joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ae15
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x468744]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00441362
and dword [ebp - 0x14], 0
cmp dword [0x46ae14], 0
mov dword [ebp - 0x18], eax
jne 0x44aec8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x44af70
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x455b98
push ebx
call edi
test eax, eax
je 0x44af70
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46ae14], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46ae18], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46ae1c], eax
call edi
push eax
call esi
mov dword [0x46ae24], eax
test eax, eax
je 0x44aec8
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46ae20], eax
mov eax, dword [0x46ae20]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x44af21
cmp dword [0x46ae24], ecx
je 0x44af21
push eax
call esi
push dword [0x46ae24]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x44af21
test ebx, ebx
je 0x44af21
call edi
test eax, eax
je 0x44af18
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x44af18
test byte [ebp - 8], 1
jne 0x44af21
or dword [ebp + 0x10], 0x200000
jmp 0x44af54
mov eax, dword [0x46ae18]
cmp eax, dword [ebp - 0x18]
je 0x44af54
push eax
call esi
test eax, eax
je 0x44af54
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x44af54
mov eax, dword [0x46ae1c]
cmp eax, dword [ebp - 0x18]
je 0x44af54
push eax
call esi
test eax, eax
je 0x44af54
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46ae14]
call esi
test eax, eax
je 0x44af70
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x44af72
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00438786
leave
ret
Function at 0x403baa
Capabilities:
Identify system language via api

Disassembly:
push ecx
cmp byte [0x47b000], 0
push ebx
push ebp
push esi
push edi
mov ebx, 0xffff
mov ebp, 0x47b000
je 0x403bca
push ebp
call fcn.00405e89
jmp 0x403bd0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [esp + 0x10], eax
xor esi, esi
mov edi, dword [0x44aa64]
mov eax, edi
dec edi
test eax, eax
je 0x403c2c
mov eax, dword [0x44aa28]
mov ecx, dword [eax + 0x64]
mov edx, ecx
imul ecx, edi
neg edx
add ecx, dword [0x44aa60]
mov ax, word [esp + 0x10]
mov esi, ecx
xor ax, word [ecx]
and eax, ebx
test ax, ax
je 0x403c14
mov eax, edi
dec edi
add ecx, edx
test eax, eax
jne 0x403bf8
jmp 0x403c2c
mov eax, dword [esi + 2]
mov dword [0x446a00], eax
mov eax, dword [esi + 6]
mov dword [0x44aac8], eax
lea eax, [esi + 0xa]
mov dword [0x4469fc], eax
cmp dword [0x4469fc], 0
jne 0x403c47
cmp bx, 0xffff
jne 0x403c43
mov ebx, 0x3ff
jmp 0x403bd6
xor ebx, ebx
jmp 0x403bd6
movzx eax, word [esi]
push eax
push ebp
call fcn.00405e70
push 0xfffffffffffffffe
push 0x446a20
call fcn.00405f42
push eax
push dword [0x4343c0]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x44aa4c]
mov esi, dword [0x44aa48]
mov ecx, eax
dec eax
test ecx, ecx
je 0x403c9b
lea ebx, [esi + 0x18]
lea ebp, [eax + 1]
mov edi, 0x2018
mov eax, dword [esi]
test eax, eax
je 0x403c94
push eax
push ebx
call fcn.00405f42
add esi, edi
add ebx, edi
dec ebp
jne 0x403c87
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x405743
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x439be8], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x405767
test al, 0x10
jne 0x40576a
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x439be8
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405795
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x40621c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406241
mov eax, dword [0x4098b8]
