joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100017c1
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000185c
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100017f3
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x1000185e
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.JVM_DTraceGetVersion
push ebx
call esi
push str.JVM_DTraceIsSupported
push ebx
mov dword [edi], eax
call esi
push str.JVM_DTraceActivate
push ebx
mov dword [edi + 4], eax
call esi
push str.JVM_DTraceDispose
push ebx
mov dword [edi + 8], eax
call esi
push str.JVM_DTraceIsProbeEnabled
push ebx
mov dword [edi + 0xc], eax
call esi
push ebx
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor esi, esi
cmp dword [edi], esi
je 0x10001851
cmp dword [edi + 4], esi
je 0x10001851
cmp dword [edi + 8], esi
je 0x10001851
cmp dword [edi + 0xc], esi
je 0x10001851
cmp dword [edi + 0x10], esi
jne 0x1000185b
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x100022cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x100022de
pop dword [ebp - 0x44]
mov eax, 0xf4555946
add eax, 0x1baac998
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xae8fad5e
add dword [ebp - 0x54], 0x9fc297ed
mov dword [ebp - 0x50], 0x7b90db57
sub dword [ebp - 0x50], 0x495d8f12
mov dword [ebp - 0x4c], 0x5addbb13
add dword [ebp - 0x4c], 0xf16e891b
mov dword [ebp - 0x48], 0xfa5702f9
add dword [ebp - 0x48], 0x5a8fd07
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x5eda85a
add dword [ebp - 0x54], 0x6e84c0fc
mov dword [ebp - 0x50], 0xa819b02b
sub dword [ebp - 0x50], 0x66ad4eb6
mov dword [ebp - 0x4c], 0x3aa8fbb1
add dword [ebp - 0x4c], 0x28c670bb
mov dword [ebp - 0x48], 0x7a76fcf0
sub dword [ebp - 0x48], 0x7a76fcf0
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x7e675706
add eax, 0x9198d902
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3309e
push 0
call eax
mov ecx, 0xf162d616
add ecx, 0xe9d641f
mov esi, eax
mov edx, 0x7ff49b6a
add edx, 0x900bc696
add edx, dword [ebp - 0x44]
mov ebx, 0x3573455f
sub ebx, 0x419faf0c
mov edi, dword [edx]
add dword [ebp - 0xc], 0x60a6b0c
add edi, ebx
xor dword [ebp - 0x14], 0x40031da5
mov dword [esi], edi
add esi, 0x9500a519
add esi, 0x6aff5aeb
add edx, 0x8508d271
add edx, 0x7af72d93
loop 0x100023fb
add eax, 0xa8da949d
sub eax, 0xa8d9b8f6
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x82b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0082b1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x82b07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x82b06a
add dl, dl
jne 0x82b089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x82b0dc
xor eax, eax
add dl, dl
jne 0x82b096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x82b17d
add dl, dl
jne 0x82b0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x82b0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x82b0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x82b0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x82b0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x82b075
mov eax, 1
add dl, dl
jne 0x82b0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x82b0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x82b0e1
sub eax, ebx
mov ebx, 1
jne 0x82b128
mov ecx, 1
add dl, dl
jne 0x82b10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x82b119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x82b105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x82b075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x82b13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x82b14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x82b136
cmp eax, 0x7d00
jae 0x82b16d
cmp eax, 0x500
jb 0x82b168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x82b075
cmp eax, 0x7f
ja 0x82b170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x82b075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x82b19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x82b075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x49fd49
Capabilities:
Encode data using xor

