joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad19f13
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
xor edi, edi
cmp ebx, edi
jne 0x4ad19f4f
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x4ad19254
add eax, 0x40
push 0x4ad3d8f0
push eax
call dword [sym.imp.msvcrt.dll_fprintf]
xor eax, eax
add esp, 0xc
inc eax
jmp 0x4ad1a008
push esi
push edi
push dword [ebp + 8]
call fcn.4ad02b83
mov esi, eax
push 0x20
push esi
mov dword [ebp + 8], esi
call fcn.4ad01a67
cmp eax, edi
je 0x4ad19f6d
mov word [eax], di
cmp esi, edi
je 0x4ad19f7e
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov dword [ebp - 0xc], eax
jmp 0x4ad19f81
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 1
cmp ebx, edi
je 0x4ad19f99
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov dword [ebp - 4], eax
jmp 0x4ad19f9c
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
jbe 0x4ad19fed
cmp dword [0x4ad2b9e8], edi
jne 0x4ad19fe8
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 4], eax
jb 0x4ad19fdf
push dword [ebp + 8]
lea esi, [ebx + eax*2]
mov di, word [esi]
and word [esi], 0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov word [esi], di
jne 0x4ad19fdd
push ebx
push 0x4ad3cbe0
call fcn.4ad05e0c
and dword [ebp - 8], 0
pop ecx
pop ecx
xor edi, edi
mov eax, dword [ebp - 4]
lea ebx, [ebx + eax*2 + 2]
jmp 0x4ad19f88
xor eax, eax
inc eax
jmp 0x4ad1a007
cmp dword [ebp - 8], edi
je 0x4ad1a004
push dword [ebp + 8]
push 1
push 0x23a9
call fcn.4ad0606f
add esp, 0xc
mov eax, dword [ebp - 8]
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x4ad1a013
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4ad1a043
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x4ad19254
add eax, 0x40
push 0x4ad3d8f0
push eax
call dword [sym.imp.msvcrt.dll_fprintf]
add esp, 0xc
xor eax, eax
inc eax
pop esi
ret
push edi
test esi, esi
je 0x4ad1a054
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov edi, eax
jmp 0x4ad1a056
xor edi, edi
test edi, edi
jbe 0x4ad1a081
cmp dword [0x4ad2b9e8], 0
jne 0x4ad1a07c
cmp word [esi], 0x3d
je 0x4ad1a076
push esi
push 0x4ad3cbe0
call fcn.4ad05e0c
pop ecx
pop ecx
lea esi, [esi + edi*2 + 2]
jmp 0x4ad1a044
xor eax, eax
inc eax
jmp 0x4ad1a083
xor eax, eax
pop edi
pop esi
ret
Function at 0x4ad1b11f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4ad33b78]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
test eax, eax
push esi
push edi
jne 0x4ad1b1d7
xor edi, edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test esi, esi
jne 0x4ad1b1c6
cmp word [ebp - 0x20c], 0x2e
jne 0x4ad1b1b6
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
mov dword [ebp - 0x418], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov esi, eax
test esi, esi
jne 0x4ad1b23d
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x4ad3d8c0
call fcn.4ad05e0c
add esp, 0xc
mov esi, eax
cmp dword [0x4ad2b9e8], 0
jne 0x4ad1b1d2
inc edi
test esi, esi
je 0x4ad1b145
jmp 0x4ad1b23d
cmp esi, 0x103
jne 0x4ad1b23d
xor esi, esi
jmp 0x4ad1b23d
xor eax, eax
inc eax
jmp 0x4ad1b23f
push 0
push eax
call fcn.4ad02b83
mov edi, eax
push 0x20
push edi
call fcn.4ad01a67
test eax, eax
je 0x4ad1b1f1
and word [eax], 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
push ebx
mov dword [ebp - 0x418], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov esi, eax
test esi, esi
jne 0x4ad1b22d
lea eax, [ebp - 0x414]
push eax
push edi
push 0x4ad3d8c0
call fcn.4ad05e0c
mov esi, eax
jmp 0x4ad1b23a
push edi
push 1
push 0x23a3
call fcn.4ad0606f
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01305
leave
ret 8

Function at 0x4ad1b253
Capabilities:
Delete registry key
Set registry value

Disassembly:
push 0xc
push 0x4ad1b310
call fcn.4ad0162f
mov esi, dword [ebp + 0x10]
xor edi, edi
cmp esi, edi
je 0x4ad1b2df
cmp word [esi], di
je 0x4ad1b2df
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x4ad1b2d3
mov dword [ebp - 4], edi
push edi
push edi
push edi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push esi
push dword [ebp + 0xc]
push 0x4ad3d8c0
call fcn.4ad05e0c
add esp, 0xc
or dword [ebp - 4], 0xffffffff
jmp 0x4ad1b304
push dword [ebp + 0xc]
push 1
push 0x235d
jmp 0x4ad1b2fc
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x4ad1b304
push dword [ebp + 0xc]
push 1
push 0x23a3
call fcn.4ad0606f
add esp, 0xc
mov eax, dword [ebp - 0x1c]
call fcn.4ad01447
ret 0xc
Function at 0x4ad1b321
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x4ad33b78]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor esi, esi
cmp edi, esi
mov dword [ebp - 0x420], eax
jne 0x4ad1b478
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, 0x104
push ebx
lea ecx, [ebp - 0x20c]
push ecx
push esi
mov dword [ebp - 0x424], esi
push eax
jmp 0x4ad1b45b
cmp word [ebp - 0x20c], 0x2e
je 0x4ad1b438
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov esi, eax
lea eax, [ebp - 0x20c]
mov dword [esp], 0x4ad1b590
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x414]
push 0x4ad1b550
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
add esp, 0x10
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4ad1b438
and word [ebp + esi*2 - 0x20c], ax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x428]
push eax
push 0
push 0x4ad02a6c
push dword [ebp - 0x418]
mov dword [ebp - 0x41c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x418]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4ad1b438
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x4ad3d8c0
call fcn.4ad05e0c
add esp, 0xc
cmp dword [0x4ad2b9e8], 0
jne 0x4ad1b473
inc dword [ebp - 0x424]
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x424]
push dword [ebp - 0x420]
call edi
mov esi, eax
test esi, esi
je 0x4ad1b36d
cmp esi, 0x103
jne 0x4ad1b491
xor esi, esi
jmp 0x4ad1b491
xor eax, eax
inc eax
jmp 0x4ad1b493
cmp word [edi], 0x2e
jne 0x4ad1b4a2
push 0x7b
pop esi
push edi
push 1
push 0x23a5
call fcn.4ad0606f
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01305
leave
ret 8
push esi
push edi
call fcn.4ad02b83
mov edi, eax
push 0x20
push edi
call fcn.4ad01a67
cmp eax, esi
je 0x4ad1b4ba
mov word [eax], si
push edi
push 0x4ad1926c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, esi
je 0x4ad1b4f7
mov esi, eax
jmp 0x4ad1b481
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push 0x4ad02a6c
push dword [ebp - 0x418]
mov dword [ebp - 0x41c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x4ad1b481
lea eax, [ebp - 0x414]
push eax
push edi
push 0x4ad3d8c0
call fcn.4ad05e0c
jmp 0x4ad1b48e
Function at 0x4ad1b5bd
Capabilities:
Delete registry key
Persist via default file association registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4ad33b78]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push ebx
push 0x4ad1926c
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x220], esi
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x210], eax
je 0x4ad1b6c7
cmp esi, edi
je 0x4ad1b6a6
cmp word [esi], di
je 0x4ad1b6a6
lea esi, [ebp - 0x20c]
jmp 0x4ad1b647
cmp word [esi], 0x5c
je 0x4ad1b64c
inc esi
inc esi
cmp word [esi], di
jne 0x4ad1b63f
mov bx, word [esi]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push 0x2000000
