joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100724e0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x61766441
push eax
xor bl, bl
mov dword [ebp - 0xc], 0x32336970
mov dword [ebp - 7], 0x6c6c64
mov byte [ebp - 8], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100726da
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x84]
push eax
push edi
mov word [ebp - 0x73], 0x7478
mov dword [ebp - 0x84], 0x70797243
mov word [ebp - 0x7f], 0x6341
mov word [ebp - 0x79], 0x4365
mov word [ebp - 0x76], 0x746e
mov word [ebp - 0x7c], 0x6975
mov word [ebp - 0x71], 0x41
mov byte [ebp - 0x80], 0x74
mov byte [ebp - 0x74], 0x65
mov byte [ebp - 0x77], 0x6f
mov byte [ebp - 0x7a], 0x72
mov byte [ebp - 0x7d], 0x71
call esi
mov dword [0x10098868], eax
lea eax, [ebp - 0x30]
push eax
push edi
mov dword [ebp - 0x26], 0x73614865
mov word [ebp - 0x2a], 0x6572
mov word [ebp - 0x22], 0x68
mov word [ebp - 0x2d], 0x7470
mov byte [ebp - 0x2b], 0x43
mov word [ebp - 0x30], 0x7243
mov word [ebp - 0x28], 0x7461
mov byte [ebp - 0x2e], 0x79
call esi
mov dword [0x10098870], eax
lea eax, [ebp - 0x6c]
push eax
push edi
mov word [ebp - 0x5a], 0x74
mov dword [ebp - 0x5f], 0x65746e6f
mov word [ebp - 0x6b], 0x7972
mov dword [ebp - 0x66], 0x61656c65
mov word [ebp - 0x68], 0x5274
mov byte [ebp - 0x6c], 0x43
mov word [ebp - 0x61], 0x4365
mov byte [ebp - 0x62], 0x73
mov byte [ebp - 0x69], 0x70
mov byte [ebp - 0x5b], 0x78
call esi
mov dword [0x1009886c], eax
lea eax, [ebp - 0x20]
push eax
push edi
mov dword [ebp - 0x1b], 0x68736148
mov dword [ebp - 0x16], 0x617461
mov dword [ebp - 0x1f], 0x74707972
mov byte [ebp - 0x20], 0x43
mov byte [ebp - 0x17], 0x44
call esi
mov dword [0x10098860], eax
lea eax, [ebp - 0x44]
push eax
push edi
mov word [ebp - 0x38], 0x6148
mov word [ebp - 0x35], 0x68
mov word [ebp - 0x40], 0x4474
mov word [ebp - 0x43], 0x7972
mov word [ebp - 0x3b], 0x6f72
mov byte [ebp - 0x44], 0x43
mov byte [ebp - 0x36], 0x73
mov word [ebp - 0x3e], 0x7365
mov byte [ebp - 0x39], 0x79
mov byte [ebp - 0x3c], 0x74
mov byte [ebp - 0x41], 0x70
call esi
mov dword [0x10098864], eax
mov word [ebp - 0x53], 0x6547
mov word [ebp - 0x4b], 0x7261
mov dword [ebp - 0x50], 0x68736148
mov dword [ebp - 0x58], 0x70797243
mov word [ebp - 0x48], 0x6d
mov byte [ebp - 0x54], 0x74
mov byte [ebp - 0x51], 0x74
mov byte [ebp - 0x49], 0x61
lea eax, [ebp - 0x58]
mov byte [ebp - 0x4c], 0x50
push eax
push edi
call esi
cmp dword [0x10098868], 0
mov ecx, eax
mov dword [0x1009885c], ecx
pop esi
je 0x100726da
cmp dword [0x10098870], 0
je 0x100726da
cmp dword [0x1009886c], 0
je 0x100726da
cmp dword [0x10098860], 0
je 0x100726da
cmp dword [0x10098864], 0
je 0x100726da
movzx eax, bl
test ecx, ecx
mov edx, 1
pop edi
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007a250
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push esi
push 0x1008b4bf
mov esi, ecx
call fcn.10002c40
push 0x20a
lea eax, [ebp - 0x668]
push 0
push eax
call fcn.1002bca0
add esp, 0xc
lea eax, [ebp - 0x458]
push 0x20a
push 0
push eax
call fcn.1002bca0
add esp, 0xc
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x248]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
push 0x208
push 0
push eax
call fcn.1002bca0
add esp, 0xc
lea eax, [ebp - 0x248]
push 0
push 0x25
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov word [ebp - 9], 0x2e32
mov word [ebp - 0x242], ax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xe], 0x6c656e72
push eax
mov word [ebp - 0x10], 0x654b
mov dword [ebp - 7], 0x6c6c64
mov byte [ebp - 0xa], 0x33
mov dword [ebp - 0x16], 0x576e6f
mov word [ebp - 0x19], 0x7461
mov dword [ebp - 0x20], 0x666e4965
mov word [ebp - 0x28], 0x6547
mov word [ebp - 0x1c], 0x726f
mov word [ebp - 0x25], 0x6f56
mov byte [ebp - 0x1a], 0x6d
mov word [ebp - 0x22], 0x6d75
mov byte [ebp - 0x26], 0x74
mov byte [ebp - 0x23], 0x6c
mov byte [ebp - 0x17], 0x69
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10097ffc], eax
