joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca379
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1024
call fcn.00515150
push ebx
push esi
push edi
xor ebx, ebx
push 0xffc
lea eax, [esp + 0x38]
push ebx
push eax
mov dword [esp + 0x3c], ebx
call fcn.004fe380
add esp, 0xc
lea eax, [esp + 0x20]
push eax
push 0x1000
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x2c], ebx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x4ca4e2
mov esi, dword [esp + 0x20]
shr esi, 2
mov dword [esp + 0x28], esi
mov dword [esp + 0x14], ebx
cmp esi, ebx
jbe 0x4ca4e2
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x30]
cmp eax, ebx
je 0x4ca4d4
push eax
push ebx
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [esp + 0x24], edi
cmp edi, ebx
je 0x4ca4d4
lea eax, [esp + 0x2c]
push eax
push 4
lea eax, [esp + 0x24]
push eax
push edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x3c], ebx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x4ca431
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4ca4d4
lea esi, [esp + 0x10]
call fcn.00406670
mov ecx, 0x104
push ecx
call fcn.004108c0
push eax
push dword [esp + 0x24]
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
or eax, 0xffffffff
call fcn.00444a00
mov edi, dword [esp + 0x10]
mov esi, dword [edi - 0xc]
cmp esi, 8
lea eax, [esp + 0x10]
jg 0x4ca473
lea esi, [esp + 0x18]
call fcn.00492ad0
jmp 0x4ca48b
call fcn.004ca563
lea ecx, [esi + edi - 8]
push ecx
push 8
mov ecx, eax
pop edi
lea esi, [esp + 0x1c]
call fcn.004ca510
lea eax, [esp + 0x18]
push eax
mov ecx, str._adb.exe
call fcn.0042c9d0
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [esp + 0x18]
inc bl
call fcn.004b8a70
test bl, bl
je 0x4ca4bb
push dword [esp + 0x10]
push dword [ebp + 8]
call fcn.004c7f5b
lea eax, [esp + 0x10]
call fcn.004b8a70
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x28]
xor ebx, ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jb 0x4ca3dc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4caa15
Capabilities:
Read file on windows

Disassembly:
push ebp
push 0x5fe8fc
push str._dev_urandom
call fcn.004fc169
mov ebp, eax
pop ecx
pop ecx
test ebp, ebp
je 0x4caa80
push esi
push edi
push ebp
push 1
lea esi, [ebx + 0x88]
push 0x14
push esi
call fcn.004f95a3
push ebp
mov edi, eax
call fcn.004f9951
imul edi, edi, 0x14
add esp, 0x14
push 0x14
pop ebp
cmp edi, ebp
jne 0x4caa7e
call fcn.004ca7ea
push 5
pop ecx
lea edi, [eax + 0x24]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0xd8]
push eax
mov edi, ebx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], 1
mov dword [eax + 0x18], ebp
call fcn.004d76a1
pop ecx
pop edi
pop esi
pop ebp
ret
Function at 0x4cae53
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, 0x59dc16
call fcn.00581dd4
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
je 0x4cae78
mov dword [esi + 8], eax
cmp dword [ecx + 0x14], ebx
je 0x4cae89
push 0xffffffffffffffff
push ebx
push ecx
lea ecx, [esi + 0x18]
call fcn.0042d910
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov dword [ebp - 4], ebx
lea eax, [esi + 0x14]
push eax
push 4
push esi
push 0x4cafd2
push ebx
push ebx
call fcn.004f7e80
add esp, 0x18
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x4caf17
call fcn.004fbc92
mov esi, eax
call fcn.004fbc7f
push 0x5fa430
push ecx
push dword [esi]
push ecx
push str.__doserrno_
push ecx
push dword [eax]
push ecx
push str.errno_
push 0x628718
call fcn.004b7630
add esp, 0xc
push eax
call fcn.004b4d10
pop ecx
push eax
call fcn.004b7630
add esp, 0xc
push eax
call fcn.004c5740
pop ecx
push eax
call fcn.004b7630
push eax
call fcn.004cae1a
add esp, 0xc
mov byte [ebp - 0x11], bl
push 0x607d24
lea eax, [ebp - 0x11]
push eax
call fcn.004fe8eb
push dword [esi + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
or dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.itdtk::object::ErrorCode_bool_.0
mov byte [edi + 4], 1
mov byte [edi + 5], bl
mov eax, edi
jmp 0x4caf65
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4d1147
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
push ebx
push esi
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
xor esi, esi
lea eax, [ebp - 8]
inc esi
push eax
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4d119e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreatePipe___failure__error__ld_n
call fcn.004fba88
add eax, 0x40
push eax
call fcn.004fc27e
add esp, 0xc
jmp 0x4d12e8
mov edi, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push ebx
push esi
push dword [ebp - 8]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
call esi
push 0xfffffffffffffff4
mov dword [ebp - 4], eax
call esi
cmp dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xc], eax
je 0x4d11cd
push ebx
push 1
push dword [ebp - 4]
call edi
cmp dword [ebp - 0xc], 0xffffffff
je 0x4d11db
push ebx
push 1
push dword [ebp - 0xc]
call edi
push 0x44
pop edi
push edi
lea eax, [ebp - 0x78]
push ebx
push eax
call fcn.004fe380
add esp, 0xc
push 0xfffffffffffffff6
mov dword [ebp - 0x78], edi
call esi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x10]
push 0xfffffffffffffff4
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x400
lea eax, [ebp - 0x478]
push eax
push ebx
mov dword [ebp - 0x4c], 0x100
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push 8
push 1
push ebx
push ebx
push str.adb_fork_server_server
lea eax, [ebp - 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
call esi
cmp edi, ebx
jne 0x4d127d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failure__error__ld_n
call fcn.004fba88
add eax, 0x40
push eax
call fcn.004fc27e
add esp, 0xc
push dword [ebp - 8]
call esi
jmp 0x4d12e8
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x28]
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 3
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 8]
mov edi, eax
call esi
cmp edi, ebx
jne 0x4d12b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.could_not_read_ok_from_ADB_Server__error___ld_n
jmp 0x4d1188
cmp dword [ebp - 0xc], 3
jne 0x4d12d3
cmp byte [ebp - 4], 0x4f
jne 0x4d12d3
cmp byte [ebp - 3], 0x4b
jne 0x4d12d3
cmp byte [ebp - 2], 0xa
jne 0x4d12d3
xor eax, eax
jmp 0x4d12eb
push str.ADB_server_didnt_ACK_n
call fcn.004fba88
add eax, 0x40
push eax
call fcn.004fc27e
pop ecx
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4d12f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push fcn.004d9a08
call fcn.004f735c
pop ecx
xor edi, edi
inc edi
push edi
push 0x4d113c
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea eax, [ebp - 0xc]
call fcn.004d494d
test eax, eax
je 0x4d1329
push str.cannot_open_transport_registration_socketpair
call fcn.004ca6c2
mov eax, dword [ebp - 0xc]
xor ebx, ebx
push ebx
mov dword [0x62158c], eax
mov eax, dword [ebp - 8]
push 0x4d7a8b
push eax
mov esi, 0x64cf50
mov dword [0x621750], eax
call fcn.004d4e4c
add esp, 0xc
mov eax, edi
mov ecx, esi
call fcn.004d4ee7
mov dword [0x65e1a0], edi
call fcn.004db5ff
push ebx
push ebx
push 0x4d8703
call fcn.004fcac4
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4d137e
push str.cannot_create_input_thread
jmp 0x4d1324
call fcn.004dbd1a
push dword [ebp + 8]
lea eax, [ebp - 0x2c]
push str.tcp:_d
push 0x1e
push eax
call fcn.004fbeae
push ebx
push ebx
push str.smartsocket
lea eax, [ebp - 0x2c]
call fcn.004d0fbb
add esp, 0x1c
test eax, eax
je 0x4d13b2
push edi
call fcn.004f7826
call fcn.004d4f57
int3

Function at 0x4d3a07
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push bind
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x4d3a30
xor eax, eax
jmp 0x4d3a88
push esi
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor edi, edi
cmp esi, ebx
jbe 0x4d3a76
lea eax, [esi + 1]
push eax
call fcn.004f6dde
mov edi, eax
pop ecx
cmp edi, ebx
je 0x4d3a74
push ebx
lea eax, [ebp - 8]
push eax
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4d3a6b
cmp dword [ebp - 8], esi
je 0x4d3a76
push edi
call fcn.004f6d01
pop ecx
xor edi, edi
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4d3fbf
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
cmp dword [0x65e1d0], 0
jne 0x4d4000
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4d3feb
push str.adb:_could_not_initialize_Winsock_n
call fcn.004ca676
push 0x4d3fb9
call fcn.004f735c
pop ecx
mov dword [0x65e1d0], 1
add esp, 0x194
ret
Function at 0x4d4007
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, 0x5d4320
call fcn.004d3ae3
mov esi, eax
test esi, esi
jne 0x4d402b
or eax, 0xffffffff
jmp 0x4d40c2
cmp dword [0x65e1d0], 0
jne 0x4d4039
call fcn.004d3fbf
xor eax, eax
lea edi, [esp + 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
pop eax
push dword [ebp + 8]
mov word [esp + 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x7f000001
mov word [esp + 0x16], ax
call dword [sym.imp.WS2_32.dll_htonl]
push 0
push 1
push 2
mov dword [esp + 0x20], eax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x4d4080
call fcn.004d3b62
jmp 0x4d4023
push 0x10
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [esi + 0xc], eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jl 0x4d4079
push dword [ebp + 8]
mov eax, esi
push 0x5d906c
call fcn.004d3ab7
push eax
push str._d_lo_client:_s_d_
lea eax, [esi + 0x18]
push 0x400
push eax
call fcn.004fbeae
add esp, 0x18
mov eax, esi
call fcn.004d3ab7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d40c9
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, 0x5d4320
call fcn.004d3ae3
xor esi, esi
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x4d40ed
or eax, 0xffffffff
jmp 0x4d41cd
cmp dword [0x65e1d0], esi
jne 0x4d40fa
call fcn.004d3fbf
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
pop eax
push 0x13ad
mov word [ebp - 0x20], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x7f000001
mov word [ebp - 0x1e], ax
call dword [sym.imp.WS2_32.dll_htonl]
push esi
xor edi, edi
inc edi
push edi
push 2
mov dword [ebp - 0x1c], eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4d4145
mov esi, dword [ebp - 4]
call fcn.004d3b62
jmp 0x4d40e5
push 4
lea eax, [ebp - 8]
push eax
push edi
push 6
mov dword [ebp - 8], edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push ebx
call edi
push 8
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xc], esi
push 0x1005
mov esi, 0xffff
push esi
push ebx
mov dword [ebp - 0x10], 5
call edi
push 8
lea eax, [ebp - 0x10]
push eax
push 0x1006
push esi
push ebx
call edi
mov esi, dword [ebp - 4]
push 0x10
lea eax, [ebp - 0x20]
push eax
push ebx
mov dword [esi + 0xc], ebx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jl 0x4d413e
push 0x13ad
push 0x5d906c
mov eax, esi
call fcn.004d3ab7
push eax
push str._d_lo_client:_s_d_
lea eax, [esi + 0x18]
push 0x400
push eax
call fcn.004fbeae
add esp, 0x18
mov eax, esi
call fcn.004d3ab7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4d41d2
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebx, 0x5d4320
call fcn.004d3ae3
mov esi, eax
test esi, esi
jne 0x4d41f1
or eax, 0xffffffff
jmp 0x4d42f0
cmp dword [0x65e1d0], 0
jne 0x4d41ff
call fcn.004d3fbf
xor eax, eax
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
pop eax
push dword [esp + 0x2c]
mov word [esp + 0x1c], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x7f000001
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov ebx, dword [sym.imp.WS2_32.dll_socket]
xor ebp, ebp
mov dword [esp + 0x1c], eax
inc ebp
jmp 0x4d4298
push 0
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0xffff
mov dword [esi + 0xc], edi
push edi
mov dword [esp + 0x28], ebp
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jge 0x4d42ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [esp + 0x2c], 0x13ad
jne 0x4d41e9
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push ebp
push 2
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x4d423a
jmp 0x4d41e9
push 4
push edi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jge 0x4d42c2
call fcn.004d3b62
jmp 0x4d41e9
push dword [esp + 0x2c]
mov eax, esi
push 0x5d906c
call fcn.004d3ab7
push eax
push str._d_lo_server:_s_d_
lea eax, [esi + 0x18]
push 0x400
push eax
call fcn.004fbeae
add esp, 0x18
mov eax, esi
call fcn.004d3ab7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x4d42f8
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, 0x5d4320
call fcn.004d3ae3
mov esi, eax
test esi, esi
jne 0x4d431c
or eax, 0xffffffff
jmp 0x4d43ce
cmp dword [0x65e1d0], 0
jne 0x4d432a
call fcn.004d3fbf
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
jne 0x4d4340
call fcn.004d3b62
jmp 0x4d4314
push dword [ebp + 0xc]
xor eax, eax
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ax, word [ebx + 8]
mov word [esp + 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
movsx eax, word [ebx + 0xa]
push eax
mov eax, dword [ebx + 0xc]
push dword [eax]
lea eax, [esp + 0x1c]
push eax
call fcn.00500790
movsx eax, word [ebx + 8]
add esp, 0xc
push 0
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
je 0x4d4339
push 0x10
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [esi + 0xc], eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jl 0x4d4339
push dword [ebp + 0xc]
mov eax, esi
push 0x5d906c
call fcn.004d3ab7
push eax
push str._d_net_client:_s_d_
lea eax, [esi + 0x18]
push 0x400
push eax
call fcn.004fbeae
add esp, 0x18
mov eax, esi
call fcn.004d3ab7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d43d5
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, 0x5d4320
call fcn.004d3ae3
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x4d43f8
or eax, 0xffffffff
jmp 0x4d44ac
cmp dword [0x65e1d0], ebx
jne 0x4d4405
call fcn.004d3fbf
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
pop eax
push dword [ebp + 8]
mov word [ebp - 0x18], ax
call dword [sym.imp.WS2_32.dll_htons]
push ebx
mov word [ebp - 0x16], ax
call dword [sym.imp.WS2_32.dll_htonl]
push ebx
xor ebx, ebx
inc ebx
push ebx
push 2
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4d4447
call fcn.004d3b62
jmp 0x4d43f0
push 4
lea eax, [ebp - 8]
push eax
push 0xfffffffffffffffb
push 0xffff
mov dword [esi + 0xc], edi
push edi
mov dword [ebp - 8], ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jl 0x4d4440
push 4
push edi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jl 0x4d4440
push dword [ebp + 8]
mov eax, esi
push 0x5d906c
call fcn.004d3ab7
push eax
push str._d_any_server:_s_d_
lea eax, [esi + 0x18]
push 0x400
push eax
call fcn.004fbeae
add esp, 0x18
mov eax, esi
call fcn.004d3ab7
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4d4541
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.004d3a8b
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
test eax, eax
je 0x4d456e
cmp dword [eax], 0x5d4320
jne 0x4d456e
push 4
lea edx, [ebp - 4]
push edx
push ecx
push 6
push dword [eax + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
leave
ret

Function at 0x4d538b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00515150
cmp dword [ebp + 8], 0
jl 0x4d53c8
push esi
lea eax, [ebp - 0x1000]
push 0x1000
push eax
mov eax, dword [ebp + 8]
call fcn.004d3dba
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4d53c7
jge 0x4d53ca
call fcn.004fbc7f
cmp dword [eax], 4
je 0x4d539f
pop esi
leave
ret
call fcn.004fba88
add eax, 0x20
push eax
push esi
lea eax, [ebp - 0x1000]
push 1
push eax
call fcn.004fa893
call fcn.004fba88
add eax, 0x20
push eax
call fcn.004fbe52
add esp, 0x14
jmp 0x4d539f

Function at 0x4d53f5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, 0x8000
push esi
call fcn.004f6dde
and dword [ebp - 4], 0
mov ebx, eax
pop ecx
mov eax, dword [ebp + 8]
push esi
push ebx
call fcn.004d3dba
cmp dword [ebp + 8], 0
pop ecx
pop ecx
push esi
push ebx
jne 0x4d542e
push 0
call fcn.0050cb98
add esp, 0xc
jmp 0x4d5438
mov eax, dword [ebp + 8]
call fcn.004d3dba
pop ecx
pop ecx
mov edi, eax
test edi, edi
je 0x4d544a
jge 0x4d5456
call fcn.004fbc7f
cmp dword [eax], 4
je 0x4d540e
push ebx
call fcn.004f6d01
pop ecx
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 0xc]
push edi
push ebx
call fcn.004d3dd9
add dword [ebp - 4], edi
pop ecx
jmp 0x4d540d
Function at 0x4d5536
Capabilities:
Create thread

Disassembly:
push esi
push str.shell:
call fcn.004dc594
mov esi, eax
pop ecx
test esi, esi
jge 0x4d5568
push 0x65e1f0
push str.error:__s_n
call fcn.004fba88
add eax, 0x40
push eax
call fcn.004fc27e
xor eax, eax
add esp, 0xc
inc eax
pop esi
ret
push 8
call fcn.004f6dde
and dword [eax + 4], 0
pop ecx
push eax
push 0
push 0x4d5466
mov dword [eax], esi
call fcn.004fcac4
add esp, 0xc
push esi
call fcn.004d538b
pop ecx
xor eax, eax
pop esi
ret

Function at 0x4d55df
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00515150
push ebx
push esi
push edi
mov edi, ecx
push edi
mov esi, str.sideload
push esi
lea eax, [ebp - 0x1010]
push str._s:_d
push eax
call fcn.004f9d9b
lea eax, [ebp - 0x1010]
push eax
call fcn.004dc594
add esp, 0x14
mov dword [ebp - 4], eax
test eax, eax
jge 0x4d5642
push 0x65e1f0
push str.error:__s_n
call fcn.004fba88
add eax, 0x40
push eax
call fcn.004fc27e
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
push 4
lea ecx, [ebp - 0xc]
push ecx
push 0x1001
push 0xffff
mov ebx, 0x10000
push eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push 0x3a
push esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
call fcn.004fcbb0
pop ecx
jmp 0x4d56d9
cmp edi, ebx
mov esi, ebx
jg 0x4d5680
mov esi, edi
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov eax, esi
call fcn.004d8540
pop ecx
test eax, eax
jne 0x4d5721
add dword [ebp - 8], esi
sub edi, esi
push 0
mov eax, edi
cdq
push 0x64
push edx
push eax
call fcn.005034c0
push 0
push dword [ebp - 0x10]
push edx
push eax
call fcn.0050a300
push 0x64
pop ecx
sub ecx, eax
push ecx
push dword [ebp + 8]
push str.sending:__s__4d_______r
call fcn.004f9cd6
add esp, 0xc
call fcn.004fba88
add eax, 0x20
push eax
call fcn.004fbe52
pop ecx
test edi, edi
jg 0x4d5678
push 0x5f8c54
call fcn.004f9cd6
pop ecx
push 4
push dword [ebp - 4]
lea eax, [ebp - 0x1010]
call fcn.004d8505
pop ecx
pop ecx
test eax, eax
je 0x4d573a
push str._error_reading_response__n
call fcn.004fba88
add eax, 0x40
push eax
call fcn.004fc27e
mov eax, dword [ebp - 4]
pop ecx
pop ecx
call fcn.004d3df8
jmp 0x4d563a
push dword [ebp - 4]
call fcn.004dc3b5
mov dword [esp], 0x65e1f0
push str._failed_to_write_data__s__n
jmp 0x4d5629
mov ecx, dword [ebp - 0x1010]
mov eax, str.OKAY
cmp ecx, dword [eax]
je 0x4d577f
lea eax, [ebp - 0x1010]
push eax
push str._error_response__s__n
mov byte [ebp - 0x100c], 0
call fcn.004fba88
add eax, 0x40
push eax
call fcn.004fc27e
add esp, 0xc
or esi, 0xffffffff
mov eax, dword [ebp - 4]
call fcn.004d3df8
mov eax, esi
jmp 0x4d563d
xor esi, esi
jmp 0x4d5770
Function at 0x4dbb43
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push esi
push edi
push str.ANDROID_SDK_HOME
call fcn.004fc55b
pop ecx
xor ecx, ecx
cmp eax, ecx
jne 0x4dbb77
lea eax, [ebp - 0x240]
push eax
push ecx
push ecx
push 0x28
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x240]
push str..android
push eax
mov edi, 0x5fb0a4
push edi
mov esi, 0x104
lea eax, [ebp - 0x138]
push esi
push eax
call fcn.004fbeae
add esp, 0x14
cmp eax, esi
jl 0x4dbba1
or eax, 0xffffffff
jmp 0x4dbbe3
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.004fccb7
pop ecx
pop ecx
test eax, eax
je 0x4dbbc8
lea eax, [ebp - 0x138]
push eax
call fcn.004fcb7d
pop ecx
test eax, eax
jl 0x4dbb9c
push str.adbkey
lea eax, [ebp - 0x138]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004fbeae
add esp, 0x14
pop edi
pop esi
leave
ret

Function at 0x4de8ce
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
call fcn.004d494d
test eax, eax
je 0x4de8ef
push str.cannot_create_service_socket_pair_n
call fcn.004f9cd6
pop ecx
or eax, 0xffffffff
leave
ret
push esi
push 0xc
call fcn.004f6dde
mov esi, eax
pop ecx
test esi, esi
jne 0x4de908
push str.cannot_allocate_stinfo
call fcn.004ca676
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp - 4]
push esi
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
push 0
push 0x4de8b4
mov dword [esi + 8], eax
mov dword [esi + 4], edi
call fcn.004fcac4
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4de956
push esi
call fcn.004f6d01
mov eax, dword [ebp - 8]
call fcn.004d3df8
mov eax, edi
call fcn.004d3df8
mov dword [esp], str.cannot_create_service_thread_n
call fcn.004f9cd6
pop ecx
or eax, 0xffffffff
jmp 0x4de959
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret