joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x3c
push 0x401450
call section..text
pop eax
pop edx
push 1
push 0x401460
call sub.KERNEL32.dll_SetConsoleCtrlHandler
pop esi
pop eax
call fcn.00404c90
mov dword [0x4c8008], 1
call fcn.00412990
call fcn.00411c00
sub esp, 0xc
push 0x15b3
call fcn.00406f10
call fcn.0040cc10
add esp, 0xc
mov ebx, dword [ebp + 0xc]
push ebx
lea ebx, [ebp - 0x2a]
push 0x1e
push ebx
call fcn.004014c0
xor ecx, ecx
mov edx, str.smartsocket
mov eax, ebx
call fcn.00401d50
add esp, 0x10
test eax, eax
jne 0x403c40
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x403c16
test byte [0x4dcfc8], 1
je 0x403c03
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.adb_main
push str.system_core_adb_adb.c
push 0x49d056
push ebx
call fcn.004013a0
call sub.msvcrt.dll__errno
mov dword [eax], esi
pop eax
pop edx
push str.Event_loop_starting_n
push ebx
call fcn.004013a0
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
call fcn.00412fa0
call fcn.004118e0
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
sub esp, 0xc
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
lea edx, [ebp - 0xc]
push 0
push edx
push 3
push 0x49d7bf
push eax
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
call fcn.00401bc0
jmp 0x403b93
sub esp, 0xc
push 1
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
Function at 0x406ce0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
push str.ADBHOST
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x406dd0
mov edx, dword [ebp + 0xc]
push ecx
push 1
push edx
push eax
call fcn.00415cb0
add esp, 0x10
mov edi, eax
test eax, eax
js 0x406dd0
test byte [0x4dcfc8], 8
jne 0x406d61
sub esp, 0xc
lea ebx, [ebp - 0x4c]
push edi
call fcn.00414c00
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x49e5c2
push str._s_d
push 0x40
push ebx
call fcn.00495c60
add esp, 0x20
mov eax, dword [ebp + 0xc]
push 1
push eax
push ebx
push edi
call fcn.00405820
xor eax, eax
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.local_connect_arbitrary_ports
push str.system_core_adb_transport_local.c
push 0x49e592
push ebx
call fcn.00406ca0
call sub.msvcrt.dll__errno
add esp, 0xc
mov dword [eax], esi
push edi
push str.client:_connected_on_remote_on_fd__d_n
push ebx
call fcn.00406ca0
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
jmp 0x406d21
push eax
push eax
mov eax, dword [ebp + 0xc]
push 1
push eax
call fcn.00416070
mov edi, eax
add esp, 0x10
or eax, 0xffffffff
test edi, edi
jns 0x406d18
jmp 0x406d59

Function at 0x406f10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, 0x407280
mov ebx, dword [0x4c8008]
test ebx, ebx
jne 0x406f2d
mov esi, 0x407010
test byte [0x4dcfc8], 8
jne 0x406f80
push edi
mov ebx, dword [ebp + 8]
push ebx
push 0
push esi
call sub.msvcrt.dll__beginthread
add esp, 0x10
inc eax
je 0x406f51
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [0x4c8008]
mov eax, 0x49e5d1
test ecx, ecx
jne 0x406f65
mov eax, 0x49e5d8
push edx
push edx
push eax
push str.cannot_create_local_socket__s_thread
call fcn.00402820
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
sub esp, 0xc
mov edi, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.local_init
push str.system_core_adb_transport_local.c
push 0x49e592
push ebx
call fcn.00406ca0
call sub.msvcrt.dll__errno
add esp, 0x10
mov dword [eax], edi
mov eax, 0x49e5d1
mov ecx, dword [0x4c8008]
test ecx, ecx
jne 0x406fd3
mov eax, 0x49e5d8
push edx
push eax
push str.transport:_local__s_init_n
push ebx
call fcn.00406ca0
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], edi
jmp 0x406f36
Function at 0x407f00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1008
call fcn.00495550
mov eax, dword [ebp - 0x10]
mov esi, eax
test eax, eax
js 0x40809a
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [ebp - 0x1014], eax
lea esi, [esi]
test byte [0x4dcfc8], 1
jne 0x407fa1
lea esi, [esi]
lea edx, [ebp - 0x100c]
push eax
push 0x1000
push edx
push esi
call fcn.00413dd0
add esp, 0x10
mov edi, eax
test byte [0x4dcfc8], 1
jne 0x408017
cmp edi, 0
je 0x40809a
jl 0x4080a2
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [ebp - 0x100c]
add ebx, 0x20
push ebx
push edi
push 1
push eax
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
add esp, 0x10
test byte [0x4dcfc8], 1
je 0x407f40
call sub.msvcrt.dll__errno
sub esp, 0xc
mov ebx, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
add esp, 0xc
push str.read_and_dump
push str.system_core_adb_commandline.c
push 0x4a06d0
mov eax, dword [ebp - 0x1014]
push eax
call fcn.00407d20
call sub.msvcrt.dll__errno
add esp, 0xc
mov dword [eax], ebx
push esi
push str.read_and_dump__:_pre_adb_read_fd_d__n
mov eax, dword [ebp - 0x1014]
push eax
call fcn.00407d20
pop eax
mov eax, dword [ebp - 0x1014]
push eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], ebx
jmp 0x407f40
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
mov dword [ebp - 0x1010], eax
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.read_and_dump
push str.system_core_adb_commandline.c
push 0x4a06d0
push ebx
call fcn.00407d20
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x1010]
mov dword [eax], edx
push edi
push esi
push str.read_and_dump__:_post_adb_read_fd_d_:_len_d_n
push ebx
call fcn.00407d20
add esp, 0x14
push ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x1010]
cmp edi, 0
mov dword [eax], edx
jne 0x407f6e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x407f30
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408840
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
push str.shell:
call fcn.0040b570
add esp, 0x10
mov ebx, eax
test eax, eax
js 0x408890
sub esp, 0xc
push 8
call sub.msvcrt.dll_malloc
add esp, 0xc
mov dword [eax], ebx
mov dword [eax + 4], 0
push eax
push 0
push 0x4088c0
call sub.msvcrt.dll__beginthread
mov eax, ebx
call fcn.00407f00
xor eax, eax
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
call fcn.0040aef0
push edx
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x4a0867
add eax, 0x40
push eax
call fcn.00407d20
mov eax, 1
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40bbb0
Capabilities:
Create directory
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x248
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x244], edx
push 0x4a16dc
call sub.msvcrt.dll_getenv
add esp, 0x10
mov edi, eax
test eax, eax
je 0x40bce1
test byte [0x4dcfc9], 4
jne 0x40bc73
sub esp, 0xc
push 0x4a1725
push edi
lea edi, [ebp - 0x133]
push 0x4a172e
push 0x103
push edi
call fcn.00495c60
add esp, 0x20
cmp eax, 0x102
jle 0x40bc20
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x30]
push esi
push esi
push eax
push edi
call sub.msvcrt.dll__stat
add esp, 0x10
test eax, eax
je 0x40bc47
sub esp, 0xc
push edi
call sub.msvcrt.dll__mkdir
add esp, 0x10
test eax, eax
js 0x40bd02
sub esp, 0xc
push str.adbkey
push edi
push 0x4a172e
mov ebx, dword [ebp - 0x244]
push ebx
mov ecx, dword [ebp - 0x240]
push ecx
call fcn.00495c60
add esp, 0x20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.get_user_keyfilepath
push str.system_core_adb_adb_auth_host.c
push 0x4a1710
push ebx
call fcn.0040bb90
call sub.msvcrt.dll__errno
add esp, 0xc
mov dword [eax], esi
push edi
push str.home__s_n
push ebx
call fcn.0040bb90
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
jmp 0x40bbec
sub esp, 0xc
lea ebx, [ebp - 0x236]
mov edi, ebx
push ebx
push 0
push 0
push 0x28
push 0
call sub.SHELL32.DLL_SHGetFolderPathA
add esp, 0xc
jmp 0x40bbdf
test byte [0x4dcfc9], 4
je 0x40bc15
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.get_user_keyfilepath
push str.system_core_adb_adb_auth_host.c
push 0x4a1710
push ebx
call fcn.0040bb90
call sub.msvcrt.dll__errno
add esp, 0xc
mov dword [eax], esi
push edi
push str.Cannot_mkdir__s
push ebx
call fcn.0040bb90
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
or eax, 0xffffffff
jmp 0x40bc18
Function at 0x40fae0
Capabilities:
Create thread

Disassembly:
push ebp
mov ecx, 4
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, str.tcp:
mov ebx, dword [ebp + 8]
