joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4384e8
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.00401524
and dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp bx, ax
jne 0x438521
movzx ecx, ax
mov eax, ecx
mov edx, edi
shr eax, 0xa
and ecx, 0x3ff
mov dword [esi], eax
call fcn.00438525
pop edi
pop esi
pop ebx
ret

Function at 0x43967f
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x44fa58
call fcn.0044b4c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
or eax, 0xffffffff
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x38]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], 1
mov byte [esi + 3], bl
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
call fcn.00402d43
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.00402d43
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call fcn.00402d43
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
call fcn.00439715
lea ecx, [esi + 0x98]
call fcn.0044b1d0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x43b576
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x44fddc
call fcn.0044b4c0
sub esp, 0x44
push ebx
push esi
push edi
mov esi, ecx
push 0
call fcn.0043a028
push 1
mov ecx, esi
call fcn.0043aacd
mov edx, 0x198
lea ecx, [ebp - 0x20]
call fcn.00438429
mov eax, dword [eax]
lea edi, [esi + 4]
push eax
push 2
push dword [edi]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push dword [ebp - 0x20]
call fcn.004036ef
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
pop ecx
push 2
push dword [edi]
call ebx
push 1
push 1
push 0xf4
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x1bc
push dword [edi]
call ebx
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1be
push dword [edi]
call ebx
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
lea ecx, [ebp - 0x50]
call fcn.0043b70c
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], ebx
call fcn.0043b70c
lea eax, [esi + 0x200]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x1c8], ebx
lea ebx, [esi + 0x1d0]
push ebx
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
setne byte [ebp - 0xd]
call fcn.0043b73d
add ebx, 0x18
lea ecx, [ebp - 0x38]
push ebx
call fcn.0043b73d
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
cmp dword [ebp - 0x40], ebx
je 0x43b690
cmp dword [ebp - 0x4c], ebx
mov byte [esi + 0x21b], 1
jne 0x43b686
push 0x455a58
lea ecx, [ebp - 0x50]
call fcn.00403029
push 0x10
push dword [ebp - 0x50]
push dword [ebp - 0x44]
jmp 0x43b6bb
cmp byte [ebp - 0xd], 0
jne 0x43b6d1
cmp dword [ebp - 0x28], ebx
mov byte [esi + 0x21b], 1
je 0x43b6ea
cmp dword [ebp - 0x34], ebx
jne 0x43b6b4
push 0x455a58
lea ecx, [ebp - 0x38]
call fcn.00403029
push ebx
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
mov eax, esi
neg eax
sbb eax, eax
and eax, edi
push dword [eax]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [ebp - 0xd], 0
je 0x43b6ea
cmp byte [esi + 0x156], 0
jne 0x43b6ea
mov ecx, esi
mov byte [esi + 0x155], 1
call fcn.0043bb42
jmp 0x43b6f3
push ebx
push dword [edi]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x50]
call fcn.00439eef
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x43c883
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esp + 8]
shr eax, 0xf
movzx ecx, word [ecx + 0xc]
and al, 1
cmp ecx, 8
je 0x43c8c4
cmp ecx, 0x52
je 0x43c8b7
cmp ecx, 0x76
je 0x43c8ae
xor al, al
jmp 0x43c8cd
mov ecx, esi
call fcn.0043d296
jmp 0x43c8cb
test al, al
je 0x43c8aa
mov ecx, esi
call fcn.0043d0e4
jmp 0x43c8cb
mov ecx, esi
call fcn.0043d186
mov al, 1
pop esi
ret 4
Function at 0x43d6b9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x45008e
call fcn.0044b4c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x4556f8
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov byte [esi + 0x45], bl
call fcn.00402d43
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.00402d43
or dword [esi + 0x64], 0xffffffff
mov byte [esi + 0x60], bl
mov byte [esi + 0x61], bl
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 5
call fcn.00402d43
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 6
call fcn.00402d43
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x455e8c
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x43ddff
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x4501be
call fcn.0044b4c0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x4556f8
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
call fcn.00402d43
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402d43
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00402d43
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi], 0x455eec
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x43de61
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4501f1
call fcn.0044b4c0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 3
call fcn.0043decb
push dword [esi + 0x24]
call fcn.004036ef
push dword [esi + 0x18]
call fcn.004036ef
push dword [esi + 0xc]
call fcn.004036ef
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi], 0x45572c
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x43e2e0
Capabilities:
Get file system object information

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push edx
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
ret 0xc

