joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d42c8
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d44cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x74], 0
je 0x4d4302
lea eax, [ebp - 0x1c]
mov edx, 0x4d44e8
call fcn.00404878
jmp 0x4d430f
lea eax, [ebp - 0x1c]
mov edx, 0x4d4518
call fcn.00404878
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004d3fa4
push 2
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x4d42a0]
call fcn.004062fc
add esp, 4
mov eax, 0x4d4530
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [eax + 4], edx
mov esi, 0x4400000
mov eax, dword [ebp - 4]
cmp dword [eax + 0x58], 4
jne 0x4d4366
or esi, 0x800000
mov eax, dword [ebp - 4]
test byte [eax + 0x75], 2
je 0x4d4366
or esi, 0x3000
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4d447b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
push eax
push esi
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.00404c90
push eax
push 0x4d453c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
push eax
call sub.wininet.dll_HttpOpenRequestA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setne dl
xor dl, 1
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004d3b14
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004d3e98
push 0x20000000
mov eax, dword [ebp - 0x14]
call fcn.00404a98
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404c90
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_HttpAddRequestHeadersA
push 0x20000000
mov eax, dword [ebp - 0x1c]
call fcn.00404a98
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00404c90
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_HttpAddRequestHeadersA
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00406e1c
mov eax, dword [ebp - 0x18]
call fcn.00404a98
push eax
lea eax, [ebp - 0x18]
call fcn.00404ce8
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_HttpSendRequestA
mov edx, eax
cmp edx, 1
sbb edx, edx
neg edx
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004d3b14
lea eax, [ebp - 0xc]
push eax
push 7
call sub.kernel32.dll_GetLastError_1
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetDesktopWindow
push eax
call sub.wininet.dll_InternetErrorDlg
sub eax, 1
jb 0x4d4471
sub eax, 0x4c6
je 0x4d446a
jmp 0x4d440f
call fcn.0040d4d4
jmp 0x4d440f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d44a3
mov ebx, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d44d6
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404804
lea eax, [ebp - 0x10]
mov edx, dword [0x4d42a0]
call fcn.0040641c
ret
Function at 0x4d456c
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d4714
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004d3fa4
push 2
lea eax, [ebp - 0x18]
mov ecx, 1
mov edx, dword [0x4d4544]
call fcn.004062fc
add esp, 4
mov eax, 0x4d4724
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 4], edx
mov dword [ebp - 0xc], 0x4000000
mov eax, dword [ebp - 4]
cmp dword [eax + 0x58], 4
jne 0x4d45e6
or dword [ebp - 0xc], 0x800000
mov eax, dword [ebp - 4]
test byte [eax + 0x75], 2
je 0x4d45e6
or dword [ebp - 0xc], 0x3000
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4d46cd
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.00404c90
push eax
push 0x4d4728
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
push eax
call sub.wininet.dll_HttpOpenRequestA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setne dl
xor dl, 1
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004d3b14
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_HttpSendRequestA
test eax, eax
jne 0x4d46c3
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0x2f0d
jne 0x4d4697
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1f
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetQueryOptionA
or dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1f
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
jmp 0x4d463d
lea eax, [ebp - 0x14]
push eax
push 7
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetDesktopWindow
push eax
call sub.wininet.dll_InternetErrorDlg
sub eax, 1
jb 0x4d46c3
sub eax, 0x4c6
jne 0x4d463d
call fcn.0040d4d4
jmp 0x4d463d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d46f5
mov ebx, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d471b
lea eax, [ebp - 0x18]
mov edx, dword [0x4d4544]
call fcn.0040641c
ret
Function at 0x4d4d64
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c80
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor eax, eax
push ebp
push 0x4d4e00
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, dword [ebp - 4]
call fcn.004d3cd0
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, dword [ebx]
mov edx, dword [edx + 0x14]
call fcn.004d3e20
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, dword [ebx]
mov edx, dword [edx + 0x18]
call fcn.004d3e48
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, dword [ebx]
