eax
cmp word [ebp + 0xc], 0
jne 0x41806d
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d3a4
leave
ret
Function at 0x42b7ab
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
mov edi, 0x111
cmp dword [ebp + 8], edi
mov esi, ecx
jne 0x42b7e9
push dword [ebp + 0x10]
mov eax, dword [esi]
push dword [ebp + 0xc]
call dword [eax + 0x38]
test eax, eax
je 0x42b7d6
xor eax, eax
inc eax
jmp 0x42b8ac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x50]
jmp 0x42b8ac
cmp dword [ebp + 8], 0x4e
mov edi, dword [ebp + 0x10]
jne 0x42b81e
and dword [ebp + 8], 0
cmp dword [edi], 0
je 0x42b816
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
push edi
push dword [ebp + 0xc]
mov ecx, esi
call dword [eax + 0x3c]
test eax, eax
je 0x42b816
mov eax, dword [ebp + 8]
jmp 0x42b8ac
push edi
push dword [ebp + 0xc]
push 0x4e
jmp 0x42b7dd
cmp dword [ebp + 8], 6
push ebx
jne 0x42b835
push edi
call fcn.0042a23e
push dword [ebp + 0xc]
mov ebx, eax
call fcn.0042b41c
cmp dword [ebp + 8], 0x20
jne 0x42b854
mov eax, edi
shr eax, 0x10
push eax
movsx eax, di
push eax
mov ecx, esi
call fcn.0042b4b4
test eax, eax
jne 0x42bab4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov ecx, dword [ebp + 8]
mov ebx, eax
xor ebx, ecx
and ebx, 0xff
imul ebx, ebx, 0xc
add ebx, 0x3001ef50
cmp ecx, dword [ebx]
mov dword [ebp + 0x10], eax
jne 0x42b891
cmp eax, dword [ebx + 8]
jne 0x42b891
mov eax, dword [ebx + 4]
test eax, eax
je 0x42b89f
cmp ecx, 0xc000
jb 0x42b8d2
jmp 0x42bb1b
mov dword [ebx], ecx
mov dword [ebx + 8], eax
cmp dword [eax], 0
jne 0x42b8b5
and dword [ebx + 4], 0
mov eax, dword [esi]
push edi
push dword [ebp + 0xc]
push ecx
mov ecx, esi
call dword [eax + 0x50]
pop ebx
pop edi
pop esi
leave
ret 0xc
mov eax, dword [ebp + 0x10]
mov edx, 0xc000
cmp ecx, edx
push 0
push 0
jae 0x42b8e9
push ecx
push dword [eax + 4]
call fcn.0042a3ec
test eax, eax
je 0x42b913
mov dword [ebx + 4], eax
mov ebx, dword [eax + 0x14]
mov eax, dword [eax + 0x10]
dec eax
cmp eax, 0x2b
ja 0x42bb11
jmp dword [eax*4 + 0x30012725]
mov eax, dword [eax + 4]
push edx
jmp 0x42b909
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp + 8]
cmp dword [ecx], edx
je 0x42bb18
push 0
push 0
push 0xc000
add eax, 0x18
push eax
call fcn.0042a3ec
test eax, eax
jne 0x42b8ef
mov eax, dword [ebp + 0x10]
call dword [eax]
cmp dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x10], eax
jne 0x42b8b2
jmp 0x42b89b
xor eax, eax
inc eax
jmp 0x42b8ab
xor eax, eax
jmp 0x42b8ab
mov dword [ebx + 4], eax
mov eax, dword [eax + 0x14]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call eax
jmp 0x42b8ab
Function at 0x1001005a
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, ecx
push esi
push edi
push 0
push 0
push dword [eax + 6]
mov dword [ebp - 4], eax
call ebx
xor ecx, ecx
mov edi, eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
call fcn.10011a7d
mov esi, eax
mov eax, dword [ebp - 4]
push edi
push esi
push dword [eax + 6]
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov ecx, esi
setne bl
call fcn.10011a8e
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011157
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [ecx]
push esi
mov esi, edx
test al, al
je 0x1001116e
sub ecx, edx
xor al, 0x7f
mov byte [edx], al
inc edx
mov al, byte [ecx + edx]
test al, al
jne 0x10011162
mov eax, esi
mov byte [edx], 0
pop esi
ret
Function at 0x401a10
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18c
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0xc
mov dword [ebp - 0x24], 0
