joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403a00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x3c
push 0x401450
call section..text
pop ecx
pop ebx
push 1
push 0x401460
call sub.KERNEL32.dll_SetConsoleCtrlHandler
pop eax
pop edx
call fcn.00404bb0
mov dword [0x4c9008], 1
call fcn.00412f50
call fcn.004122f0
push esi
push esi
push 0x15b3
push str.android.host.adb.port
call fcn.00401730
mov dword [esp], eax
call fcn.00406f50
call fcn.0040cfe0
add esp, 0xc
mov ebx, dword [ebp + 0xc]
push ebx
lea ebx, [ebp - 0x2a]
push 0x1e
push ebx
call fcn.004014c0
xor ecx, ecx
mov edx, str.smartsocket
mov eax, ebx
mov dword [esp], 0
call fcn.00401c00
add esp, 0x10
test eax, eax
jne 0x403b4a
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x403b20
test byte [0x4ddfd8], 1
je 0x403b06
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4ddfe8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.adb_main
push str.system_core_adb_adb.c
push 0x49e056
push ebx
call fcn.004013a0
call sub.msvcrt.dll__errno
mov dword [eax], esi
pop eax
pop edx
push str.Event_loop_starting_n
push ebx
call fcn.004013a0
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ddfe8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
call fcn.00413570
call fcn.00411fd0
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
sub esp, 0xc
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
lea edx, [ebp - 0xc]
push 0
push edx
push 3
push 0x49e6a6
push eax
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
call fcn.00401a50
jmp 0x403a96
sub esp, 0xc
push 1
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x406d20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
push str.ADBHOST
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x406e10
mov edx, dword [ebp + 0xc]
push ecx
push 1
push edx
push eax
call fcn.00416280
add esp, 0x10
mov edi, eax
test eax, eax
js 0x406e10
test byte [0x4ddfd8], 8
jne 0x406da1
sub esp, 0xc
lea ebx, [ebp - 0x4c]
push edi
call fcn.004151d0
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x49f4de
push str._s_d
push 0x40
push ebx
call fcn.00496460
add esp, 0x20
mov eax, dword [ebp + 0xc]
push 1
push eax
push ebx
push edi
call fcn.00404fa0
xor eax, eax
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4ddfe8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.local_connect_arbitrary_ports
push str.system_core_adb_transport_local.c
push 0x49f4ae
push ebx
call fcn.00406ce0
call sub.msvcrt.dll__errno
add esp, 0xc
mov dword [eax], esi
push edi
push 0x49f4b8
push ebx
call fcn.00406ce0
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ddfe8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
jmp 0x406d61
push eax
push eax
mov eax, dword [ebp + 0xc]
push 1
push eax
call fcn.00416640
mov edi, eax
add esp, 0x10
or eax, 0xffffffff
test edi, edi
jns 0x406d58
jmp 0x406d99

Function at 0x406f50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, 0x4072f0
mov ebx, dword [0x4c9008]
test ebx, ebx
jne 0x406f6d
mov esi, 0x407050
test byte [0x4ddfd8], 8
jne 0x406fc0
push edi
mov ebx, dword [ebp + 8]
push ebx
push 0
push esi
call sub.msvcrt.dll__beginthread
add esp, 0x10
inc eax
je 0x406f91
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [0x4c9008]
mov eax, 0x49f4ed
test ecx, ecx
jne 0x406fa5
mov eax, 0x49f4f4
push edx
push edx
push eax
push str.cannot_create_local_socket__s_thread
call fcn.00402690
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
sub esp, 0xc
mov edi, dword [eax]
push 0x4ddfe8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.local_init
push str.system_core_adb_transport_local.c
push 0x49f4ae
push ebx
call fcn.00406ce0
call sub.msvcrt.dll__errno
add esp, 0x10
mov dword [eax], edi
mov eax, 0x49f4ed
mov ecx, dword [0x4c9008]
test ecx, ecx
jne 0x407013
mov eax, 0x49f4f4
push edx
push eax
push str.transport:_local__s_init_n
push ebx
call fcn.00406ce0
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ddfe8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], edi
jmp 0x406f76
Function at 0x407f90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1008
call fcn.00495d50
mov eax, dword [ebp - 0x10]
mov esi, eax
test eax, eax
js 0x40812a
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [ebp - 0x1014], eax
lea esi, [esi]
test byte [0x4ddfd8], 1
jne 0x408031
lea esi, [esi]
lea edx, [ebp - 0x100c]
push eax
push 0x1000
push edx
push esi
call fcn.004143a0
add esp, 0x10
mov edi, eax
test byte [0x4ddfd8], 1
jne 0x4080a7
cmp edi, 0
je 0x40812a
jl 0x408132
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [ebp - 0x100c]
add ebx, 0x20
push ebx
push edi
push 1
push eax
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
add esp, 0x10
test byte [0x4ddfd8], 1
je 0x407fd0
call sub.msvcrt.dll__errno
sub esp, 0xc
mov ebx, dword [eax]
push 0x4ddfe8
call sub.KERNEL32.dll_EnterCriticalSection
add esp, 0xc
push str.read_and_dump
push str.system_core_adb_commandline.c
push 0x4a1a18
mov eax, dword [ebp - 0x1014]
push eax
call fcn.00407db0
call sub.msvcrt.dll__errno
add esp, 0xc
mov dword [eax], ebx
push esi
push str.read_and_dump__:_pre_adb_read_fd_d__n
mov eax, dword [ebp - 0x1014]
push eax
call fcn.00407db0
pop eax
mov eax, dword [ebp - 0x1014]
push eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ddfe8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], ebx
jmp 0x407fd0
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
mov dword [ebp - 0x1010], eax
push 0x4ddfe8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.read_and_dump
push str.system_core_adb_commandline.c
push 0x4a1a18
push ebx
call fcn.00407db0
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x1010]
mov dword [eax], edx
push edi
push esi
push str.read_and_dump__:_post_adb_read_fd_d_:_len_d_n
push ebx
call fcn.00407db0
add esp, 0x14
push ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ddfe8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x1010]
cmp edi, 0
mov dword [eax], edx
jne 0x407ffe
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x407fc0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4085d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov eax, 0x103c
mov ebp, esp
push edi
push esi
push ebx
call fcn.00495d50
mov esi, dword [ebp + 0x14]
push esi
lea eax, [ebp - 0x1014]
mov ecx, dword [ebp + 8]
push ecx
push 0x4a1ba9
mov dword [ebp - 0x1044], eax
push eax
call fcn.004085b0
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call fcn.0040b910
add esp, 0x10
mov dword [ebp - 0x1028], eax
test eax, eax
js 0x40880f
sub esp, 0xc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x10000
push 4
push eax
push 0x1001
push 0xffff
mov eax, dword [ebp - 0x1028]
push eax
call sub.WS2_32.DLL_setsockopt
mov dword [ebp - 0x102c], esi
add esp, 0xc
mov dword [ebp - 0x14], eax
test esi, esi
jle 0x408720
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov edx, dword [ebp + 0x10]
add eax, 0x20
mov dword [ebp - 0x1024], edx
mov dword [ebp - 0x1040], eax
jmp 0x408687
test esi, esi
jle 0x408720
mov eax, dword [ebp - 0x1024]
add eax, edi
mov dword [ebp - 0x1024], eax
mov edi, esi
cmp esi, 0x10000
jle 0x408696
mov edi, 0x10000
push eax
push edi
mov eax, dword [ebp - 0x1024]
push eax
mov ebx, dword [ebp - 0x1028]
push ebx
call fcn.00405b20
add esp, 0x10
test eax, eax
jne 0x408781
mov edx, dword [ebp + 0x18]
sub esi, edi
test edx, edx
je 0x408671
mov ebx, 0x64
mov eax, esi
imul ebx
sub esp, 0x10
mov dword [ebp - 0x1038], eax
mov dword [ebp - 0x1034], edx
mov eax, dword [ebp - 0x102c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1034]
push eax
mov eax, dword [ebp - 0x1038]
push eax
call fcn.00495d80
add esp, 0x1c
sub ebx, eax
push ebx
mov eax, dword [ebp + 0xc]
push eax
push str.sending:__s__4d_______r
call fcn.00408150
pop eax
mov eax, dword [ebp - 0x1040]
push eax
call sub.msvcrt.dll_fflush
add esp, 0x10
test esi, esi
jg 0x408679
mov edi, dword [ebp + 0x18]
test edi, edi
jne 0x4087ba
lea edx, [ebp - 0x1014]
push esi
push 4
push edx
mov ebx, dword [ebp - 0x1028]
push ebx
call fcn.004055c0
add esp, 0x10
test eax, eax
jne 0x4087cf
cld
mov edi, 0x4a1c12
mov ecx, 4
mov esi, dword [ebp - 0x1044]
repe cmpsb byte [esi], byte es:[edi]
jne 0x4087f9
sub esp, 0xc
mov eax, dword [ebp - 0x1028]
push eax
call fcn.00414270
xor eax, eax
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
mov ecx, dword [ebp - 0x1028]
push ecx
call fcn.0040b2d0
call fcn.0040b260
add esp, 0xc
push eax
push str._failed_to_write_data__s__n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.00407db0
or eax, 0xffffffff
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push 0x4a1bf4
call fcn.00408150
add esp, 0x10
jmp 0x40872b
push ecx
push ecx
push str._error_reading_response__n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.00407db0
pop eax
mov eax, dword [ebp - 0x1028]
push eax
call fcn.00414270
or eax, 0xffffffff
add esp, 0x10
jmp 0x408779
lea eax, [ebp - 0x1014]
mov byte [ebp - 0x1010], 0
push edx
push eax
push str._error_response__s__n
jmp 0x4087d6
call fcn.0040b260
push edx
push eax
push 0x4a1baf
jmp 0x40879e
Function at 0x408890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
push str.shell:
call fcn.0040b910
add esp, 0x10
mov ebx, eax
test eax, eax
js 0x4088e0
sub esp, 0xc
push 8
call sub.msvcrt.dll_malloc
add esp, 0xc
mov dword [eax], ebx
mov dword [eax + 4], 0
push eax
push 0
push 0x408910
call sub.msvcrt.dll__beginthread
mov eax, ebx
call fcn.00407f90
xor eax, eax
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
call fcn.0040b260
push edx
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x4a1baf
add eax, 0x40
push eax
call fcn.00407db0
mov eax, 1
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40bf80
Capabilities:
Create directory
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x248
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x244], edx
push 0x4a2b2c
call sub.msvcrt.dll_getenv
add esp, 0x10
mov edi, eax
test eax, eax
je 0x40c0b1
test byte [0x4ddfd9], 4
jne 0x40c043
sub esp, 0xc
push 0x4a2b75
push edi
lea edi, [ebp - 0x133]
push 0x4a2b7e
push 0x103
push edi
call fcn.00496460
add esp, 0x20
cmp eax, 0x102
jle 0x40bff0
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x30]
push esi
push esi
push eax
push edi
call sub.msvcrt.dll__stat
add esp, 0x10
test eax, eax
je 0x40c017
sub esp, 0xc
push edi
call sub.msvcrt.dll__mkdir
add esp, 0x10
test eax, eax
js 0x40c0d2
sub esp, 0xc
push str.adbkey
push edi
push 0x4a2b7e
mov ebx, dword [ebp - 0x244]
push ebx
mov ecx, dword [ebp - 0x240]
push ecx
call fcn.00496460
add esp, 0x20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4ddfe8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.get_user_keyfilepath
push str.system_core_adb_adb_auth_host.c
push 0x4a2b60
push ebx
call fcn.0040bf60
call sub.msvcrt.dll__errno
add esp, 0xc
mov dword [eax], esi
push edi
push str.home__s_n
push ebx
call fcn.0040bf60
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ddfe8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
jmp 0x40bfbc
sub esp, 0xc
lea ebx, [ebp - 0x236]
mov edi, ebx
push ebx
push 0
push 0
push 0x28
push 0
call sub.SHELL32.DLL_SHGetFolderPathA
add esp, 0xc
jmp 0x40bfaf
test byte [0x4ddfd9], 4
je 0x40bfe5
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4ddfe8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.get_user_keyfilepath
push str.system_core_adb_adb_auth_host.c
push 0x4a2b60
push ebx
call fcn.0040bf60
call sub.msvcrt.dll__errno
add esp, 0xc
mov dword [eax], esi
push edi
push str.Cannot_mkdir__s
push ebx
call fcn.0040bf60
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ddfe8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
or eax, 0xffffffff
jmp 0x40bfe8
Function at 0x40fb60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov esi, eax
lea eax, [ebp - 0x14]
mov edi, edx
push eax
call fcn.00415c40
add esp, 0x10
test eax, eax
jne 0x40fc55
sub esp, 0xc