mov edx, dword [edx + 0x10]
call fcn.004d3e70
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4e07
lea eax, [ebp - 4]
call fcn.004047e0
ret

Function at 0x4eb478
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x134], edx
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4eb5b6
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004e7024
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor edx, edx
cmp edx, 0xffffffff
jne 0x4eb4ce
cmp eax, 0xffffffff
je 0x4eb598
xor eax, eax
push ebp
push 0x4eb591
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [edi], 0x128
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004e7044
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4eb572
mov dword [edi], 0x128
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004e7064
cmp eax, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x134]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404a48
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004091e0
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x138]
mov eax, 0x4eb5cc
call fcn.004091e0
mov eax, dword [ebp - 0x138]
pop edx
call fcn.00404dd4
test eax, eax
jle 0x4eb572
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push esi
call sub.kernel32.dll_CloseHandle_1
test bl, bl
jne 0x4eb4f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb598
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb5bd
lea eax, [ebp - 0x138]
mov edx, 3
call fcn.00404804
ret
Function at 0x4eb968
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404c80
xor eax, eax
push ebp
push 0x4ebacb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x4ebae4
call fcn.00404834
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404c90
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4ebaad
mov eax, ebx
call fcn.00402884
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4ebaa6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4eba90
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4ebaec
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4eba90
mov eax, dword [ebp - 0x1c]
test dword [eax + 0x1c], 2
jbe 0x4eba23
lea eax, [ebp - 0x20]
mov edx, 0x4ebaf8
call fcn.00404878
jmp 0x4eba2b
lea eax, [ebp - 0x20]
call fcn.004047e0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
call fcn.00407f2c
movzx ebx, ax
mov eax, dword [ebp - 0x1c]
movzx edi, word [eax + 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
call fcn.00407f2c
movzx eax, ax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0xc]
mov dword [ebp - 0x14], eax
push esi
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0x3c], 0
mov dword [ebp - 0x38], edi
mov byte [ebp - 0x34], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x40]
mov ecx, 3
mov eax, 0x4ebb08
call fcn.0040a470
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ebaad
mov eax, dword [ebp - 0x18]
call fcn.004028a4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ebad2
lea eax, [ebp - 0x20]
call fcn.004047e0
lea eax, [ebp - 4]
call fcn.004047e0
ret
Function at 0x4017f0
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18c
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0xc
mov dword [ebp - 0x24], 0
push 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 1
push eax
lea eax, [ebp - 0x14]
push eax
call sub.KERNEL32.dll_CreatePipe
test eax, eax
je 0x401990
mov ecx, dword [ebp - 0x14]
push ebx
push 0
push 1
push ecx
call sub.KERNEL32.dll_SetHandleInformation
push edx
push edx
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
add esp, 0xc
mov esi, eax
cmp ebx, 0xffffffff
je 0x401862
push eax
push 0
push 1
push ebx
call sub.KERNEL32.dll_SetHandleInformation
pop eax
cmp esi, 0xffffffff
je 0x401873
push eax
push 0
push 1
push esi
call sub.KERNEL32.dll_SetHandleInformation
pop eax
lea edi, [ebp - 0x7c]
push eax
push 0x44
push 0
push edi
call sub.msvcrt.dll_memset
mov dword [ebp - 0x7c], 0x44
mov dword [esp], 0xfffffff6
call sub.KERNEL32.dll_GetStdHandle
lea ebx, [ebp - 0x180]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov dword [ebp - 0x50], 0x100
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
push eax
mov dword [ebp - 0x30], 0
push eax
mov dword [ebp - 0x2c], 0
push 0x104
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
lea esi, [ebp - 0x38]
add esp, 0xc
push esi
push edi
push 0
push 0
push 8
push 1
push 0
push 0
push str.adb_fork_server_server
push ebx
call sub.KERNEL32.dll_CreateProcessA
mov ecx, dword [ebp - 0x18]
mov ebx, eax
push esi
push ecx
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
test ebx, ebx
je 0x40199e
sub esp, 0xc
mov edi, dword [ebp - 0x38]
push edi
call sub.KERNEL32.dll_CloseHandle
mov esi, dword [ebp - 0x34]
push esi
call sub.KERNEL32.dll_CloseHandle
lea eax, [ebp - 0x1c]
mov ebx, dword [ebp - 0x14]
push 0
push eax
lea eax, [ebp - 0xf]
push 3
push eax
push ebx
call sub.KERNEL32.dll_ReadFile
mov ecx, dword [ebp - 0x14]