push 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 1
push eax
lea eax, [ebp - 0x14]
push eax
call sub.KERNEL32.dll_CreatePipe
test eax, eax
je 0x401b76
push eax
mov eax, dword [ebp - 0x14]
push 0
push 1
push eax
call sub.KERNEL32.dll_SetHandleInformation
lea edi, [ebp - 0x7c]
lea ebx, [ebp - 0x180]
push 0x44
push 0
push edi
call sub.msvcrt.dll_memset
mov dword [ebp - 0x7c], 0x44
mov dword [esp], 0xfffffff6
call sub.KERNEL32.dll_GetStdHandle
lea esi, [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov dword [ebp - 0x50], 0x100
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
push eax
mov dword [ebp - 0x30], 0
push eax
mov dword [ebp - 0x2c], 0
push 0x104
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add esp, 0xc
push esi
push edi
push 0
push 0
push 8
push 1
push 0
push 0
push str.adb_fork_server_server
push ebx
call sub.KERNEL32.dll_CreateProcessA
mov ecx, dword [ebp - 0x18]
mov ebx, eax
push esi
push ecx
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
test ebx, ebx
je 0x401b84
sub esp, 0xc
mov eax, dword [ebp - 0x38]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.dll_CloseHandle
lea eax, [ebp - 0x1c]
mov edi, dword [ebp - 0x14]
push 0
push eax
lea eax, [ebp - 0xf]
push 3
push eax
push edi
call sub.KERNEL32.dll_ReadFile
mov esi, dword [ebp - 0x14]
mov ebx, eax
push esi
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
test ebx, ebx
je 0x401bb0
cmp dword [ebp - 0x1c], 3
jne 0x401b43
cmp byte [ebp - 0xf], 0x4f
je 0x401b66
push edx
push edx
push str.ADB_server_didnt_ACK_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.004013a0
or eax, 0xffffffff
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [ebp - 0xe], 0x4b
jne 0x401b43
xor eax, eax
cmp byte [ebp - 0xd], 0xa
jne 0x401b43
jmp 0x401b5e
call sub.KERNEL32.dll_GetLastError
push edx
push eax
push str.CreatePipe___failure__error__ld_n
jmp 0x401b4a
call sub.KERNEL32.dll_GetLastError
push edx
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push str.CreateProcess_failure__error__ld_n
add eax, 0x40
push eax
call fcn.004013a0
pop eax
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_CloseHandle
or eax, 0xffffffff
add esp, 0xc
jmp 0x401b5e
call sub.KERNEL32.dll_GetLastError
push ecx
push eax
push str.could_not_read_ok_from_ADB_Server__error___ld_n
jmp 0x401b4a
Function at 0x401bc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x134
lea eax, [ebp - 0x110]
push eax
push 0xfc
call sub.KERNEL32.dll_GetTempPathA
lea ecx, [ebp - 0x110]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x401be3
test edx, 0x8080
je 0x401cc0
add dl, dl
mov eax, ecx
sbb eax, 3
mov dword [eax], 0x2e626461
mov dword [eax + 4], 0x676f6c
push 0x49d2cb
push 0x49d2ce
call sub.msvcrt.dll_fopen
add esp, 0x10
mov dword [ebp - 0x120], eax
test eax, eax
je 0x401cde
mov ebx, dword [sym.imp.msvcrt.dll__iob]
mov ecx, 8
cld
mov edi, ebx
mov esi, eax
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x110]
push esi
push esi
push 0x49d2d2
push edi
call sub.msvcrt.dll_fopen
add esp, 0x10
mov dword [ebp - 0x138], eax
test eax, eax
je 0x401cd0
mov ecx, dword [ebp - 0x138]
push 0
push 4
push 0
push ecx
call sub.msvcrt.dll_setvbuf
cld
mov eax, 8
mov esi, dword [ebp - 0x138]
lea edi, [ebx + 0x20]
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
add ebx, 0x40
mov esi, dword [ebp - 0x138]
mov edi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll__getpid
add esp, 0xc
push eax
push str.____adb_starting__pid__d______n
push ebx
call fcn.004013a0
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
shr edx, 0x10
