joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415500
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov edi, dword fs:[0x18]
sub esp, 0xc
mov esi, dword [ebp + 8]
cmp dword [edi + 0x20], esi
je 0x415580
mov dword [esp + 8], 0
xor ebx, ebx
mov dword [esp + 4], esi
mov dword [esp], sym._tgt_process_active_close_process
call sym._dbg_add_process
mov dword [0x43ac08], eax
test eax, eax
je 0x415576
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_DebugActiveProcess]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4155a0
mov dword [esp + 4], 0
mov ebx, 1
mov dword [esp], str.DBGHELP_NOLIVE
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
mov eax, dword [0x43ac08]
sub esp, 8
mov dword [eax + 0x34], 1
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.WineDbg_cant_debug_its_own_process._Please_use_another_process_ID._n
xor ebx, ebx
call sym._dbg_printf
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 0x34]
mov dword [esp + 4], esi
mov dword [esp], str.Cant_attach_process__04lx:_error__lu_n
mov dword [esp + 8], eax
call sym._dbg_printf
mov eax, dword [0x43ac08]
mov dword [esp], eax
call sym._dbg_del_process
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41b180
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp + 0xc]
push ebx
sub esp, 0x28
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], 0x439900
mov dword [esp], 6
mov dword [esp + 4], 0
call dword [sym.imp.ucrtbase.dll___stdio_common_vsprintf]
mov ebx, eax
test eax, eax
mov eax, 0xffffffff
cmovns eax, ebx
mov dword [ebp - 0x18], eax
cmp eax, 0xfff
ja 0x41b322
mov edx, dword [0x43ad6c]
test edx, edx
jne 0x41b311
test ebx, ebx
je 0x41b352
mov ebx, dword [ebp - 0x18]
mov esi, 0x439900
mov edi, dword [0x43cde0]
mov dword [ebp - 0x14], esi
mov esi, ebx
lea esi, cs:[esi]
nop
mov ebx, 0x1000
mov ecx, dword [ebp - 0x14]
lea eax, [edi + 0x43bde0]
sub ebx, edi
mov dword [esp], eax
cmp ebx, esi
mov dword [esp + 4], ecx
cmova ebx, esi
mov dword [esp + 8], ebx
sub esi, ebx
call sym._memcpy
lea edx, [ebx + edi]
add dword [ebp - 0x14], ebx
mov dword [0x43cde0], edx
mov ebx, edx
jmp 0x41b25e
cmp byte [ebx + 0x43bddf], 0xa
lea eax, [ebx - 1]
je 0x41b268
mov ebx, eax
test ebx, ebx
jne 0x41b250
test esi, esi
jle 0x41b2d3
mov ebx, edx
mov eax, dword [0x43ad6c]
test eax, eax
je 0x41b2e0
mov eax, dword [0x43ac00]
cmp eax, 0xffffffff
je 0x41b2a2
lea ecx, [ebp - 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x43bde0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov edi, dword [0x43cde0]
mov dword [esp], 0x43bde0
sub edi, ebx
add ebx, 0x43bde0
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
call dword [sym.imp.ucrtbase.dll_memmove]
mov dword [0x43cde0], edi
test esi, esi
jg 0x41b210
mov eax, dword [ebp - 0x18]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [0x43ac18]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x43bde0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
jmp 0x41b271
mov dword [esp], 0x439900
call sym.___wine_dbg_output
jmp 0x41b1ec
mov ecx, dword [0x43ad6c]
mov dword [ebp - 0x18], 0xfff
mov dword [0x43a8fc], 0x2e2e2e
test ecx, ecx
je 0x41b1f4
mov dword [esp], 0x439900
call sym.___wine_dbg_output
jmp 0x41b1f4
mov dword [ebp - 0x18], 0
jmp 0x41b2d3
Function at 0x41b520
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov eax, dword [0x43ac08]
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x41b5f0
mov esi, dword [0x43ac14]
test esi, esi
je 0x41b630
test ebx, ebx
je 0x41b608
mov eax, ebx
mov edx, 2
lea esi, cs:[esi]
nop
mov eax, dword [eax + 4]
inc edx
test eax, eax
jne 0x41b560
shl edx, 2
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x41b5e2
mov dword [eax], esi
mov eax, 1
lea esi, [esi]
mov edx, dword [ebx]
mov dword [edi + eax*4], edx
mov ebx, dword [ebx + 4]
inc eax
test ebx, ebx
jne 0x41b588
mov dword [edi + eax*4], 0
mov eax, edi
call sym._dbg_build_command_line
mov dword [esp], edi
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov ebx, eax
call esi
test ebx, ebx
je 0x41b620
mov eax, ebx
call sym._dbg_start_debuggee
test eax, eax
je 0x41b620
mov dword [0x43ac20], 0
call sym._wait_exception
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._source_list_from_addr
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp + 8], str.Already_attached_to_a_process._Use_detach_or_kill_before_using_run_n
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
jmp sym._dbg_printf
mov eax, dword [0x43ad00]
test eax, eax
je 0x41b639
call sym._dbg_start_debuggee
jmp 0x41b5bf
mov dword [ebp + 8], ebx
add esp, 8
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
jmp eax
mov dword [ebp + 8], str.No_active_target_to_be_restarted_n
jmp 0x41b5f7
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll__strdup]
mov dword [0x43ad00], eax
jmp 0x41b611
Function at 0x41b9c0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebx + 0x18]
test edx, edx
jne 0x41b9e9
test eax, eax
je 0x41b9e4
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov dword [ebx + 0x18], eax
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 8], 0x141
mov dword [esp + 4], str..._src_wine_programs_winedbg_winedbg.c
mov dword [esp], str.p__imageName__NULL
call dword [sym.imp.ucrtbase.dll__assert]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x41ba10
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
lea eax, [ebp - 0x50]
sub esp, 0xc0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
lea edx, [ebp - 0x90]
xor eax, eax
mov ecx, 0x10
mov dword [ebp - 0x94], 0x44
mov edi, edx
sub esp, 4
test byte [ebp - 0x24], 1
rep stosd dword es:[edi], eax
mov eax, 1
cmovne ax, word [ebp - 0x20]
lea edx, [ebp - 0xa4]
mov dword [esp + 0x24], edx
lea edx, [ebp - 0x94]
cmp dword [0x43acd0], 1
mov word [ebp - 0x64], ax
sbb eax, eax
mov dword [ebp - 0x68], 1
and eax, 2
mov dword [esp + 0x20], edx
add eax, 0x11
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
test eax, eax
je 0x41bb68
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x41bb30
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], sym._tgt_process_active_close_process
mov dword [0x43ac04], eax
call sym._dbg_add_process
mov dword [0x43ac08], eax
test eax, eax
je 0x41bb88
mov dword [eax + 0x34], 1
mov eax, dword [0x43ad00]
mov esi, 1
cmp eax, ebx
je 0x41bb24
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov dword [0x43ad00], ebx
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
mov esi, 1
mov dword [esp], str.Debuggee_has_been_started___s__nBut_WineDbg_isnt_attached_to_it._Maybe_youre_trying_to_debug_a_winelib_wrapper____nTry_to_attach_to_one_of_those_processes:_n
call sym._dbg_printf
mov dword [esp], 0x64
call dword [sym.imp.kernel32.dll_Sleep]
sub esp, 4
call sym._info_win32_processes
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
mov esi, eax
mov dword [esp], str.Couldnt_start_process__s_n
call sym._dbg_printf
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
xor esi, esi
jmp 0x41bb24
Function at 0x41bb90
Capabilities:
Check if process is running under wine
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [0x43ac08]
test edx, edx
je 0x41bbc8
mov eax, dword [0x43ac04]
mov dword [esp], str.WineDbg_starting_on_pid__04lx_n
mov dword [esp + 4], eax
call sym._dbg_printf
mov eax, dword [0x43ac08]
mov eax, dword [eax + 0x34]
test eax, eax
jne 0x41bcf8
mov dword [0x43ac20], 1
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._parser_handle
mov eax, dword [0x43ad60]
mov ebx, dword [eax]
cmp eax, 0x43ad60
je 0x41bc13
lea esi, [esi]
mov edx, dword [eax + 0x10]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [edx]
mov eax, ebx
mov ebx, dword [ebx]
cmp eax, 0x43ad60
jne 0x41bbf8
lea eax, [ebp - 0x14]
mov dword [esp + 4], str.SoftwareWineWineDbg
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
sub esp, 0xc
test eax, eax
jne 0x41bcc0
mov esi, dword [sym.imp.advapi32.dll_RegSetValueExA]
mov ebx, 0x43ac40
lea edi, [ebp - 0x10]
jmp 0x41bc5b
add ebx, 0x10
cmp ebx, 0x43acf0
je 0x41bca0
cmp dword [ebx + 8], ebx
jne 0x41bc50
mov eax, dword [ebx]
mov dword [esp + 0x14], 4
add ebx, 0x10
mov dword [esp + 0x10], edi
mov dword [ebp - 0x10], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov eax, dword [ebx - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call esi
sub esp, 0x18
cmp ebx, 0x43acf0
jne 0x41bc5b
nop
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x4391a8], 2
je 0x41bcaf
mov dword [esp + 0xc], str.Cannot_create_WineDbg_key_in_registry_n
mov dword [esp + 8], str.dbg_save_internal_vars
mov dword [esp + 4], 0x4391a8
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._dbg_active_wait_for_first_exception
jmp 0x41bbc8
Function at 0x41cca0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym._crash_details_thread_4
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
leave
ret
Function at 0x41fd70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x41fdc8
cmp byte [esi + ebx - 1], 0xa
je 0x41fd9c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x43cec0], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x421e30
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x20c]
sub esp, 0x218
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._K32GetProcessImageFileNameW_12
sub esp, 0xc
test eax, eax
je 0x421eb8
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcsrchr]
test eax, eax
lea edx, [eax + 2]
cmove edx, ebx
cmp word [edx], 0
je 0x421ea6
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x421e80
sub eax, edx
cmp eax, 0x9e
jle 0x421ea6
mov dword [edx + 0x98], 0x2e002e
mov dword [edx + 0x9c], 0x2e
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], 0x50
mov dword [esp + 8], 0x43d040
mov dword [esp + 4], 0x12
mov dword [esp], eax
call dword [0x4ac87c]
mov ebx, dword [ebp - 4]
mov eax, 0x43d040
sub esp, 0x10
leave
ret
Function at 0x422d10
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, edx
sub esp, 0x14
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 0xa0]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
test edx, edx
jne 0x422d31
mov ebx, dword [eax + 0x44]
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + 0x1c]
lea esi, [eax + 0x1c]
cmp esi, edi
je 0x422dc0
cmp dword [ebp + 8], 0xffffffff
mov edx, 0x10002
mov eax, 0x80010001
cmove eax, edx
mov dword [ebp - 0x1c], eax
mov eax, ebx
mov ebx, esi
mov esi, eax
jmp 0x422d7f
mov edx, dword [ebp - 0x18]
mov eax, edi
call sym._dbg_thread_set_single_step
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResumeThread]
sub esp, 4
mov edi, dword [edi]
cmp edi, ebx
je 0x422dc0
cmp esi, 0xffffffff
je 0x422d89
cmp dword [edi + 0x10], esi
jne 0x422d79
mov eax, dword [edi + 0xc8]
test eax, eax
je 0x422d79
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov dword [edi + 0xc8], 0
mov edx, dword [ecx + 0x40]
cmp dword [eax + 0xc], edx
jne 0x422d60
mov eax, dword [ecx + 0x44]
cmp dword [edi + 0x10], eax
jne 0x422d60
mov eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x9c], ecx
jmp 0x422d60
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x423940
Capabilities:
Resume thread
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 8]
mov edx, dword [0x43ac08]
mov dword [ebp - 0x20], eax
test edx, edx
je 0x423ab0
mov eax, dword [0x43ac0c]
test eax, eax
je 0x423ab0
mov dword [esp], str.Exception_frames:_n
call sym._dbg_printf
mov eax, dword [ebp - 0x20]
mov edi, dword [0x43ac0c]
cmp dword [0x43ac10], eax
jne 0x4239d0
mov eax, dword [0x43ac08]
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 4
mov dword [esp + 8], ecx
mov ecx, dword [edi + 0x14]
mov dword [esp + 4], ecx
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [edx + 4]
test eax, eax
jne 0x423a20
mov dword [esp], str.Cant_read_TEB:except_frame_n
call sym._dbg_printf
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [0x43ac08]
mov dword [esp], eax
call sym._dbg_get_thread
mov edi, eax
test eax, eax
je 0x423af8
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SuspendThread]
sub esp, 4
cmp eax, 0xffffffff
jne 0x423987
mov eax, dword [ebp - 0x20]
mov dword [esp], str.Cant_suspend_thread_id___04lx__n
mov dword [esp + 4], eax
call sym._dbg_printf
jmp 0x4239c5
cmp dword [ebp - 0x14], 4
jne 0x4239b9
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x18]
cmp eax, 0xffffffff
je 0x423a86
lea esi, [esi]
mov dword [esp + 4], eax
mov dword [esp], str._p:
call sym._dbg_printf
mov eax, dword [0x43ac08]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 8
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [edx + 4]
test eax, eax
je 0x423a7a
cmp dword [ebp - 0x18], 8
je 0x423ac8
mov dword [esp], str.Invalid_frame_address_n
call sym._dbg_printf
mov eax, dword [ebp - 0x20]
cmp dword [0x43ac10], eax
je 0x4239c5
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResumeThread]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp + 8], str.Cannot_get_info_on_exceptions_while_no_process_is_loaded_n
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._dbg_printf
mov eax, dword [ebp - 0x10]
mov dword [esp], str.prev_p_handler_p_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
call sym._dbg_printf
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x423a38
jmp 0x423a86
mov eax, dword [ebp - 0x20]
mov dword [esp], str.Unknown_thread_id___04lx__in_current_process_n
mov dword [esp + 4], eax
call sym._dbg_printf
jmp 0x4239c5
Function at 0x424040
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
cmp eax, 0xffffffff
je 0x4241cc
mov dword [ebp - 0x1c], 0xffffffff
mov ebx, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x10
mov dword [esp], 0x1300
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4241ed
mov dword [eax], 0x128
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._Process32First_8
mov esi, dword [sym.imp.ucrtbase.dll_realloc]
sub esp, 8
test eax, eax
je 0x424130
lea esi, cs:[esi]
nop
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
lea eax, [ecx + 1]
imul ecx, ecx, 0x130
mov dword [ebp - 0x14], eax
mov dword [edx + ecx + 0x128], 0xffffffff
mov ecx, dword [ebp - 0x10]
cmp eax, ecx
jb 0x424106
imul ecx, ecx, 0x260
mov dword [esp], edx
mov dword [esp + 4], ecx
call esi
mov edx, eax
test eax, eax
je 0x4241f9
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
shl dword [ebp - 0x10], 1
imul eax, eax, 0x130
mov dword [edx + eax], 0x128
imul eax, dword [ebp - 0x14], 0x130
add eax, dword [ebp - 0x18]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._Process32Next_8
sub esp, 8
test eax, eax
jne 0x4240c0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ebx, dword [ebp - 0x14]