mov ebx, eax
push ecx
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
test ebx, ebx
je 0x4019ca
cmp dword [ebp - 0x1c], 3
jne 0x40195d
cmp byte [ebp - 0xf], 0x4f
je 0x401980
push eax
push eax
push str.ADB_server_didnt_ACK_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.004013a0
or eax, 0xffffffff
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [ebp - 0xe], 0x4b
jne 0x40195d
xor eax, eax
cmp byte [ebp - 0xd], 0xa
jne 0x40195d
jmp 0x401978
call sub.KERNEL32.dll_GetLastError
push esi
push eax
push str.CreatePipe___failure__error__ld_n
jmp 0x401964
call sub.KERNEL32.dll_GetLastError
push edx
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push str.CreateProcess_failure__error__ld_n
add eax, 0x40
push eax
call fcn.004013a0
pop eax
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_CloseHandle
or eax, 0xffffffff
add esp, 0xc
jmp 0x401978
call sub.KERNEL32.dll_GetLastError
push edx
push eax
push str.could_not_read_ok_from_ADB_Server__error___ld_n
jmp 0x401964
Function at 0x4019e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x134
lea eax, [ebp - 0x110]
push eax
push 0xfc
call sub.KERNEL32.dll_GetTempPathA
lea ecx, [ebp - 0x110]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x401a03
test edx, 0x8080
je 0x401ae0
add dl, dl
mov eax, ecx
sbb eax, 3
mov dword [eax], 0x2e626461
mov dword [eax + 4], 0x676f6c
push 0x4a812b
push 0x4a812e
call sub.msvcrt.dll_fopen
add esp, 0x10
mov dword [ebp - 0x120], eax
test eax, eax
je 0x401afe
mov ebx, dword [sym.imp.msvcrt.dll__iob]
mov ecx, 8
cld
mov edi, ebx
mov esi, eax
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x110]
push eax
push eax
push 0x4a8132
push edi
call sub.msvcrt.dll_fopen
add esp, 0x10
mov dword [ebp - 0x138], eax
test eax, eax
je 0x401af0
mov edi, dword [ebp - 0x138]
push 0
push 4
push 0
push edi
call sub.msvcrt.dll_setvbuf
cld
mov eax, 8
mov esi, dword [ebp - 0x138]
lea edi, [ebx + 0x20]
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
add ebx, 0x40
mov esi, dword [ebp - 0x138]
mov edi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll__getpid
add esp, 0xc
push eax
push str.____adb_starting__pid__d______n
push ebx
call fcn.004013a0
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
shr edx, 0x10
add ecx, 2
jmp 0x401a27
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x138], eax
jmp 0x401a8d
mov ebx, dword [sym.imp.msvcrt.dll__iob]
jmp 0x401a6d

Function at 0x402050
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
push str.ADB_TRACE
call sub.msvcrt.dll_getenv
add esp, 0x10
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40210c
mov al, byte [eax]
test al, al
je 0x40210c
push eax
push eax
push str.__:_
mov eax, dword [ebp - 0x14]
push eax
call sub.msvcrt.dll_strpbrk
add esp, 0x10
mov dword [ebp - 0x10], eax
test eax, eax
je 0x402123
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
sub edi, esi
mov ebx, dword [0x4a8820]
mov dword [ebp - 0x20], edi
test ebx, ebx
je 0x402104
mov esi, dword [0x4a8820]
xor ebx, ebx
jmp 0x4020c4
inc ebx
mov esi, dword [ebx*8 + 0x4a8820]
test esi, esi
je 0x402104
sub esp, 0xc
push esi
call sub.msvcrt.dll_strlen
add esp, 0x10
cmp dword [ebp - 0x20], eax
jne 0x4020b8
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x14]
cld
cmp eax, eax
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4020b8
mov ecx, dword [ebx*8 + 0x4a8824]
test ecx, ecx
je 0x40213f
mov eax, 1
shl eax, cl
mov ecx, dword [0x4ec098]
or ecx, eax
mov dword [0x4ec098], ecx
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x402114
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov al, byte [edx + 1]
jmp 0x402073
sub esp, 0xc
mov eax, dword [ebp - 0x14]
push eax
call sub.msvcrt.dll_strlen
mov edi, dword [ebp - 0x14]
add esp, 0x10
add eax, edi
mov dword [ebp - 0x10], eax
jmp 0x402099
mov dword [0x4ec098], 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x3c
push 0x401450
call section..text
pop eax
pop edx
push 1
push 0x401460
call sub.KERNEL32.dll_SetConsoleCtrlHandler
pop esi
pop eax
call fcn.00404c00
mov dword [0x4d7008], 1
call fcn.00413580
call fcn.00412920
sub esp, 0xc
push 0x15b3
call fcn.00406fb0
call fcn.0040d160
add esp, 0xc
mov ebx, dword [ebp + 0xc]
push ebx
lea ebx, [ebp - 0x2a]
push 0x1e
push ebx
call fcn.00401470
xor ecx, ecx
mov edx, str.smartsocket
mov eax, ebx
mov dword [esp], 0
call fcn.004022d0
add esp, 0x10
test eax, eax
jne 0x402f4a
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x402f20
test byte [0x4ec098], 1
je 0x402f0a
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4ec0a8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.adb_main
push str.system_core_adb_adb.c
push 0x4a8056
push ebx
call fcn.004013a0
call sub.msvcrt.dll__errno
mov dword [eax], esi
pop eax
pop edx
push str.Event_loop_starting_n
push ebx
call fcn.004013a0
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ec0a8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
