joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4205fc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x4ddc17
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420637
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x420650
lea eax, [ebp - 0x10]
mov edx, dword [0x4fb5f0]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x420663
lea eax, [ebp - 0x10]
mov edx, dword [0x4fb5f0]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42066f
adc edx, 0
mov edx, dword [edx*4 + 0x4fa3fc]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4207e9
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4207dc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4207dc
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x42077a
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x42077a
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x42077a
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x42077a
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4207dc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4207dc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4207dc
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4207dc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420801
inc ebx
cmp ebx, 0x19
jne 0x420629
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddc1e
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x5f9a66
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x5f9b03
push ebx
push esi
call fcn.005f9a2f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.005f26e4
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x5f9ab0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5f9b02
push edi
push eax
call fcn.005f126c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x5f9ad0
call fcn.005f06b6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5f9b01
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.005f26e4
add esp, 0x20
test eax, eax
jne 0x5f9aef
push edi
call fcn.005f06b6
jmp 0x5f9af7
push ebx
call fcn.005f06b6
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x5f9b06
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x5f9b17
pop esi
ret
push ebx
push edi
push esi
call fcn.005f9a2f
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.005f126c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x5f9b3f
push ebx
push esi
push edi
call fcn.005d6ef0
add esp, 0xc
push 0
call fcn.005f06b6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x5fa299
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005f9db4

Function at 0x5fe8b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5fe8dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5fe8dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1000177c
Capabilities:
Packed with generic packer

Disassembly:
jle 0x10000fb0
stosb byte es:[edi], al
or byte [esi + 0x32f9bf2f], ah
fstp xword [edi - 0x78dcd67c]
inc edi
xor eax, 0x35024123
and esi, dword [ebx]
mov ebp, 0xb4c260ac
sub dword [ebx], esi
mov esi, 0xd4222ff8
mov byte [ecx + 0x23], bl
into
pop es
sub bp, si
test byte [ecx], bh
and esi, dword [edx]
xchg ecx, eax
sub byte [ecx - 0x42], bl
mov ah, 0x29
xor edi, dword [ebp - 0x41acce66]
xchg esp, eax
lodsb al, byte [esi]
pushal
retf 0x29b4
lodsb al, byte [esi]
pop eax
adc dword [eax], eax
std
mov eax, 0xb0045
add byte [eax], al
lahf
add dword [eax], eax
add byte [edi], bh
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax + 0x40045b8], dh
add byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], dl
add byte [eax], bl
add byte [eax], al
stc
jmp 0x10001783
pushal
clc
jmp 0x1000179f
call 0x100017c1
jbe 0x10001750
sbb dl, byte [esi]
jmp 0x100017ac
adc eax, 0x6f782cb4
sub al, 0x7f
xchg esi, eax
or eax, 0x90c71a1
fld dword [edx + 0x17a379eb]
xchg ecx, eax
pop esi
jae 0x100017de
ret 0x16da
add esi, 0xffffff8c
jmp 0x100017f4
cmp dword [esi], 0
jmp 0x10001806
je 0x100018ed
jmp 0x10001832
mov ecx, esi
jmp 0x1000183a
add esi, 4
jmp 0x10001860
mov edx, dword [esi]
jmp 0x10001884
add edx, esi
clc
jae 0x10001898
fisubr dword [edx]
adc dword [ecx + ecx*2 + 0x4e], 0x1cc563fe
pop ss
rol dword [ecx + 0x468b4804], cl
add al, 0xeb
add eax, 0x645bb242
imul eax, dword [ecx - 0x41dcd6d6], 0xffffff84
mov eax, dword [esi + 4]
jmp 0x100018a2
sub dword [edx], 0x84be2329
jmp 0x100018ac
add edx, 4
jmp 0x100018b9
sub eax, 1
clc
jmp 0x100018c0
jne 0x1000189b
jae 0x100018ca
sahf
add esi, 8
add esi, 8
jmp 0x100018d1
sub dword [ecx], 1
clc
jmp 0x100018d8
jne 0x1000183d
jmp 0x100018e2
mov ebx, esi
jmp 0x100018e8
call fcn.100018fb
jmp 0x100018f1
popal
stc
jmp 0x100018f6
jmp section..text

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x4010b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
mov edi, ecx
call fcn.004010a0
test al, al
je 0x4010f4
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str._n_Tried_to_insert
call fcn.00401370
mov edx, dword [ebp + 8]
mov ecx, eax
call fcn.00401370
mov edx, str._into_a_full_list...Force_Exit.