add ecx, 2
jmp 0x401c07
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x138], eax
jmp 0x401c6d
mov ebx, dword [sym.imp.msvcrt.dll__iob]
jmp 0x401c4d

Function at 0x402710
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
push str.ADB_TRACE
call sub.msvcrt.dll_getenv
add esp, 0x10
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4027cc
mov al, byte [eax]
test al, al
je 0x4027cc
push eax
push eax
push str.__:_
mov eax, dword [ebp - 0x14]
push eax
call sub.msvcrt.dll_strpbrk
add esp, 0x10
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4027e3
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
sub edi, esi
mov ebx, dword [0x49d900]
mov dword [ebp - 0x20], edi
test ebx, ebx
je 0x4027c4
mov esi, dword [0x49d900]
xor ebx, ebx
jmp 0x402784
inc ebx
mov esi, dword [ebx*8 + 0x49d900]
test esi, esi
je 0x4027c4
sub esp, 0xc
push esi
call sub.msvcrt.dll_strlen
add esp, 0x10
cmp dword [ebp - 0x20], eax
jne 0x402778
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x14]
cld
cmp eax, eax
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x402778
mov ecx, dword [ebx*8 + 0x49d904]
test ecx, ecx
je 0x4027ff
mov eax, 1
shl eax, cl
mov ecx, dword [0x4dcfc8]
or ecx, eax
mov dword [0x4dcfc8], ecx
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x4027d4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov al, byte [edx + 1]
jmp 0x402733
sub esp, 0xc
mov eax, dword [ebp - 0x14]
push eax
call sub.msvcrt.dll_strlen
mov edi, dword [ebp - 0x14]
add esp, 0x10
add eax, edi
mov dword [ebp - 0x10], eax
jmp 0x402759
mov dword [0x4dcfc8], 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x3c
push 0x401450
call section..text
pop eax
pop edx
push 1
push 0x401460
call sub.KERNEL32.dll_SetConsoleCtrlHandler
pop esi
pop eax
call fcn.00404c90
mov dword [0x4c8008], 1
call fcn.004129b0
call fcn.00411c20
sub esp, 0xc
push 0x15b3
call fcn.00406f10
call fcn.0040cc30
add esp, 0xc
mov ebx, dword [ebp + 0xc]
push ebx
lea ebx, [ebp - 0x2a]
push 0x1e
push ebx
call fcn.004014c0
xor ecx, ecx
mov edx, str.smartsocket
mov eax, ebx
call fcn.00401d50
add esp, 0x10
test eax, eax
jne 0x403c40
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x403c16
test byte [0x4dcfc8], 1
je 0x403c03
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.adb_main
push str.system_core_adb_adb.c
push 0x49d056
push ebx
call fcn.004013a0
call sub.msvcrt.dll__errno
mov dword [eax], esi
pop eax
pop edx
push str.Event_loop_starting_n
push ebx
call fcn.004013a0
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
call fcn.00412fd0
call fcn.00411900
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
sub esp, 0xc
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
lea edx, [ebp - 0xc]
push 0
push edx
push 3
push 0x49d7bf
push eax
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
call fcn.00401bc0
jmp 0x403b93
sub esp, 0xc
push 1
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
Function at 0x406ce0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
push str.ADBHOST
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x406dd0
mov edx, dword [ebp + 0xc]
push ecx
push 1
push edx
push eax
call fcn.00415ce0
add esp, 0x10
mov edi, eax
test eax, eax
js 0x406dd0
test byte [0x4dcfc8], 8
jne 0x406d61
sub esp, 0xc
lea ebx, [ebp - 0x4c]
push edi
call fcn.00414c30
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x49e5c2
push str._s_d
push 0x40
push ebx
call fcn.00495c90
add esp, 0x20
mov eax, dword [ebp + 0xc]
push 1
push eax
push ebx
push edi
call fcn.00405820
xor eax, eax