call fcn.00413ba0
call fcn.00412600
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
sub esp, 0xc
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
lea edx, [ebp - 0xc]
push 0
push edx
push 3
push 0x4a851c
push eax
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
call fcn.004019e0
jmp 0x402e9a
sub esp, 0xc
push 1
call sub.msvcrt.dll_exit
lea esi, [esi]
lea edi, [edi]

Function at 0x406d80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
push str.ADBHOST
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x406e70
mov edx, dword [ebp + 0xc]
push ecx
push 1
push edx
push eax
call fcn.00415db0
add esp, 0x10
mov edi, eax
test eax, eax
js 0x406e70
test byte [0x4ec098], 8
jne 0x406e01
sub esp, 0xc
lea ebx, [ebp - 0x4c]
push edi
call fcn.00415800
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x4a9546
push str._s_d
push 0x40
push ebx
call fcn.004a0540
add esp, 0x20
mov eax, dword [ebp + 0xc]
push 1
push eax
push ebx
push edi
call fcn.00404ff0
xor eax, eax
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4ec0a8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.local_connect_arbitrary_ports
push str.system_core_adb_transport_local.c
push 0x4a9516
push ebx
call fcn.00406d40
call sub.msvcrt.dll__errno
add esp, 0xc
mov dword [eax], esi
push edi
push 0x4a9520
push ebx
call fcn.00406d40
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ec0a8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
jmp 0x406dc1
push eax
push eax
mov eax, dword [ebp + 0xc]
push 1
push eax
call fcn.00416c80
mov edi, eax
add esp, 0x10
or eax, 0xffffffff
test edi, edi
jns 0x406db8
jmp 0x406df9
Function at 0x406fb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, 0x407320
mov ebx, dword [0x4d7008]
test ebx, ebx
jne 0x406fcd
mov esi, 0x4070b0
test byte [0x4ec098], 8
jne 0x407020
push edi
mov ebx, dword [ebp + 8]
push ebx
push 0
push esi
call sub.msvcrt.dll__beginthread
add esp, 0x10
inc eax
je 0x406ff1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [0x4d7008]
mov eax, 0x4a9555
test ecx, ecx
jne 0x407005
mov eax, 0x4a955c
push edx
push edx
push eax
push str.cannot_create_local_socket__s_thread
call fcn.00402160
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
sub esp, 0xc
mov edi, dword [eax]
push 0x4ec0a8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.local_init
push str.system_core_adb_transport_local.c
push 0x4a9516
push ebx
call fcn.00406d40
call sub.msvcrt.dll__errno
add esp, 0x10
mov dword [eax], edi
mov eax, 0x4a9555
mov ecx, dword [0x4d7008]
test ecx, ecx
jne 0x407073
mov eax, 0x4a955c
push edx
push eax
push str.transport:_local__s_init_n
push ebx
call fcn.00406d40
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ec0a8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], edi
jmp 0x406fd6
Function at 0x408070
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1008
call fcn.0049fe20
mov eax, dword [ebp - 0x10]
mov esi, eax
test eax, eax
js 0x40820a
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [ebp - 0x1014], eax
lea esi, [esi]
test byte [0x4ec098], 1
jne 0x408111
lea esi, [esi]
lea edx, [ebp - 0x100c]
push eax
push 0x1000
push edx
push esi
call fcn.004149d0
add esp, 0x10
mov edi, eax
test byte [0x4ec098], 1
jne 0x408187
cmp edi, 0
je 0x40820a
jl 0x408212
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [ebp - 0x100c]
add ebx, 0x20
push ebx
push edi
push 1
push eax
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
add esp, 0x10
test byte [0x4ec098], 1
je 0x4080b0
call sub.msvcrt.dll__errno
sub esp, 0xc
mov ebx, dword [eax]
push 0x4ec0a8
call sub.KERNEL32.dll_EnterCriticalSection
add esp, 0xc
push str.read_and_dump
push str.system_core_adb_commandline.c
push 0x4abbf5
mov eax, dword [ebp - 0x1014]
push eax
call fcn.00407e90
call sub.msvcrt.dll__errno
add esp, 0xc
mov dword [eax], ebx
push esi
push str.read_and_dump__:_pre_adb_read_fd_d__n
mov eax, dword [ebp - 0x1014]
push eax
call fcn.00407e90
pop eax
mov eax, dword [ebp - 0x1014]
push eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ec0a8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], ebx
jmp 0x4080b0
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
mov dword [ebp - 0x1010], eax
push 0x4ec0a8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.read_and_dump
push str.system_core_adb_commandline.c
push 0x4abbf5
push ebx
call fcn.00407e90
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x1010]
mov dword [eax], edx
push edi
push esi
push str.read_and_dump__:_post_adb_read_fd_d_:_len_d_n
push ebx
call fcn.00407e90
add esp, 0x14
push ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ec0a8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x1010]
cmp edi, 0
mov dword [eax], edx
jne 0x4080de
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x4080a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret