joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40156a
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, edx
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], edi
call fcn.00401543
push 3
pop ecx
cmp edi, ecx
jb 0x4015d6
mov eax, edi
xor edx, edx
div ecx
mov dword [ebp - 8], eax
movzx ecx, byte [ebx]
lea edi, [esi + 3]
movzx eax, byte [ebx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 2]
shl ecx, 8
push 4
add ecx, eax
pop edx
mov eax, ecx
shr ecx, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [edi], al
dec edi
dec edx
jne 0x4015b0
mov edi, dword [ebp - 4]
add ebx, 3
sub edi, 3
add esi, 4
dec dword [ebp - 8]
mov dword [ebp - 4], edi
jne 0x401595
test edi, edi
je 0x40161f
mov cl, byte [ebx]
cmp edi, 1
jbe 0x4015e7
movzx eax, byte [ebx + 1]
jmp 0x4015e9
xor eax, eax
movzx ecx, cl
lea edx, [esi + 3]
shl ecx, 8
movzx eax, al
add ecx, eax
push 4
shl ecx, 8
pop ebx
mov eax, ecx
shr ecx, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [edx], al
dec edx
dec ebx
jne 0x4015fd
mov byte [esi + 3], 0x3d
cmp edi, 1
jne 0x40161c
mov byte [esi + 2], 0x3d
add esi, 4
sub esi, dword [ebp + 8]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0x33323130
mov ecx, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0xc], 0x37363534
lea eax, [esi + edx]
mov dword [ebp - 8], 0x42413938
mov edi, eax
mov dword [ebp - 4], 0x46454443
sub edi, esi
xor edx, edx
cmp esi, eax
cmova edi, ebx
test edi, edi
je 0x401713
mov al, byte [esi]
cmp al, 0x30
jb 0x4016c8
cmp al, 0x39
jbe 0x40170a
cmp al, 0x61
jb 0x4016d0
cmp al, 0x7a
jbe 0x40170a
cmp al, 0x41
jb 0x4016d8
cmp al, 0x5a
jbe 0x40170a
cmp al, 0x7e
je 0x40170a
cmp al, 0x2d
je 0x40170a
cmp al, 0x2e
je 0x40170a
cmp al, 0x5f
je 0x40170a
mov byte [ecx], 0x25
movzx eax, byte [esi]
shr eax, 4
mov al, byte [ebp + eax - 0x10]
mov byte [ecx + 1], al
movzx eax, byte [esi]
and eax, 0xf
mov al, byte [ebp + eax - 0x10]
mov byte [ecx + 2], al
add ecx, 3
jmp 0x40170d
mov byte [ecx], al
inc ecx
inc esi
inc edx
cmp edx, edi
jb 0x4016be
sub ecx, dword [ebp + 8]
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401827
Capabilities:
Parse pe header

Disassembly:
cmp edx, 0x40
jae 0x40182f
xor eax, eax
ret
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40182c
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40182c
mov edx, 0x10b
xor ecx, ecx
cmp word [eax + 0x18], dx
cmovne eax, ecx
ret
Function at 0x4019ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
push ebx
push esi
push edi
mov edi, dword [eax]
xor edi, 0x47e6bc7e
mov dword [ebp - 4], eax
mov eax, edi
mov dword [ebp - 0x10], edi
and eax, 3
jne 0x4019d0
lea esi, [edi + 4]
jmp 0x4019d7
mov esi, edi
sub esi, eax
add esi, 4
mov ecx, esi
call fcn.004014f2
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x401a49
mov eax, dword [ebp - 4]
mov edx, ebx
and dword [ebp - 4], 0
add eax, 4
and dword [ebp - 0xc], 0
shr esi, 2
lea ecx, [eax + esi*4]
mov esi, ecx
sub esi, eax
add esi, 3
shr esi, 2
cmp eax, ecx
cmova esi, dword [ebp - 4]
test esi, esi
je 0x401a45
mov ebx, dword [ebp - 0xc]
mov edi, eax
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, 0x47e6bc7e
mov byte [edx], cl
mov eax, ecx
shr eax, 8
lea edx, [edx + 4]
shr ecx, 0x10
mov byte [edx - 3], al
mov byte [edx - 2], cl
shr ecx, 8
inc ebx
mov byte [edx - 1], cl
cmp ebx, esi
jb 0x401a16
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
mov byte [ebx + edi], 0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401a52
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, edx
push esi
push edi
mov dword [ebp - 0x10], eax
mov edi, dword [ebx]
xor edi, eax
mov eax, edi
mov dword [ebp - 0x14], edi
and eax, 3
jne 0x401a75
lea esi, [edi + 4]
jmp 0x401a7c
mov esi, edi
sub esi, eax
add esi, 4
lea ecx, [esi + esi]
call fcn.004014f2
mov edx, eax
mov dword [ebp - 0x18], edx
test edx, edx
je 0x401b00
and dword [ebp - 8], 0
lea eax, [ebx + 4]
and dword [ebp - 4], 0
shr esi, 2
lea ecx, [eax + esi*4]
mov esi, edx
mov ebx, ecx
sub ebx, eax
add ebx, 3
shr ebx, 2
cmp eax, ecx
cmova ebx, dword [ebp - 8]
test ebx, ebx
je 0x401afa
mov edx, dword [ebp - 0x10]
mov edi, eax
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, edx
movzx eax, cl
mov word [esi], ax
mov eax, ecx
shr eax, 8
lea esi, [esi + 8]
movzx eax, al
mov word [esi - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [esi - 4], ax
shr ecx, 8
movzx eax, cl
mov word [esi - 2], ax
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, ebx
jb 0x401ab9
mov edi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
xor eax, eax
mov word [edx + edi*2], ax
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4019c0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], str.ADB_TRACE
call sub.msvcrt.dll_getenv
test eax, eax
mov edi, eax
je 0x401a80
movzx eax, byte [eax]
test al, al
je 0x401a80
mov dword [esp + 4], str.__:_
mov dword [esp], edi
call sub.msvcrt.dll_strpbrk
test eax, eax
mov dword [esp + 0xc], eax
je 0x401a88
mov esi, dword [esp + 0xc]
mov eax, 1
mov ebx, 0x4c0049
xor ebp, ebp
sub esi, edi
jmp 0x401a2e
add ebp, 1
mov ebx, dword [ebp*8 + 0x4c0820]
test ebx, ebx
je 0x401a5e
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
cmp esi, eax
jne 0x401a18
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x401a18
mov ecx, dword [ebp*8 + 0x4c0824]
test ecx, ecx
je 0x401a9b
mov eax, 1
shl eax, cl
or dword [0x504120], eax
mov edx, dword [esp + 0xc]
xor eax, eax
cmp byte [edx], 0
je 0x401a74
movzx eax, byte [edx + 1]
lea edx, [edx + 1]
mov dword [esp + 0xc], edx
test al, al
mov edi, dword [esp + 0xc]
jne 0x4019e8
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call sub.msvcrt.dll_strlen
add eax, edi
mov dword [esp + 0xc], eax
jmp 0x401a04
mov dword [0x504120], 0xffffffff
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4030e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x120
lea ebx, [ebp - 0x10c]
mov dword [esp + 4], ebx
mov dword [esp], 0xfc
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, ebx
sub esp, 8
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x403107
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
add al, al
sbb edx, 3
mov dword [edx], 0x2e626461
mov dword [edx + 4], 0x676f6c
mov dword [esp + 4], 0x4c03ea
mov dword [esp], 0x4c03ed
call sub.msvcrt.dll_fopen
test eax, eax
mov esi, eax
je 0x40318f
mov edx, dword [esi]
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [eax], edx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov edx, dword [esi + 8]
mov dword [eax + 8], edx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [esi + 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [esi + 0x14]
mov dword [eax + 0x14], edx
mov edx, dword [esi + 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [esi + 0x1c]
mov dword [eax + 0x1c], edx
mov dword [esp], ebx
mov dword [esp + 4], 0x4c03f1
call sub.msvcrt.dll_fopen
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
test eax, eax
mov ebx, eax
cmove ebx, esi
mov dword [esp], ebx
call sub.msvcrt.dll_setvbuf
mov edx, dword [ebx]
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [eax + 0x20], edx
mov edx, dword [ebx + 4]
mov dword [eax + 0x24], edx
mov edx, dword [ebx + 8]
mov dword [eax + 0x28], edx
mov edx, dword [ebx + 0xc]
mov dword [eax + 0x2c], edx
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x30], edx
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x34], edx
mov edx, dword [ebx + 0x18]
mov dword [eax + 0x38], edx
mov edx, dword [ebx + 0x1c]
mov dword [eax + 0x3c], edx
mov edx, dword [ebx]
mov dword [eax + 0x40], edx
mov edx, dword [ebx + 4]
mov dword [eax + 0x44], edx
mov edx, dword [ebx + 8]
mov dword [eax + 0x48], edx
mov edx, dword [ebx + 0xc]
mov dword [eax + 0x4c], edx
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x50], edx
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x54], edx
mov edx, dword [ebx + 0x18]
mov dword [eax + 0x58], edx
mov edx, dword [ebx + 0x1c]
mov dword [eax + 0x5c], edx
call sub.msvcrt.dll__getpid
mov dword [esp + 4], str.____adb_starting__pid__d______n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00401520
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4035e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x50
mov dword [esp], 0x4016e0
lea ebx, [ebp - 0x26]
call fcn.004afd70
mov dword [esp + 4], 1
mov dword [esp], 0x401510
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
sub esp, 8
call fcn.00406290
mov dword [0x4ef024], 1
call fcn.00416c80
call fcn.00415b10
mov dword [esp], 0x15b3
call fcn.00408450
call fcn.0040fe30
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], str.tcp:_d
mov dword [esp + 4], 0x1e
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.00401550
xor ecx, ecx
mov edx, str.smartsocket
mov dword [esp], 0
mov eax, ebx
call fcn.00402ef0
test eax, eax
jne 0x403767
mov eax, dword [ebp + 8]
test eax, eax
jne 0x403722
test byte [0x504120], 1
je 0x40370f
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov esi, dword [eax]
mov dword [esp], 0x504108
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
sub esp, 4
mov dword [esp + 0xc], str.adb_main
mov dword [esp + 8], str.system_core_adb_adb.c
mov dword [esp + 4], 0x4c008e
mov dword [esp], eax
call fcn.00401520
call ebx
mov dword [eax], esi
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.Event_loop_starting_n
add eax, 0x40
mov dword [esp], eax
call fcn.00401520
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x504108
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
call ebx
mov dword [eax], esi
call fcn.0041b350
call fcn.00415b50
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
mov dword [esp], 0xfffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [ebp - 0x2c]
sub esp, 4
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x4c04be
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
call fcn.004030e0
jmp 0x403680
mov dword [esp], 1
call sub.msvcrt.dll_exit
lea esi, [esi]
lea edi, [edi]
Function at 0x408220
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
mov esi, dword [ebp + 0xc]
mov dword [esp], str.ADBHOST
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4082b3
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0041a130
test eax, eax
mov ebx, eax
js 0x4082b3
test byte [0x504120], 8
jne 0x4082d7
mov dword [esp], ebx
lea edi, [ebp - 0x58]
call fcn.0041aa60
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0x4c16d2
mov dword [esp + 8], str._s_d
mov dword [esp + 4], 0x40
mov dword [esp + 0x10], eax
mov dword [esp], edi
call fcn.004081f0
mov dword [esp + 0xc], 1
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00406e30
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 1
mov dword [esp], esi
call fcn.00419a80
mov ebx, eax
mov eax, 0xffffffff
test ebx, ebx
js 0x4082ab
test byte [0x504120], 8
je 0x40825f
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
mov eax, dword [eax]
mov dword [esp], 0x504108
mov dword [ebp - 0x5c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [ecx + 0x40]
sub esp, 4
mov dword [esp + 0xc], str.local_connect_arbitrary_ports
mov dword [esp + 8], str.system_core_adb_transport_local.c
mov dword [esp + 4], 0x4c1542
mov dword [esp], eax
call fcn.00407b10
call edi
mov edx, dword [ebp - 0x5c]
mov dword [eax], edx
mov ecx, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x4c16ac
lea eax, [ecx + 0x40]
mov dword [esp], eax
call fcn.00407b10
mov ecx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [ecx + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x504108
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
call edi
mov edx, dword [ebp - 0x5c]
mov dword [eax], edx
jmp 0x40825f
Function at 0x408450
Capabilities:
Create thread

Disassembly:
push ebp
mov eax, 0x407b40
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 0x408390
sub esp, 0x1c
mov esi, dword [0x4ef024]
test esi, esi
cmove ebx, eax
test byte [0x504120], 8
jne 0x4084a0
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.msvcrt.dll__beginthread]
cmp eax, 0xffffffff
je 0x408540
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
mov edi, dword [eax]
mov dword [esp], 0x504108
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
sub esp, 4
mov dword [esp + 0xc], str.local_init
mov dword [esp + 8], str.system_core_adb_transport_local.c
mov dword [esp + 4], 0x4c1542
mov dword [esp], eax
call fcn.00407b10
call esi
mov edx, 0x4c170f
mov dword [eax], edi
mov ecx, dword [0x4ef024]
mov eax, 0x4c1708
mov dword [esp + 4], str.transport:_local__s_init_n
test ecx, ecx
cmove eax, edx
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00407b10
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x504108
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
call esi
mov dword [eax], edi
jmp 0x408477
mov edx, dword [0x4ef024]
mov eax, 0x4c1708
mov dword [esp], str.cannot_create_local_socket__s_thread
test edx, edx
mov edx, 0x4c170f
cmove eax, edx
mov dword [esp + 4], eax
call fcn.00401940
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x409130
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1028
call fcn.004b0d60
sub esp, eax
mov eax, dword [esp + eax]
test eax, eax
mov ebx, eax
js 0x409325
lea esi, [ebp - 0x1018]
test byte [0x504120], 1
jne 0x4091c9
mov dword [esp + 8], 0x1000
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00419800
test byte [0x504120], 1
mov edi, eax
jne 0x409260
test edi, edi
je 0x409325
js 0x409316
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], esi
add eax, 0x20
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call sub.msvcrt.dll_fflush
test byte [0x504120], 1
je 0x40915f
call dword [sym.imp.msvcrt.dll__errno]
mov edi, dword [eax]
mov dword [esp], 0x504108
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
sub esp, 4
mov dword [esp + 0xc], str.read_and_dump
mov dword [esp + 8], str.system_core_adb_commandline.c
mov dword [esp + 4], 0x4c199e
mov dword [esp], eax
call fcn.00408e50
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], edi
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.read_and_dump__:_pre_adb_read_fd_d__n
add eax, 0x40
mov dword [esp], eax
call fcn.00408e50
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x504108
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], edi
jmp 0x40915f
mov ecx, dword [sym.imp.msvcrt.dll__errno]
mov dword [ebp - 0x1020], ecx
call ecx
mov eax, dword [eax]
mov dword [esp], 0x504108
mov dword [ebp - 0x101c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [ecx + 0x40]
sub esp, 4
mov dword [esp + 0xc], str.read_and_dump
mov dword [esp + 8], str.system_core_adb_commandline.c
mov dword [esp + 4], 0x4c199e
mov dword [esp], eax
call fcn.00408e50
mov ecx, dword [ebp - 0x1020]
call ecx
mov edx, dword [ebp - 0x101c]
mov dword [eax], edx
mov ecx, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], str.read_and_dump__:_post_adb_read_fd_d_:_len_d_n
lea eax, [ecx + 0x40]
mov dword [esp], eax
call fcn.00408e50
mov ecx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [ecx + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x504108
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x1020]
sub esp, 4
call ecx
mov edx, dword [ebp - 0x101c]
mov dword [eax], edx
jmp 0x409182
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x409156
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x409b50
Capabilities:
Create thread

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], str.shell:
call fcn.0040de00
test eax, eax
mov ebx, eax
js 0x409ba2
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [eax], ebx
mov dword [eax + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x408e80
call dword [sym.imp.msvcrt.dll__beginthread]
mov eax, ebx
call fcn.00409130
add esp, 0x18
xor eax, eax
pop ebx
ret
call fcn.0040d4e0
mov dword [esp + 4], 0x4c4123
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00408e50
add esp, 0x18
mov eax, 1
pop ebx
ret
Function at 0x40e5e0
Capabilities:
Create directory
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0x26c
mov dword [esp], 0x4c5180
call sub.msvcrt.dll_getenv
test eax, eax
mov ebx, eax
je 0x40e762
