joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43af18
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x44e6e0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0043aead
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00426aa0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x43af67
cmp dword [ebp - 0x1c], 5
jb 0x43af7f
jmp 0x43af7b
cmp dword [ebp - 0x10], 1
jne 0x43af7f
cmp dword [ebp - 0x1c], 4
ja 0x43af7b
jne 0x43af7f
cmp dword [ebp - 0x18], 0
jbe 0x43af7f
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x443e38
call fcn.0043ad81
test eax, eax
jge 0x43afa0
mov byte [0x59e18c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004242e8
add ebp, 0x78
leave
ret
Function at 0x1002712
Capabilities:
Query environment variable

Disassembly:
inc ah
xor al, 0xd
add ch, 0xcc
mov al, bh
imul esi, ebp
dec esi
movzx edi, al
test cl, dl
adc al, dh
jb 0x10026ea
test ah, 0x77
inc edi
add dh, ch
imul edx, ebp, 0x9b23f6bf
inc esi
inc ecx
add ebp, 0x9172
imul edx, ecx
test dl, dh
add ebp, 0x7d
movzx ecx, bh
imul ecx, ecx, 0x3b4bb485
push 0xfba379
push 0x250e20
test dh, 0x32
mov ebx, edx
push 0x92c717
push ebp
imul esi, eax, 0x1daf1d88
mov dl, 0x60
test ebp, 0x5cee0891
call 0x1002736
pop edi
mov al, cl
mov edx, eax
adc eax, eax
movsx edx, al
xor ecx, ecx
mov ebx, edx
jbe 0x1002756
imul edx, edi, 0xc4c388fa
test ebp, 0xbee96bfa
or dh, dl
test eax, ebx
jo 0x100275c
test dl, ch
or cl, dl
lea edx, [0xd3e5a2b2]
movzx edx, ax
push ecx
mov ebp, 0x45091f68
dec ecx
pop ebx
sub dh, al
mov dl, al
mov ch, 7
lea esi, [ebx]
mov dl, al
xchg edx, edx
mov dl, dh
mov cl, 0xa2
xchg cl, cl
xor eax, esi
test ebp, 0x66025640
dec ebp
mov bh, 0x94
sub ebx, 0x28029acf
inc ebx
test ah, dh
sub esi, esi
inc ebp
and ecx, 0x37a986b6
lea ebp, [0x96e1a4b9]
adc edx, 0xfb5766c0
cmp eax, ecx
mov ah, 0x35
xchg ebp, ecx
add esi, 0x77e
and edx, ebx
add ebx, esi
imul eax, eax, 0x745aff5
sub esi, 0x77d
movsx ebx, bl
xchg eax, ecx
test ebx, 0xd83464df
inc dl
test ecx, eax
jno 0x10027e3
mov bh, 0x11
imul ebp, esi, 0x639b17b6
cmp esi, 0x162
jb 0x100279a
or eax, 0xf0c91c8f
movzx edx, di
imul edx, edi
mov ebp, 0x68ac1ccf
mov esi, 0x9c08029
mov esi, 0x861f6e5f
mov edx, 0x83340280
mov edx, edx
add edi, 0x7e7fa
imul ebp, edi
movzx ebx, dx
xchg edx, esi
sub edi, 0x77872
or cl, 0xe3
mov esi, ecx
push esi
test esi, edx
js 0x100283c
mov ah, 0xf1
mov ebp, 0x28db3143
add al, 0x24
imul ebp, edx
imul esi, edi
dec edx
dec edx
xchg eax, ebx
test ecx, ecx
jbe 0x100284f
mov dh, al
inc edx
inc ebp
lea esi, [0xcf6c]
cmp eax, 0x6b97503f
add esi, 0x2ce
lea edx, [0xcd0be375]
inc edx
mov ebx, ecx
add ecx, esi
inc eax
test eax, 0xf4d8d88
xchg dh, al
push esi
push 0xb0398e
inc ecx
push edi
test edi, eax
jo 0x100288b
movsx edx, cl
xor ebp, eax
movsx ebp, cx
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41e004]
jne 0x40100a
repz ret
jmp fcn.004019fd

Function at 0x408d4b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403d8b
and dword [ebp - 0x14], 0
cmp dword [0x420708], 0
mov dword [ebp - 0x18], eax
jne 0x408dfe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408ea6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408ea6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x420708], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42070c], eax
call edi
push eax
call esi
push 0x41c8e8
push ebx
mov dword [0x420710], eax
call edi
push eax
call esi
mov dword [0x420718], eax
test eax, eax
je 0x408dfe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x420714], eax
mov eax, dword [0x420714]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408e57
cmp dword [0x420718], ecx
je 0x408e57
push eax
call esi
push dword [0x420718]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408e57
test ebx, ebx
je 0x408e57
call edi
test eax, eax
je 0x408e4e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408e4e
test byte [ebp - 8], 1
jne 0x408e57
or dword [ebp + 0x10], 0x200000
jmp 0x408e8a
mov eax, dword [0x42070c]
cmp eax, dword [ebp - 0x18]
je 0x408e8a
push eax
call esi
test eax, eax
je 0x408e8a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408e8a
mov eax, dword [0x420710]
cmp eax, dword [ebp - 0x18]
je 0x408e8a
push eax
call esi
test eax, eax
je 0x408e8a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x420708]
call esi
test eax, eax
je 0x408ea6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408ea8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x41a4e0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x4220dc]
push ebx
push esi
mov esi, dword [0x421dfc]
mov ebx, eax
cmp eax, 0x5dd
jne 0x41a502
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x41f1c0]
call fcn.0041a3c0
cmp dword [0x4220dc], 0x2f
jne 0x41a51d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call fcn.0041a400
add esp, 4
cmp dword [0x4220dc], 0x568
pop esi
pop ebx
jne 0x41a54a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
ret
Function at 0x403b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x3c
push 0x401450
call section..text
pop eax
pop edx
push 1
push 0x401460
call sub.KERNEL32.dll_SetConsoleCtrlHandler
pop esi
pop eax
call fcn.00404c90
mov dword [0x4c8008], 1
call fcn.004129c0
call fcn.00411c00
sub esp, 0xc
push 0x15b3
call fcn.00406f10
call fcn.0040cb30
add esp, 0xc
mov ebx, dword [ebp + 0xc]
push ebx
lea ebx, [ebp - 0x2a]
push 0x1e
push ebx
call fcn.004014c0
xor ecx, ecx
mov edx, str.smartsocket
mov eax, ebx
call fcn.00401d50
add esp, 0x10
test eax, eax
jne 0x403c40
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x403c16
test byte [0x4dcfc8], 1
je 0x403c03
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.adb_main
push str.system_core_adb_adb.c
push 0x49d056
push ebx
call fcn.004013a0
call sub.msvcrt.dll__errno
mov dword [eax], esi
pop eax
pop edx
push str.Event_loop_starting_n
push ebx
call fcn.004013a0
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
call fcn.00412fd0
call fcn.00411800
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
sub esp, 0xc
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
lea edx, [ebp - 0xc]
push 0
push edx
push 3
push 0x49d7bf
push eax
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
call fcn.00401bc0
jmp 0x403b93
sub esp, 0xc
push 1
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
Function at 0x407f00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1008
call fcn.00495580
mov eax, dword [ebp - 0x10]
mov esi, eax
test eax, eax
js 0x40809a
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [ebp - 0x1014], eax
lea esi, [esi]
test byte [0x4dcfc8], 1
jne 0x407fa1
lea esi, [esi]
lea edx, [ebp - 0x100c]
push eax
push 0x1000
push edx
push esi
call fcn.00413e00
add esp, 0x10
mov edi, eax
test byte [0x4dcfc8], 1
jne 0x408017
cmp edi, 0
je 0x40809a
jl 0x4080a2
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [ebp - 0x100c]
add ebx, 0x20
push ebx
push edi
push 1
push eax
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
add esp, 0x10
test byte [0x4dcfc8], 1
je 0x407f40
call sub.msvcrt.dll__errno
sub esp, 0xc
mov ebx, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
add esp, 0xc
push str.read_and_dump
push str.system_core_adb_commandline.c
push 0x4a06d0
mov eax, dword [ebp - 0x1014]
push eax
call fcn.00407d20
call sub.msvcrt.dll__errno
add esp, 0xc
mov dword [eax], ebx
push esi
push str.read_and_dump__:_pre_adb_read_fd_d__n
mov eax, dword [ebp - 0x1014]
push eax
call fcn.00407d20
pop eax
mov eax, dword [ebp - 0x1014]
push eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], ebx
jmp 0x407f40
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
mov dword [ebp - 0x1010], eax
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.read_and_dump
push str.system_core_adb_commandline.c
push 0x4a06d0
push ebx
call fcn.00407d20
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x1010]
mov dword [eax], edx
push edi
push esi
push str.read_and_dump__:_post_adb_read_fd_d_:_len_d_n
push ebx
call fcn.00407d20
add esp, 0x14
push ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x1010]
cmp edi, 0
mov dword [eax], edx
jne 0x407f6e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x407f30
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408840
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
push str.shell:
call fcn.0040b580
add esp, 0x10
mov ebx, eax
test eax, eax
js 0x408890
sub esp, 0xc
push 8
call sub.msvcrt.dll_malloc
add esp, 0xc
mov dword [eax], ebx
mov dword [eax + 4], 0
push eax
push 0
push 0x4088c0
call sub.msvcrt.dll__beginthread
mov eax, ebx
call fcn.00407f00
xor eax, eax
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
call fcn.0040af20
push edx
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x4a0867
add eax, 0x40
push eax
call fcn.00407d20
mov eax, 1
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40bad0
Capabilities:
Create directory
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x248
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x244], edx
push 0x4a16ac
call sub.msvcrt.dll_getenv
add esp, 0x10
mov edi, eax
test eax, eax
je 0x40bc01
test byte [0x4dcfc9], 4
jne 0x40bb93
sub esp, 0xc
push 0x4a16f5
push edi
lea edi, [ebp - 0x133]
push 0x4a16fe
push 0x103
push edi
call fcn.00495c90
add esp, 0x20
cmp eax, 0x102
jle 0x40bb40
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x30]
push esi
push esi
push eax
push edi
call sub.msvcrt.dll__stat
add esp, 0x10
test eax, eax
je 0x40bb67
sub esp, 0xc
push edi
call sub.msvcrt.dll__mkdir
add esp, 0x10
test eax, eax
js 0x40bc22
sub esp, 0xc
push str.adbkey
push edi
push 0x4a16fe
mov ebx, dword [ebp - 0x244]
push ebx
mov ecx, dword [ebp - 0x240]
push ecx
call fcn.00495c90
add esp, 0x20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.get_user_keyfilepath
push str.system_core_adb_adb_auth_host.c
push 0x4a16e0
push ebx
call fcn.0040bab0
call sub.msvcrt.dll__errno
add esp, 0xc
mov dword [eax], esi
push edi
push str.home__s_n
push ebx
call fcn.0040bab0
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
jmp 0x40bb0c
sub esp, 0xc
lea ebx, [ebp - 0x236]
mov edi, ebx
push ebx
push 0
push 0
push 0x28
push 0
call sub.SHELL32.DLL_SHGetFolderPathA
add esp, 0xc
jmp 0x40baff
test byte [0x4dcfc9], 4
je 0x40bb35