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.local_connect_arbitrary_ports
push str.system_core_adb_transport_local.c
push 0x49e592
push ebx
call fcn.00406ca0
call sub.msvcrt.dll__errno
add esp, 0xc
mov dword [eax], esi
push edi
push str.client:_connected_on_remote_on_fd__d_n
push ebx
call fcn.00406ca0
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
jmp 0x406d21
push eax
push eax
mov eax, dword [ebp + 0xc]
push 1
push eax
call fcn.004160a0
mov edi, eax
add esp, 0x10
or eax, 0xffffffff
test edi, edi
jns 0x406d18
jmp 0x406d59

Function at 0x406f10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, 0x407280
mov ebx, dword [0x4c8008]
test ebx, ebx
jne 0x406f2d
mov esi, 0x407010
test byte [0x4dcfc8], 8
jne 0x406f80
push edi
mov ebx, dword [ebp + 8]
push ebx
push 0
push esi
call sub.msvcrt.dll__beginthread
add esp, 0x10
inc eax
je 0x406f51
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [0x4c8008]
mov eax, 0x49e5d1
test ecx, ecx
jne 0x406f65
mov eax, 0x49e5d8
push edx
push edx
push eax
push str.cannot_create_local_socket__s_thread
call fcn.00402820
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
sub esp, 0xc
mov edi, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.local_init
push str.system_core_adb_transport_local.c
push 0x49e592
push ebx
call fcn.00406ca0
call sub.msvcrt.dll__errno
add esp, 0x10
mov dword [eax], edi
mov eax, 0x49e5d1
mov ecx, dword [0x4c8008]
test ecx, ecx
jne 0x406fd3
mov eax, 0x49e5d8
push edx
push eax
push str.transport:_local__s_init_n
push ebx
call fcn.00406ca0
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], edi
jmp 0x406f36
Function at 0x407f20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1008
call fcn.00495580
mov eax, dword [ebp - 0x10]
mov esi, eax
test eax, eax
js 0x4080ba
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [ebp - 0x1014], eax
lea esi, [esi]
test byte [0x4dcfc8], 1
jne 0x407fc1
lea esi, [esi]
lea edx, [ebp - 0x100c]
push eax
push 0x1000
push edx
push esi
call fcn.00413e00
add esp, 0x10
mov edi, eax
test byte [0x4dcfc8], 1
jne 0x408037
cmp edi, 0
je 0x4080ba
jl 0x4080c2
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [ebp - 0x100c]
add ebx, 0x20
push ebx
push edi
push 1
push eax
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
add esp, 0x10
test byte [0x4dcfc8], 1
je 0x407f60
call sub.msvcrt.dll__errno
sub esp, 0xc
mov ebx, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
add esp, 0xc
push str.read_and_dump
push str.system_core_adb_commandline.c
push 0x4a06d0
mov eax, dword [ebp - 0x1014]
push eax
call fcn.00407d40
call sub.msvcrt.dll__errno
add esp, 0xc
mov dword [eax], ebx
push esi
push str.read_and_dump__:_pre_adb_read_fd_d__n
mov eax, dword [ebp - 0x1014]
push eax
call fcn.00407d40
pop eax
mov eax, dword [ebp - 0x1014]
push eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], ebx
jmp 0x407f60
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
mov dword [ebp - 0x1010], eax
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.read_and_dump
push str.system_core_adb_commandline.c
push 0x4a06d0
push ebx
call fcn.00407d40
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x1010]
mov dword [eax], edx
push edi
push esi
push str.read_and_dump__:_post_adb_read_fd_d_:_len_d_n
push ebx
call fcn.00407d40
add esp, 0x14
push ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x1010]
cmp edi, 0
mov dword [eax], edx
jne 0x407f8e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x407f50
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret