joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9b3d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x9b3d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x9b3d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x9b3d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x9b3d94
push eax
push esi
call fcn.009b620b
add esp, 8
pop esi
ret 0x10

Function at 0x9b3da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x9b3e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x9b3e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x9cc320
push ecx
mov dword [esp + 0x1c], 4
call fcn.009b5dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x9b3dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x9b3e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x9b3ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x9b3eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x9cc320
push ecx
mov dword [esp + 0x1c], 4
call fcn.009b5dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x9b3eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x9b3e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x9b4000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x9b4131
push esi
call fcn.009b7145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.009a6080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x9b4131
push 0
push ebp
call fcn.009a63a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.009a6260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x9b408b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.009a62f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x9b4121
push 0x9cc918
push edi
call fcn.009b53f0
push eax
push ebx
push esi
call fcn.009b3f60
push 0x9cc8f8
push edi
call fcn.009b53f0
push eax
push ebx
push esi
call fcn.009b3f60
push 0x9cc8d8
push edi
call fcn.009b53f0
push eax
push ebx
push esi
call fcn.009b3f60
push 0x9cc8c0
push edi
call fcn.009b53f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.009b3f60
push 0x9cc8a0
push edi
call fcn.009b53f0
push eax
push ebx
push esi
call fcn.009b3f60
push 0x9cc888
push edi
call fcn.009b53f0
push eax
push ebx
push esi
call fcn.009b3f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x9b51b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.009b5140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.009b5140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.009b5140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.009b5140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x9b5bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x9b5c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x9c787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9b5c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x9b5c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2da16bec
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6cb84f13
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x403960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
sub esp, 0x34
call dbg.adb_wait_for_device_initialization()
mov ebx, dword [ebx + 0xc]
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0xa4b4f
mov dword [ebp - 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 3
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x4039c6
mov eax, dword [ebp - 0x14]
cmp eax, 3
jne 0x4039f2
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x10]
mov dword [esp], edx
mov dword [esp + 4], eax
call dbg.android::base::SystemErrorCodeToString(int)
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], ebx
mov dword [esp], str.adb:_cannot_write_ACK_to_handle_0x_p:__s
mov dword [esp + 8], eax
call dbg.fatal(char const*, ::)
mov dword [esp + 8], eax
mov dword [esp + 4], 3
mov dword [esp], str.adb:_cannot_write__lu_bytes_of_ACK:_only_wrote__lu_bytes
call dbg.fatal(char const*, ::)
lea esi, [esi]
push ebx
sub esp, 8
mov ebx, dword [ecx + 8]
mov dword [ecx], vtable.ad5_ImplISt12_Bind_simpleIFPFvPvEP10atransportEEEE.0
test ebx, ebx
je 0x403a28
lock sub dword [ebx + 4], 1
je 0x403a30
add esp, 8
pop ebx
ret
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
lock sub dword [ebx + 8], 1
jne 0x403a28
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0xc]
add esp, 8
pop ebx
jmp eax
Function at 0x41cac0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x25c
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x220]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x28
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
sub esp, 0x14
test eax, eax
mov edi, eax
js 0x41cb65
lea eax, [ebp - 0x224]
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [ebp - 0x224], 0x56631c
call dbg.android::base::WideToUTF8(wchar_t const*, std::string*)
test al, al
je 0x41cb57
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x224], 0x56631c
mov dword [ebx], eax
mov eax, 0x56631c
lea ecx, [eax - 0xc]
cmp ecx, 0x566310
jne 0x41cc7a
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebx], 0x56631c
mov eax, dword [ebp - 0x224]
jmp 0x41cb3e
test byte [0x5a4058], 1
je 0x41cb78
call dbg.android::base::GetMinimumLogSeverity()
cmp eax, 1
jle 0x41cb88
mov dword [ebx], 0x56631c
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.imp.msvcrt.dll__errno]
lea esi, [ebp - 0x22c]
mov dword [ebp - 0x240], eax
call eax
mov edx, dword [eax]
lea eax, [ebp - 0x228]
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [ebp - 0x23c], edx
call dbg.android::base::SystemErrorCodeToString(int)
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x224]
mov dword [esp], edx
mov dword [esp + 4], str.SHGetFolderPathW_failed:__s
mov dword [ebp - 0x244], edx
mov dword [esp + 8], eax
call dbg.android::base::StringPrintf(char const*, ::)
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0xec
mov dword [esp], str.system_core_adb_adb_utils.cpp
call dbg.android::base::LogMessage::LogMessage(char const*, unsigned int, android::base::LogId, android::base::LogSeverity, char const*, int)
mov ecx, esi
sub esp, 0x18
call dbg.android::base::LogMessage::stream()
mov ecx, dword [ebp - 0x224]
mov edi, dword [ecx - 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], edi
call dbg.std::basic_ostream<char, std::char_traits<char> >& std::__ostream_insert<char, std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&, char const*, int)
mov ecx, esi
call dbg.android::base::LogMessage::~LogMessage()
mov ecx, dword [ebp - 0x224]
mov dword [esp], esi
sub ecx, 0xc
call dbg.std::string::_Rep::_M_dispose(std::allocator<char> const&)
mov edx, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x228]
sub ecx, 0xc
push eax
mov dword [esp], edx
call dbg.std::string::_Rep::_M_dispose(std::allocator<char> const&)
mov eax, dword [ebp - 0x240]
push edx
call eax
mov edx, dword [ebp - 0x23c]
mov dword [eax], edx
jmp 0x41cb78
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x41cb4d
lea eax, [ebp - 0x228]
mov dword [esp], eax
call dbg.std::string::_Rep::_M_destroy(std::allocator<char> const&)
push ecx
jmp 0x41cb4d
Function at 0x41cf00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x23c
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x220]
mov dword [ebp - 0x228], 0x2e626461
mov dword [ebp - 0x224], 0x676f6c
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub eax, 1
sub esp, 8
cmp eax, 0x102
ja 0x41cfe2
lea edi, [ebp - 0x22c]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [ebp - 0x22c], 0x56631c
call dbg.android::base::WideToUTF8(wchar_t const*, std::string*)
test al, al
je 0x41d010
mov ecx, esi
mov dword [esp], edi
call dbg.std::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(std::string const&)
lea ecx, [ebp - 0x228]
mov ebx, ecx
sub esp, 4
mov eax, dword [ebx]
add ebx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x41cf84
mov eax, edx
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea eax, [ebx + 2]
cmove ebx, eax
add dl, dl
sbb ebx, 3
sub ebx, ecx
mov dword [esp], ecx
mov ecx, esi
mov dword [esp + 4], ebx
call dbg.std::string::append(char const*, unsigned int)
mov eax, dword [ebp - 0x22c]
lea ecx, [eax - 0xc]
sub esp, 8
cmp ecx, 0x566310
jne 0x41d01c
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x22c]
mov dword [esp], edx
mov dword [esp + 4], eax
call dbg.android::base::SystemErrorCodeToString(int)
mov eax, dword [ebp - 0x22c]
mov dword [esp], str.cannot_retrieve_temporary_file_path:__s_n
mov dword [esp + 4], eax
call dbg.fatal(char const*, ::)
mov dword [esp], str.cannot_convert_temporary_file_path_from_UTF_16_to_UTF_8
call dbg.fatal_errno(char const*, ::)
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x41cfd8
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call dbg.std::string::_Rep::_M_destroy(std::allocator<char> const&)
push eax
jmp 0x41cfd8
Function at 0x42f820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x24]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x42f872
mov eax, dword [ebp - 0x24]
cmp ebx, eax
jbe 0x42f86a
mov dword [esi + 8], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x5a4058], 0x80
jne 0x42f890
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
mov dword [eax], 5
mov eax, 0xffffffff
jmp 0x42f86a
call dbg.android::base::GetMinimumLogSeverity()
mov edi, dword [sym.imp.msvcrt.dll__errno]
cmp eax, 1
jg 0x42f881
call edi
add esi, 0x10
mov edx, dword [eax]
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x20]
mov dword [esp], eax
mov dword [esp + 4], str.adb_file_write:_could_not_write__d_bytes_from__s
mov dword [ebp - 0x2c], edx
call dbg.android::base::StringPrintf(char const*, ::)
mov ecx, ebx
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x115
mov dword [esp], str.system_core_adb_sysdeps_win32.cpp
call dbg.android::base::LogMessage::LogMessage(char const*, unsigned int, android::base::LogId, android::base::LogSeverity, char const*, int)
mov ecx, ebx
sub esp, 0x18
call dbg.android::base::LogMessage::stream()
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx - 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], esi
call dbg.std::basic_ostream<char, std::char_traits<char> >& std::__ostream_insert<char, std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&, char const*, int)
mov ecx, ebx
call dbg.android::base::LogMessage::~LogMessage()
mov eax, dword [ebp - 0x1c]
mov dword [esp], ebx
lea ecx, [eax - 0xc]
call dbg.std::string::_Rep::_M_dispose(std::allocator<char> const&)
push eax
call edi
mov edx, dword [ebp - 0x2c]
mov dword [eax], edx
jmp 0x42f881
Function at 0x42f940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x24]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x42f992
mov eax, dword [ebp - 0x24]
cmp ebx, eax
jbe 0x42f98a
mov dword [esi + 8], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x5a4058], 0x80
jne 0x42f9b0
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
mov dword [eax], 5
mov eax, 0xffffffff
jmp 0x42f98a
call dbg.android::base::GetMinimumLogSeverity()
mov edi, dword [sym.imp.msvcrt.dll__errno]
cmp eax, 1
jg 0x42f9a1
call edi
add esi, 0x10
mov edx, dword [eax]
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x20]
mov dword [esp], eax
mov dword [esp + 4], str.adb_read:_could_not_read__d_bytes_from__s
mov dword [ebp - 0x2c], edx
call dbg.android::base::StringPrintf(char const*, ::)
mov ecx, ebx
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x108
mov dword [esp], str.system_core_adb_sysdeps_win32.cpp
call dbg.android::base::LogMessage::LogMessage(char const*, unsigned int, android::base::LogId, android::base::LogSeverity, char const*, int)
mov ecx, ebx
sub esp, 0x18
call dbg.android::base::LogMessage::stream()
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx - 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], esi
call dbg.std::basic_ostream<char, std::char_traits<char> >& std::__ostream_insert<char, std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&, char const*, int)
mov ecx, ebx
call dbg.android::base::LogMessage::~LogMessage()
mov eax, dword [ebp - 0x1c]
mov dword [esp], ebx
lea ecx, [eax - 0xc]
call dbg.std::string::_Rep::_M_dispose(std::allocator<char> const&)
push eax
call edi
mov edx, dword [ebp - 0x2c]
mov dword [eax], edx
jmp 0x42f9a1
Function at 0x42fe20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
cmp eax, 0xffffffff
mov ebx, eax
je 0x42fe62
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
mov edi, eax
je 0x42fe84
test byte [0x5a4058], 0x80
je 0x42fe84
call dbg.android::base::GetMinimumLogSeverity()
cmp eax, 1
jle 0x42fe8d
mov eax, edi
call dbg._socket_set_errno
jmp 0x42fe58
mov eax, dword [sym.imp.msvcrt.dll__errno]
mov dword [ebp - 0x30], eax
call eax
mov eax, dword [eax]
mov dword [esp + 4], edi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call dbg.android::base::SystemErrorCodeToString(int)
or eax, 0xffffffff
mov ecx, dword [ebp - 0x20]
cmp dword [esi + 4], 0
je 0x42fedd
cmp esi, 0x5a4180
jb 0x42fedd
cmp esi, 0x5bc180
mov eax, ebx
jae 0x42fedd
sub esi, 0x5a4180
sar esi, 4
imul eax, esi, 0xaaaaaaab
add eax, 0x800
lea edx, [ebp - 0x1c]
mov dword [esp], edx
lea esi, [ebp - 0x24]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str.recv_fd__d_failed:__s
mov dword [ebp - 0x34], edx
call dbg.android::base::StringPrintf(char const*, ::)
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x260
mov dword [esp], str.system_core_adb_sysdeps_win32.cpp
call dbg.android::base::LogMessage::LogMessage(char const*, unsigned int, android::base::LogId, android::base::LogSeverity, char const*, int)
mov ecx, esi
sub esp, 0x18
call dbg.android::base::LogMessage::stream()
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx - 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], edx
call dbg.std::basic_ostream<char, std::char_traits<char> >& std::__ostream_insert<char, std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&, char const*, int)
mov ecx, esi
call dbg.android::base::LogMessage::~LogMessage()
mov eax, dword [ebp - 0x1c]
mov dword [esp], esi
lea ecx, [eax - 0xc]
call dbg.std::string::_Rep::_M_dispose(std::allocator<char> const&)
mov edx, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x20]
mov dword [esp], edx
lea ecx, [eax - 0xc]
call dbg.std::string::_Rep::_M_dispose(std::allocator<char> const&)
mov eax, dword [ebp - 0x30]
push edx
call eax
mov edx, dword [ebp - 0x2c]
mov dword [eax], edx
jmp 0x42fe84
Function at 0x432670
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, 0x7f000001
mov eax, dword [esp + 4]
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
jmp dbg._network_server

Function at 0x432690
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
mov edx, dword [esp + 0xc]
xor ecx, ecx
mov eax, dword [esp + 4]
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
jmp dbg._network_server
Function at 0x436230
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
mov eax, esi
call dbg._get_console_handle
test eax, eax
je 0x436280
mov edx, ebp
mov ecx, esi
imul edx, ebx
mov dword [esp], eax
mov eax, edi
call dbg._console_write_utf8
cmp eax, 0xffffffff
je 0x436274
add esp, 0x1c
xor edx, edx
div ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp sym._fwrite

Function at 0x43c830
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24c
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
mov dword [esp], 0
mov dword [esp + 4], eax
call dbg.std::string::_M_mutate(unsigned int, unsigned int, unsigned int)
lea eax, [ebp - 0x248]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__fstati64]
cmp eax, 0xffffffff
je 0x43c89a
cmp dword [ebp - 0x22c], 0
mov eax, dword [sb.st_rdev]
jle 0x43c8eb
mov ecx, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.std::string::reserve(unsigned int)
sub esp, 4
lea ebx, [sb.st_ctime]
mov dword [esp + 8], 0x200
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym._read
cmp eax, 0xffffffff
mov edi, eax
je 0x43c8d3
test eax, eax
jle 0x43c8de
mov ecx, dword [ebp + 0xc]
mov dword [esp + 4], edi
mov dword [esp], ebx
call dbg.std::string::append(char const*, unsigned int)
sub esp, 8
jmp 0x43c8a0
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x43c8a0
test edi, edi
sete al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
jl 0x43c89a
cmp eax, 0
ja 0x43c88c
jmp 0x43c89a