test byte [0x504121], 4
jne 0x40e6b0
mov dword [esp + 0xc], ebx
lea ebx, [ebp - 0x220]
mov dword [esp + 0x10], 0x4c51c9
mov dword [esp + 8], 0x4c51d2
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call fcn.0040e5b0
cmp eax, 0x103
jg 0x40e69d
lea eax, [ebp - 0x250]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__stati64]
test eax, eax
jne 0x40e683
mov dword [esp + 0xc], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], str.adbkey
mov dword [esp + 8], 0x4c51d2
call fcn.0040e5b0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__mkdir]
test eax, eax
jns 0x40e65b
test byte [0x504121], 4
jne 0x40e7a0
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [sym.imp.msvcrt.dll__errno]
mov dword [ebp - 0x260], ecx
call ecx
mov eax, dword [eax]
mov dword [esp], 0x504108
mov dword [ebp - 0x25c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [ecx + 0x40]
sub esp, 4
mov dword [esp + 0xc], str.get_user_keyfilepath
mov dword [esp + 8], str.system_core_adb_adb_auth_host.c
mov dword [esp + 4], 0x4c51b4
mov dword [esp], eax
call fcn.0040e580
mov ecx, dword [ebp - 0x260]
call ecx
mov edx, dword [ebp - 0x25c]
mov dword [eax], edx
mov ecx, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.home__s_n
lea eax, [ecx + 0x40]
mov dword [esp], eax
call fcn.0040e580
mov ecx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [ecx + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x504108
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x260]
sub esp, 4
call ecx
mov edx, dword [ebp - 0x25c]
mov dword [eax], edx
jmp 0x40e613
lea ebx, [ebp - 0x11c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x28
mov dword [esp], 0
call dword [sym.imp.SHELL32.DLL_SHGetFolderPathA]
sub esp, 0x14
jmp 0x40e606
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
mov edi, dword [eax]
mov dword [esp], 0x504108
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
sub esp, 4
mov dword [esp + 0xc], str.get_user_keyfilepath
mov dword [esp + 8], str.system_core_adb_adb_auth_host.c
mov dword [esp + 4], 0x4c51b4
mov dword [esp], eax
call fcn.0040e580
call esi
mov dword [eax], edi
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Cannot_mkdir__s
add eax, 0x40
mov dword [esp], eax
call fcn.0040e580
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x504108
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
call esi
mov dword [eax], edi
jmp 0x40e69d
Function at 0x4130b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
sub esp, 0x2c
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.0041aac0
test eax, eax
jne 0x413208
mov dword [esp], 0xc
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
je 0x4131f7
mov eax, dword [ebp - 0x1c]
mov dword [ebx], edi
mov dword [ebx + 8], esi
mov dword [ebx + 4], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0x412e30
call dword [sym.imp.msvcrt.dll__beginthread]
cmp eax, 0xffffffff
je 0x4131c0
test byte [0x504121], 2
jne 0x413127
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov esi, dword [eax]
mov dword [esp], 0x504108
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
sub esp, 4
mov dword [esp + 0xc], str.create_service_thread
mov dword [esp + 8], str.system_core_adb_services.c
mov dword [esp + 4], 0x4c5e49
mov dword [esp], eax
call fcn.00412e90
call ebx
mov dword [eax], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.service_thread_started___d:_d_n
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00412e90
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x504108
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
call ebx
mov dword [eax], esi
jmp 0x41311c
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.004199a0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.004199a0
mov dword [esp], str.cannot_create_service_thread_n
call fcn.00413090
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.cannot_allocate_stinfo
call fcn.004018e0
jmp 0x4130e6
mov dword [esp], str.cannot_create_service_socket_pair_n
call fcn.00413090
mov eax, 0xffffffff
jmp 0x41311f