test eax, eax
je 0x1007a3a0
push 0x105
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push 0x105
lea ecx, [ebp - 0x668]
push ecx
lea ecx, [ebp - 0x248]
push ecx
call eax
test eax, eax
je 0x1007a3a0
push dword [ebp - 0x2c]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x30], 0x75
push eax
push esi
mov dword [ebp - 0x34], 0x6c0025
call fcn.10004af0
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1007a3e0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc94
push ebx
push esi
push edi
push 0x1008b4bf
mov edi, ecx
call fcn.10002c40
mov eax, 0x43
mov dword [ebp - 0x52], 0x720075
mov word [ebp - 0x54], ax
mov edx, 0x72
mov eax, 0x52
mov dword [ebp - 0x6a], 0x690057
mov word [ebp - 0x84], ax
mov ebx, 0x6f
mov eax, 0x4d
mov dword [ebp - 0x7c], 0x630069
mov word [ebp - 0x7e], ax
mov eax, 0x65
push 0x800
mov word [ebp - 0x44], ax
lea eax, [ebp - 0xc90]
push 0
push eax
mov dword [ebp - 0x88], 0x410057
mov dword [ebp - 0x82], 0x5c0045
mov dword [ebp - 0x90], 0x4f0053
mov dword [ebp - 0x76], 0x73006f
mov dword [ebp - 0x72], 0x66006f
mov dword [ebp - 0x42], 0x730072
mov dword [ebp - 0x8c], 0x540046
mov dword [ebp - 0x5c], 0x4e0020
mov dword [ebp - 0x4c], 0x6e0065
mov dword [ebp - 0x3e], 0x6f0069
mov dword [ebp - 0x6e], 0x5c0074
mov dword [ebp - 0x58], 0x5c0054
mov dword [ebp - 0x48], 0x560074
mov dword [ebp - 0x60], 0x730077
mov dword [ebp - 0x66], 0x64006e
mov word [ebp - 0x4e], dx
mov word [ebp - 0x78], dx
mov dword [ebp - 0x3a], 0x6e
mov word [ebp - 0x62], bx
mov dword [ebp - 0x1a], 0x64006f
mov dword [ebp - 0x16], 0x630075
mov dword [ebp - 0x20], 0x50006c
mov dword [ebp - 0x24], 0x610074
mov dword [ebp - 0x12], 0x490074
mov dword [ebp - 0x28], 0x690067
mov dword [ebp - 0xe], 0x64
mov dword [ebp - 0x2c], 0x690044
mov word [ebp - 0x1c], dx
call fcn.1002bca0
add esp, 0xc
mov dword [ebp - 4], 0x800
lea eax, [ebp - 8]
push eax
push 0x101
push 0
lea eax, [ebp - 0x90]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1007a5e8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc90]
push eax
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1007a5df
push 0x400
push eax
lea eax, [ebp - 0x490]
push eax
call fcn.1002bca0
add esp, 0xc
lea edx, [ebp - 0x490]
lea ecx, [ebp - 0xc90]
push dword [ebp - 4]
call fcn.1007a630
lea eax, [ebp - 0x490]
add esp, 4
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1007a5a0
sub eax, edx
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x1007a5b8
xor eax, eax
jmp 0x1007a5d0
lea eax, [esi + esi]
call fcn.10029840
mov ecx, esp
lea edx, [ebp - 0x490]
push 3
push esi
call fcn.100013d0
push eax
push 0x1008b528
push edi
call fcn.10004af0
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0xca0]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007a730
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007ae11
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x26c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x78], esi
mov dword [ebp - 4], 0
push edi
mov dword [ebp - 0x70], 0
call fcn.10001f90
mov ecx, eax
test ecx, ecx
jne 0x1007a779
push 0x80004005
call fcn.10001530
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x1007a78e
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x1007a790
call edx
add eax, 0x10
mov dword [esi], eax
push 0x200
lea eax, [ebp - 0x278]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x70], 1
call fcn.1002bca0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, 0x54
mov word [ebp - 0x66], ax
add esp, 0xc
mov eax, 0x53
mov dword [ebp - 0x14], 0x200
mov word [ebp - 0x6c], ax
mov dword [ebp - 0x64], 0x410057
mov dword [ebp - 0x6a], 0x46004f
lea ecx, [eax + 0x16]
mov dword [ebp - 0x48], 0x43005c
mov eax, 0x65
mov dword [ebp - 0x5c], 0x4d005c
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x44], 0x790072
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x38], 0x610072
mov dword [ebp - 0x30], 0x79
mov dword [ebp - 0x54], 0x6f0072
mov dword [ebp - 0x4c], 0x740066
mov dword [ebp - 0x34], 0x680070
mov dword [ebp - 0x58], 0x630069
mov dword [ebp - 0x60], 0x450052
mov dword [ebp - 0x3c], 0x67006f
mov dword [ebp - 0x40], 0x740070
mov dword [ebp - 0x50], 0x6f0073
mov dword [ebp - 0x18], 0x64
mov dword [ebp - 0x28], 0x680063
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x1e], 0x750047
mov dword [ebp - 0x2c], 0x61004d
mov word [ebp - 0x1a], cx
call ebx
test eax, eax
jne 0x1007a91e
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x74]
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x1007a8ee
lea eax, [ebp - 0x10]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x6c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x1007a91e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x74]
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x1007a91e
lea eax, [ebp - 0x278]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1007a8f7
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.100045d0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4123c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x460244]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fstp qword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
fld qword [0x4601a8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
fmul qword [ebp - 8]
fstp qword [0x4601a8]
inc dword [0x460244]
push dword [0x462ec0]
call fcn.00419430
inc dword [0x460204]
add esp, 4
mov eax, dword [0x460204]
mov ecx, dword [0x460108]
sub ecx, eax
mov eax, dword [0x4602e0]
add eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
push 1
fstp qword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
fld qword [0x4601a8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
fmul qword [ebp - 8]
fstp qword [0x4601a8]
dec dword [0x460108]
call fcn.004239e0
int3

Function at 0x412ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
add dword [0x460380], 0xe23a3dc
movsx eax, word [0x460174]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fstp qword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
fld qword [0x4600a8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
fadd qword [ebp - 8]
fcomp qword [0x455a58]
fnstsw ax
fld qword [0x4600a8]
fadd qword [0x455070]
fstp qword [0x4600a8]
test ah, 1
jne 0x412b66
movsx eax, word [0x4602f4]
dec word [0x4602f4]
cmp eax, 0x59aca837
jge 0x412b66
fld qword [0x4602b8]
mov eax, dword [0x4600e8]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fstp qword [ebp - 8]
fsub qword [ebp - 8]
fstp qword [0x4602b8]
cmp dword [0x463508], 0
jne 0x412b79
call fcn.00404e30
mov dword [0x463508], eax
push esi
push edi
push 3
push 0x4b52
call fcn.004024f0
fld qword [0x460238]
mov esi, eax
fadd qword [0x4559d8]
push esi
push dword [ebp + 8]
fstp qword [ebp - 8]
fld dword [0x4602ac]
fadd qword [ebp - 8]
fstp dword [0x4602ac]
call fcn.00424277
push esi
push 3
mov edi, eax
call fcn.00401160
add esp, 0x18
test edi, edi
jne 0x412bfe
push 0x3e8
call dword [0x461cf8]
push 3
push 0x4b52
call fcn.004024f0
mov esi, eax
push esi
push dword [ebp + 8]
call fcn.00424277
add dword [0x460348], 0x5e8e5f00
mov edi, eax
push esi
push 3
call fcn.00401160
add esp, 0x18
test edi, edi
je 0x412c6f
fld dword [0x46030c]
mov ecx, 0xe038f291
fld1
faddp st(1)
fstp dword [0x46030c]
mov eax, dword [0x4603b0]
sub ecx, eax
mov dword [ebp - 4], ecx
fild dword [ebp - 4]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp qword [ebp - 8]
fld dword [0x46030c]
fadd dword [0x455d80]
inc dword [0x4603b0]
fcomp qword [ebp - 8]
fnstsw ax
test ah, 1
jne 0x412c57
fld dword [0x460024]
fsub dword [0x455c54]
fstp dword [0x460024]
push edi
push 1
push 4
push 0x463508
call fcn.0042442a
push edi
call fcn.00423f4c
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x416600
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
inc dword [0x460144]
mov edx, dword [0x460144]
mov eax, dword [0x460304]
add eax, 0x459724cf