Disassembly:
inc ebp
jae 0x49fd72
cmpsb byte [esi], byte es:[edi]
mov dl, 0x65
les eax, [0x6df19c51]
push 0xce57ae40
inc eax
scasb al, byte es:[edi]
push edi
into
jns 0x49fd8f
pushal
int3
pop ss
mov bl, 0x42
push edi
sbb byte [ebx - 4], bh
dec ebx
jns 0x49fd36
xlatb
adc dh, byte [0x7c59021a]
mov ah, 0x60
adc esi, edi
mov eax, dword ss:[0xaa7c6ce2]
inc eax
stosd dword es:[edi], eax
invalid
xor ebx, eax
or eax, 0xfaa47abd
jp 0x49fd1c
cli
sub byte [eax], 0x80
dec esp
cmc
jmp 0x49fd2c
xlatb
add eax, 0xb2ca72de
sbb eax, 0x50d08588
movsb byte es:[edi], byte [esi]
dec ebx
push ss
mov dh, 0xec
sti
salc
movsb byte es:[edi], byte [esi]
salc
mov bh, 0xcb
xchg dword [eax], esi
mov esi, 0x5130a0bb
jne 0x49fe15
nop
sub dword [edx + 0x6c], edi
mov ebp, 0x30e1670c
lodsd eax, dword [esi]
jae 0x49fd76
inc ebx
add edx, ebp
mov bh, 0xd8
frstor dword [esi]
jae 0x49fe04
xchg edi, eax
test dword [eax - 0x4a488717], esi
or edi, dword [esi + edx*4]
adc byte [ebp - 0x3a212780], ah
invalid
dec esi
fbstp tbyte [edx]
invalid
xlatb
salc
std
or al, 0xc5
test eax, 0xac67941
shl byte [edi*8 + 0x2b78f661], 0xcd
jp 0x49fe83
and al, 0xfd
popal
idiv byte [eax + 0x2b]
int 0x7a
pop esp
cmpsd dword [esi], dword es:[edi]
mov eax, dword [0x5222621d]
pop edx
and edi, esp
xor al, byte [esi]
jge 0x49fe1e
sub byte [edi + 0x5d], 0xfd
loopne 0x49fe13
ret 0x681e
mov esi, 0x9a2dc2cd
push esp
sub al, byte [esi - 0x2c5890ff]
fadd dword [ebp - 0x3d]
inc esp
retf

Function at 0x4ea929
Capabilities:
Encode data using xor

Disassembly:
fsub qword [edi - 0x36]
stc
xor esi, edx
salc
salc
sbb eax, 0x63879517
and esp, dword [esi + 0x150e0789]
push ebp
or eax, 0x149ac01
sbb al, 0x2e
push esp
dec ecx
sbb ch, bh
jle 0x4ea924
sal byte [ebp + 0x18], cl
sbb ebx, dword [edi - 0x685c561f]
or byte [edx], 0xdb
outsd dx, dword [esi]
arpl word [ebp + 0x62], di
mov byte [0x5b810b16], al
adc bh, byte [edx + 0x6f021817]
add al, byte [edx + 0x62cd71b4]
xchg edi, eax
pushfd
rcr dword [edx], cl
adc byte [edx + ebx*8 + 0x6e53c1ab], 0xd0
inc esi
inc edx
mov ch, byte [eax + 0x52]
push ebp
das
push ecx
sub dword [edx - 0x74], 0x49497b28
in eax, dx
push esp
fadd st(7)
inc esp
xchg esp, ecx
inc esi
invalid
Function at 0x616fa9
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pop es
and dword [edx + 0x60], 0x93cbf3c8
cmp eax, 0xc92e2b01
test eax, 0x6030c201
pop ss
popfd
test dword [edx + 0x180e51e1], ebp
pop esi
or edx, dword [ebx + 0x47]
add al, 0x4e
inc esp
cmp al, 0xf1
invalid

Function at 0x623349
Capabilities:
Encode data using xor

Disassembly:
invalid
xor dword [eax], esi
adc eax, 0x4fecd505
push cs
and byte [ebp - 0x5e9cde4f], cl
cmpsb byte [esi], byte es:[edi]
fldl2t
loopne 0x62338a
retf
stosd dword es:[edi], eax
nop
das
inc ebx
imul edx, dword [edx - 0x67], 0xddb9f96c
jno 0x623336
jl 0x6233e9
movsd dword es:[edi], dword [esi]
or esi, ebx
popal
sal dword [edx + 0x695480fd], 0x8c
mov ebx, 0xc65fa50f
cmp al, 0xe4
mov cs, word [eax]
xor esp, 0x14c50ea7
add dword [ebx*4 + 0x7c5b079c], 0x64a8f961
insd dword es:[edi], dx
dec eax
imul esp, dword [ecx], 0xf3f96794
invalid
invalid
Function at 0x1000ec86
Capabilities:
Hash data using djb2

Disassembly:
movzx eax, word [ecx]
mov edx, 0x1505
push esi
xor esi, esi
jmp 0x1000eca0
imul edx, edx, 0x21
movzx eax, ax
xor edx, eax
inc esi
movzx eax, word [ecx + esi*2]
test ax, ax
jne 0x1000ec93
imul eax, edx, 0x41c64e6d
imul ecx, edx, 0x10dcd
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret

Function at 0x1000f8cb
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x1000f8d7
or eax, 0xffffffff
pop esi
ret
movzx eax, word [esi]
push ebx
push edi
mov edi, 0x1505
xor ebx, ebx
jmp 0x1000f8ff
movzx ecx, ax
add eax, 0xffffffbf
cmp ax, 0x19
lea edx, [ecx + 0x20]
cmova edx, ecx
imul edi, edi, 0x21
xor edi, edx
inc ebx
movzx eax, word [esi + ebx*2]
test ax, ax
jne 0x1000f8e5
imul eax, edi, 0x41c64e6d
imul ecx, edi, 0x10dcd
pop edi
pop ebx
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret

Function at 0x10023f2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10023f3c
pop dword [ebp - 0x34]
mov eax, 0x10023f3c
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x9dc1d779
add dword [ebp - 0x44], 0xb0906dd2
mov dword [ebp - 0x40], 0x9ba53cae
add dword [ebp - 0x40], 0x968e0f97
mov dword [ebp - 0x3c], 0x764d5ee9
add dword [ebp - 0x3c], 0xd5fee545
mov dword [ebp - 0x38], 0x67428a98
sub dword [ebp - 0x38], 0x67428a98
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x1ffbcc7a
add dword [ebp - 0x44], 0x54769cdc
mov dword [ebp - 0x40], 0x24a84cf4
add dword [ebp - 0x40], 0x1cc41481
mov dword [ebp - 0x3c], 0x55591185
sub dword [ebp - 0x3c], 0xf1e9a519
mov dword [ebp - 0x38], 0xfc5995a3
add dword [ebp - 0x38], 0x3a66a5d
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3c7a2
push 0
call eax
mov ecx, 0x7f2f075b
sub ecx, 0x7f2ec2bd
xor edi, edi
add edi, eax
mov ebx, 0x10041c00
add ebx, dword [ebp - 0x34]
mov edx, 0xc58707c5
add edx, 0xea996b19
xor dword [ebp - 0x10], edi
mov esi, dword [ebx]
xor esi, edx
add dword [ebp - 0x1c], edi
mov dword [edi], esi
sub dword [ebp - 0x10], ecx
add edi, 4
add ebx, 0x7cf0efb3
add ebx, 0x830f1051
loop 0x1002404b
add eax, 0x1054b
xor ebx, ebx
add ebx, eax
add eax, 0xb539a18c
sub eax, 0xb539a187
mov ecx, 0x8e4737a3
sub ecx, 0x7e4737a3
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x403600
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x23c
lea ebx, [ebp - 0x220]
mov dword [ebp - 0x228], 0x2e626461
mov dword [ebp - 0x224], 0x676f6c
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub eax, 1
sub esp, 8
cmp eax, 0x102
ja 0x4036e1
lea edi, [ebp - 0x22c]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [ebp - 0x22c], 0x52bf9c
call fcn.00436250
test al, al
je 0x40370f
mov ecx, esi
mov dword [esp], edi
call fcn.004ef2a0
lea ecx, [ebp - 0x228]
mov ebx, ecx
sub esp, 4
mov eax, dword [ebx]
add ebx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x403683
mov eax, edx
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea eax, [ebx + 2]
cmove ebx, eax
add dl, dl
sbb ebx, 3
sub ebx, ecx
mov dword [esp], ecx
mov ecx, esi
mov dword [esp + 4], ebx
call fcn.004edfa0
mov eax, dword [ebp - 0x22c]
lea ecx, [eax - 0xc]
sub esp, 8
cmp ecx, 0x52bf90
jne 0x40371b
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x22c]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00435b90
mov eax, dword [ebp - 0x22c]
mov dword [esp], str.cannot_retrieve_temporary_file_path:__s_n
mov dword [esp + 4], eax
call fcn.00416690
mov dword [esp], str.cannot_convert_temporary_file_path_from_UTF_16_to_UTF_8
call fcn.004166f0
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4036d7
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call fcn.004edad0
push eax
jmp 0x4036d7
Function at 0x415fd0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0x4c
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
sub esp, 0x10
test eax, eax
je 0x4160b8
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
lea ecx, [edx - 1]
cmp ecx, 0xfffffffd
mov dword [ebp - 0x20], eax
mov eax, edx
mov dword [ebp - 0x24], edx
jbe 0x416110
mov edx, dword [esi]
mov dword [ebp - 0x24], 0
mov dword [esi], eax
test edx, edx
je 0x416059
mov dword [esp], edx
mov ecx, esi
call fcn.0042c500
sub esp, 4
mov eax, dword [edi]
mov ebx, 1
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], 0
test eax, eax
mov dword [edi], edx
je 0x416092
mov dword [esp], eax
mov ecx, edi
call fcn.0042c500
sub esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x416092
mov dword [esp], eax
lea ecx, [ebp - 0x20]
call fcn.0042c500
sub esp, 4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], 0
test eax, eax
je 0x4160ae
mov dword [esp], eax
lea ecx, [ebp - 0x24]
call fcn.0042c500
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00435b90
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.Cannot_create_pipe:__s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00431110