cmp eax, 0xffffffff
je 0x406238
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x4098b8], 0xffffffff
jmp 0x4062b4
cmp dword [0x43a980], ebx
je 0x4062b4
cmp byte [0x43a580], bl
je 0x406280
cmp dword [0x4098b8], 0xffffffff
jne 0x406289
push 4
push 0x40000000
push 0x43a580
call fcn.00405be4
cmp eax, 0xffffffff
mov dword [0x4098b8], eax
je 0x4062b4
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x4098b8], 0xffffffff
je 0x4062b4
push esi
mov esi, 0x43e9c0
push 0x409a8c
push esi
call fcn.00405f31
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.00405f24
push eax
push esi
push dword [0x4098b8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40637a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x43a174], esi
push edi
jne 0x4063b4
mov ecx, 0x43a170
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x406390
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x43a570
jl 0x40638b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x4063e9
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43a170]
xor eax, esi
inc ecx
dec edx
jne 0x4063cc
pop edi
pop esi
not eax
ret 0xc

Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret
Function at 0x401570
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
test byte [ebp + 0xc], 1
jne 0x401582
mov ebx, dword [ebp - 4]
leave
ret
mov dword [ebp - 8], 0x10
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
push eax
call dbg.adb_socket_accept
add esp, 0x10
mov ebx, eax
test eax, eax
js 0x40157d
sub esp, 0xc
mov dword [ebp - 0xc], 0x10000
lea eax, [ebp - 0xc]
push 4
push eax
push 0x1002
push 0xffff
push ebx
call sub.WS2_32.DLL_setsockopt
push ebx
call dbg.create_local_socket
add esp, 0x10
test eax, eax
je 0x4015e2
sub esp, 0xc
push eax
call dbg.connect_to_smartsocket
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
sub esp, 0xc
push ebx
call dbg.adb_close
add esp, 0x10
jmp 0x40157d
Function at 0x4018a0
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18c
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0xc
mov dword [ebp - 0x24], 0
push 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 1
push eax
lea eax, [ebp - 0x14]
push eax
call sub.KERNEL32.dll_CreatePipe
test eax, eax
je 0x401a06
push eax
mov eax, dword [ebp - 0x14]
push 0
push 1
push eax
call sub.KERNEL32.dll_SetHandleInformation
lea edi, [ebp - 0x7c]
lea ebx, [ebp - 0x180]
push 0x44
push 0
push edi
call sym._memset
mov dword [ebp - 0x7c], 0x44
mov dword [esp], 0xfffffff6
call sub.KERNEL32.dll_GetStdHandle
lea esi, [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov dword [ebp - 0x50], 0x100
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
push eax
mov dword [ebp - 0x30], 0
push eax
mov dword [ebp - 0x2c], 0
push 0x104
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add esp, 0xc
push esi
push edi
push 0
push 0
push 8
push 1
push 0
push 0
push str.adb_fork_server_server
push ebx
call sub.KERNEL32.dll_CreateProcessA
mov ecx, dword [ebp - 0x18]
mov ebx, eax
push esi
push ecx
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
test ebx, ebx
je 0x401a14
sub esp, 0xc
mov eax, dword [ebp - 0x38]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.dll_CloseHandle
lea eax, [ebp - 0x1c]
mov edi, dword [ebp - 0x14]
push 0
push eax
lea eax, [ebp - 0xf]
push 3
push eax
push edi
call sub.KERNEL32.dll_ReadFile
mov esi, dword [ebp - 0x14]
mov ebx, eax
push esi
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
test ebx, ebx
je 0x401a40
cmp dword [ebp - 0x1c], 3
jne 0x4019d3
cmp byte [ebp - 0xf], 0x4f
je 0x4019f6
push edx
push edx
push str.ADB_server_didnt_ACK_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call sym._fprintf
or eax, 0xffffffff
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [ebp - 0xe], 0x4b
jne 0x4019d3
xor eax, eax
cmp byte [ebp - 0xd], 0xa
jne 0x4019d3
jmp 0x4019ee
call sub.KERNEL32.dll_GetLastError
push edx
push eax
push str.CreatePipe___failure__error__ld_n
jmp 0x4019da
call sub.KERNEL32.dll_GetLastError
push edx
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push str.CreateProcess_failure__error__ld_n
add eax, 0x40
push eax
call sym._fprintf
pop eax
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_CloseHandle
or eax, 0xffffffff
add esp, 0xc
jmp 0x4019ee
call sub.KERNEL32.dll_GetLastError
push ecx
push eax
push str.could_not_read_ok_from_ADB_Server__error___ld_n
jmp 0x4019da
Function at 0x401a50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x134
lea eax, [ebp - 0x110]
push eax
push 0xfc
call sub.KERNEL32.dll_GetTempPathA
lea ecx, [ebp - 0x110]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x401a73
test edx, 0x8080
je 0x401b50
add dl, dl
mov eax, ecx
sbb eax, 3
mov dword [eax], 0x2e626461
mov dword [eax + 4], 0x676f6c
push 0x41a29f
push 0x41a2a2
call sym._fopen
add esp, 0x10
mov dword [ebp - 0x120], eax
test eax, eax
je 0x401b6e
mov ebx, dword [sym.imp.msvcrt.dll__iob]
mov ecx, 8
cld
mov edi, ebx
mov esi, eax
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x110]
push esi
push esi
push 0x41a2a6
push edi
call sym._fopen
add esp, 0x10
mov dword [ebp - 0x138], eax
test eax, eax
je 0x401b60
mov ecx, dword [ebp - 0x138]
push 0
push 4
push 0
push ecx
call sym._setvbuf
cld
mov eax, 8
mov esi, dword [ebp - 0x138]
lea edi, [ebx + 0x20]
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
add ebx, 0x40
mov esi, dword [ebp - 0x138]
mov edi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
call sym._getpid
add esp, 0xc
push eax
push str.____adb_starting__pid__d______n
push ebx
call sym._fprintf
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
shr edx, 0x10
add ecx, 2
jmp 0x401a97
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x138], eax
jmp 0x401afd
mov ebx, dword [sym.imp.msvcrt.dll__iob]
jmp 0x401add

Function at 0x401dd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
push str.ADB_TRACE
call sym._getenv
add esp, 0x10
mov dword [ebp - 0x14], eax
test eax, eax
je 0x401e8c
mov al, byte [eax]
test al, al
je 0x401e8c
push eax
push eax
push str.__:_
mov eax, dword [ebp - 0x14]
push eax
call sym._strpbrk
add esp, 0x10
mov dword [ebp - 0x10], eax
test eax, eax
je 0x401ea3
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
sub edi, ebx
mov ecx, dword [global_tags]
mov dword [ebp - 0x20], edi
test ecx, ecx
je 0x401e84
mov esi, dword [global_tags]
xor ebx, ebx
jmp 0x401e44
inc ebx
mov esi, dword [ebx*8 + 0x41a6c0]
test esi, esi
je 0x401e84
sub esp, 0xc
push esi
call sym._strlen
add esp, 0x10
cmp dword [ebp - 0x20], eax
jne 0x401e38
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x14]
cld
cmp eax, eax
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x401e38
mov ecx, dword [ebx*8 + 0x41a6c4]
test ecx, ecx
je 0x401ebf
mov eax, 1
mov edx, dword [0x434b38]
shl eax, cl
or edx, eax
mov dword [0x434b38], edx
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x401e94
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov al, byte [edx + 1]
jmp 0x401df3
sub esp, 0xc
mov edi, dword [ebp - 0x14]
push edi
call sym._strlen
mov esi, dword [ebp - 0x14]
add esp, 0x10
add eax, esi
mov dword [ebp - 0x10], eax
jmp 0x401e19
mov dword [0x434b38], 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402a50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x40
push dbg.adb_cleanup
call dbg.atexit
pop ecx
pop ebx
push 1
push dbg.ctrlc_handler
call sub.KERNEL32.dll_SetConsoleCtrlHandler
lea ebx, [ebp - 0x26]
pop eax
pop edx
call dbg.init_transport_registration
mov dword [0x422008], 1
call dbg.usb_vendors_init
call dbg.usb_init
sub esp, 0xc
push 0x15b3
call dbg.local_init
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
push 0x1e
push ebx
call dbg.build_local_name
xor ecx, ecx
mov edx, str.smartsocket
mov eax, ebx
call dbg.install_listener
add esp, 0x10
test eax, eax
jne 0x402afb
mov eax, dword [ebp + 8]
test eax, eax
je 0x402aea
sub esp, 0xc
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
lea edx, [ebp - 8]
push 0
push edx
push 3
push 0x41a5b0
push eax
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
call dbg.start_logging
call dbg.fdevent_loop
call dbg.usb_cleanup
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
sub esp, 0xc
push 1
call sym._exit
lea esi, [esi]
lea edi, [edi]
Function at 0x404e80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 4
mov ebx, dbg.client_socket_thread
mov eax, dword [0x422008]
test eax, eax
jne 0x404e9a
mov ebx, dbg.server_socket_thread
test byte [0x434b38], 8
je 0x404ec4
mov edx, str.client
test eax, eax
je 0x404ee0
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push edx
push str.transport:_local__s_init_n
push eax
call sym._fprintf_3
add esp, 0x10
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push ebx
call sym.__beginthread
add esp, 0x10
inc eax
je 0x404ee7
mov ebx, dword [ebp - 4]
leave
ret
mov edx, 0x41b19d
jmp 0x404eac
mov ecx, dword [0x422008]
mov eax, str.client
test ecx, ecx
jne 0x404efb
mov eax, 0x41b19d
push edx
push edx
push eax
push str.cannot_create_local_socket__s_thread
call dbg.fatal_errno
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x404f10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
mov edi, dword [ebp + 0xc]
push str.ADBHOST
call sym._getenv
add esp, 0x10
test eax, eax
je 0x404fa0
push ecx
push 1
push edi
push eax
call dbg.socket_network_client
add esp, 0x10
mov esi, eax
test eax, eax
js 0x404fa0
test byte [0x434b38], 8
jne 0x404f86
sub esp, 0xc
lea ebx, [ebp - 0x4c]
push esi
call dbg.disable_tcp_nagle
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x41b216
push str._s_d
push 0x40
push ebx
call sym.___mingw_snprintf
add esp, 0x20
push 1
push edi
push ebx
push esi
call dbg.register_socket_transport
xor eax, eax
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push esi
push str.client:_connected_on_remote_on_fd__d_n
push eax
call sym._fprintf_3
add esp, 0x10
jmp 0x404f49
push edx
push edx
push 1
push edi
call dbg.socket_loopback_client
add esp, 0x10
mov esi, eax
or eax, 0xffffffff
test esi, esi
jns 0x404f40
jmp 0x404f7e

Function at 0x4057e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1008
call fcn.00412f70
mov eax, dword [ebp - 0x10]
mov ebx, eax
test eax, eax
js 0x40584a
mov edi, dword [sym.imp.msvcrt.dll__iob]
lea esi, [ebp - 0x100c]
add edi, 0x20
lea esi, [esi]
push ecx
push 0x1000
push esi
push ebx
call dbg.adb_read
add esp, 0x10
cmp eax, 0
je 0x40584a
jl 0x405840
push edi
push eax
push 1
push esi
call sym._fwrite
mov dword [esp], edi
call sym._fflush
add esp, 0x10
jmp 0x405810
call sym.__errno
cmp dword [eax], 4
je 0x405810
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405b00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
push 0x41cb07
call dbg.adb_connect
add esp, 0x10
mov ebx, eax
test eax, eax
js 0x405b50
sub esp, 0xc
push 8
call sym._malloc
add esp, 0xc
mov dword [eax], ebx
mov dword [eax + 4], 0
push eax
push 0
push dbg.stdin_read_thread
call sym.__beginthread
mov eax, ebx
call dbg.read_and_dump
xor eax, eax
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
call dbg.adb_error
push ecx
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x41cb0e
add eax, 0x40
push eax
call sym._fprintf_5
mov eax, 1
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x405b80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x418
xor ebx, ebx
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x40c]
mov edx, dword [eax]
mov dword [ebp - 0x410], edx
mov edi, dword [eax + 4]
push eax
call sym._free
add esp, 0x10
push eax
push 0x400
push esi
push edi
call sym._read
add esp, 0x10
cmp eax, 0
je 0x405bf0
jl 0x405c40
xor ecx, ecx
mov dl, byte [ecx + esi]
cmp dl, 0xd
je 0x405c00
ja 0x405c07
cmp dl, 0xa
je 0x405c00
xor ebx, ebx
inc ecx
cmp ecx, eax
jne 0x405bc4
push edx
push eax
mov eax, dword [ebp - 0x410]
push esi
push eax
call dbg.adb_write
add esp, 0x10
test eax, eax
jg 0x405bab
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, 1
jmp 0x405bd5
cmp dl, 0x2e
je 0x405c1a
cmp dl, 0x7e
jne 0x405bd3
cmp ebx, 1
jne 0x405bd5
mov bl, 2
jmp 0x405bd5
cmp ebx, 2
jne 0x405bd3
mov eax, dword [sym.imp.msvcrt.dll__iob]
push ecx
add eax, 0x40
push ecx
push str._n_disconnect__n
push eax
call sym._fprintf_5
mov dword [esp], 0
call sym._exit
call sym.__errno
cmp dword [eax], 4
je 0x405bab
jmp 0x405bf0
Function at 0x4094d0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0x434ba8
call sub.KERNEL32.dll_EnterCriticalSection
push ebx
call sub.WS2_32.DLL_gethostbyname
mov esi, eax
push ebx
call sym._free
add esp, 0x10
test esi, esi
je 0x409535
push eax
push 4
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
push eax
push edi
call dbg.writex
add esp, 0x10
sub esp, 0xc
push 0x434ba8
call sub.KERNEL32.dll_LeaveCriticalSection
push edi
call dbg.adb_close
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
lea eax, [ebp - 0x10]
push 4
push eax
push edi
call dbg.writex
add esp, 0x10
jmp 0x409517

Function at 0x409550
Capabilities:
Create thread

Disassembly:
push ebp
mov ecx, 4
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, str.tcp:
mov ebx, dword [ebp + 8]
cld
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4095c5
sub esp, 0xc
add ebx, 4
push ebx
call sym._atoi
pop edi
mov esi, eax
pop eax
push 0x3a
push ebx
call sym._strchr
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x4095ed
sub esp, 0xc
push 0x434ba8
call sub.KERNEL32.dll_EnterCriticalSection
lea eax, [ebx + 1]
push ecx
push ecx
push 1
push esi
push eax
call dbg.socket_network_client
add esp, 0x14
mov ebx, eax
push 0x434ba8
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, ebx
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cld
mov esi, str.dns:
mov ecx, 4
mov edi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x409647
mov edx, dword [0x422008]
test edx, edx
je 0x409610
or ebx, 0xffffffff
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
push ebx
push ebx
push 1
push esi
call dbg.socket_loopback_client
add esp, 0x10
mov ebx, eax
test eax, eax
js 0x4095e3
sub esp, 0xc
push eax
call dbg.disable_tcp_nagle
add esp, 0x10
jmp 0x4095e3
cld
mov edi, str.shell:
mov ecx, 6
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4095e0
lea ecx, [ebx + 6]
mov edx, 0x41dabc
cmp byte [ebx + 6], 0
jne 0x409636
xor ecx, ecx
mov edx, 0x41dac7
lea esp, [ebp - 0xc]
mov eax, str._bin_sh
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.create_subprocess
sub esp, 0xc
lea eax, [ebx + 4]
or ebx, 0xffffffff
push eax
call sym._strdup
add esp, 0x10
test eax, eax
je 0x4095e3
lea esp, [ebp - 0xc]
mov edx, eax
mov eax, dbg.dns_service
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.create_service_thread