joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402980
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x490250]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push eax
push 0xfc
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x108]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4029b0
mov ecx, dword [str.adb.log]
mov edx, dword [0x47e860]
push ebx
push esi
push edi
push 0x47e864
mov dword [eax], ecx
push 0x47e868
mov dword [eax + 4], edx
call fcn.00455b3d
add esp, 8
mov dword [ebp - 0x10c], eax
test eax, eax
je 0x402a0b
mov esi, eax
mov ecx, 8
lea edi, [ebp - 0x12c]
rep movsd dword es:[edi], dword [esi]
call fcn.00454e90
mov ecx, 8
lea esi, [ebp - 0x12c]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x108]
push 0x47e86c
push eax
call fcn.00455b3d
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x402a2b
mov ebx, dword [ebp - 0x10c]
push 0
push 4
push 0
push ebx
call fcn.00455b54
mov ecx, 8
mov esi, ebx
lea edi, [ebp - 0x12c]
add esp, 0x10
rep movsd dword es:[edi], dword [esi]
call fcn.00454e90
lea edi, [eax + 0x20]
mov ecx, 8
lea esi, [ebp - 0x12c]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
mov esi, ebx
lea edi, [ebp - 0x12c]
rep movsd dword es:[edi], dword [esi]
call fcn.00454e90
lea edi, [eax + 0x40]
mov ecx, 8
lea esi, [ebp - 0x12c]
rep movsd dword es:[edi], dword [esi]
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push str.____adb_starting__pid__d______n
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00454b91
mov esp, ebp
pop ebp
ret
Function at 0x402d10
Capabilities:
Check mutex on windows
Create thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x490250]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x40e470
call fcn.00455888
add esp, 4
push 1
push 0x402970
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.00413ee0
push str.Mobogenie_Phone_Assitant_Adb_Singleton_Mutex
push 1
push 0
mov dword [0x4a4e08], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402dfc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [0x492ce0], 1
je 0x402deb
call fcn.00455413
mov esi, dword [eax]
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.adb_main
push str.adb.cpp
push str._s::_s__:
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
add esp, 0x10
call fcn.00455413
push str.adb_instance_is_exist_we_don_not_wanna_other_instance_start__so_quit_this_time_n
mov dword [eax], esi
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
call fcn.00454e90
add eax, 0x40
push eax
call fcn.004552a8
add esp, 0xc
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00455413
mov dword [eax], esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00454b91
mov esp, ebp
pop ebp
ret
call fcn.00416370
push 0
push 0
push 0x416570
call fcn.00456c1a
add esp, 0xc
cmp eax, 0xffffffff
jne 0x402e21
push str.cannot_create_input_thread
call fcn.00401050
call fcn.00415b80
call fcn.004050b0
mov eax, dword [ebp + 0xc]
push eax
push str.tcp:_d
lea ecx, [ebp - 0x24]
push 0x1e
push ecx
call fcn.00455325
push 0
mov eax, str.smartsocket
lea ecx, [ebp - 0x24]
call fcn.004026f0
add esp, 0x14
test eax, eax
je 0x402e5c
push 1
call fcn.00456253
cmp dword [ebp + 8], 0
je 0x402e83
push 0
lea edx, [ebp - 0x28]
push edx
push 3
push 0x47ea10
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.00402980
test byte [0x492ce0], 1
je 0x402efb
call fcn.00455413
mov esi, dword [eax]
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.adb_main
push str.adb.cpp
push str._s::_s__:
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
add esp, 0x10
call fcn.00455413
push str.Event_loop_starting_n
mov dword [eax], esi
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
call fcn.00454e90
add eax, 0x40
push eax
call fcn.004552a8
add esp, 0xc
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00455413
mov dword [eax], esi
call fcn.00411a30
int3
Function at 0x402f10
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x490250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
push 0x3a
push esi
mov dword [ebp - 0xd4], ebx
call fcn.00455060
push 0x63
mov edi, eax
lea eax, [ebp - 0xcc]
push esi
push eax
call fcn.004558a0
add esp, 0x14
test edi, edi
je 0x402fc7
mov eax, edi
sub eax, esi
cmp eax, 0x64
jl 0x402f7e
push esi
push str.bad_host_name__s
push 0x1000
push ebx
call fcn.00455325
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454b91