cld
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40fb55
sub esp, 0xc
add ebx, 4
push ebx
call sub.msvcrt.dll_atoi
pop ecx
pop edi
push 0x3a
mov esi, eax
push ebx
call sub.msvcrt.dll_strchr
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x40fb97
sub esp, 0xc
push 0x4dd058
call sub.KERNEL32.dll_EnterCriticalSection
push eax
push eax
lea eax, [ebx + 1]
push 1
push esi
push eax
call fcn.00415cb0
add esp, 0x14
mov esi, eax
push 0x4dd058
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
cld
mov esi, str.dns:
mov ecx, 4
mov edi, ebx
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
or esi, 0xffffffff
cmp dl, al
jne 0x40fb4b
sub esp, 0xc
lea eax, [ebx + 4]
push eax
call sub.msvcrt.dll__strdup
add esp, 0x10
test eax, eax
je 0x40fb4b
lea esp, [ebp - 0xc]
mov edx, eax
mov eax, 0x40fa60
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0040f7e0
push edx
push edx
push 1
push esi
call fcn.00416070
add esp, 0x10
mov esi, eax
test eax, eax
js 0x40fb4b
sub esp, 0xc
push eax
call fcn.00414c00
add esp, 0x10
jmp 0x40fb4b
Function at 0x411c00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
push 0x412070
call sub.msvcrt.dll__beginthread
add esp, 0x10
inc eax
je 0x411c20
leave
ret
sub esp, 0xc
push str.cannot_create_input_thread
call fcn.00402820
add esp, 0x10
leave
ret

Function at 0x412910
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x120
push str.ANDROID_SDK_HOME
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x412946
push eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push str._s_s_s
push eax
push ebx
call fcn.004128d0
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
sub esp, 0xc
lea ebx, [ebp - 0x108]
push ebx
push 0
push 0
push 0x28
push 0
call sub.SHELL32.DLL_SHGetFolderPathA
add esp, 0xc
push ebx
jmp 0x41292c
Function at 0x414c00
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
call fcn.00413ad0
mov edx, eax
test eax, eax
je 0x414c1c
cmp dword [eax], 0x4a3570
je 0x414c20
leave
ret
sub esp, 0xc
lea eax, [ebp - 4]
push 4
push eax
push 1
push 6
mov eax, dword [edx + 0xc]
push eax
call sub.WS2_32.DLL_setsockopt
add esp, 0xc
leave
ret

Function at 0x415130
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x4d9f48]
test eax, eax
je 0x415144
leave
ret
lea eax, [ebp - 0x190]
push ecx
push ecx
push eax
push 0x202
call sub.WS2_32.DLL_WSAStartup
pop ecx
test eax, eax
pop edx
jne 0x415180
sub esp, 0xc
push 0x4151a0
call section..text
mov dword [0x4d9f48], 1
add esp, 0x10
leave
ret
sub esp, 0xc
push str.adb:_could_not_initialize_Winsock_n
call fcn.00401470
add esp, 0x10
jmp 0x41515d
Function at 0x415230
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [ebp + 8]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push esi
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
pop ebx
xor eax, eax
cmp esi, 0xffffffff
je 0x415282
push ecx
push ecx
push 0
push esi
call sub.KERNEL32.dll_GetFileSize
xor ebx, ebx
mov edi, eax
pop eax
test edi, edi
pop edx
jne 0x415290
sub esp, 0xc
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [eax], edi
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
lea eax, [edi + 1]
push eax
call sub.msvcrt.dll_malloc
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x4152e1
sub esp, 0xc
lea eax, [ebp - 0x10]
push 0
push eax
push edi
push ebx
push esi
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x4152c2
cmp edi, dword [ebp - 0x10]
je 0x41526f
cmp byte [0x4dcfc8], 0
js 0x41536e
sub esp, 0xc
xor edi, edi
push ebx
call sub.msvcrt.dll_free
xor ebx, ebx
add esp, 0x10
jmp 0x41526f
cmp byte [0x4dcfc8], 0
js 0x4152ee
xor edi, edi
jmp 0x41526f
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
push 0x4dcfd8
mov dword [ebp - 0x28], eax
call sub.KERNEL32.dll_EnterCriticalSection
mov eax, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add eax, 0x40
push str.load_file
mov dword [ebp - 0x2c], eax
push str.system_core_adb_sysdeps_win32.c
push str._s::_s__:
push eax
call fcn.00412f80
call sub.msvcrt.dll__errno
add esp, 0xc
mov edx, dword [ebp - 0x28]
mov dword [eax], edx
push edi
mov edi, dword [ebp - 0x2c]
push str.load_file:_could_not_allocate__ld_bytes_n
push edi
call fcn.00412f80
pop ecx
mov edx, dword [ebp - 0x2c]
push edx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
xor edi, edi
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x28]
mov dword [eax], edx
jmp 0x41526f
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
push 0x4dcfd8
mov dword [ebp - 0x24], eax
call sub.KERNEL32.dll_EnterCriticalSection
mov eax, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add eax, 0x40
push str.load_file
mov dword [ebp - 0x20], eax
push str.system_core_adb_sysdeps_win32.c
push str._s::_s__:
push eax
call fcn.00412f80
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x24]
mov dword [eax], edx
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x20]
push edi
push str.load_file:_could_not_read__ld_bytes_from__s_n
push eax
call fcn.00412f80
add esp, 0x14
mov eax, dword [ebp - 0x20]
push eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x24]
mov dword [eax], edx
jmp 0x4152cf
Function at 0x415ad0
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov eax, 0x4a3570
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 0xc]
call fcn.004139b0
mov esi, eax
or eax, 0xffffffff
test esi, esi
je 0x415bd4
mov eax, dword [0x4d9f48]
test eax, eax
je 0x415be0
sub esp, 0xc
mov eax, dword [ebp + 8]
and eax, 0xffff
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov word [ebp - 0x20], 2
push eax
call sub.WS2_32.DLL_htons
mov word [ebp - 0x1e], ax
push 0
call sub.WS2_32.DLL_htonl
mov dword [ebp - 0x1c], eax
push eax
push eax
push 0
push edi
push 2
call sub.WS2_32.DLL_socket
add esp, 0x14
mov ebx, eax
cmp eax, 0xffffffff
je 0x415c99
sub esp, 0xc
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push 4
push eax
push 0xfffffffffffffffb
push 0xffff
push ebx
call sub.WS2_32.DLL_setsockopt
push eax
push eax
lea eax, [ebp - 0x20]
push 0x10
push eax
push ebx
call sub.WS2_32.DLL_bind
add esp, 0x14
test eax, eax
js 0x415c99
mov edx, str.udp:
cmp edi, 1
je 0x415c80
push eax
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, esi
push edx
call fcn.00412a70
push eax
lea eax, [esi + 0x18]
push str._d_any_server:_s_d_
push 0x20
push eax
call fcn.00495c60
add esp, 0x20
cmp byte [0x4dcfc8], 0
js 0x415bf0
mov eax, esi
call fcn.00412a70
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00415130
jmp 0x415b00
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
push 0x4dcfd8
mov dword [ebp - 0x30], eax
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.socket_inaddr_any_server
push str.system_core_adb_sysdeps_win32.c
push str._s::_s__:
push ebx
call fcn.00412f80
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x30]
mov dword [eax], edx
mov eax, esi
call fcn.00412a70
add esp, 0x10
mov edx, 0x4a31a4
dec edi
je 0x415ca8
sub esp, 0xc
mov edi, dword [ebp + 8]
push eax
push edx
push edi
push str.socket_inaddr_server:_port__d_type__s___fd__d_n
push ebx
call fcn.00412f80
add esp, 0x14
push ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x30]
mov dword [eax], edx
jmp 0x415bcd
push eax
push eax
push 4
push ebx
call sub.WS2_32.DLL_listen
pop edx
test eax, eax
pop ecx
mov edx, 0x4a318a
jns 0x415ba2
mov eax, esi
call fcn.00412ac0
or eax, 0xffffffff
jmp 0x415bd4
mov edx, 0x4a31a8
jmp 0x415c44
Function at 0x415cb0
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov eax, 0x4a3570
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 0x10]
call fcn.004139b0
mov esi, eax
or eax, 0xffffffff
test esi, esi
je 0x415dbc
mov edx, dword [0x4d9f48]
test edx, edx
je 0x415dc4
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
call sub.WS2_32.DLL_gethostbyname
add esp, 0xc
mov ebx, eax
test eax, eax
je 0x415e73
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, dword [eax + 8]
sub esp, 0xc
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0xc]
and eax, 0xffff
push eax
call sub.WS2_32.DLL_htons
mov word [ebp - 0x1a], ax
sub esp, 8
movsx eax, word [ebx + 0xa]
mov edx, dword [ebx + 0xc]
push eax
lea ecx, [ebp - 0x18]
mov eax, dword [edx]
push eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0x1c
push 0
push edi
movsx eax, word [ebx + 8]
push eax
call sub.WS2_32.DLL_socket
pop edx
cmp eax, 0xffffffff
je 0x415e73
mov dword [esi + 0xc], eax
lea edx, [ebp - 0x1c]
push ebx
push 0x10
push edx
push eax
call sub.WS2_32.DLL_connect
pop ecx
test eax, eax
js 0x415e73
mov eax, str.udp:
cmp edi, 1
je 0x415e62
mov ebx, dword [ebp + 0xc]
push edx
push edx
push ebx
push eax
mov eax, esi
call fcn.00412a70
push eax
lea eax, [esi + 0x18]
push str._d_net_client:_s_d_
push 0x20
push eax
call fcn.00495c60
add esp, 0x20
cmp byte [0x4dcfc8], 0
js 0x415dd0
mov eax, esi
call fcn.00412a70
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00415130
jmp 0x415ce1
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
push 0x4dcfd8
mov dword [ebp - 0x20], eax
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.socket_network_client
push str.system_core_adb_sysdeps_win32.c
push str._s::_s__:
push ebx
call fcn.00412f80
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x20]
mov dword [eax], edx
mov eax, esi
call fcn.00412a70
add esp, 0x10
mov edx, 0x4a31a4
dec edi
je 0x415e6c
push ecx
push ecx
push eax
mov eax, dword [ebp + 0xc]
push edx
push eax
mov eax, dword [ebp + 8]
push eax
push str.socket_network_client:_host__s_port__d_type__s___fd__d_n
push ebx
call fcn.00412f80
add esp, 0x14
push ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x20]
mov dword [eax], edx
jmp 0x415db5
mov eax, 0x4a318a
jmp 0x415d8a
mov edx, 0x4a31a8
jmp 0x415e24
mov eax, esi
call fcn.00412ac0
or eax, 0xffffffff
jmp 0x415dbc
Function at 0x415e90
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov eax, 0x4a3570
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
call fcn.004139b0
mov ebx, eax
test eax, eax
jne 0x415eb4
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x4d9f48]
test eax, eax
je 0x415fa0
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], 0
and eax, 0xffff
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov word [ebp - 0x20], 2
push eax
call sub.WS2_32.DLL_htons
mov word [ebp - 0x1e], ax
lea edi, [ebp - 0x20]
push 0x7f000001
call sub.WS2_32.DLL_htonl
mov dword [ebp - 0x1c], eax
push eax
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
push 2
call sub.WS2_32.DLL_socket
add esp, 0x14
mov esi, eax
cmp eax, 0xffffffff
je 0x415ea9
sub esp, 0xc
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x10]
push 4
push eax
push 0xfffffffffffffffb
push 0xffff
push esi
call sub.WS2_32.DLL_setsockopt
push eax
push eax
push 0x10
push edi
push esi
call sub.WS2_32.DLL_bind
add esp, 0x14
test eax, eax
js 0x41604c
mov edx, str.udp:
cmp dword [ebp + 0xc], 1
je 0x416033
push edi
push edi
mov esi, dword [ebp + 8]
mov eax, ebx
push esi
push edx
call fcn.00412a70
push eax
lea eax, [ebx + 0x18]
push str._d_lo_server:_s_d_
push 0x20
push eax
call fcn.00495c60
add esp, 0x20
cmp byte [0x4dcfc8], 0
js 0x415faa
mov eax, ebx
call fcn.00412a70
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00415130
jmp 0x415ec1
call sub.msvcrt.dll__errno
sub esp, 0xc
mov edi, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov esi, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add esi, 0x40
push str.socket_loopback_server
push str.system_core_adb_sysdeps_win32.c
push str._s::_s__:
push esi
call fcn.00412f80
call sub.msvcrt.dll__errno
mov dword [eax], edi
mov eax, ebx
call fcn.00412a70
add esp, 0x10
mov edx, 0x4a31a4
cmp dword [ebp + 0xc], 1
je 0x416060
sub esp, 0xc
push eax
push edx
mov ecx, dword [ebp + 8]
push ecx
push str.socket_loopback_server:_port__d_type__s___fd__d_n
push esi
call fcn.00412f80
add esp, 0x14
push esi
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], edi
jmp 0x415f91
push edi
push edi
push 4
push esi
call sub.WS2_32.DLL_listen
pop edx
test eax, eax
pop ecx
mov edx, 0x4a318a
jns 0x415f66
mov eax, ebx
call fcn.00412ac0
or eax, 0xffffffff
jmp 0x415eac
mov edx, 0x4a31a8
jmp 0x415ffb