joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c710
Capabilities:
Write file on windows

Disassembly:
push r12
push rdi
push rsi
sub rsp, 0x230
mov r12, rcx
call qword [sym.imp.ucrtbase.dll_strlen]
lea rdx, [rax + 3]
cmp rdx, 0x1ff
ja 0x41c808
mov edx, 0x212a
add rax, 1
lea rcx, [rsp + 0x32]
mov word [rsp + 0x30], dx
cmp eax, 8
jb 0x41c7e0
mov rdx, qword [r12]
lea rdi, [rsp + 0x38]
mov rsi, r12
mov qword [rsp + 0x32], rdx
mov edx, eax
mov r8, qword [r12 + rdx - 8]
mov qword [rcx + rdx - 8], r8
sub rcx, rdi
sub rsi, rcx
add ecx, eax
mov eax, ecx
shr eax, 3
mov ecx, eax
rep movsq qword [rdi], qword [rsi]
mov edx, 1
mov ecx, 0x3e8
call sym.SymSetExtendedOption
lea r9, [sym.symbols_info_cb]
lea r8, [rsp + 0x30]
xor edx, edx
mov r12d, eax
mov rax, qword [0x004471b0]
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x20], 0
call sym.SymEnumSymbols
mov edx, r12d
mov ecx, 0x3e8
call sym.SymSetExtendedOption
nop
add rsp, 0x230
pop rsi
pop rdi
pop r12
ret
test al, 4
jne 0x41c828
test eax, eax
je 0x41c780
movzx edx, byte [r12]
mov byte [rcx], dl
test al, 2
je 0x41c780
mov edx, eax
movzx eax, word [r12 + rdx - 2]
mov word [rcx + rdx - 2], ax
jmp 0x41c780
mov rdx, r12
lea rcx, str.Symbol_too_long___s__n
add rsp, 0x230
pop rsi
pop rdi
pop r12
jmp sym.dbg_printf
mov edx, dword [r12]
mov dword [rcx], edx
mov edx, eax
mov eax, dword [r12 + rdx - 4]
mov dword [rcx + rdx - 4], eax
jmp 0x41c780

Function at 0x41c870
Capabilities:
Terminate process

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov rbx, qword [0x004471b0]
mov rax, qword [rbx]
mov r12, rcx
test edx, edx
je 0x41c8c0
xor edx, edx
cmp rcx, rax
je 0x41c8e0
mov rcx, qword [r12 + 0x10]
call qword [sym.imp.kernel32.dll_TerminateProcess]
mov rcx, qword [r12 + 0x10]
call sym.SymCleanup
mov rcx, r12
call sym.dbg_del_process
mov eax, 1
add rsp, 0x28
pop rbx
pop r12
ret
cmp rcx, rax
je 0x41c900
mov ecx, dword [r12 + 0x18]
call qword [sym.imp.kernel32.dll_DebugActiveProcessStop]
test eax, eax
jne 0x41c89a
add rsp, 0x28
pop rbx
pop r12
ret
mov rax, qword [0x004471c0]
mov rax, qword [rax]
mov ecx, dword [rax + 0x7c]
test ecx, ecx
je 0x41c88f
mov edx, dword [rax + 0x88]
jmp 0x41c88f
xor ecx, ecx
call sym.break_set_xpoints
mov rax, qword [rbx]
xor edx, edx
mov rcx, qword [0x00447190]
mov rax, qword [rax + 0x58]
call qword [rax + 0x28]
mov rax, qword [0x004471c0]
mov rax, qword [rax]
mov edx, dword [rax + 0x7c]
test edx, edx
je 0x41c8c5
mov rcx, qword [rax + 0x18]
mov rax, qword [rbx]
mov rdx, qword [0x00447190]
mov rax, qword [rax + 0x58]
call qword [rax + 0xa8]
mov rax, qword [0x004471d0]
mov r8d, 0x10002
mov edx, dword [rax]
mov rax, qword [0x004471a0]
mov ecx, dword [rax]
call qword [sym.imp.kernel32.dll_ContinueDebugEvent]
jmp 0x41c8c5
Function at 0x41cbf0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push r13
push r12
push rdi
sub rsp, 0x150
mov r13, rcx
lea rcx, [rsp + 0xe0]
call qword [sym.imp.kernel32.dll_GetStartupInfoA]
lea rdx, [rsp + 0x70]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
test byte [rsp + 0x11c], 1
rep stosq qword [rdi], rax
mov eax, 1
mov dword [rsp + 0x70], 0x68
cmovne ax, word [rsp + 0x120]
mov dword [rsp + 0xac], 1
lea rcx, [rsp + 0x50]
mov word [rsp + 0xb0], ax
mov rax, qword [0x00447200]
cmp dword [rax + 0x120], 1
mov qword [rsp + 0x48], rcx
sbb eax, eax
mov qword [rsp + 0x40], rdx
xor r9d, r9d
xor ecx, ecx
and eax, 2
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x38], 0
add eax, 0x11
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
call qword [sym.imp.kernel32.dll_CreateProcessA]
mov r12d, eax
test eax, eax
je 0x41cd58
mov edx, dword [rsp + 0x60]
test edx, edx
je 0x41cd20
mov rax, qword [0x004471a0]
xor r8d, r8d
lea rcx, sym.tgt_process_active_close_process
mov dword [rax], edx
call sym.dbg_add_process
mov rdx, qword [0x004471b0]
mov qword [rdx], rax
test rax, rax
je 0x41cd80
mov rcx, qword [0x0044e250]
mov dword [rax + 0x68], 1
mov r12d, 1
cmp rcx, r13
je 0x41cd08
call qword [sym.imp.ucrtbase.dll_free]
mov qword [0x0044e250], r13
mov eax, r12d
add rsp, 0x150
pop rdi
pop r12
pop r13
ret
mov rdx, r13
lea rcx, str.Debuggee_has_been_started___s__nBut_WineDbg_isnt_attached_to_it._Maybe_youre_trying_to_debug_a_winelib_wrapper____nTry_to_attach_to_one_of_those_processes:_n
mov r12d, 1
call sym.dbg_printf
mov ecx, 0x64
call qword [sym.imp.kernel32.dll_Sleep]
call sym.info_win32_processes
mov eax, r12d
add rsp, 0x150
pop rdi
pop r12
pop r13
ret
mov rdx, r13
lea rcx, str.Couldnt_start_process__s_n
call sym.dbg_printf
mov eax, r12d
add rsp, 0x150
pop rdi
pop r12
pop r13
ret
xor r12d, r12d
jmp 0x41cd08

Function at 0x41cd90
Capabilities:
Get common file path

Disassembly:
push r13
push r12
sub rsp, 0x468
mov ecx, 0x104
lea r12, [rsp + 0x40]
mov rdx, r12
call qword [sym.imp.kernel32.dll_GetTempPathW]
test eax, eax
jne 0x41cdc8
mov rax, 0xffffffffffffffff
add rsp, 0x468
pop r12
pop r13
ret
lea r13, [rsp + 0x250]
xor r8d, r8d
lea rdx, [0x0043df7e]
mov rcx, r12
mov r9, r13
call qword [sym.imp.kernel32.dll_GetTempFileNameW]
test eax, eax
je 0x41cdb2
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, 4
mov rcx, r13
mov dword [rsp + 0x28], 0x4000080
mov edx, 0xc0010000
mov dword [rsp + 0x20], 2
call qword [sym.imp.kernel32.dll_CreateFileW]
add rsp, 0x468
pop r12
pop r13
ret
Function at 0x41e6e0
Capabilities:
Set environment variable

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword gs:[0x30]
mov r12d, ecx
cmp dword [rbx + 0x40], ecx
je 0x41e760
mov edx, ecx
xor r8d, r8d
lea rcx, sym.tgt_process_active_close_process
xor r13d, r13d
call sym.dbg_add_process
mov rsi, qword [0x004471b0]
mov qword [rsi], rax
test rax, rax
je 0x41e74d
mov ecx, r12d
call qword [sym.imp.kernel32.dll_DebugActiveProcess]
mov r13d, eax
test eax, eax
je 0x41e780
xor edx, edx
lea rcx, str.DBGHELP_NOLIVE
mov r13d, 1
call qword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
mov rax, qword [rsi]
mov dword [rax + 0x68], 1
mov eax, r13d
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
lea rcx, str.WineDbg_cant_debug_its_own_process._Please_use_another_process_ID._n
xor r13d, r13d
call sym.dbg_printf
mov eax, r13d
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
mov r8d, dword [rbx + 0x68]
mov edx, r12d
lea rcx, str.Cant_attach_process__04lx:_error__lu_n
call sym.dbg_printf
mov rcx, qword [rsi]
call sym.dbg_del_process
mov eax, r13d
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret

Function at 0x41eaa0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov rax, qword [0x004471b0]
cmp qword [rax], 0
mov rbx, rcx
lea rcx, str.Already_attached_to_a_process._Use_detach_or_kill_before_using_run_n
jne 0x41eb8f
mov r13, qword [0x0044e258]
test r13, r13
je 0x41eb88
test rbx, rbx
je 0x41eba0
mov rax, rbx
mov ecx, 2
nop dword [rax]
mov rax, qword [rax + 8]
add ecx, 1
test rax, rax
jne 0x41eae8
shl rcx, 3
call qword [sym.imp.ucrtbase.dll_malloc]
mov r12, rax
test rax, rax
je 0x41ebdf
mov qword [rax], r13
mov eax, 1
nop word [rax + rax]
mov rcx, qword [rbx]
mov edx, eax
add eax, 1
mov qword [r12 + rdx*8], rcx
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x41eb18
mov rcx, r12
mov qword [r12 + rax*8], 0
call sym.dbg_build_command_line
mov rbx, qword [sym.imp.ucrtbase.dll_free]
mov rcx, r12
mov r13, rax
call rbx
test r13, r13
je 0x41ebb8
mov rcx, r13
call sym.dbg_start_debuggee
test eax, eax
je 0x41ebb8
mov rax, qword [0x004471f0]
mov dword [rax], 0
call sym.wait_exception
xor edx, edx
xor ecx, ecx
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp sym.source_list_from_addr
lea rcx, str.No_active_target_to_be_restarted_n
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp sym.dbg_printf
mov rcx, qword [0x0044e250]
test rcx, rcx
je 0x41ebca
call sym.dbg_start_debuggee
jmp 0x41eb5d
mov rcx, r13
mov rax, rbx
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp rax
mov rcx, r13
call qword [sym.imp.ucrtbase.dll__strdup]
mov qword [0x0044e250], rax
mov rcx, rax
jmp 0x41ebac
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
Function at 0x41f050
Capabilities:
Get common file path

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x248
mov rbx, rdx
mov esi, ecx
mov ecx, 0xfffffff4
call qword [sym.imp.kernel32.dll_GetStdHandle]
mov rdx, qword [0x004471e0]
lea r8, [rbx + 8]
mov qword [rdx], rax
mov rax, qword [0x00447200]
lea edx, [rsi - 1]
mov dword [rax + 0x80], 0
cmp esi, 3
je 0x41f0c0
cmp edx, 3
je 0x41f1d8
mov eax, 1
cmp edx, 1
je 0x41f1b0
add rsp, 0x248
pop rbx
pop rsi
pop r12
pop r13
ret
mov rdx, r8
mov ecx, 2
call sym.dbg_active_attach
test eax, eax
jne 0x41f250
movabs rax, 0x706d7564696e696d
mov r9d, 0x2220
lea r12, [rsp + 0x130]
mov qword [rsp + 0x130], rax
mov word [rsp + 0x138], r9w
lea r13, [rsp + 0x20]
mov ecx, 0x104
mov rdx, r13
call qword [sym.imp.kernel32.dll_GetTempPathA]
lea rdx, [0x0043e71b]
xor r8d, r8d
mov rcx, r13
lea r9, [rsp + 0x13a]
call qword [sym.imp.kernel32.dll_GetTempFileNameA]
mov rcx, r12
call sym.strlen
mov ecx, 0x22
lea rdx, [rsp + 0x139]
mov word [r12 + rax], cx
lea rcx, str.Capturing_program_state_in__s_n
call sym.dbg_printf
mov rcx, r12
xor r8d, r8d
lea rdx, str.detach
call sym.parser_generate_command_file
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x41f280
mov rax, qword [0x004471b0]
mov rbx, qword [0x004471f0]
mov rax, qword [rax]
mov eax, dword [rax + 0x68]
test eax, eax
jne 0x41f268
mov rdx, r12
xor ecx, ecx
mov dword [rbx], 1
call sym.parser_handle
xor eax, eax
add rsp, 0x248
pop rbx
pop rsi
pop r12
pop r13
ret
mov rdx, r8
mov ecx, 1
call sym.dbg_active_attach
test eax, eax
je 0x41f0d5
add rsp, 0x248
pop rbx
pop rsi
pop r12
pop r13
ret
lea rdx, [rbx + 0x10]
mov ecx, 2
mov r13, qword [rbx + 8]
call sym.dbg_active_attach
test eax, eax
jne 0x41f0ab
movabs rax, 0x706d7564696e696d
mov r8d, 0x2220
lea r12, [rsp + 0x130]
mov qword [rsp + 0x130], rax
mov word [rsp + 0x138], r8w
test r13, r13
je 0x41f0fe
mov rdx, r13
lea rcx, [rsp + 0x13a]
call qword [sym.imp.ucrtbase.dll_strcpy]
mov rcx, r12
call sym.strlen
mov edx, 0x22
mov word [r12 + rax], dx
jmp 0x41f152
lea rdx, [rbx + 0x10]
mov ecx, 1
mov r13, qword [rbx + 8]
call sym.dbg_active_attach
jmp 0x41f1ea
mov dword [rbx], 0
call sym.wait_exception
jmp 0x41f18d
mov eax, 1
jmp 0x41f0ab
Function at 0x420260
Capabilities:
Create process memory minidump

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x60
mov rbx, qword [0x004471b0]
mov rax, qword [rbx]
mov rax, qword [rax + 0x58]
cmp dword [rax], 0x8664
mov rsi, rdx
je 0x4202c0
test byte [0x0042e2e0], 1
jne 0x420298
add rsp, 0x60
pop rbx
pop rsi
pop r12
ret
lea r9, str.Cannot_write_minidump_for_32_bit_process_using_64_bit_winedbg_n
lea r8, str.minidump_write
xor ecx, ecx
lea rdx, [0x0042e2e0]
add rsp, 0x60
pop rbx
pop rsi
pop r12
jmp sym.wine_dbg_log.constprop.0_9
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.kernel32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x42028a
test rsi, rsi
je 0x420331
mov rax, qword [0x004471c0]
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x50], rsi
lea rsi, [rsp + 0x40]
mov rax, qword [rax]
mov eax, dword [rax + 0x20]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x44], rax
mov rax, qword [0x00447190]
mov qword [rsp + 0x58], rax
mov rax, qword [rbx]
xor r9d, r9d
mov r8, r12
mov edx, dword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call sym.MiniDumpWriteDump
mov rcx, r12
call qword [sym.imp.kernel32.dll_CloseHandle]
nop
add rsp, 0x60
pop rbx
pop rsi
pop r12
ret
Function at 0x420370
Capabilities:
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x180
mov qword [rsp + 0x198], rdx
mov dword [rsp + 0x44], 1
cmp ecx, 1
jne 0x4204e5
test byte [0x0042e2e0], 8
jne 0x4204f8
mov ecx, 0x18
call qword [sym.imp.ucrtbase.dll_malloc]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x4205e3
mov rbx, qword [rsp + 0x48]
movdqu xmm0, xmmword [0x0043ed90]
xor r9d, r9d
mov r8d, 1
mov rax, qword [rsp + 0x198]
mov edx, 0x80000000
mov qword [rbx + 0x10], 0
movups xmmword [rbx], xmm0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov rcx, qword [rax]
call qword [sym.imp.kernel32.dll_CreateFileA]
mov qword [rbx + 8], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x4205f0
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov dword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_CreateFileMappingA]
mov qword [rbx + 0x10], rax
mov rcx, rax
test rax, rax
je 0x420530
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
call qword [sym.imp.kernel32.dll_MapViewOfFile]
mov qword [rbx], rax
test rax, rax
je 0x4205c0
mov rax, qword [sym.__wine_exception_handler_page_fault]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x44], 1
mov qword [rsp + 0x58], rax
call sym.__wine_setjmpex
test eax, eax
jne 0x420590
mov rax, qword gs:[0x30]
mov rdx, qword [rax]
mov qword [rsp + 0x50], rdx
lea rdx, [rsp + 0x50]
mov qword [rax], rdx
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
cmp dword [rax], 0x504d444d
je 0x4205d0
mov rdx, qword [rsp + 0x50]
mov rax, qword gs:[0x30]
mov qword [rax], rdx
mov eax, dword [rsp + 0x44]
test eax, eax
jne 0x4205f0
mov eax, dword [rsp + 0x44]
add rsp, 0x180
pop rbx
ret
mov rax, qword [rsp + 0x198]
lea r9, str.Processing_Minidump_file__s_n
lea r8, str.minidump_reload
mov ecx, 3
lea rdx, [0x0042e2e0]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
call sym.wine_dbg_log.constprop.0_9
jmp 0x42039e
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x44], 1
mov rcx, qword [rax]
test rcx, rcx
je 0x42055f
call qword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x42055f
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x420574
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ucrtbase.dll_free]
mov eax, dword [rsp + 0x44]
add rsp, 0x180
pop rbx
ret
mov rax, qword [rsp + 0x198]
lea rcx, str.Unexpected_fault_while_reading_minidump__s_n
mov rdx, qword [rax]
call sym.dbg_printf
mov rax, qword [0x004471a0]
mov dword [rax], 0
jmp 0x4204d9
mov dword [rsp + 0x44], 1
jmp 0x42054b
mov rcx, qword [rsp + 0x48]
call sym.minidump_do_reload
mov dword [rsp + 0x44], eax
jmp 0x4204c8
mov dword [rsp + 0x44], 2
jmp 0x4204e5
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
test rcx, rcx
jne 0x420545
jmp 0x42054b
Function at 0x420af0
Capabilities:
Get number of processors

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
mov rax, qword [0x004471b0]
mov rax, qword [rax]
mov edi, edx
mov rdx, qword [rax + 0x1468]
mov ebp, r8d
mov rsi, r9
test rdx, rdx
je 0x420c30
mov rbx, qword [rdx + 8]
test rbx, rbx
je 0x420be8
lea r9, [0x0043fb00]
jmp 0x420b49
mov rbx, qword [rdx + 0x18]
add rdx, 0x10
test rbx, rbx
je 0x420be8
mov eax, dword [rdx]
add eax, 0x100
cmp eax, 0x17
ja 0x420b38
movzx ecx, byte [r9 + rax*2]
cmp ecx, edi
jne 0x420b38
movzx eax, byte [r9 + rax*2 + 1]
cmp eax, ebp
jne 0x420b38
cmp word [rbx], 0
je 0x420c1b
mov rax, rbx
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x420b78
sub rax, rbx
mov r8, rax
sar r8, 1
add r8d, 1
movsxd r8, r8d
add r8, r8
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov qword [rsi], rax
mov rcx, rax
test rax, rax
je 0x420c89
xor eax, eax
nop
movzx edx, word [rbx + rax]
mov word [rcx + rax], dx
add rax, 2
test dx, dx
jne 0x420bc0
mov eax, 1
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
ret
test byte [0x0042e320], 1
jne 0x420c60
mov dword [rsp + 0x20], ebp
lea rbx, [rsp + 0x30]
mov r9d, edi
lea r8, str.bt__u__u_
mov edx, 0x40
mov rcx, rbx
call sym.swprintf.constprop.0
cmp word [rbx], 0
jne 0x420b72
mov r8d, 2
jmp 0x420b95
mov rax, qword [rax + 0x58]
lea rdx, [0x0043f980]
lea rbx, [0x0043ee06]
cmp dword [rax + 4], 4
je 0x420b2a
call sym.get_data_model.part.0
mov rdx, rax
jmp 0x420b1d
mov dword [rsp + 0x28], ebp
lea r9, str.Unsupported_basic_type__u__u_n
lea r8, str.lookup_base_type_in_data_model
xor ecx, ecx
mov dword [rsp + 0x20], edi
lea rdx, [0x0042e320]
call sym.wine_dbg_log.constprop.0_10
jmp 0x420bf1
xor eax, eax
jmp 0x420bd6
Function at 0x423e30
Capabilities:
Accept command line arguments
Create process on windows
Get common file path
Terminate process

Disassembly:
push r12
push rdi
push rbx
sub rsp, 0x300
xor eax, eax
mov ecx, 0xd
mov edx, 0x104
lea rbx, [rsp + 0x80]
lea r12, [rsp + 0xf0]
mov rdi, rbx
rep stosq qword [rdi], rax
mov rcx, r12
mov dword [rsp + 0x80], 0x68
call qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov rax, r12
cmp word [rsp + 0xf0], 0
je 0x423e8a
nop
add rax, 2
cmp word [rax], 0
jne 0x423e80
lea rdx, str.winedbg.exe
nop dword [rax]
movzx ecx, word [rdx]
add rdx, 2
add rax, 2
mov word [rax - 2], cx
test cx, cx
jne 0x423e98
lea rcx, [rsp + 0x58]
call qword [sym.imp.kernel32.dll_Wow64DisableWow64FsRedirection]
call qword [sym.imp.kernel32.dll_GetCommandLineW]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rbx
mov rdx, rax
lea rax, [rsp + 0x60]
mov rcx, r12
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
jne 0x423f63
test byte [0x0042e340], 2
jne 0x423f25
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.kernel32.dll_Wow64RevertWow64FsRedirection]
nop
add rsp, 0x300
pop rbx
pop rdi
pop r12
ret
mov rcx, r12
mov rax, qword gs:[0x30]
mov ebx, dword [rax + 0x68]
call sym.wine_dbgstr_wn.constprop.0_1
lea r9, str.failed_to_restart_64_bit__s__err__ld_n
mov ecx, 1
lea r8, str.restart_if_wow64
mov dword [rsp + 0x28], ebx
lea rdx, [0x0042e340]
mov qword [rsp + 0x20], rax
call sym.wine_dbg_log.constprop.0_11
jmp 0x423f0d
test byte [0x0042e340], 8
jne 0x423fa1
mov edx, 1
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetConsoleCtrlHandler]
mov rcx, qword [rsp + 0x60]
or edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x54]
call qword [sym.imp.kernel32.dll_GetExitCodeProcess]
mov ecx, dword [rsp + 0x54]
call qword [sym.imp.kernel32.dll_ExitProcess]
mov rcx, r12
call sym.wine_dbgstr_wn.constprop.0_1
lea r9, str.restarting__s_n
mov ecx, 3
lea r8, str.restart_if_wow64
mov qword [rsp + 0x20], rax
lea rdx, [0x0042e340]
call sym.wine_dbg_log.constprop.0_11
jmp 0x423f6c
Function at 0x424000
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r14d, 0xffffffff
lea rax, [rsp + 0xa8]
mov qword [rsp + 0xa8], rdx
lea rdx, [0x0044f900]
mov qword [rsp + 0xb0], r8
mov r8d, 0x1000
mov qword [rsp + 0xb8], r9
mov r9, rcx
mov ecx, 6
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.ucrtbase.dll___stdio_common_vsprintf]
test eax, eax
cmovns r14d, eax
mov dword [rsp + 0x3c], r14d
cmp r14d, 0xfff
ja 0x424244
test eax, eax
jle 0x424217
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
mov r15d, dword [0x0044f8e0]
lea r13, [0x0044f900]
lea rbp, [0x0044e8e0]
mov r12d, dword [rsp + 0x3c]
mov qword [rsp + 0x30], rax
mov r14, r15
nop dword [rax]
mov esi, 0x1000
movsxd rdx, r12d
lea r8, [rbp + r15]
sub rsi, r15
cmp rsi, rdx
cmovbe rdx, rsi
cmp edx, 8
jae 0x424180
test dl, 4
jne 0x42422c
test edx, edx
je 0x4240ee
movzx eax, byte [r13]
mov byte [r8], al
test dl, 2
jne 0x42425b
mov edi, r12d
lea esi, [r14 + rdx]
add r13, rdx
sub edi, edx
mov dword [0x0044f8e0], esi
mov ebx, esi
mov r12d, edi
jmp 0x424120
lea edx, [rbx - 1]
cmp byte [rbp + rdx], 0xa
je 0x4241c0
mov ebx, edx
test ebx, ebx
jne 0x424110
test edi, edi
jle 0x424217
mov r8d, esi
mov rcx, qword [0x0044e3c0]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea rdx, [0x0044e8e0]
call qword [sym.imp.kernel32.dll_WriteFile]
mov r14d, dword [0x0044f8e0]
mov edx, esi
lea rcx, [0x0044e8e0]
add rdx, rbp
sub r14d, esi
mov r15d, r14d
mov r8, r15
call qword [sym.imp.ucrtbase.dll_memmove]
jmp 0x4240b0
mov rax, qword [r13]
lea rdi, [r8 + 8]
mov rsi, r13
and rdi, 0xfffffffffffffff8
mov qword [r8], rax
mov eax, edx
mov rcx, qword [r13 + rax - 8]
mov qword [r8 + rax - 8], rcx
sub r8, rdi
sub rsi, r8
add r8d, edx
shr r8d, 3
mov ecx, r8d
rep movsq qword [rdi], qword [rsi]
jmp 0x4240ee
mov rcx, qword [0x0044e3c0]
lea r9, [rsp + 0x44]
mov r8d, ebx
lea rdx, [0x0044e8e0]
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x30]
call rax
mov r14d, dword [0x0044f8e0]
mov edx, ebx
lea rcx, [0x0044e8e0]
add rdx, rbp
sub r14d, ebx
mov r15d, r14d
mov r8, r15
call qword [sym.imp.ucrtbase.dll_memmove]
mov dword [0x0044f8e0], r14d
test edi, edi
jg 0x4240b0
mov eax, dword [rsp + 0x3c]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [r13]
mov dword [r8], eax
mov eax, edx
mov ecx, dword [r13 + rax - 4]
mov dword [r8 + rax - 4], ecx
jmp 0x4240ee
mov dword [0x004508fc], 0x2e2e2e
mov dword [rsp + 0x3c], 0xfff
jmp 0x424084
mov eax, edx
movzx ecx, word [r13 + rax - 2]
mov word [r8 + rax - 2], cx
jmp 0x4240ee
Function at 0x4248c0
Capabilities:
Access pe header
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd08
mov rbx, qword [0x0042e330]
lea rax, [0x0042e330]
mov r12, rcx
mov r14, rdx
mov r15, r8
mov rsi, r9
cmp rbx, rax
jne 0x42490c
jmp 0x424aa9
mov rbx, qword [rbx]
cmp rbx, rax
je 0x424aa9
cmp r12, qword [rbx + 0x10]
jne 0x424900
mov ecx, 0x20
call qword [sym.imp.ucrtbase.dll_malloc]
mov r13, rax
test rax, rax
je 0x424aa9
mov eax, dword [rsp + 0xd70]
xor r9d, r9d
mov r8, r15
mov rdx, r14
mov dword [rsp + 0x38], 0
mov rcx, r12
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call sym.SymLoadModuleExW
test rax, rax
je 0x424aa0
mov qword [r13 + 0x10], rsi
mov rax, qword [rbx + 0x48]
mov rcx, r14
xor r9d, r9d
mov r8d, 2
xor edx, edx
lea rdi, [rsp + 0x40]
mov qword [r13], rax
lea rax, [rbx + 0x48]
mov qword [r13 + 8], rax
mov rax, qword [rbx + 0x48]
mov qword [rax + 8], r13
mov qword [rbx + 0x48], r13
mov qword [r13 + 0x18], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_CreateFileMappingW]
mov r14, rax
test rax, rax
je 0x424a52
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
je 0x424a49
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov edx, 1
mov r9, rdi
mov rcx, rbx
mov rbp, rax
mov r8d, 9
call qword [sym.imp.ntdll.dll_RtlImageDirectoryEntryToData]
movzx edx, word [rbp + 0x18]
cmp dx, 0x10b
je 0x424ac3
cmp dx, 0x20b
jne 0x424a40
test rax, rax
je 0x424a40
cmp dword [rsp + 0x40], 0x27
jbe 0x424a40
sub rax, rbx
add rax, 0x10
mov qword [r13 + 0x18], rax
nop word [rax + rax]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, r12
mov r8, rdi
mov rdx, rsi
mov dword [rsp + 0x40], 0xcc0
call sym.SymGetModuleInfoW64
mov r12d, 1
test eax, eax
je 0x424aac
cmp qword [rsp + 0xcd8], 0
je 0x424aac
mov rcx, r15
call sym.wine_dbgstr_wn.constprop.0_1
lea rcx, str.Loaded_unmatched_debug_information_for__s_n
mov rdx, rax
call sym.dbg_printf
jmp 0x424aac
mov rcx, r13
call qword [sym.imp.ucrtbase.dll_free]
xor r12d, r12d
mov eax, r12d
add rsp, 0xd08
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rax, rax
je 0x424a40
cmp dword [rsp + 0x40], 0x17
jbe 0x424a40
sub rax, rbx
add rax, 8
mov qword [r13 + 0x18], rax
jmp 0x424a40