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xd0]
push ecx
lea edx, [edi + 1]
push 0x47ea40
push edx
mov byte [ebp + eax - 0xcc], 0
call fcn.00454c0e
add esp, 0xc
test eax, eax
jne 0x402fd1
push edi
push str.bad_port_number__s
push 0x1000
push ebx
call fcn.00455325
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454b91
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0xd0], 0x15b3
mov eax, dword [ebp - 0xd0]
push eax
lea ecx, [ebp - 0xcc]
push ecx
push str._s:_d
lea edx, [ebp - 0x68]
push 0x64
push edx
call fcn.00455325
add esp, 0x14
lea edi, [ebp - 0x68]
call fcn.00414a70
test eax, eax
je 0x403025
mov eax, edi
push eax
push str.already_connected_to__s
push 0x1000
push ebx
call fcn.00455325
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454b91
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0xd0]
lea ecx, [ebp - 0xcc]
call fcn.0040fb00
mov edi, eax
test edi, edi
jns 0x40306e
mov ecx, dword [ebp - 0xd0]
mov edx, dword [ebp - 0xd4]
push ecx
push esi
push str.unable_to_connect_to__s:_d
push 0x1000
push edx
call fcn.00455325
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454b91
mov esp, ebp
pop ebp
ret
mov ebx, 1
test byte [0x492ce0], bl
je 0x4030eb
call fcn.00455413
mov esi, dword [eax]
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.connect_device
push str.adb.cpp
push str._s::_s__:
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
add esp, 0x10
call fcn.00455413
push edi
push str.client:_connected_on_remote_on_fd__d_n
mov dword [eax], esi
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
call fcn.00454e90
add eax, 0x40
push eax
call fcn.004552a8
add esp, 0x10
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00455413
mov dword [eax], esi
mov eax, edi
call fcn.0040e760
mov dword [ebp - 0xd8], ebx
test eax, eax
je 0x40311a
cmp dword [eax], 0x481fe8
jne 0x40311a
mov edx, dword [eax + 0xc]
push 4
lea ecx, [ebp - 0xd8]
push ecx
push ebx
push 6
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [ebp - 0xd0]
push 0
push eax
lea edx, [ebp - 0x68]
mov ecx, edi
call fcn.00414820
mov edx, dword [ebp - 0xd4]
lea ecx, [ebp - 0x68]
push ecx
push str.connected_to__s
push 0x1000
push edx
call fcn.00455325
mov ecx, dword [ebp - 4]
add esp, 0x18
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00454b91
mov esp, ebp
pop ebp
ret
Function at 0x404700
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x490250]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push str.ANDROID_SDK_HOME
mov dword [ebp - 0x43c], eax
call fcn.00455f07
mov edi, eax
add esp, 4
test edi, edi
jne 0x40474a
lea ecx, [ebp - 0x408]
push ecx
push eax
push eax
push 0x28
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea edi, [ebp - 0x408]
test dword [0x492ce0], 0x400
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
je 0x4047c8
call fcn.00455413
mov esi, dword [eax]
push 0x492cc8
call ebx
push str.get_user_keyfilepath
push str.adb_auth_host.cpp
push str._s::_s__:
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
add esp, 0x10
call fcn.00455413
push edi
push str.home__s_n
mov dword [eax], esi
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
call fcn.00454e90
add eax, 0x40
push eax
call fcn.004552a8
add esp, 0x10
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00455413
mov dword [eax], esi
push str..android
push edi
push 0x47ef80
lea edx, [ebp - 0x208]
push 0x200
push edx
call fcn.00455325
add esp, 0x14
cmp eax, 0x200
jge 0x4048a5
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.004564a8
add esp, 8
test eax, eax
je 0x4048b9
lea edx, [ebp - 0x208]
push edx
call fcn.004562bb
add esp, 4
test eax, eax
jns 0x4048b9
test dword [0x492ce0], 0x400
je 0x4048a5
call fcn.00455413
mov esi, dword [eax]
push 0x492cc8
call ebx
push str.get_user_keyfilepath
push str.adb_auth_host.cpp
push str._s::_s__:
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
add esp, 0x10
call fcn.00455413
mov dword [eax], esi
lea eax, [ebp - 0x208]
push eax
push str.Cannot_mkdir__s
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
call fcn.00454e90
add eax, 0x40
push eax
call fcn.004552a8
add esp, 0x10
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00455413
mov dword [eax], esi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454b91
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x43c]
push str.adbkey