Function at 0x43e4e8
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
lea eax, [esp]
neg cl
sbb ecx, ecx
and cl, 1
add ecx, 0x100
or cx, 0x4010
push ecx
push 0x2b4
push eax
push 0x90
push 0x452774
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
add esp, 0x2b4
ret
Function at 0x440eab
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x4504e0
call fcn.0044b4c0
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
push 0xedb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
push 0
sete bl
mov al, bl
neg al
sbb eax, eax
and al, 0xd6
add eax, 0x2a
movzx eax, ax
push eax
push 0xcc
push dword [esi + 0x4c]
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
lea edi, [esi + 0x50]
push dword [ebp - 0x10]
push 0xcc
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x1c]
call fcn.00402d43
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0x4c]
call fcn.0040ad9f
push dword [ebp - 0x1c]
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.0040ad9f
push dword [ebp - 0x1c]
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0xeda
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
neg bl
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
sbb ebx, ebx
and ebx, 0xfffffffb
add ebx, 5
push ebx
push eax
call esi
push ebx
push dword [edi]
call esi
push dword [ebp - 0x1c]
call fcn.004036ef
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x441052
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x450513
call fcn.0044b4c0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi], 0x4556f8
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
mov byte [esi + 0x18], al
mov byte [esi + 0x19], al
mov byte [esi + 0x1a], al
mov byte [esi + 0x1b], al
mov byte [esi + 0x24], al
mov byte [esi + 0x25], al
mov byte [esi + 0x26], al
mov byte [esi + 0x27], al
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
mov byte [esi + 0x32], al
mov byte [esi + 0x33], al
mov byte [esi + 0x3c], al
mov byte [esi + 0x3d], al
lea ecx, [esi + 0x48]
mov byte [esi + 0x3e], al
mov byte [esi + 0x3f], al
call fcn.00402d43
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.00402d43
mov ecx, dword [ebp - 0xc]
or dword [esi + 0x14], 0xffffffff
mov dword [esi], 0x4565a8
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x445653
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 8]
mov ecx, edi
call fcn.0043ed77
mov ecx, dword [edi + 0xf0]
mov edx, 0x456680
mov ecx, dword [ecx]
mov edi, dword [ecx + eax*4]
mov eax, dword [edi]
mov ecx, eax
shr ecx, 0x12
and cl, 1
mov byte [ebp - 0xc], cl
mov ecx, eax
shr ecx, 0xe
and cl, 1
shr eax, 0x10
mov byte [ebp - 8], cl
mov ecx, dword [edi + 0x10]
and al, 1
mov byte [ebp - 4], al
call fcn.004022d7
test al, al
je 0x4456bd
mov ecx, dword [esi + 8]
and byte [ebp - 8], 0
and byte [ebp - 4], 0
call fcn.00443226
cmp eax, 0xd
jne 0x4456bd
mov byte [ebp - 4], 1
mov ecx, dword [edi + 0x10]
mov edx, 0x454380
call fcn.004022d7
test al, al
je 0x4456ef
lea eax, [esi + 0xc]
push 0
push eax
mov ecx, esi
call fcn.00445239
cmp eax, 0xffffffff
jne 0x4456e3
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4456ef
and byte [ebp - 8], 0
and byte [ebp - 4], 0
mov eax, dword [edi]
mov ecx, dword [esi + 8]
shr eax, 0x13
and al, 1
mov byte [esi + 0x19], al
mov eax, dword [edi]
shr eax, 0xf
and al, 1
mov byte [esi + 0x25], al
mov eax, dword [edi]
and byte [esi + 0x3d], 0
shr eax, 0x11
and al, 1
mov byte [esi + 0x31], al
call fcn.00442c06
mov ebx, eax
lea eax, [esi + 0x18]
push eax
mov ecx, esi
lea eax, [ebx + 0x18]
push eax
push dword [ebp - 0xc]
call fcn.0044510f
lea eax, [esi + 0x24]
mov ecx, esi
push eax
lea eax, [ebx + 0x1c]
push eax
push dword [ebp - 8]
call fcn.0044510f
lea eax, [esi + 0x30]
mov ecx, esi
push eax
lea eax, [ebx + 0x1a]
push eax
push dword [ebp - 4]
call fcn.0044510f
lea eax, [esi + 0x3c]
mov ecx, esi
push eax
lea eax, [ebx + 0x1e]
push eax
push 1
call fcn.0044510f
cmp byte [ebp - 0xc], 0
je 0x44579b
cmp byte [ebx + 0x19], 0
jne 0x44579b
test byte [edi], 1
jne 0x44579b
push dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [esi + 4]
call edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x1c]
push dword [esi + 4]
call edi
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4478ab
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x450bc3
call fcn.0044b4c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x456f44
mov dword [esi + 4], 0x456f2c
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov dword [ebp - 4], ebx
call fcn.00402d43
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 1
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov byte [esi + 0x58], bl
mov byte [esi + 0x59], bl
mov dword [esi], 0x456f10
mov dword [esi + 4], 0x456ef8
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x447ae2
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x450c3b
call fcn.0044b4c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.00402d43
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.00412b54
lea ecx, [esi + 0x30]
call fcn.00402d43
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x447ffa
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x450e52
call fcn.0044b4c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.00402d43
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402d43
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
mov byte [esi + 0x24], bl
mov byte [esi + 0x25], bl
mov dword [esi + 0x2c], ebx
call fcn.00402d43
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x448de6
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4510c8
call fcn.0044b4c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x4556f8
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
mov dword [esi + 8], ebx
call fcn.00402d43
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x18], bl
mov byte [esi + 0x19], bl
mov byte [esi + 0x1a], bl
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
or dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x38], 1
mov dword [esi], 0x4570cc
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44b0d0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x44b0f8
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44b107
mov eax, 1
ret 4

Function at 0x44b110
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 4
mov edi, ecx
mov ecx, dword [esp + 0x14]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
mov esi, eax
add esp, 0x18
mov dword [edi], esi
test esi, esi
je 0x44b156
mov edx, dword [esp + 0x10]
push edx
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x44b156
mov eax, edi
pop edi
pop esi
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44b151
pop edi
mov eax, 1
pop esi
ret 8

Function at 0x44b3ba
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44b410
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x457344
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44b403
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x44b412
xor eax, eax
pop esi
leave
ret 4
Function at 0x404e80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 4
mov ebx, dbg.client_socket_thread
mov eax, dword [0x422008]
test eax, eax
jne 0x404e9a
mov ebx, dbg.server_socket_thread
test byte [0x434b38], 8
je 0x404ec4
mov edx, str.client
test eax, eax
je 0x404ee0
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push edx
push str.transport:_local__s_init_n
push eax
call sym._fprintf_3
add esp, 0x10
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push ebx
call sym.__beginthread
add esp, 0x10
inc eax
je 0x404ee7
mov ebx, dword [ebp - 4]
leave
ret
mov edx, 0x41b19d
jmp 0x404eac
mov ecx, dword [0x422008]
mov eax, str.client
test ecx, ecx
jne 0x404efb
mov eax, 0x41b19d
push edx
push edx
push eax
push str.cannot_create_local_socket__s_thread
call dbg.fatal_errno
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x404f10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
mov edi, dword [ebp + 0xc]
push str.ADBHOST
call sym._getenv
add esp, 0x10
test eax, eax
je 0x404fa0
push ecx
push 1
push edi
push eax
call dbg.socket_network_client
add esp, 0x10
mov esi, eax
test eax, eax
js 0x404fa0
test byte [0x434b38], 8
jne 0x404f86
sub esp, 0xc
lea ebx, [ebp - 0x4c]
push esi
call dbg.disable_tcp_nagle
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x41b216
push str._s_d
push 0x40
push ebx
call sym.___mingw_snprintf
add esp, 0x20
push 1
push edi
push ebx
push esi
call dbg.register_socket_transport
xor eax, eax
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push esi
push str.client:_connected_on_remote_on_fd__d_n
push eax
call sym._fprintf_3
add esp, 0x10
jmp 0x404f49
push edx
push edx
push 1
push edi
call dbg.socket_loopback_client
add esp, 0x10
mov esi, eax
or eax, 0xffffffff
test esi, esi
jns 0x404f40
jmp 0x404f7e

Function at 0x4057c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1008
call fcn.00412fe0
mov eax, dword [ebp - 0x10]
mov ebx, eax
test eax, eax
js 0x40582a
mov edi, dword [sym.imp.msvcrt.dll__iob]
lea esi, [ebp - 0x100c]
add edi, 0x20
lea esi, [esi]
push ecx
push 0x1000
push esi
push ebx
call dbg.adb_read
add esp, 0x10
cmp eax, 0
je 0x40582a
jl 0x405820
push edi
push eax
push 1
push esi
call sym._fwrite
mov dword [esp], edi
call sym._fflush
add esp, 0x10
jmp 0x4057f0
call sym.__errno
cmp dword [eax], 4
je 0x4057f0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405ae0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
push 0x41cb07
call dbg.adb_connect
add esp, 0x10
mov ebx, eax
test eax, eax
js 0x405b30
sub esp, 0xc
push 8
call sym._malloc
add esp, 0xc
mov dword [eax], ebx
mov dword [eax + 4], 0
push eax
push 0
push dbg.stdin_read_thread
call sym.__beginthread
mov eax, ebx
call dbg.read_and_dump
xor eax, eax
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
call dbg.adb_error
push ecx
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x41cb0e
add eax, 0x40
push eax
call sym._fprintf_5
mov eax, 1
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x405b60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x418
xor ebx, ebx
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x40c]
mov edx, dword [eax]
mov dword [ebp - 0x410], edx
mov edi, dword [eax + 4]
push eax
call sym._free
add esp, 0x10
push eax
push 0x400
push esi
push edi
call sym._read
add esp, 0x10
cmp eax, 0
je 0x405bd0
jl 0x405c20
xor ecx, ecx
mov dl, byte [ecx + esi]
cmp dl, 0xd
je 0x405be0
ja 0x405be7
cmp dl, 0xa
je 0x405be0
xor ebx, ebx
inc ecx
cmp ecx, eax
jne 0x405ba4
push edx
push eax
mov eax, dword [ebp - 0x410]
push esi
push eax
call dbg.adb_write
add esp, 0x10
test eax, eax
jg 0x405b8b
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, 1
jmp 0x405bb5
cmp dl, 0x2e
je 0x405bfa
cmp dl, 0x7e
jne 0x405bb3
cmp ebx, 1
jne 0x405bb5
mov bl, 2
jmp 0x405bb5
cmp ebx, 2
jne 0x405bb3
mov eax, dword [sym.imp.msvcrt.dll__iob]
push ecx
add eax, 0x40
push ecx
push str._n_disconnect__n
push eax
call sym._fprintf_5
mov dword [esp], 0
call sym._exit
call sym.__errno
cmp dword [eax], 4
je 0x405b8b
jmp 0x405bd0
Function at 0x4094f0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0x434ba8
call sub.KERNEL32.dll_EnterCriticalSection
push ebx
call sub.WS2_32.DLL_gethostbyname
mov esi, eax
push ebx
call sym._free
add esp, 0x10
test esi, esi
je 0x409555
push eax
push 4
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
push eax
push edi
call dbg.writex
add esp, 0x10
sub esp, 0xc
push 0x434ba8
call sub.KERNEL32.dll_LeaveCriticalSection
push edi
call dbg.adb_close
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
lea eax, [ebp - 0x10]
push 4
push eax
push edi
call dbg.writex
add esp, 0x10
jmp 0x409537

Function at 0x409570
Capabilities:
Create thread

Disassembly:
push ebp
mov ecx, 4
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, str.tcp:
mov ebx, dword [ebp + 8]
cld
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4095e5
sub esp, 0xc
add ebx, 4
push ebx
call sym._atoi
pop edi
mov esi, eax
pop eax
push 0x3a
push ebx
call sym._strchr
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x40960d
sub esp, 0xc
push 0x434ba8
call sub.KERNEL32.dll_EnterCriticalSection
lea eax, [ebx + 1]
push ecx
push ecx
push 1
push esi
push eax
call dbg.socket_network_client
add esp, 0x14
mov ebx, eax
push 0x434ba8
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, ebx
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cld
mov esi, str.dns:
mov ecx, 4
mov edi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x409667
mov edx, dword [0x422008]
test edx, edx
je 0x409630
or ebx, 0xffffffff
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
push ebx
push ebx
push 1
push esi
call dbg.socket_loopback_client
add esp, 0x10
mov ebx, eax
test eax, eax
js 0x409603
sub esp, 0xc
push eax
call dbg.disable_tcp_nagle
add esp, 0x10
jmp 0x409603
cld
mov edi, str.shell:
mov ecx, 6
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x409600
lea ecx, [ebx + 6]
mov edx, 0x41dabc
cmp byte [ebx + 6], 0
jne 0x409656
xor ecx, ecx
mov edx, 0x41dac7
lea esp, [ebp - 0xc]
mov eax, str._bin_sh
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.create_subprocess
sub esp, 0xc
lea eax, [ebx + 4]
or ebx, 0xffffffff
push eax
call sym._strdup
add esp, 0x10
test eax, eax
je 0x409603
lea esp, [ebp - 0xc]
mov edx, eax
mov eax, dbg.dns_service
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.create_service_thread
Function at 0x40b8e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
push dbg.device_poll_thread
call sym.__beginthread
add esp, 0x10
inc eax
je 0x40b900
leave
ret
sub esp, 0xc
push str.cannot_create_input_thread
call dbg.fatal_errno
add esp, 0x10
leave
ret