Function at 0x405890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, edx
sub esp, 0x7c
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x5c], eax
call fcn.00404520
lea eax, [ebp - 0x50]
mov dword [esp + 4], eax
lea eax, [ebp - 0x30]
mov dword [esp], eax
mov dword [ebp - 0x50], 0x52bf9c
call fcn.004028f0
test al, al
je 0x405938
lea eax, [ebp - 0x44]
mov dword [esp + 4], eax
mov eax, dword [str.shell_v2]
lea ecx, [ebp - 0x3c]
mov dword [esp], eax
call fcn.004ef570
lea eax, [ebp - 0x3c]
sub esp, 8
mov dword [esp + 4], eax
lea eax, [ebp - 0x30]
mov dword [esp], eax
call fcn.00426500
mov byte [ebp - 0x61], al
mov eax, dword [ebp - 0x3c]
lea ecx, [eax - 0xc]
cmp ecx, 0x52bf90
jne 0x405f93
cmp byte [ebp - 0x61], 1
mov edi, 0x7e
mov dword [ebx], str.adb_shell
mov dword [0x526358], 1
sbb eax, eax
mov dword [ebp - 0x60], eax
and dword [ebp - 0x60], 3
lea esi, [esi]
mov eax, dword [ebp - 0x5c]
mov dword [esp + 8], str.e:ntTx
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004ade90
cmp eax, 0xffffffff
je 0x405970
sub eax, 0x54
cmp eax, 0x24
ja case.0x405888.85
jmp dword [eax*4 + 0x52fa40]
mov dword [ebp - 0x60], 1
jmp 0x405860
mov dword [ebp - 0x60], 3
mov edi, 0x7e
mov byte [ebp - 0x61], 0
jmp 0x405860
xor eax, eax
cmp dword [ebp - 0x60], 2
setge al
mov dword [ebp - 0x60], eax
add dword [ebp - 0x60], 2
jmp 0x405860
call fcn.0041b790
jmp 0x405860
mov edx, dword [0x57c3b8]
mov edi, str.none
mov dword [esp], edx
mov dword [ebp - 0x68], edx
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x68]
mov ecx, 5
mov esi, edx
cmp eax, 1
je 0x405960
repe cmpsb byte [esi], byte es:[edi]
jne 0x405d4a
xor edi, edi
jmp 0x405860
mov ebx, 1
mov eax, dword [ebp - 0x50]
lea ecx, [eax - 0xc]
cmp ecx, 0x52bf90
jne 0x405fb4
lea ecx, [ebp - 0x30]
call fcn.004eff10
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call fcn.00520d30
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x50]
mov ebx, 1
mov dword [esp + 4], 0x52dc85
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00431480
jmp 0x405909
repe cmpsb byte [esi], byte es:[edi]
je 0x4058fd
movzx edi, byte [edx]
jmp 0x405860
lea eax, [ebp - 0x3c]
mov esi, dword [0x526358]
mov dword [esp + 4], eax
lea ecx, [ebp - 0x4c]
mov dword [esp], 0x530a3c
call fcn.004ef570
sub esp, 8
cmp dword [ebp - 0x60], 1
je 0x405d98
mov ecx, dword [ebp - 0x60]
test ecx, ecx
je 0x405e44
cmp dword [ebp - 0x60], 2
je 0x405d6c
test byte [0x56103c], 1
jne 0x405b60
cmp byte [ebp - 0x61], 0
je 0x405db7
mov eax, dword [0x526358]
lea esi, [ebp - 0x40]
cmp dword [ebp - 0x5c], eax
mov dword [ebp - 0x48], 0x52bf9c
lea edx, [ebp - 0x48]
jg 0x405e66
movzx eax, byte [ebp - 0x61]
lea ecx, [ebp - 0x4c]
mov dword [esp], edx
mov dword [ebp - 0x60], eax
mov edx, eax
lea eax, [ebp - 0x44]
call fcn.00405520
lea ecx, [ebp - 0x4c]
mov dword [esp], 0x530a3c
call fcn.004c5f40
mov byte [ebp - 0x5c], 1
sub esp, 4
test eax, eax
jne 0x405c50
lea eax, [ebp - 0x44]
mov dword [esp + 4], esi
mov dword [esp], eax
mov dword [ebp - 0x40], 0x52bf9c
call fcn.00401fb0
test eax, eax
mov esi, eax
js 0x405f1f
mov dword [esp], 0x14
call fcn.00520de0
cmp byte [ebp - 0x61], 0
mov ebx, eax
mov dword [eax + 0xc], 0
mov dword [eax], 0
mov dword [eax + 4], esi
movzx eax, byte [ebp - 0x5c]
mov byte [ebx + 8], al
mov eax, edi
mov byte [ebx + 0x10], al
jne 0x405d02
cmp byte [ebp - 0x5c], 0
jne 0x405d38
mov dword [esp], 8
call fcn.00520de0
mov dword [eax], 0x404d00
mov dword [eax + 4], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x404480
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
test eax, eax
je 0x405c73
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x60]
sub esp, 4
mov dword [esp + 8], 0x561028
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00405150
cmp byte [ebp - 0x5c], 0
mov ebx, eax
jne 0x405f15
mov eax, dword [ebp - 0x40]
lea ecx, [eax - 0xc]
cmp ecx, 0x52bf90
jne 0x40603d
mov eax, dword [ebp - 0x44]
lea ecx, [eax - 0xc]
cmp ecx, 0x52bf90
jne 0x40601c
mov eax, dword [ebp - 0x48]
lea ecx, [eax - 0xc]
cmp ecx, 0x52bf90
jne 0x405ffb
mov eax, dword [ebp - 0x4c]
lea ecx, [eax - 0xc]
cmp ecx, 0x52bf90
je 0x405909
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405909
lea eax, [ebp - 0x3c]
mov dword [esp], eax
call fcn.004ede40
push edi
jmp 0x405909
call fcn.00435450
cmp eax, 2
jg 0x4059bb
mov edx, dword [sym.imp.msvcrt.dll__errno]
mov esi, 0x52f8d4
mov dword [ebp - 0x6c], edx
call edx
lea ecx, [ebp - 0x4c]
mov eax, dword [eax]
mov dword [esp], 0x530a3c
mov dword [ebp - 0x68], eax
call fcn.004c5f40
mov ecx, 0x52f8c7
test eax, eax
mov eax, 0x52f8cb
cmovne ecx, eax
mov eax, 0x52f8cf
cmp byte [ebp - 0x61], 0
push edx
mov edx, dword [ebp - 0x60]
cmove eax, esi
mov dword [esp + 0x10], eax
mov eax, edi
movsx eax, al
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x3c]
lea esi, [ebp - 0x40]
mov dword [esp], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str.shell__e_0x_x_t_d_use_shell_protocol_s_shell_type_arg_s_n
call fcn.00435b60
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2ff
mov dword [esp], str.system_core_adb_commandline.cpp
call fcn.00434b70
mov ecx, esi
sub esp, 0x14
call fcn.00434cf0
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx - 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], edx
call fcn.0051a330
mov ecx, esi
call fcn.00434d50
mov edx, dword [ebp - 0x3c]
mov dword [esp], esi
lea ecx, [edx - 0xc]
call fcn.004ede60
mov edx, dword [ebp - 0x6c]
push ecx
call edx
mov esi, dword [ebp - 0x68]
mov dword [eax], esi
jmp 0x4059bb
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 0x5c], 0
mov eax, dword [eax - 0xc]
test eax, eax
jne 0x405a15
mov eax, dword [ebp - 0x48]
mov eax, dword [eax - 0xc]
test eax, eax
sete byte [ebp - 0x5c]
jmp 0x405a15
call fcn.00435450
cmp eax, 4
jg 0x405cdd
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
mov edi, dword [eax]
call esi
lea ecx, [ebp - 0x3c]
mov eax, dword [eax]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2a1
mov dword [esp + 0x10], eax
mov dword [esp], str.system_core_adb_commandline.cpp
call fcn.00434b70
lea ecx, [ebp - 0x3c]
sub esp, 0x14
call fcn.00434cf0
mov dword [esp + 4], str.error_starting_stdin_read_thread
mov dword [esp], eax
call fcn.0051e740
lea ecx, [ebp - 0x3c]
call fcn.00434d50
call esi
mov dword [eax], edi
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x405ce9
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebx + 0xc], 0
mov dword [esp], ebx
call fcn.00520d30
mov eax, 1
jmp 0x405ae8
mov dword [esp], 0x40014
call fcn.00520de0
mov edi, eax
mov eax, dword [ebx + 4]
mov ecx, edi
mov dword [esp], eax
call fcn.00415cd0
mov ecx, dword [ebx + 0xc]
mov dword [ebx + 0xc], edi
sub esp, 4
test ecx, ecx
je 0x405a69
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x405a69
nop
lea esi, [esi]
call fcn.0042f950
jmp 0x405a73
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov ebx, 1
mov dword [esp + 4], str.error:__e_requires_a_single_character_argument_or_none_n
add eax, 0x40
mov dword [esp], eax
call fcn.00431480
jmp 0x405909
mov dword [esp], 0
call fcn.0042f8f0
test eax, eax
jne 0x4059ae
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.Remote_PTY_will_not_be_allocated_because_stdin_is_not_a_terminal._nUse_multiple__t_options_to_force_remote_PTY_allocation._n
add eax, 0x40
mov dword [esp], eax
call fcn.00431480
mov dword [esp + 4], 3
lea ecx, [ebp - 0x4c]
mov dword [esp], 0x530a40
call fcn.004ee6c0
sub esp, 8
jmp 0x4059ae
mov dword [esp], 0x530a3c
lea ecx, [ebp - 0x4c]
call fcn.004c5f40
sub esp, 4
test eax, eax
je 0x405f48
lea eax, [ebp - 0x44]
mov dword [esp + 4], eax
mov eax, dword [str.shell_v2]
lea ecx, [ebp - 0x3c]
mov dword [esp], eax
call fcn.004ef570
lea eax, [ebp - 0x3c]
sub esp, 8
mov dword [esp + 4], eax
lea eax, [ebp - 0x30]
mov dword [esp], eax
call fcn.00426500
mov edx, 0x52f8da
mov dword [esp + 4], str.error:__s_only_supports_allocating_a_pty_n
test al, al
mov eax, 0x52f8e1
cmovne edx, eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], edx
add eax, 0x40
mov dword [esp], eax
call fcn.00431480
mov eax, dword [ebp - 0x3c]
lea ecx, [eax - 0xc]
cmp ecx, 0x52bf90
jne 0x405fd5
mov ebx, 1
jmp 0x405b2a
mov dword [esp], 0
call fcn.0042f8f0
test eax, eax
je 0x405d98
cmp dword [ebp - 0x5c], esi
jne 0x405d98
jmp 0x4059ae
lea ecx, [ebx + eax*4]
mov eax, dword [ebp - 0x5c]
xor edx, edx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea ebx, [ebx + eax*4]
xor eax, eax
sub ebx, ecx
sar ebx, 2
test ebx, ebx
jne 0x405f67
lea esi, [eax + edx]
test ebx, ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], esi
je 0x405eb2
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memmove
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], esi
lea esi, [ebp - 0x40]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [esp], esi
call fcn.004c1230
lea edx, [ebp - 0x48]
mov ecx, edx
mov dword [esp], esi
mov dword [ebp - 0x5c], edx
call fcn.004ee0d0
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x5c]
lea ecx, [eax - 0xc]
sub esp, 4
cmp ecx, 0x52bf90
jne 0x40605e
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x4059e0
mov dword [esp], eax
mov dword [ebp - 0x5c], edx
call fcn.00520d30
mov edx, dword [ebp - 0x5c]
jmp 0x4059e0
call fcn.0042fa70
jmp 0x405af4
mov eax, dword [ebp - 0x40]
mov ebx, 1
mov dword [esp + 4], 0x52dc85
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00431480
jmp 0x405af4
mov dword [esp + 4], 0
lea ecx, [ebp - 0x4c]
mov dword [esp], 0x52dd0a
call fcn.004ee6c0
sub esp, 8
jmp 0x4059c5
cmp ebx, 0x3fffffff
ja 0x405ff6
lea edx, [ebx*4]
mov dword [esp], edx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], edx
call fcn.00520de0
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x5c]
jmp 0x405e95
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405838
lea esi, [ebp - 0x40]
mov dword [esp], esi
call fcn.004ede40
push esi
jmp 0x405838
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40591b
lea eax, [ebp - 0x3c]
mov dword [esp], eax
call fcn.004ede40
push esi
jmp 0x40591b
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405e3a
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.004ede40
push edx
jmp 0x405e3a
call fcn.0051add0
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405b2a
lea eax, [ebp - 0x3c]
mov dword [esp], eax
call fcn.004ede40
push eax
jmp 0x405b2a
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405b18
lea eax, [ebp - 0x3c]
mov dword [esp], eax
call fcn.004ede40
push eax
jmp 0x405b18
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405b06
lea eax, [ebp - 0x3c]
mov dword [esp], eax
call fcn.004ede40
push eax
jmp 0x405b06
or ebx, 0xffffffff
lock xadd dword [eax - 4], ebx
test ebx, ebx
jg 0x405ef7
lea eax, [ebp - 0x44]
mov dword [esp], eax
mov dword [ebp - 0x5c], edx
call fcn.004ede40
mov edx, dword [ebp - 0x5c]
push eax
jmp 0x405ef7