lea ecx, [ebp - 0x208]
push ecx
push 0x47ef80
push edx
push eax
call fcn.00455325
mov ecx, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00454b91
mov esp, ebp
pop ebp
ret
Function at 0x405f50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00457be0
mov eax, dword [0x490250]
xor eax, ebp
mov dword [ebp - 4], eax
test ebx, ebx
js 0x4060a3
push esi
push edi
test byte [0x492ce0], 1
je 0x405fea
call fcn.00455413
mov esi, dword [eax]
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.read_and_dump
push str.commandline.cpp
push str._s::_s__:
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
add esp, 0x10
call fcn.00455413
push ebx
push str.read_and_dump__:_pre_adb_read_fd_d__n
mov dword [eax], esi
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
call fcn.00454e90
add eax, 0x40
push eax
call fcn.004552a8
add esp, 0x10
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00455413
mov dword [eax], esi
mov eax, ebx
call fcn.0040e760
test eax, eax
jne 0x405ffa
or edi, 0xffffffff
jmp 0x406013
mov ecx, dword [eax]
push 0x1000
lea edx, [ebp - 0x1004]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
add esp, 0xc
mov edi, eax
test byte [0x492ce0], 1
je 0x40608d
call fcn.00455413
mov esi, dword [eax]
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.read_and_dump
push str.commandline.cpp
push str._s::_s__:
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
add esp, 0x10
call fcn.00455413
push edi
push ebx
push str.read_and_dump__:_post_adb_read_fd_d_:_len_d_n
mov dword [eax], esi
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
call fcn.00454e90
add eax, 0x40
push eax
call fcn.004552a8
add esp, 0x14
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00455413
mov dword [eax], esi
test edi, edi
je 0x4060a1
jns 0x4060b1
call fcn.00455413
cmp dword [eax], 4
je 0x405f71
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454b91
mov esp, ebp
pop ebp
ret
call fcn.00454e90
add eax, 0x20
push eax
push edi
lea ecx, [ebp - 0x1004]
push 1
push ecx
call fcn.004571ff
call fcn.00454e90
add eax, 0x20
push eax
call fcn.004552a8
add esp, 0x14
jmp 0x405f71

Function at 0x406670
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, str.shell:
call fcn.00405990
mov ebx, eax
test ebx, ebx
jns 0x4066a3
push 0x4a4e20
push str.error:__s_n
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
add esp, 0xc
mov eax, 1
pop ebx
ret
push 8
call fcn.00454d6a
add esp, 4
push eax
push 0
push 0x4063c0
mov dword [eax], ebx
mov dword [eax + 4], 0
call fcn.00456c1a
add esp, 0xc
call fcn.00405f50
xor eax, eax
pop ebx
ret
Function at 0x406720
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00457be0
mov eax, dword [0x490250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push esi
push str.sideload
lea eax, [ebp - 0x1008]
push str._s:_d
push eax
mov edi, edx
mov dword [ebp - 0x1010], str.sideload
call fcn.004568ff
add esp, 0x10
lea ebx, [ebp - 0x1008]
call fcn.00405990
mov ebx, eax
mov dword [ebp - 0x100c], ebx
test ebx, ebx
jns 0x4067a8
push 0x4a4e20
push str.error:__s_n
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454b91
mov esp, ebp
pop ebp
ret
push 4
lea ecx, [ebp - 0x1014]
push ecx
push 0x1001
push 0xffff
push ebx
mov dword [ebp - 0x1014], 0x10000
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x3a
push str.sideload
mov dword [ebp - 0x1014], eax
mov dword [ebp - 0x1018], esi
call fcn.00457280
add esp, 8
test eax, eax
je 0x4067f2
inc eax
mov dword [ebp - 0x1010], eax
test esi, esi
jle 0x40687c
mov ebx, 0x10000
cmp esi, 0x10000
jg 0x406809
mov ebx, esi
mov edx, dword [ebp - 0x100c]
push ebx
push edx
mov eax, edi
call fcn.004150d0
add esp, 8
test eax, eax
jne 0x4068b7
sub esi, ebx
push 0
mov eax, esi
cdq
push 0x64
push edx
push eax
add edi, ebx
call fcn.004587a0
mov ecx, dword [ebp - 0x1018]
push 0
push ecx
push edx
push eax
call fcn.00462a90
mov edx, 0x64
sub edx, eax
mov eax, dword [ebp - 0x1010]
push edx
push eax
push str.sending:__s__4d_______r
call fcn.004559c4
add esp, 0xc
call fcn.00454e90
add eax, 0x20
push eax
call fcn.004552a8
add esp, 4
test esi, esi
jg 0x4067fa
mov ebx, dword [ebp - 0x100c]
push 0x47e3c0
call fcn.004559c4
add esp, 4
push 4
lea ecx, [ebp - 0x1008]
push ecx
push ebx
call fcn.00414e20
add esp, 0xc
test eax, eax
je 0x4068d1
push str._error_reading_response__n
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