add eax, edx
mov dword [0x460304], eax
mov dword [ecx], 0
mov dword [ecx + 4], 0
movsx eax, word [0x4600c0]
sub eax, 0x2679449a
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp qword [ebp - 8]
fld dword [0x456448]
fld dword [0x460370]
fsubr qword [ebp - 8]
inc word [0x4600c0]
fucompp
fnstsw ax
test ah, 0x44
jp 0x41667c
fld dword [0x46020c]
fsub dword [0x455e3c]
fstp dword [0x46020c]
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x434902
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x461020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00426e2c
mov dword [ebp - 0x14], eax
cmp dword [0x464298], esi
jne 0x4349f5
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x434982
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x434ad5
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x434ad5
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x434ad5
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x464298], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x46429c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4642a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4642a8], eax
test eax, eax
je 0x4349f2
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4642a4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x434a1a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x434a0d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x434a2f
push 4
pop eax
jmp 0x434ad7
cmp dword [ebp - 0x14], esi
je 0x434a2f
push dword [0x464298]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x434a14
mov eax, dword [0x4642a4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x434a8d
cmp dword [0x4642a8], edi
je 0x434a8d
push eax
call ebx
push dword [0x4642a8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x434a8d
test eax, eax
je 0x434a8d
call ecx
test eax, eax
je 0x434a82
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x434a82
test byte [ebp - 8], 1
jne 0x434a8d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x434abd
mov eax, dword [0x46429c]
cmp eax, edi
je 0x434aba
push eax
call ebx
test eax, eax
je 0x434aba
call eax
mov esi, eax
test esi, esi
je 0x434aba
mov eax, dword [0x4642a0]
cmp eax, edi
je 0x434aba
push eax
call ebx
test eax, eax
je 0x434aba
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x464298]
call ebx
test eax, eax
je 0x434ad5
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x434ad7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042583d
mov esp, ebp
pop ebp
ret
Function at 0x4019b0
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18c
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0xc
mov dword [ebp - 0x24], 0
push 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 1
push eax
lea eax, [ebp - 0x14]
push eax
call sub.KERNEL32.dll_CreatePipe
test eax, eax
je 0x401b16
push eax
mov eax, dword [ebp - 0x14]
push 0
push 1
push eax
call sub.KERNEL32.dll_SetHandleInformation
lea edi, [ebp - 0x7c]
lea ebx, [ebp - 0x180]
push 0x44
push 0
push edi
call sub.msvcrt_memset
mov dword [ebp - 0x7c], 0x44
mov dword [esp], 0xfffffff6
call sub.KERNEL32.dll_GetStdHandle
lea esi, [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov dword [ebp - 0x50], 0x100
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
push eax
mov dword [ebp - 0x30], 0
push eax
mov dword [ebp - 0x2c], 0
push 0x104
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add esp, 0xc
push esi
push edi
push 0
push 0
push 8
push 1
push 0
push 0
push str.adb_fork_server_server
push ebx
call sub.KERNEL32.dll_CreateProcessA
mov ecx, dword [ebp - 0x18]
mov ebx, eax
push esi
push ecx
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
test ebx, ebx
je 0x401b24
sub esp, 0xc
mov edi, dword [ebp - 0x38]
push edi
call sub.KERNEL32.dll_CloseHandle
mov esi, dword [ebp - 0x34]
push esi
call sub.KERNEL32.dll_CloseHandle
lea eax, [ebp - 0x1c]
mov ebx, dword [ebp - 0x14]
push 0
push eax
lea eax, [ebp - 0xf]
push 3
push eax
push ebx
call sub.KERNEL32.dll_ReadFile
mov ecx, dword [ebp - 0x14]
mov ebx, eax
push ecx
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
test ebx, ebx
je 0x401b50
cmp dword [ebp - 0x1c], 3
jne 0x401ae3
cmp byte [ebp - 0xf], 0x4f
je 0x401b06
push eax
push eax
push str.ADB_server_didnt_ACK_n
mov eax, dword [sym.imp.msvcrt__iob]
add eax, 0x40
push eax
call fcn.004013a0
or eax, 0xffffffff
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [ebp - 0xe], 0x4b
jne 0x401ae3
xor eax, eax
cmp byte [ebp - 0xd], 0xa
jne 0x401ae3
jmp 0x401afe
call sub.KERNEL32.dll_GetLastError
push edx
push eax
push str.CreatePipe___failure__error__ld_n
jmp 0x401aea
call sub.KERNEL32.dll_GetLastError
push edx
push eax
mov eax, dword [sym.imp.msvcrt__iob]
push str.CreateProcess_failure__error__ld_n
add eax, 0x40
push eax
call fcn.004013a0
pop eax
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_CloseHandle
or eax, 0xffffffff
add esp, 0xc
jmp 0x401afe
call sub.KERNEL32.dll_GetLastError
push edx
push eax
push str.could_not_read_ok_from_ADB_Server__error___ld_n
jmp 0x401aea
Function at 0x401b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x134
lea eax, [ebp - 0x110]
push eax
push 0xfc
call sub.KERNEL32.dll_GetTempPathA
lea ecx, [ebp - 0x110]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x401b83
test edx, 0x8080
je 0x401c60
add dl, dl
mov eax, ecx
sbb eax, 3
mov dword [eax], 0x2e626461
mov dword [eax + 4], 0x676f6c
push 0x4202cb
push 0x4202ce
call sub.msvcrt_fopen
add esp, 0x10
mov dword [ebp - 0x120], eax
test eax, eax
je 0x401c7e
mov ebx, dword [sym.imp.msvcrt__iob]
mov ecx, 8
cld
mov edi, ebx
mov esi, eax
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x110]
push esi
push esi
push 0x4202d2
push edi
call sub.msvcrt_fopen
add esp, 0x10
mov dword [ebp - 0x138], eax
test eax, eax
je 0x401c70
mov ecx, dword [ebp - 0x138]
push 0
push 4
push 0
push ecx
call sub.msvcrt_setvbuf
cld
mov eax, 8
mov esi, dword [ebp - 0x138]
lea edi, [ebx + 0x20]
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
add ebx, 0x40
mov esi, dword [ebp - 0x138]
mov edi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll__getpid
add esp, 0xc
push eax
push str.____adb_starting__pid__d______n
push ebx
call fcn.004013a0
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
shr edx, 0x10
add ecx, 2
jmp 0x401ba7
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x138], eax
jmp 0x401c0d
mov ebx, dword [sym.imp.msvcrt__iob]
jmp 0x401bed

Function at 0x4024a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
push str.ADB_TRACE
call sub.msvcrt_getenv
add esp, 0x10
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40255c
mov al, byte [eax]
test al, al
je 0x40255c
push eax
push eax
push str.__:_
mov eax, dword [ebp - 0x14]
push eax
call sub.msvcrt_strpbrk
add esp, 0x10
mov dword [ebp - 0x10], eax
test eax, eax
je 0x402573
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
sub edi, esi
mov ebx, dword [0x4207a0]
mov dword [ebp - 0x20], edi
test ebx, ebx
je 0x402554
mov esi, dword [0x4207a0]
xor ebx, ebx
jmp 0x402514
inc ebx
mov esi, dword [ebx*8 + 0x4207a0]
test esi, esi
je 0x402554
sub esp, 0xc
push esi
call sub.msvcrt_strlen
add esp, 0x10
cmp dword [ebp - 0x20], eax
jne 0x402508
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x14]
cld
cmp eax, eax
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x402508
mov ecx, dword [ebx*8 + 0x4207a4]
test ecx, ecx
je 0x40258f
mov eax, 1
shl eax, cl
mov ecx, dword [0x43cb58]
or ecx, eax
mov dword [0x43cb58], ecx
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x402564
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov al, byte [edx + 1]
jmp 0x4024c3
sub esp, 0xc
mov eax, dword [ebp - 0x14]
push eax
call sub.msvcrt_strlen
mov edi, dword [ebp - 0x14]
add esp, 0x10
add eax, edi
mov dword [ebp - 0x10], eax
jmp 0x4024e9
mov dword [0x43cb58], 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret