joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae08a
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov dword [ebp - 0xc], 0xfffffffa
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], 0
jns 0x4ae0b6
mov eax, dword [ebp - 0xc]
jmp 0x4ae197
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4ae112
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x508cb0
mov dword [esp + 8], str.OS_SendSecureTCP
mov dword [esp + 4], 0x29a
mov dword [esp], str.os_net_os_net.c
call dbg._merror_exit
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.wnet_order
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
lea edx, [eax + 4]
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._memcpy
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov dword [eax], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_send]
call eax
sub esp, 0x10
mov edx, eax
mov eax, dword [ebp - 0x14]
cmp edx, eax
jne 0x4ae181
mov eax, 0
jmp 0x4ae186
mov eax, 0xfffffffa
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4ae267
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 4
cmp dword [ebp + 0xc], 0
jne 0x4ae30a
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x10]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1002
mov dword [esp + 4], 0xffff
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_getsockopt]
call eax
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x4ae2b8
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp + 0x10], eax
jle 0x4ae395
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1002
mov dword [esp + 4], 0xffff
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_setsockopt]
call eax
sub esp, 0x14
test eax, eax
jns 0x4ae395
mov eax, 0xffffffff
jmp 0x4ae39a
cmp dword [ebp + 0xc], 1
jne 0x4ae395
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x10]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0xffff
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_getsockopt]
call eax
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x4ae34e
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp + 0x10], eax
jle 0x4ae395
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0xffff
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_setsockopt]
call eax
sub esp, 0x14
test eax, eax
jns 0x4ae395
mov eax, 0xffffffff
jmp 0x4ae39a
mov eax, 0
leave
ret
Function at 0x4ae743
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
jmp 0x4ae796
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
mov ecx, eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
add edx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x4ae790
mov eax, dword [ebp - 0x10]
jmp 0x4ae7a1
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jb 0x4ae752
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x4ae7a3
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], 0
mov dword [fdtimeout.tv_sec], 0
mov dword [ebp - 0xc], 0
jmp 0x4ae7e7
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + eax*4 - 0x10c]
mov eax, dword [ebp + 8]
cmp edx, eax
je 0x4ae7f2
add dword [ebp - 0xc], 1
mov eax, dword [fdtimeout.tv_sec]
cmp dword [ebp - 0xc], eax
jb 0x4ae7d2
mov eax, dword [fdtimeout.tv_sec]
cmp dword [ebp - 0xc], eax
jne 0x4ae824
mov eax, dword [fdtimeout.tv_sec]
cmp eax, 0x3f
ja 0x4ae824
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x10c], edx
mov eax, dword [fdtimeout.tv_sec]
add eax, 1
mov dword [fdtimeout.tv_sec], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
lea eax, [ebp - 0x118]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [fdtimeout.tv_sec]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WSOCK32.DLL_select]
call eax
sub esp, 0x14
leave
ret

Function at 0x4be2a4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
add eax, 0x244
mov dword [esp], eax
call dbg.rwlock_lock_write
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x200
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_gethostname]
call eax
sub esp, 8
test eax, eax
je 0x4be309
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x1ff
mov dword [esp + 4], str.localhost
mov dword [esp], eax
call sym._strncpy
mov eax, dword [ebp + 8]
mov byte [eax + 0x1ff], 0
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0x244
mov dword [esp], eax
call dbg.rwlock_unlock
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x4c4003
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x16], 0
mov word [ebp - 0x12], 0x100
mov eax, dword [0x58a3a4]
test eax, eax
jne 0x4c40c0
mov dword [esp + 0x28], 0x58a3a4
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
lea eax, [ebp - 0x16]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call eax
sub esp, 0x2c
test eax, eax
jne 0x4c40c0
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._6632_:_Could_not_obtain_the_sid_of_Everyone._Error__lu.
mov dword [esp + 8], str.is_valid_sacl
mov dword [esp + 4], 0x167
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror
mov eax, 2
jmp 0x4c41e1
cmp dword [ebp + 8], 0
jne 0x4c40f4
mov dword [esp + 0xc], str._6267_:_No_SACL_found_on_target._A_new_one_will_be_created.
mov dword [esp + 8], str.is_valid_sacl
mov dword [esp + 4], 0x16d
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._mdebug2
mov eax, 1
jmp 0x4c41e1
mov dword [ebp - 0xc], 0
jmp 0x4c41c9
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_GetAce]
call eax
sub esp, 0xc
test eax, eax
jne 0x4c415b
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._6633_:_Could_not_extract_the_ACE_information._Error:__lu.
mov dword [esp + 8], str.is_valid_sacl
mov dword [esp + 4], 0x173
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror
mov eax, 1
jmp 0x4c41e1
cmp dword [ebp + 0xc], 0
jne 0x4c417b
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 1]
movzx edx, al
movzx eax, word [0x4e9642]
movzx eax, ax
and eax, edx
test eax, eax
je 0x4c41c5
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 1]
movzx eax, al
and eax, 0x40
test eax, eax
je 0x4c41c5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
and eax, 0x50106
cmp eax, 0x50106
jne 0x4c41c5
mov eax, dword [0x58a3a4]
mov edx, dword [ebp - 0x10]
add edx, 8
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_EqualSid]
call eax
sub esp, 8
test eax, eax
je 0x4c41c5
mov eax, 0
jmp 0x4c41e1
add dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
movzx eax, word [eax + 4]
movzx eax, ax
cmp dword [ebp - 0xc], eax
jl 0x4c4100
mov eax, 1
leave
ret
Function at 0x4c7f97
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x5d], 0
lea eax, [ebp - 0x59]
mov ecx, 0x3d
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x64], 0x40
mov dword [ebp - 0x10], str.SystemCurrentControlSetControlSession_ManagerEnvironment
mov dword [ebp - 0x14], str.PROCESSOR_ARCHITECTURE
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
je 0x4c8053
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._1758_:_Unable_to_open_registry_key:__s.
mov dword [esp + 8], str.whodata_check_arch
mov dword [esp + 4], 0x67b
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror
mov eax, 0xffffffff
jmp 0x4c816e
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x64]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x5d]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4c80c1
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._6682_:_Error_reading_Architecture_from_Windows_registry.__Error__u_
mov dword [esp + 8], str.whodata_check_arch
mov dword [esp + 4], 0x67f
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror
jmp 0x4c815b
mov dword [esp + 8], 5
mov dword [esp + 4], str.AMD64
lea eax, [ebp - 0x5d]
mov dword [esp], eax
call sym._strncmp
test eax, eax
je 0x4c811e
mov dword [esp + 8], 4
mov dword [esp + 4], str.IA64
lea eax, [ebp - 0x5d]
mov dword [esp], eax
call sym._strncmp
test eax, eax
je 0x4c811e
mov dword [esp + 8], 5
mov dword [esp + 4], str.ARM64
lea eax, [ebp - 0x5d]
mov dword [esp], eax
call sym._strncmp
test eax, eax
jne 0x4c812e
mov byte [0x4e9640], 1
mov dword [ebp - 0xc], 0
jmp 0x4c815b
mov dword [esp + 8], 3
mov dword [esp + 4], 0x5104b8
lea eax, [ebp - 0x5d]
mov dword [esp], eax
call sym._strncmp
test eax, eax
jne 0x4c815b
mov byte [0x4e9640], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x4d0ec7
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x748
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dbg.filter
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
call dbg.filter
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
mov dword [esp], eax
call dbg.filter
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x10], 0
je 0x4d0f38
cmp dword [ebp - 0x14], 0
je 0x4d0f38
cmp dword [ebp - 0x18], 0
jne 0x4d0fae
mov dword [esp + 0xc], str._6200_:_Diff_execution_skipped_for_containing_insecure_characters.
mov dword [esp + 8], str.fim_diff_generate
mov dword [esp + 4], 0x296
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_fim_diff_changes.c
call dbg._mdebug1
cmp dword [ebp - 0x10], 0
je 0x4d0f74
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x14], 0
je 0x4d0f8c
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x18], 0
je 0x4d0fa4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x18], 0
mov eax, 0
jmp 0x4d10a3
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.fc__n___s____s______s__2__nul
mov dword [esp + 4], 0x70c
lea eax, [ebp - 0x728]
mov dword [esp], eax
call sym._snprintf_81
cmp dword [ebp - 0x10], 0
je 0x4d0ff9
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x14], 0
je 0x4d1011
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x18], 0
je 0x4d1029
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x728]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4d1066
mov dword [esp + 0xc], str._6352_:_Command_diff_fc_output_0__files_are_the_same
mov dword [esp + 8], str.fim_diff_generate
mov dword [esp + 4], 0x2b3
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_fim_diff_changes.c
call dbg._mdebug2
jmp 0x4d10a0
cmp dword [ebp - 0x1c], 1
jne 0x4d107c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.gen_diff_str
mov dword [ebp - 0xc], eax
jmp 0x4d10a0
mov dword [esp + 0xc], str._6714_:_Command_fc_output_an_error
mov dword [esp + 8], str.fim_diff_generate
mov dword [esp + 4], 0x2b8
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_fim_diff_changes.c
call dbg._merror
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x4d10a5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10048
call fcn.004d7290
sub esp, eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
mov dword [esp + 4], 0x51222f
mov dword [esp], eax
call dbg.wfopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4d1112
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._6665_:_Unable_to_generate_diff_alert__fopen__s.