add esp, 8
jmp 0x40691b
mov ecx, dword [ebp - 0x100c]
call fcn.004055b0
push 0x4a4e20
push str._failed_to_write_data__s__n
jmp 0x406783
cmp dword [ebp - 0x1008], 0x59414b4f
jne 0x4068f7
mov eax, ebx
call fcn.0040f380
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454b91
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1008]
push edx
push str._error_response__s__n
mov byte [ebp - 0x1004], 0
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
add esp, 0xc
mov eax, ebx
call fcn.0040f380
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.00454b91
mov esp, ebp
pop ebp
ret
Function at 0x40b250
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
lea edi, [ebp - 8]
call fcn.004107d0
test eax, eax
je 0x40b278
push str.cannot_create_service_socket_pair_n
call fcn.004559c4
add esp, 4
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0xc
call fcn.00454d6a
mov esi, eax
add esp, 4
test esi, esi
jne 0x40b293
push str.cannot_allocate_stinfo
call fcn.00401000
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
push esi
push 0
push 0x40b1b0
mov dword [esi], eax
mov dword [esi + 8], ecx
mov dword [esi + 4], edi
call fcn.00456c1a
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40b2e4
push esi
call fcn.00454cf0
mov eax, dword [ebp - 8]
call fcn.0040f380
mov eax, edi
call fcn.0040f380
push str.cannot_create_service_thread_n
call fcn.004559c4
add esp, 8
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
test dword [0x492ce0], 0x200
push ebx
mov ebx, dword [ebp - 8]
je 0x40b365
call fcn.00455413
mov esi, dword [eax]
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.create_service_thread
push str.services.cpp
push str._s::_s__:
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
add esp, 0x10
call fcn.00455413
push edi
push ebx
push str.service_thread_started___d:_d_n
mov dword [eax], esi
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
call fcn.00454e90
add eax, 0x40
push eax
call fcn.004552a8
add esp, 0x14
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00455413
mov dword [eax], esi
mov eax, ebx
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40b370
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push 4
mov edi, eax
push str.tcp:
push edi
or esi, 0xffffffff
call fcn.00454c30
add esp, 0xc
test eax, eax
jne 0x40b42f
lea esi, [edi + 4]
push esi
call fcn.0045531a
add esp, 4
push 0x3a
push esi
mov ebx, eax
call fcn.00455060
mov esi, eax
add esp, 8
test esi, esi
jne 0x40b406
mov ecx, ebx
call fcn.0040f680
mov esi, eax
test esi, esi
js 0x40b46d
call fcn.0040e760
mov dword [esp + 0xc], 1
test eax, eax
je 0x40b46d
cmp dword [eax], 0x481fe8
jne 0x40b46d
mov edx, dword [eax + 0xc]
push 4
lea ecx, [esp + 0x10]
push ecx
push 1
push 6
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4a2d00
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [esi + 1]
call fcn.0040fb00
push 0x4a2d00
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 4
push edi
push str.dns:
call fcn.00454c30
add esp, 0xc
test eax, eax
jne 0x40b46d
add edi, 4
push edi
call fcn.004663e9
add esp, 4
test eax, eax
jne 0x40b45d
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push 0x40b1e0
call fcn.0040b250
add esp, 8
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b5f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x490250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push 0x3a
push esi
call fcn.00455060
push 0x63
mov ebx, eax
lea eax, [ebp - 0x68]
push esi
push eax
call fcn.004558a0
add esp, 0x14
test ebx, ebx
je 0x40b664
mov eax, ebx
sub eax, esi
cmp eax, 0x64
jl 0x40b638
push esi
push str.bad_host_name__s
jmp 0x40b7bc
lea ecx, [ebp - 0xd0]
push ecx
lea edx, [ebx + 1]
push 0x47ea40
push edx
mov byte [ebp + eax - 0x68], 0
call fcn.00454c0e
add esp, 0xc
test eax, eax
jne 0x40b66e
push ebx
push str.bad_port_number__s
jmp 0x40b7bc
mov dword [ebp - 0xd0], 0x15b3
mov eax, dword [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x68]
push ecx
push str._s:_d
lea edx, [ebp - 0xcc]
push 0x64
push edx
call fcn.00455325
mov ebx, dword [ebp - 0xd0]
add esp, 0x14
lea ecx, [ebp - 0x68]
call fcn.0040fb00
mov ebx, eax
test ebx, ebx
jns 0x40b6ce
mov eax, dword [ebp - 0xd0]
push eax
push esi
push str.unable_to_connect_to__s:_d
push 0x1000
push edi
call fcn.00455325
add esp, 0x14
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454b91