call sub.msvcrt.dll__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.get_user_keyfilepath
push str.system_core_adb_adb_auth_host.c
push 0x4a16e0
push ebx
call fcn.0040bab0
call sub.msvcrt.dll__errno
add esp, 0xc
mov dword [eax], esi
push edi
push str.Cannot_mkdir__s
push ebx
call fcn.0040bab0
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], esi
or eax, 0xffffffff
jmp 0x40bb38
Function at 0x40fa00
Capabilities:
Create thread

Disassembly:
push ebp
mov ecx, 4
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, str.tcp:
mov ebx, dword [ebp + 8]
cld
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40fa75
sub esp, 0xc
add ebx, 4
push ebx
call sub.msvcrt.dll_atoi
pop ecx
pop edi
push 0x3a
mov esi, eax
push ebx
call sub.msvcrt.dll_strchr
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x40fab7
sub esp, 0xc
push 0x4dd058
call sub.KERNEL32.dll_EnterCriticalSection
push eax
push eax
lea eax, [ebx + 1]
push 1
push esi
push eax
call fcn.00415ce0
add esp, 0x14
mov esi, eax
push 0x4dd058
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
cld
mov esi, str.dns:
mov ecx, 4
mov edi, ebx
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
or esi, 0xffffffff
cmp dl, al
jne 0x40fa6b
sub esp, 0xc
lea eax, [ebx + 4]
push eax
call sub.msvcrt.dll__strdup
add esp, 0x10
test eax, eax
je 0x40fa6b
lea esp, [ebp - 0xc]
mov edx, eax
mov eax, 0x40f980
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0040f700
push edx
push edx
push 1
push esi
call fcn.004160a0
add esp, 0x10
mov esi, eax
test eax, eax
js 0x40fa6b
sub esp, 0xc
push eax
call fcn.00414c30
add esp, 0x10
jmp 0x40fa6b
Function at 0x411c00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
push 0x412020
call sub.msvcrt.dll__beginthread
add esp, 0x10
inc eax
je 0x411c20
leave
ret
sub esp, 0xc
push str.cannot_create_input_thread
call fcn.00402820
add esp, 0x10
leave
ret

Function at 0x412940
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x120
push str.ANDROID_SDK_HOME
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x412976
push eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push str._s_s_s
push eax
push ebx
call fcn.00412900
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
sub esp, 0xc
lea ebx, [ebp - 0x108]
push ebx
push 0
push 0
push 0x28
push 0
call sub.SHELL32.DLL_SHGetFolderPathA
add esp, 0xc
push ebx
jmp 0x41295c
Function at 0x414c30
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
call fcn.00413b00
mov edx, eax
test eax, eax
je 0x414c4c
cmp dword [eax], 0x4a3624
je 0x414c50
leave
ret
sub esp, 0xc
lea eax, [ebp - 4]
push 4
push eax
push 1
push 6
mov eax, dword [edx + 0xc]
push eax
call sub.WS2_32.DLL_setsockopt
add esp, 0xc
leave
ret

Function at 0x415160
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x4d9f48]
test eax, eax
je 0x415174
leave
ret
lea eax, [ebp - 0x190]
push ecx
push ecx
push eax
push 0x202
call sub.WS2_32.DLL_WSAStartup
pop ecx
test eax, eax
pop edx
jne 0x4151b0
sub esp, 0xc
push 0x4151d0
call section..text
mov dword [0x4d9f48], 1
add esp, 0x10
leave
ret
sub esp, 0xc
push str.adb:_could_not_initialize_Winsock_n
call fcn.00401470
add esp, 0x10
jmp 0x41518d
Function at 0x415b00
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov eax, 0x4a3624
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 0xc]
call fcn.004139e0
mov esi, eax
or eax, 0xffffffff
test esi, esi
je 0x415c04
mov eax, dword [0x4d9f48]
test eax, eax
je 0x415c10
sub esp, 0xc
mov eax, dword [ebp + 8]
and eax, 0xffff
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov word [ebp - 0x20], 2
push eax
call sub.WS2_32.DLL_htons
mov word [ebp - 0x1e], ax
push 0
call sub.WS2_32.DLL_htonl
mov dword [ebp - 0x1c], eax
push eax
push eax
push 0
push edi
push 2
call sub.WS2_32.DLL_socket
add esp, 0x14
mov ebx, eax
cmp eax, 0xffffffff
je 0x415cc9
sub esp, 0xc
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push 4
push eax
push 0xfffffffffffffffb
push 0xffff
push ebx
call sub.WS2_32.DLL_setsockopt
push eax
push eax
lea eax, [ebp - 0x20]
push 0x10
push eax
push ebx
call sub.WS2_32.DLL_bind
add esp, 0x14
test eax, eax
js 0x415cc9
mov edx, str.udp:
cmp edi, 1
je 0x415cb0
push eax
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, esi
push edx
call fcn.00412aa0
push eax
lea eax, [esi + 0x18]
push str._d_any_server:_s_d_
push 0x20
push eax
call fcn.00495c90
add esp, 0x20
cmp byte [0x4dcfc8], 0
js 0x415c20
mov eax, esi
call fcn.00412aa0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00415160
jmp 0x415b30
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
push 0x4dcfd8
mov dword [ebp - 0x30], eax
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.socket_inaddr_any_server
push str.system_core_adb_sysdeps_win32.c
push str._s::_s__:
push ebx
call fcn.00412fb0
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x30]
mov dword [eax], edx
mov eax, esi
call fcn.00412aa0
add esp, 0x10
mov edx, 0x4a3258
dec edi
je 0x415cd8
sub esp, 0xc
mov edi, dword [ebp + 8]
push eax
push edx
push edi
push str.socket_inaddr_server:_port__d_type__s___fd__d_n
push ebx
call fcn.00412fb0
add esp, 0x14
push ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x30]
mov dword [eax], edx
jmp 0x415bfd
push eax
push eax
push 4
push ebx
call sub.WS2_32.DLL_listen
pop edx
test eax, eax
pop ecx
mov edx, 0x4a323e
jns 0x415bd2
mov eax, esi
call fcn.00412af0
or eax, 0xffffffff
jmp 0x415c04
mov edx, 0x4a325c
jmp 0x415c74
Function at 0x415ce0
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov eax, 0x4a3624
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 0x10]
call fcn.004139e0
mov esi, eax
or eax, 0xffffffff
test esi, esi
je 0x415dec
mov edx, dword [0x4d9f48]
test edx, edx
je 0x415df4
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
call sub.WS2_32.DLL_gethostbyname
add esp, 0xc
mov ebx, eax
test eax, eax
je 0x415ea3
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, dword [eax + 8]
sub esp, 0xc
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0xc]
and eax, 0xffff
push eax
call sub.WS2_32.DLL_htons
mov word [ebp - 0x1a], ax
sub esp, 8
movsx eax, word [ebx + 0xa]
mov edx, dword [ebx + 0xc]
push eax
lea ecx, [ebp - 0x18]
mov eax, dword [edx]
push eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0x1c
push 0
push edi
movsx eax, word [ebx + 8]
push eax
call sub.WS2_32.DLL_socket
pop edx
cmp eax, 0xffffffff
je 0x415ea3
mov dword [esi + 0xc], eax
lea edx, [ebp - 0x1c]
push ebx
push 0x10
push edx
push eax
call sub.WS2_32.DLL_connect
pop ecx
test eax, eax
js 0x415ea3
mov eax, str.udp:
cmp edi, 1
je 0x415e92
mov ebx, dword [ebp + 0xc]
push edx
push edx
push ebx
push eax
mov eax, esi
call fcn.00412aa0
push eax
lea eax, [esi + 0x18]
push str._d_net_client:_s_d_
push 0x20
push eax
call fcn.00495c90
add esp, 0x20
cmp byte [0x4dcfc8], 0
js 0x415e00
mov eax, esi
call fcn.00412aa0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00415160
jmp 0x415d11
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
push 0x4dcfd8
mov dword [ebp - 0x20], eax
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add ebx, 0x40
push str.socket_network_client
push str.system_core_adb_sysdeps_win32.c
push str._s::_s__:
push ebx
call fcn.00412fb0
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x20]
mov dword [eax], edx
mov eax, esi
call fcn.00412aa0
add esp, 0x10
mov edx, 0x4a3258
dec edi
je 0x415e9c
push ecx
push ecx
push eax
mov eax, dword [ebp + 0xc]
push edx
push eax
mov eax, dword [ebp + 8]
push eax
push str.socket_network_client:_host__s_port__d_type__s___fd__d_n
push ebx
call fcn.00412fb0
add esp, 0x14
push ebx
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x20]
mov dword [eax], edx
jmp 0x415de5
mov eax, 0x4a323e
jmp 0x415dba
mov edx, 0x4a325c
jmp 0x415e54
mov eax, esi
call fcn.00412af0
or eax, 0xffffffff
jmp 0x415dec
Function at 0x415ec0
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov eax, 0x4a3624
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
call fcn.004139e0
mov ebx, eax
test eax, eax
jne 0x415ee4
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x4d9f48]
test eax, eax
je 0x415fd0
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], 0
and eax, 0xffff
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov word [ebp - 0x20], 2
push eax
call sub.WS2_32.DLL_htons
mov word [ebp - 0x1e], ax
lea edi, [ebp - 0x20]
push 0x7f000001
call sub.WS2_32.DLL_htonl
mov dword [ebp - 0x1c], eax
push eax
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
push 2
call sub.WS2_32.DLL_socket
add esp, 0x14
mov esi, eax
cmp eax, 0xffffffff
je 0x415ed9
sub esp, 0xc
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x10]
push 4
push eax
push 0xfffffffffffffffb
push 0xffff
push esi
call sub.WS2_32.DLL_setsockopt
push eax
push eax
push 0x10
push edi
push esi
call sub.WS2_32.DLL_bind
add esp, 0x14
test eax, eax
js 0x41607c
mov edx, str.udp:
cmp dword [ebp + 0xc], 1
je 0x416063
push edi
push edi
mov esi, dword [ebp + 8]
mov eax, ebx
push esi
push edx
call fcn.00412aa0
push eax
lea eax, [ebx + 0x18]
push str._d_lo_server:_s_d_
push 0x20
push eax
call fcn.00495c90
add esp, 0x20
cmp byte [0x4dcfc8], 0
js 0x415fda
mov eax, ebx
call fcn.00412aa0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00415160
jmp 0x415ef1
call sub.msvcrt.dll__errno
sub esp, 0xc
mov edi, dword [eax]
push 0x4dcfd8
call sub.KERNEL32.dll_EnterCriticalSection
mov esi, dword [sym.imp.msvcrt.dll__iob]
add esp, 0xc
add esi, 0x40
push str.socket_loopback_server
push str.system_core_adb_sysdeps_win32.c
push str._s::_s__:
push esi
call fcn.00412fb0
call sub.msvcrt.dll__errno
mov dword [eax], edi
mov eax, ebx
call fcn.00412aa0
add esp, 0x10
mov edx, 0x4a3258
cmp dword [ebp + 0xc], 1
je 0x416090
sub esp, 0xc
push eax
push edx
mov ecx, dword [ebp + 8]
push ecx
push str.socket_loopback_server:_port__d_type__s___fd__d_n
push esi
call fcn.00412fb0
add esp, 0x14
push esi
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4dcfd8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt.dll__errno
mov dword [eax], edi
jmp 0x415fc1
push edi
push edi
push 4
push esi
call sub.WS2_32.DLL_listen
pop edx
test eax, eax
pop ecx
mov edx, 0x4a323e
jns 0x415f96
mov eax, ebx
call fcn.00412af0
or eax, 0xffffffff
jmp 0x415edc
mov edx, 0x4a325c
jmp 0x41602b