mov dword [esp + 8], str.gen_diff_str
mov dword [esp + 4], 0x2c6
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_fim_diff_changes.c
call dbg._merror
mov eax, 0
jmp 0x4d1255
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xe7ff
mov dword [esp + 4], 1
lea eax, [ebp - 0x10019]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__unlink]
call eax
cmp dword [ebp - 0xc], 0
jne 0x4d1189
mov dword [esp + 0xc], str._6666_:_Unable_to_generate_diff_alert__fread_.
mov dword [esp + 8], str.gen_diff_str
mov dword [esp + 4], 0x2cf
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_fim_diff_changes.c
call dbg._merror
mov eax, 0
jmp 0x4d1255
lea edx, [ebp - 0x10019]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0
lea eax, [ebp - 0x10019]
mov dword [esp], eax
call dbg.adapt_win_fc_output
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4d11b8
mov eax, 0
jmp 0x4d1255
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0xa
lea eax, [ebp - 0x10019]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4d1252
mov eax, dword [ebp - 0x18]
add eax, 1
movzx eax, byte [eax]
cmp al, 0x2a
je 0x4d1252
mov eax, dword [str.More_changes...]
mov dword [esp], eax
call sym._strlen
mov edx, dword [ebp - 0xc]
add eax, edx
cmp eax, 0xe7fe
jbe 0x4d1239
mov eax, dword [str.More_changes...]
mov dword [esp], eax
call sym._strlen
sub dword [ebp - 0xc], eax
jmp 0x4d1221
sub dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x4d1239
mov eax, dword [ebp - 0xc]
lea edx, [eax - 1]
mov eax, dword [ebp - 0x14]
add eax, edx
movzx eax, byte [eax]
cmp al, 0xa
jne 0x4d121d
mov eax, dword [str.More_changes...]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._strcpy
mov eax, dword [ebp - 0x14]
leave
ret
Function at 0x4d6570
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf_1
call sym._abort
lea esi, [esi]

Function at 0x4d65d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x58a3fc]
test esi, esi
jle 0x4d66f0
mov eax, dword [0x58a400]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x4d6604
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4d6687
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4d65f0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x4d6717
mov eax, dword [0x58a400]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x58a400]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4d66f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4d6680
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4d6690
add dword [0x58a3fc], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x58a400]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4d6680
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4d660e
mov eax, dword [0x58a400]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x4d6c40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x58a418
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x58a410]
sub esp, 4
test ebx, ebx
je 0x4d6c95
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4d6c8e
test esi, esi
je 0x4d6c8e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4d6c70
mov dword [esp], 0x58a418
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4d6fc0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4d6fe5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4d6ff0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4d6fe5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x4d7038
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4d702e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4d703a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4d7020
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4d8120
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [esp + 0x150]
call sym.__errno
mov dword [eax], 0
test ebx, ebx
je 0x4d82a8
cmp byte [ebx], 0
je 0x4d8270
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x4d82b8
test al, 0x10
je 0x4d8270
lea esi, [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], esi
call sym.__fullpath
mov dword [esp], esi
call sym._strlen
mov dword [esp + 0x1c], eax
mov ebp, eax
lea eax, [eax + 0x233]
mov dword [esp], eax
call sym._malloc
mov ebx, eax
test eax, eax
je 0x4d82ca
lea edx, [eax + 0x22c]
lea eax, [ebp + 1]
cmp eax, 4
jb 0x4d8248
mov ecx, dword [esi + eax - 4]
mov edi, edx
mov dword [edx + eax - 4], ecx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
cmp byte [ebx + 0x22c], 0
je 0x4d81f0
movzx ecx, byte [ebx + ebp + 0x22b]
cmp cl, 0x5c
je 0x4d81f0
cmp cl, 0x2f
jne 0x4d8290
lea esi, [esi]
mov eax, dword [esp + 0x1c]
mov ecx, 0x2a
mov word [edx + eax], cx
lea edx, [ebx + 0x120]
mov ecx, 0x41
xor eax, eax
mov dword [ebx + 0x224], 0xffffffff
mov edi, edx
mov dword [ebx + 0x228], 0
mov dword [ebx + 0x118], 0
mov dword [ebx + 0x11c], 0
rep stosd dword es:[edi], eax
add esp, 0x13c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x4d81cb
movzx ecx, byte [esi]
mov byte [edx], cl
test al, 2
je 0x4d81cb
movzx ecx, word [esi + eax - 2]
mov word [edx + eax - 2], cx
jmp 0x4d81cb
call sym.__errno
xor ebx, ebx
mov dword [eax], 0x14
add esp, 0x13c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0x5c
mov dword [esp + 0x1c], eax
mov word [edx + ebp], si
jmp 0x4d81f0
call sym.__errno
mov dword [eax], 0xe
jmp 0x4d8236
call sym.__errno
xor ebx, ebx
mov dword [eax], 2
jmp 0x4d8236
call sym.__errno
mov dword [eax], 0xc
jmp 0x4d8236