push 0xc
call sub.msvcrt.dll_malloc
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x40fc40
mov dword [ebx], esi
mov dword [ebx + 8], edi
mov eax, dword [ebp - 0x10]
mov dword [ebx + 4], eax
push esi
push ebx
push 0
push 0x40faf0
call sub.msvcrt.dll__beginthread
add esp, 0x10
inc eax
je 0x40fc6d
test byte [0x4ddfd9], 2
jne 0x40fbd0
mov eax, dword [ebp - 0x14]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4ddfe8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.create_service_thread
push str.system_core_adb_services.c
push 0x4a37d3
push ebx
call fcn.0040fb40
call sub.msvcrt.dll__errno
mov dword [eax], esi
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push str.service_thread_started___d:_d_n
push ebx
call fcn.0040fb40
add esp, 0x14
push ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ddfe8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
jmp 0x40fbc4
sub esp, 0xc
push str.cannot_allocate_stinfo
call fcn.00401470
add esp, 0x10
jmp 0x40fb98
sub esp, 0xc
push str.cannot_create_service_socket_pair_n
call fcn.0040fb20
or eax, 0xffffffff
add esp, 0x10
jmp 0x40fbc7
sub esp, 0xc
push ebx
call sub.msvcrt.dll_free
pop ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.00414270
pop eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.00414270
mov dword [esp], str.cannot_create_service_thread_n
call fcn.0040fb20
or eax, 0xffffffff
add esp, 0x10
jmp 0x40fbc7
Function at 0x4122f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
push 0x412760
call sub.msvcrt.dll__beginthread
add esp, 0x10
inc eax
je 0x412310
leave
ret
sub esp, 0xc
push str.cannot_create_input_thread
call fcn.00402690
add esp, 0x10
leave
ret

Function at 0x412ed0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x120
push str.ANDROID_SDK_HOME
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x412f06
push eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push str._s_s_s
push eax
push ebx
call fcn.00412e90
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
sub esp, 0xc
lea ebx, [ebp - 0x108]
push ebx
push 0
push 0
push 0x28
push 0
call sub.SHELL32.DLL_SHGetFolderPathA
add esp, 0xc
push ebx
jmp 0x412eec
Function at 0x4151d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
call fcn.004140a0
mov edx, eax
test eax, eax
je 0x4151f3
mov dword [ebp - 4], 1
cmp dword [eax], 0x4a4b74
je 0x4151f5
leave
ret
sub esp, 0xc
lea eax, [ebp - 4]
push 4
push eax
push 1
push 6
mov eax, dword [edx + 0xc]
push eax
call sub.WS2_32.DLL_setsockopt
add esp, 0xc
leave
ret

Function at 0x415700
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x4daf58]
test eax, eax
je 0x415714
leave
ret
lea eax, [ebp - 0x190]
push ecx
push ecx
push eax
push 0x202
call sub.WS2_32.DLL_WSAStartup
pop ecx
test eax, eax
pop edx
jne 0x415750
sub esp, 0xc
push 0x415770
call section..text
mov dword [0x4daf58], 1
add esp, 0x10
leave
ret
sub esp, 0xc
push str.adb:_could_not_initialize_Winsock_n
call fcn.00401470
add esp, 0x10
jmp 0x41572d
Function at 0x415800
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [ebp + 8]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push esi
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
pop ebx
xor eax, eax
cmp esi, 0xffffffff
je 0x415852
push ecx
push ecx
push 0
push esi
call sub.KERNEL32.dll_GetFileSize
xor ebx, ebx
mov edi, eax
pop eax
test edi, edi
pop edx
jne 0x415860
sub esp, 0xc
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [eax], edi
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
lea eax, [edi + 1]
push eax
call sub.msvcrt.dll_malloc
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x4158b1
sub esp, 0xc
lea eax, [ebp - 0x10]
push 0
push eax
push edi
push ebx
push esi
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x415892
cmp edi, dword [ebp - 0x10]
je 0x41583f
cmp byte [0x4ddfd8], 0
js 0x41593e
sub esp, 0xc
xor edi, edi
push ebx
call sub.msvcrt.dll_free
xor ebx, ebx
add esp, 0x10
jmp 0x41583f
cmp byte [0x4ddfd8], 0