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
mov word [esi], di
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
mov dword [ebp - 0x210], eax
jne 0x4ad1b69e
cmp bx, di
je 0x4ad1b6bb
push dword [ebp - 0x214]
mov word [esi], bx
inc esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ad1b647
push dword [ebp - 0x218]
jmp 0x4ad1b6a7
push ebx
push 1
push 0x23a5
call fcn.4ad0606f
add esp, 0xc
jmp 0x4ad1b747
mov esi, dword [ebp - 0x220]
mov ebx, dword [ebp - 0x218]
cmp esi, edi
je 0x4ad1b714
cmp word [esi], di
je 0x4ad1b714
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push esi
push 2
push edi
push 0x4ad02a6c
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
mov dword [ebp - 0x210], eax
jne 0x4ad1b70a
push esi
push ebx
push 0x4ad3d8c0
call fcn.4ad05e0c
jmp 0x4ad1b738
push ebx
push 1
push 0x235d
jmp 0x4ad1b733
push edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, edi
mov dword [ebp - 0x210], eax
je 0x4ad1b73b
push ebx
push 1
push 0x23a5
call fcn.4ad0606f
add esp, 0xc
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
pop ebx
call fcn.4ad01305
leave
ret 0xc

Function at 0x4ad1b9ff
Capabilities:
Check if file exists
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.4ad0606f
pop ecx
pop ecx
call fcn.4ad065eb
push 1
push 0x4ad34640
call dword [sym.imp.msvcrt.dll_longjmp]
nop
nop
nop
nop
nop
Function at 0x401540
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x23c
lea ebx, [ebp - 0x220]
mov dword [ebp - 0x228], 0x2e626461
mov dword [ebp - 0x224], 0x676f6c
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub eax, 1
sub esp, 8
cmp eax, 0x102
ja 0x40160c
lea edi, [ebp - 0x22c]
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.00410390
lea ecx, [ebp - 0x228]
mov ebx, ecx
mov eax, dword [ebx]
add ebx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x4015a4
mov eax, edx
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea eax, [ebx + 2]
cmove ebx, eax
add dl, dl
sbb ebx, 3
sub ebx, ecx
mov dword [esp + 4], ebx
mov dword [esp], ecx
mov ecx, edi
call fcn.004dbef0
mov edx, dword [eax]
sub esp, 8
mov dword [esi], edx
mov dword [eax], 0x516f3c
mov eax, dword [ebp - 0x22c]
lea ebx, [eax - 0xc]
cmp ebx, 0x516f30
jne 0x40163a
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x22c]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.004104a0
mov eax, dword [ebp - 0x22c]
mov dword [esp], str.cannot_retrieve_temporary_file_path:__s_n
mov dword [esp + 4], eax
call fcn.004167f0
sub eax, 4
call fcn.0050d5c0
test eax, eax
jg 0x401602
lea eax, [ebp - 0x22d]
mov ecx, ebx
mov dword [esp], eax
call fcn.004dba20
push eax
jmp 0x401602
Function at 0x4120b0
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, 0x7f000001
mov eax, dword [esp + 4]
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
jmp fcn.004115c0

Function at 0x4120d0
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
mov edx, dword [esp + 0xc]
xor ecx, ecx
mov eax, dword [esp + 4]
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
jmp fcn.004115c0
Function at 0x4157a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [ebp + 8]
mov dword [esp + 8], 0xffffffff
lea eax, [ebp - 0x1c]
mov edx, dword [edx]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0040fe20
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wmkdir]
mov edx, dword [ebp - 0x1c]
lea edi, [edx - 0xc]
cmp edi, 0x516f20
mov ebx, eax
jne 0x4157eb
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [0x5112ac], 0
jne 0x415811
mov eax, dword [edx - 4]
lea esi, [eax - 1]
mov dword [edx - 4], esi
test eax, eax
jg 0x4157e1
lea eax, [ebp - 0x1d]
mov ecx, edi
mov dword [esp], eax
call fcn.004d2030
push eax
jmp 0x4157e1
lea eax, [edx - 4]
call fcn.0050df71
jmp 0x4157fd

Function at 0x415ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
mov eax, esi
call fcn.0040c120
test eax, eax
je 0x415b20
mov edx, ebp
mov ecx, esi
imul edx, ebx
mov dword [esp], eax
mov eax, edi
call fcn.00410270
cmp eax, 0xffffffff
je 0x415b14
add esp, 0x1c
xor edx, edx
div ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004ae118
Function at 0x4162a0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0x4c
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
sub esp, 0x10
test eax, eax
je 0x416388
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
lea ecx, [edx - 1]
cmp ecx, 0xfffffffd
mov dword [ebp - 0x20], eax
mov eax, edx
mov dword [ebp - 0x24], edx
jbe 0x4163e0
mov edx, dword [esi]
mov dword [ebp - 0x24], 0
mov dword [esi], eax
test edx, edx
je 0x416329
mov dword [esp], edx
mov ecx, esi
call fcn.004105d0
sub esp, 4
mov eax, dword [edi]
mov ebx, 1
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], 0
test eax, eax
mov dword [edi], edx
je 0x416362
mov dword [esp], eax
mov ecx, edi
call fcn.004105d0
sub esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x416362
mov dword [esp], eax
lea ecx, [ebp - 0x20]
call fcn.004105d0
sub esp, 4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], 0
test eax, eax
je 0x41637e
mov dword [esp], eax
lea ecx, [ebp - 0x24]
call fcn.004105d0
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.004104a0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.Cannot_create_pipe:__s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00415a00
mov eax, dword [ebp - 0x1c]
lea ebx, [eax - 0xc]
cmp ebx, 0x516f30
jne 0x416468
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x3c], edx
call fcn.00416200
mov edx, dword [ebp - 0x3c]
test al, al
mov ebx, eax
jne 0x41648d
mov dword [ebp - 0x3c], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004104a0
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 4], str.Cannot_make_handle_0x_p_non_inheritable:__s_n
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], edx
add eax, 0x40
mov dword [esp], eax
call fcn.00415a00
mov eax, dword [ebp - 0x1c]
lea esi, [eax - 0xc]
cmp esi, 0x516f30
je 0x41634d
sub eax, 4
call fcn.0050e00e
test eax, eax
jg 0x41634d
lea eax, [ebp - 0x2d]
mov ecx, esi
mov dword [esp], eax
call fcn.004dba20
push eax
jmp 0x41634d
sub eax, 4
call fcn.0050e00e
test eax, eax
jg 0x4163ce
lea eax, [ebp - 0x20]
mov ecx, ebx
mov dword [esp], eax
xor ebx, ebx
call fcn.004dba20
push edx
jmp 0x4163d0
mov eax, dword [ebp - 0x24]
jmp 0x41630d
Function at 0x4164a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x10048
call fcn.0049ca70
sub esp, eax
mov ebx, edx
mov eax, dword [esp + eax]
lea esi, [ebp - 0x10024]
mov dword [esp], edx
mov dword [ebp - 0x10028], eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, str.stdout
mov ecx, eax
sub esp, 4
mov dword [ebp - 0x1003c], eax
cmp ebx, 0xfffffff5
mov eax, str.stderr
cmove eax, edx
mov dword [ebp - 0x10040], eax
lea ebx, [ebp - 0x10018]
lea edi, [ecx - 1]
mov eax, dword [ebp - 0x10028]
mov dword [ebp - 0x10024], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x10000
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x4165e5
cmp edi, 0xfffffffd
ja 0x4164f7
lea eax, [ebp - 0x10020]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10024]
mov dword [ebp - 0x10020], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1003c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x41664f
mov eax, dword [ebp - 0x10020]
mov edx, dword [ebp - 0x10024]
cmp eax, edx
je 0x4164f7
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov ebx, 1
mov ecx, dword [ebp - 0x10040]
mov dword [esp + 0xc], edx
mov dword [esp + 4], str.Only_wrote__lu_of__lu_bytes_to__s_n
add eax, 0x40
mov dword [esp + 0x10], ecx
mov dword [esp], eax
call fcn.00415a00
nop
mov edx, dword [ebp - 0x10028]
test edx, edx
je 0x4165db
mov dword [esp], edx
lea ecx, [ebp - 0x10028]
call fcn.004105d0
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
je 0x4165c0
lea edx, [ebp - 0x1001c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004104a0
mov eax, dword [ebp - 0x1001c]
mov dword [esp + 4], str.Failed_to_read_from__s:__s_n
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10040]
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00415a00
mov eax, dword [ebp - 0x1001c]
lea ebx, [eax - 0xc]
cmp ebx, 0x516f30
jne 0x4166c5
mov ebx, 1
jmp 0x4165c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x1001c]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.004104a0
mov eax, dword [ebp - 0x1001c]
mov dword [esp + 4], str.Failed_to_write_to__s:__s_n
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10040]
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00415a00
mov eax, dword [ebp - 0x1001c]
lea ebx, [eax - 0xc]
cmp ebx, 0x516f30
je 0x416645
sub eax, 4
call fcn.0050e00e
test eax, eax
jg 0x416645
lea eax, [ebp - 0x10029]
mov ecx, ebx
mov dword [esp], eax
call fcn.004dba20
sub esp, 4
jmp 0x416645
sub eax, 4
call fcn.0050e00e
test eax, eax
jg 0x416645
lea eax, [ebp - 0x10020]
mov ecx, ebx
mov dword [esp], eax
call fcn.004dba20
sub esp, 4
jmp 0x416645
Function at 0x41ee30
Capabilities:
Create thread

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [sym.imp.msvcrt.dll__beginthread]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x421210
call ebx
cmp eax, 0xffffffff
je 0x41ee7b
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x41e990
call ebx
cmp eax, 0xffffffff
je 0x41ee87
add esp, 0x18
pop ebx
ret
mov dword [esp], str.cannot_create_device_poll_thread
call fcn.00416850
mov dword [esp], str.cannot_create_power_notification_thread
call fcn.00416850
lea esi, [esi]
lea edi, [edi]

Function at 0x4216f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
test byte [0x561ee0], 8
jne 0x421730
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0
mov dword [esp], 0x421b80
mov dword [esp + 8], eax
call dword [sym.imp.msvcrt.dll__beginthread]
cmp eax, 0xffffffff
je 0x4217c4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov esi, dword [eax]
lea eax, [ebp - 0x1c]
mov dword [esp], eax
mov dword [esp + 8], 0x51f9a8
mov dword [esp + 4], str.transport:_local__s_init
call fcn.0042a1c0
lea ecx, [ebp - 0x20]
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x138
mov dword [esp], str.system_core_adb_transport_local.cpp
call fcn.0042a560
lea ecx, [ebp - 0x20]
sub esp, 0x14
call fcn.0042a6d0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edx - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.00505c10
lea ecx, [ebp - 0x20]
call fcn.0042a790
mov eax, dword [ebp - 0x1c]
lea edi, [eax - 0xc]
cmp edi, 0x516f30
jne 0x4217d8
call ebx
mov dword [eax], esi
jmp 0x421702
mov dword [esp + 4], 0x51f9a8
mov dword [esp], str.cannot_create_local_socket__s_thread
call fcn.00416850
sub eax, 4
call fcn.0050e170
test eax, eax
jg 0x4217bb
lea eax, [ebp - 0x20]
mov ecx, edi
mov dword [esp], eax
call fcn.004dba20
push eax
jmp 0x4217bb