mov esp, ebp
pop ebp
ret
test dword [0x492ce0], 0x200
je 0x40b74a
call fcn.00455413
mov esi, dword [eax]
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.connect_device
push str.services.cpp
push str._s::_s__:
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
add esp, 0x10
call fcn.00455413
push ebx
push str.client:_connected_on_remote_on_fd__d_n
mov dword [eax], esi
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
call fcn.00454e90
add eax, 0x40
push eax
call fcn.004552a8
add esp, 0x10
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00455413
mov dword [eax], esi
mov eax, ebx
call fcn.0040e760
mov dword [ebp - 0xd4], 1
test eax, eax
je 0x40b77e
cmp dword [eax], 0x481fe8
jne 0x40b77e
mov edx, dword [eax + 0xc]
push 4
lea ecx, [ebp - 0xd4]
push ecx
push 1
push 6
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [ebp - 0xd0]
push 0
push eax
lea edx, [ebp - 0xcc]
mov ecx, ebx
call fcn.00414820
add esp, 8
test eax, eax
jns 0x40b7b0
mov eax, ebx
call fcn.0040f380
lea ecx, [ebp - 0xcc]
push ecx
push str.already_connected_to__s
jmp 0x40b7bc
lea edx, [ebp - 0xcc]
push edx
push str.connected_to__s
push 0x1000
push edi
call fcn.00455325
mov ecx, dword [ebp - 4]
add esp, 0x10
pop esi
xor ecx, ebp
pop ebx
call fcn.00454b91
mov esp, ebp
pop ebp
ret
Function at 0x40e520
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push str.MobogenieAdbSrvEvent
push 1
push 0
push 0
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x10
push edi
push ebx
call dword [sym.imp.WS2_32.dll_bind]
mov esi, eax
test esi, esi
jns 0x40e5a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2740
jne 0x40e5a3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 8]
cmp ecx, 0x3a980
jae 0x40e5a3
mov edx, eax
sub edx, dword [ebp - 4]
cmp edx, 0x1388
jbe 0x40e588
mov dword [ebp - 4], eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x10
push edi
push ebx
call dword [sym.imp.WS2_32.dll_bind]
mov esi, eax
test esi, esi
js 0x40e558
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e5b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push edi
push 0
push 0
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 4], edi
cmp edi, 0xffffffff
jne 0x40e5e1
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x40e73c
lea ecx, [esi + 1]
push ecx
call fcn.00454d6a
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40e693
test byte [0x492ce0], 0x80
je 0x40e73a
call fcn.00455413
mov edi, dword [eax]
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.load_file
push str.sysdeps_win32.cpp
push str._s::_s__:
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
add esp, 0x10
call fcn.00455413
push esi
push str.load_file:_could_not_allocate__ld_bytes_n
mov dword [eax], edi
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
call fcn.00454e90
add eax, 0x40
push eax
call fcn.004552a8
add esp, 0x10
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00455413
mov dword [eax], edi
mov edi, dword [ebp - 4]
jmp 0x40e73a
push 0
lea edx, [ebp - 8]
push edx
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40e6af
cmp dword [ebp - 8], esi
je 0x40e73c
test byte [0x492ce0], 0x80
je 0x40e72f
call fcn.00455413
mov edi, dword [eax]
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.load_file
push str.sysdeps_win32.cpp
push str._s::_s__:
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
add esp, 0x10
call fcn.00455413
mov dword [eax], edi
mov eax, dword [ebp + 8]
push eax
push esi
push str.load_file:_could_not_read__ld_bytes_from__s_n
call fcn.00454e90
add eax, 0x40
push eax
call fcn.00455c4a
call fcn.00454e90
add eax, 0x40
push eax
call fcn.004552a8
add esp, 0x14
push 0x492cc8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00455413
mov dword [eax], edi
mov edi, dword [ebp - 4]
push ebx
call fcn.00454cf0
add esp, 4
xor ebx, ebx
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], esi
pop esi
mov eax, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40f610
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x490250]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4a2d30], 0
jne 0x40f663
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40f64c
push str.adb:_could_not_initialize_Winsock_n
call fcn.00401000
push 0x40f600
call fcn.00455888
add esp, 4
mov dword [0x4a2d30], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454b91
mov esp, ebp
pop ebp
ret