js 0x4158be
xor edi, edi
jmp 0x41583f
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
push 0x4ddfe8
mov dword [ebp - 0x28], eax
call sub.KERNEL32.dll_EnterCriticalSection
mov eax, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add eax, 0x40
push str.load_file
mov dword [ebp - 0x2c], eax
push str.system_core_adb_sysdeps_win32.c
push str._s::_s__:
push eax
call fcn.00413550
call sub.msvcrt.dll__errno
add esp, 0xc
mov edx, dword [ebp - 0x28]
mov dword [eax], edx
push edi
mov edi, dword [ebp - 0x2c]
push str.load_file:_could_not_allocate__ld_bytes_n
push edi
call fcn.00413550
pop ecx
mov edx, dword [ebp - 0x2c]
push edx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ddfe8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
xor edi, edi
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x28]
mov dword [eax], edx
jmp 0x41583f
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
push 0x4ddfe8
mov dword [ebp - 0x24], eax
call sub.KERNEL32.dll_EnterCriticalSection
mov eax, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add eax, 0x40
push str.load_file
mov dword [ebp - 0x20], eax
push str.system_core_adb_sysdeps_win32.c
push str._s::_s__:
push eax
call fcn.00413550
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x24]
mov dword [eax], edx
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x20]
push edi
push str.load_file:_could_not_read__ld_bytes_from__s_n
push eax
call fcn.00413550
add esp, 0x14
mov eax, dword [ebp - 0x20]
push eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ddfe8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x24]
mov dword [eax], edx
jmp 0x41589f
Function at 0x4160a0
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov eax, 0x4a4b74
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 0xc]
call fcn.00413f80
mov esi, eax
or eax, 0xffffffff
test esi, esi
je 0x4161a4
mov eax, dword [0x4daf58]
test eax, eax
je 0x4161b0
sub esp, 0xc
mov eax, dword [ebp + 8]
and eax, 0xffff
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov word [ebp - 0x20], 2
push eax
call sub.WS2_32.DLL_htons
mov word [ebp - 0x1e], ax
push 0
call sub.WS2_32.DLL_htonl
mov dword [ebp - 0x1c], eax
push eax
push eax
push 0
push edi
push 2
call sub.WS2_32.DLL_socket
add esp, 0x14
mov ebx, eax
cmp eax, 0xffffffff
je 0x416269
sub esp, 0xc
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push 4
push eax
push 0xfffffffffffffffb
push 0xffff
push ebx
call sub.WS2_32.DLL_setsockopt
push eax
push eax
lea eax, [ebp - 0x20]
push 0x10
push eax
push ebx
call sub.WS2_32.DLL_bind
add esp, 0x14
test eax, eax
js 0x416269
mov edx, str.udp:
cmp edi, 1
je 0x416250
push eax
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, esi
push edx
call fcn.00413050
push eax
lea eax, [esi + 0x18]
push str._d_any_server:_s_d_
push 0x20
push eax
call fcn.00496460
add esp, 0x20
cmp byte [0x4ddfd8], 0
js 0x4161c0
mov eax, esi
call fcn.00413050
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00415700
jmp 0x4160d0
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
push 0x4ddfe8
mov dword [ebp - 0x30], eax
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.socket_inaddr_any_server
push str.system_core_adb_sysdeps_win32.c
push str._s::_s__:
push ebx
call fcn.00413550
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x30]
mov dword [eax], edx
mov eax, esi
call fcn.00413050
add esp, 0x10
mov edx, 0x4a47a8
dec edi
je 0x416278
sub esp, 0xc
mov edi, dword [ebp + 8]
push eax
push edx
push edi
push str.socket_inaddr_server:_port__d_type__s___fd__d_n
push ebx
call fcn.00413550
add esp, 0x14
push ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ddfe8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x30]
mov dword [eax], edx
jmp 0x41619d
push eax
push eax
push 4
push ebx
call sub.WS2_32.DLL_listen
pop edx
test eax, eax
pop ecx
mov edx, 0x4a478e
jns 0x416172
mov eax, esi
call fcn.004130a0
or eax, 0xffffffff
jmp 0x4161a4
mov edx, 0x4a47ac
jmp 0x416214