mov ecx, eax
call fcn.00401370
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0xc
call fcn.00401855
add esp, 4
mov dword [esp + 0xc], eax
mov ecx, eax
call fcn.00401830
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov dword [esi], eax
add esp, 4
mov ecx, dword [edi]
mov dword [esi + 4], ecx
mov ecx, dword [edi]
mov ecx, dword [ecx + 8]
mov dword [esi + 8], ecx
mov eax, dword [edi]
mov eax, dword [eax + 8]
mov dword [eax + 4], esi
mov eax, dword [edi]
pop edi
mov dword [eax + 8], esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x44d931
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x44d97d
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x44d962
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x44d972
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x44d98d
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x44d9cc
test ebx, ebx
je 0x44d9a1
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x44d996
cmp ecx, 0xfff1
jb 0x44d9af
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x44dab7
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x44d9f1
Function at 0x498121
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x49816d
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x498152
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x498162
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x49817d
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x4981bc
test ebx, ebx
je 0x498191
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x498186
cmp ecx, 0xfff1
jb 0x49819f
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x4982a7
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x4981e1
Function at 0x4e2981
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x4e29cd
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x4e29b2
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x4e29c2
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4e29dd
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x4e2a1c
test ebx, ebx
je 0x4e29f1
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x4e29e6
cmp ecx, 0xfff1
jb 0x4e29ff
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x4e2b07
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x4e2a41
Function at 0x65917c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x664480
cmp edx, dword [eax]
je 0x65919e
add eax, 8
inc ecx
cmp eax, 0x664510
jl 0x65918f
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x664480]
jne 0x6592cc
mov eax, dword [0xa67cf0]
cmp eax, 1
je 0x6592a6
test eax, eax
jne 0x6591cf
cmp dword [0x6622c4], 1
je 0x6592a6
cmp edx, 0xfc
je 0x6592cc
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659206
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0065a2e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a3d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659249
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a3d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65dd64
push edi
call fcn.0065ad90
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0065a2e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a2f0
lea eax, [ebp - 0xa0]
push 0x65dd44
push eax
call fcn.0065a2f0
push dword [esi + 0x664484]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a2f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065ad02
add esp, 0x2c
pop edi
jmp 0x6592cc
lea eax, [ebp + 8]
lea esi, [esi + 0x664484]
push 0
push eax
push dword [esi]
call fcn.0065a3d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x72cb776e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x3d8a37a1
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x424208
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b1140]
lea edx, [eax + 0x40]
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Fatal__internal__error_in__s__line__d:__s_n
mov dword [esp], edx
call fcn.00432a10
mov dword [esp], 1
call fcn.00463349
Function at 0x42dcf0
Capabilities:
Check if file exists
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x57c
mov eax, dword [0x4b7014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x520]
push esi
push edi
push 0
push eax
lea eax, [ebp - 0x514]
mov dword [ebp - 0x50c], 0
mov esi, edx
mov dword [ebp - 0x514], 0
push eax
lea eax, [ebp - 0x50c]
mov dword [ebp - 0x520], 0xc
push eax
mov edi, ecx
mov dword [esi], 0
mov dword [ebp - 0x518], 1
mov dword [ebp - 0x51c], 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x42df1b
push 0
push 1
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x42df1b
mov eax, dword [ebp - 0x514]
lea edx, [ebp - 0x108]
xorps xmm0, xmm0
mov dword [ebp - 0x568], 0x44
push ecx
movlpd qword [ebp - 0x53c], xmm0
mov ecx, edi
or dword [ebp - 0x53c], 0x100
movlpd qword [ebp - 0x564], xmm0