xor ecx, ecx
sub esp, 4
test ebx, ebx
je 0x4241e6
lea esi, [esi]
imul esi, ecx, 0x130
mov edx, dword [ebp - 0x18]
xor eax, eax
add esi, edx
lea esi, [esi]
cmp eax, ecx
je 0x42416c
mov edi, dword [esi + 0x18]
cmp dword [edx + 8], edi
je 0x4241d8
inc eax
add edx, 0x130
cmp eax, ebx
jne 0x424160
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x1c]
mov dword [esi + 0x12c], edx
mov dword [eax], ecx
mov ebx, dword [ebp - 0x14]
inc ecx
cmp ebx, ecx
ja 0x424150
mov ebx, dword [ebp - 0x1c]
mov dword [esp + 0xc], str.executable
mov dword [esp + 8], str.threads
mov dword [esp + 4], 0x440d64
mov dword [esp], str.___8.8s___8.8s__s__all_id:s_are_in_hex__n
call sym._dbg_printf
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, ebx
call sym._dump_proc_info
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [edx + 0x128]
mov edx, dword [edx + 0x128]
jmp 0x42417d
mov ebx, 0xffffffff
jmp 0x424190
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
jmp 0x4241cc
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x4241cc
Function at 0x4248e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
cmp dword [0x43ac04], eax
jne 0x424ab8
mov eax, dword [0x43ac08]
test eax, eax
je 0x424af7
mov eax, dword [eax + 8]
mov dword [ebp - 0x34], eax
mov dword [esp], str.Address__End______State___Type____RWX_n
xor edi, edi
call sym._dbg_printf
jmp 0x4249f9
cmp eax, 0x1000
mov esi, 0x440f51
mov eax, str.commit
cmove esi, eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x40000
je 0x424a83
ja 0x424a50
mov edx, 0x440f59
test eax, eax
je 0x424969
cmp eax, 0x20000
mov edx, str.private
mov eax, 0x440f51
cmovne edx, eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2a], 0x20
mov dword [ebp - 0x30], eax
mov eax, 0x2020
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x20]
mov byte [ebp - 0x29], 0
test al, 0xee
je 0x42498b
mov byte [ebp - 0x2c], 0x52
test al, 0x44
je 0x424993
mov byte [ebp - 0x2b], 0x57
test al, 0x88
je 0x42499b
mov byte [ebp - 0x2b], 0x43
test al, 0xf0
je 0x4249a3
mov byte [ebp - 0x2a], 0x58
mov eax, dword [ebp - 0x1c]
mov ecx, dword [0x43ac08]
lea ebx, [edi + eax - 1]
mov eax, 8
test ecx, ecx
je 0x4249c1
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 4]
add eax, eax
mov ecx, dword [ebp - 0x30]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], str._0Ix__0Ix__s__s__s_n
call sym._dbg_printf
mov eax, dword [ebp - 0x1c]
test eax, eax
js 0x424a90
add edi, eax
lea eax, [ebp - 0x28]
mov dword [esp + 0xc], 0x1c
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_VirtualQueryEx]
sub esp, 0x10
cmp eax, 0x1b
jbe 0x424a90
mov eax, dword [ebp - 0x18]
cmp eax, 0x2000
je 0x424a70
cmp eax, 0x10000
jne 0x424928
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], 0
mov esi, str.free
mov edx, 0x440850
mov dword [ebp - 0x30], eax
jmp 0x4249a3
cmp eax, 0x1000000
mov edx, str.image
mov eax, 0x440f51
cmovne edx, eax
jmp 0x424969
mov eax, dword [ebp - 0x10]
mov esi, str.reserve
cmp eax, 0x40000
jne 0x424948
mov edx, str.mapped
jmp 0x424969
mov eax, dword [ebp - 0x38]
cmp dword [0x43ac04], eax
je 0x424aaa
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], 0
mov dword [esp], 0x410
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_OpenProcess]
mov dword [ebp - 0x34], eax
sub esp, 0xc
test eax, eax
jne 0x42490e
mov eax, dword [ebp - 0x38]
mov dword [esp], str.Cannot_open_process___04lx__n
mov dword [esp + 4], eax
call sym._dbg_printf
jmp 0x424aaa
mov dword [ebp + 8], str.Cannot_look_at_mapping_of_current_process__while_no_process_is_loaded_n
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._dbg_printf