mov eax, dword [ebp - 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, 0x52bf90
jne 0x416196
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x3c], edx
call fcn.00415e10
mov edx, dword [ebp - 0x3c]
test al, al
mov ebx, eax
jne 0x4161b9
mov dword [ebp - 0x3c], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00435b90
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 4], str.Cannot_make_handle_0x_p_non_inheritable:__s_n
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], edx
add eax, 0x40
mov dword [esp], eax
call fcn.00431110
mov eax, dword [ebp - 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, 0x52bf90
je 0x41607d
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x41607d
lea eax, [ebp - 0x2d]
mov dword [esp], eax
call fcn.004edad0
push eax
jmp 0x41607d
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4160fe
lea eax, [ebp - 0x20]
xor ebx, ebx
mov dword [esp], eax
call fcn.004edad0
push edx
jmp 0x416100
mov eax, dword [ebp - 0x24]
jmp 0x41603d
Function at 0x41be10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24c
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x220]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x28
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
sub esp, 0x14
test eax, eax
mov edi, eax
js 0x41beb5
lea eax, [ebp - 0x224]
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [ebp - 0x224], 0x52bf9c
call fcn.00436250
test al, al
je 0x41bea7
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x224], 0x52bf9c
mov dword [ebx], eax
mov eax, 0x52bf9c
lea ecx, [eax - 0xc]
cmp ecx, 0x52bf90
jne 0x41bfc5
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebx], 0x52bf9c
mov eax, dword [ebp - 0x224]
jmp 0x41be8e
test byte [0x56103c], 1
je 0x41bfb5
call fcn.004350e0
cmp eax, 2
jg 0x41bfb5
mov eax, dword [sym.imp.msvcrt.dll__errno]
lea esi, [ebp - 0x22c]
mov dword [ebp - 0x240], eax
call eax
mov edx, dword [eax]
lea eax, [ebp - 0x228]
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [ebp - 0x23c], edx
call fcn.00435b90
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x224]
mov dword [esp], edx
mov dword [esp + 4], str.SHGetFolderPathW_failed:__s
mov dword [ebp - 0x244], edx
mov dword [esp + 8], eax
call fcn.004357f0
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x112
mov dword [esp], str.system_core_adb_adb_utils.cpp
call fcn.00434800
mov ecx, esi
sub esp, 0x14
call fcn.00434980
mov ecx, dword [ebp - 0x224]
mov edi, dword [ecx - 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], edi
call fcn.00519fc0
mov ecx, esi
call fcn.004349e0
mov ecx, dword [ebp - 0x224]
mov dword [esp], esi
sub ecx, 0xc
call fcn.004edaf0
mov edx, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x228]
sub ecx, 0xc
push eax
mov dword [esp], edx
call fcn.004edaf0
mov eax, dword [ebp - 0x240]
push edx
call eax
mov edx, dword [ebp - 0x23c]
mov dword [eax], edx
mov dword [ebx], 0x52bf9c
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x41be9d
lea eax, [ebp - 0x228]
mov dword [esp], eax
call fcn.004edad0
push ecx
jmp 0x41be9d
Function at 0x426c60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
test byte [0x56103c], 8
je 0x426c7c
call fcn.004350e0
cmp eax, 2
jle 0x426cf5
mov dword [esp], 8
call fcn.00520a70
mov edx, dword [ebp + 8]
mov dword [eax], 0x427630
mov dword [eax + 4], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x426880
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
test eax, eax
je 0x426ce1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x533ac8
mov dword [esp], str.cannot_create_local_socket__s_thread
call fcn.004166f0
mov esi, dword [sym.imp.msvcrt.dll__errno]
lea ebx, [ebp - 0x20]
call esi
mov edi, dword [eax]
lea eax, [ebp - 0x1c]
mov dword [esp], eax
mov dword [esp + 8], 0x533ac8
mov dword [esp + 4], str.transport:_local__s_init
call fcn.004357f0
mov ecx, ebx
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x177
mov dword [esp], str.system_core_adb_transport_local.cpp
call fcn.00434800
mov ecx, ebx
sub esp, 0x14
call fcn.00434980
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edx - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.00519fc0
mov ecx, ebx
call fcn.004349e0
mov eax, dword [ebp - 0x1c]
mov dword [esp], ebx
lea ecx, [eax - 0xc]
call fcn.004edaf0
push eax
call esi
mov dword [eax], edi
jmp 0x426c7c
Function at 0x42d970
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, 0x7f000001
mov eax, dword [esp + 4]
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
jmp fcn.0042bc80

Function at 0x42d990
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
mov edx, dword [esp + 0xc]
xor ecx, ecx
mov eax, dword [esp + 4]
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
jmp fcn.0042bc80
Function at 0x42e730
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov edx, str.adb_getsockname
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 8]
call fcn.0042a840
test eax, eax
je 0x42e780
cmp dword [eax], 0x535440
jne 0x42e780
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getsockname]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x42e842
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x56103c], 0x80
jne 0x42e7a4
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov dword [eax], 9
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004350e0
mov ebx, dword [sym.imp.msvcrt.dll__errno]
cmp eax, 2
jg 0x42e78f
call ebx
mov esi, dword [ebp + 8]
mov edi, dword [eax]
lea eax, [ebp - 0x1c]
mov dword [esp + 8], esi
lea esi, [ebp - 0x20]
mov dword [esp], eax
mov dword [esp + 4], str.adb_getsockname:_invalid_fd__d
call fcn.004357f0
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x3d5
mov dword [esp], str.system_core_adb_sysdeps_win32.cpp
call fcn.00434800
mov ecx, esi
sub esp, 0x14
call fcn.00434980
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edx - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.00519fc0
mov ecx, esi
call fcn.004349e0
mov eax, dword [ebp - 0x1c]
mov dword [esp], esi
lea ecx, [eax - 0xc]
call fcn.004edaf0
push ecx
call ebx
mov dword [eax], edi
jmp 0x42e78f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test byte [0x56103c], 0x80
mov ebx, eax
je 0x42e925
call fcn.004350e0
cmp eax, 2
jg 0x42e925
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
mov eax, dword [eax]
mov dword [esp + 4], ebx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.00435b90
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
mov esi, dword [ebp + 8]
mov dword [esp], edx
mov dword [esp + 4], str.adb_getsockname:_setsockopt_on_fd__d_failed:__s_n
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
lea esi, [ebp - 0x24]
mov dword [ebp - 0x30], edx
call fcn.004357f0
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x3de
mov dword [esp], str.system_core_adb_sysdeps_win32.cpp
call fcn.00434800
mov ecx, esi
sub esp, 0x14
call fcn.00434980
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx - 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], edx
call fcn.00519fc0
mov ecx, esi
call fcn.004349e0
mov ecx, dword [ebp - 0x1c]
mov dword [esp], esi
sub ecx, 0xc
call fcn.004edaf0
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x20]
lea ecx, [esi - 0xc]
push eax
mov dword [esp], edx
call fcn.004edaf0
push edx
call edi
mov edi, dword [ebp - 0x2c]
mov dword [eax], edi
mov eax, ebx
call fcn.0042a9b0
mov eax, 0xffffffff
jmp 0x42e778
Function at 0x42f280
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov edx, str.set_file_block_mode
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
call fcn.0042a840
test eax, eax
je 0x42f2c0
mov edx, dword [eax + 4]
test edx, edx
je 0x42f2c0
cmp dword [eax], 0x535440
je 0x42f2d3
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], pe_nt_image_headers32
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
lea edx, [ebp - 0xc]
xor ebx, 1
mov dword [esp + 8], edx
movzx ebx, bl
mov dword [esp + 4], 0x8004667e
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, eax
sub esp, 0xc
test edx, edx
mov eax, 1
je 0x42f2b8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
call fcn.0042a9b0
xor eax, eax
jmp 0x42f2b8