movlpd qword [ebp - 0x55c], xmm0
movlpd qword [ebp - 0x554], xmm0
movlpd qword [ebp - 0x54c], xmm0
movlpd qword [ebp - 0x544], xmm0
movlpd qword [ebp - 0x534], xmm0
movups xmmword [ebp - 0x578], xmm0
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x52c], eax
call fcn.0042dfa0
add esp, 4
test eax, eax
jne 0x42df1b
lea eax, [ebp - 0x578]
push eax
lea eax, [ebp - 0x568]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x42de53
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x42df1b
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004555d3
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x578]
push dword [ebp - 0x514]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
test ebx, ebx
je 0x42dea6
mov esi, dword [ebp + 0xc]
cmp esi, 2
jbe 0x42dea6
push 0
lea eax, [ebp - 0x510]
push eax
push esi
push ebx
push dword [ebp - 0x50c]
call edi
test eax, eax
je 0x42df1b
mov eax, dword [ebp - 0x510]
cmp eax, esi
jae 0x42df1b
test eax, eax
je 0x42dea6
mov byte [ebx + eax], 0
mov esi, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea eax, [ebp - 0x510]
push 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x50c]
call esi
test eax, eax
je 0x42df08
cmp dword [ebp - 0x510], 0
jbe 0x42df08
push 0
lea eax, [ebp - 0x510]
push eax
push 0x400
lea eax, [ebp - 0x508]
push eax
push dword [ebp - 0x50c]
call edi
push 0
lea eax, [ebp - 0x510]
push eax
push 0
push 0
push 0
push dword [ebp - 0x50c]
call esi
test eax, eax
jne 0x42dec7
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004555d3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004555d3
mov esp, ebp
pop ebp
ret
Function at 0x42df40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test esi, esi
je 0x42df8a
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42df6a
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x42df7a
push 0xffffffffffffffff
push esi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp - 4], 0
jne 0x42df8a
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42e0f0
Capabilities:
Check if file exists
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x4b7014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
push str.._adb_adb.exe
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42e1ea
test al, 0x10
jne 0x42e1ea
push 0
push 0
lea edx, [ebp - 0x8c]
mov dword [esi + 4], 0
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x88], str.._adb_adb.exe
mov dword [ebp - 0x84], str.start_server
mov dword [ebp - 0x80], 0
call fcn.0042dcf0
add esp, 8
test eax, eax
jne 0x42e1f1
mov edi, dword [ebp - 0x8c]
test edi, edi
je 0x42e1f1
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42e1c5
lea eax, [ebp - 0x8c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x42e1f1
push 0xffffffffffffffff
push edi
mov dword [ebp - 0x8c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004555d3
mov esp, ebp
pop ebp
ret
mov dword [esi + 4], 1
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004555d3
mov esp, ebp
pop ebp
ret
Function at 0x42e5b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4b7014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
mov edx, dword [ebp + 8]
push esi
push edi
cmp eax, 8
jl 0x42e5d7
mov dword [ecx], 0
xor eax, eax
mov eax, dword [ecx + eax*4 + 8]
test eax, eax
je 0x42e71b
mov esi, 0x69766564
cmp esi, dword [eax + 0x100]
jne 0x42e602
mov esi, 0x6563
cmp si, word [eax + 0x104]
jne 0x42e602
xor eax, eax
jmp 0x42e607
mov eax, 1
mov dword [edx], eax
mov eax, dword [ecx]
mov edi, dword [ecx + eax*4 + 8]
inc eax
cmp dword [ebp + 0xc], 0
mov dword [ecx], eax
je 0x42e707
cmp dword [edx], 0
jne 0x42e707
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.004581b0
add esp, 0xc
mov dword [ebp - 0x418], str.shell
lea eax, [ebp - 0x408]
mov dword [ebp - 0x414], str.getprop
lea edx, [ebp - 0x418]
mov dword [ebp - 0x410], str.ro.product.model
mov ecx, edi
push 0x400
push eax
push 3
call fcn.0042e040
mov esi, eax
add esp, 0xc
test esi, esi
je 0x42e707
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42e6a3
lea eax, [ebp - 0x40c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x42e6b6
push 0xffffffffffffffff
push esi
mov dword [ebp - 0x40c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp - 0x40c], 0
jne 0x42e707
lea esi, [ebp - 0x408]
movsx eax, byte [esi]
push eax
call fcn.0045c86c
add esp, 4
test eax, eax
jne 0x42e6e3
mov al, byte [esi]
cmp al, 0x20
je 0x42e6e3
cmp al, 0x2d
je 0x42e6e3
cmp al, 0x5f
jne 0x42e6ee
inc esi
lea eax, [ebp - 0x38a]
cmp esi, eax
jb 0x42e6c5
lea eax, [ebp - 0x408]
sub esi, eax
lea ecx, [edi + 0x180]
push esi
push eax
push ecx
call fcn.00458310
add esp, 0xc
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004555d3
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004555d3
mov esp, ebp
pop ebp
ret 8