joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425520
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x24
mov dword [ebp - 0x1c], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
lea ecx, [ebp - 0x10]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [0x43ad50]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], 0x10
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x425645
inc dword [0x43ad54]
mov edi, 2
mov ebx, 0x10
jmp 0x4255a6
movzx eax, byte [ebp - 0x11]
mov edx, dword [ebp - 0x18]
lea ecx, [edi - 1]
inc edi
mov byte [edx + esi], al
cmp al, 0xa
je 0x425630
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], 0
lea esi, [edi - 2]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x11]
mov dword [esp + 4], eax
mov eax, dword [0x43ad4c]
mov dword [esp + 8], 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x425610
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x425610
cmp ebx, edi
jae 0x425590
lea esi, cs:[esi]
nop
add ebx, ebx
cmp ebx, edi
jb 0x4255f0
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_realloc]
test eax, eax
je 0x425610
mov dword [ebp - 0x18], eax
jmp 0x425590
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov byte [edx + ecx], 0
mov eax, edx
mov edx, dword [ebp - 0x1c]
mov dword [edx], eax
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x1f7
mov dword [esp + 4], str.._programs_winedbg_dbg.y
mov dword [esp], str.buffer___NULL
call dword [sym.imp.ucrtbase.dll__assert]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x425b50
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop
Function at 0x428b70
Capabilities:
Create process memory minidump

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x428c30
mov ebx, eax
test esi, esi
je 0x428bea
mov eax, dword [0x43ac0c]
mov dword [ebp - 0x18], 0x43a920
mov dword [ebp - 0xc], 0
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1c], esi
lea esi, [ebp - 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [0x43ac08]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov edx, dword [eax + 0xc]
mov dword [esp + 4], edx
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._MiniDumpWriteDump_28
sub esp, 0x1c
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x429750
Capabilities:
Check os version
Contain obfuscated stackstrings
Get process heap flags
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x18]
test edx, edx
jne 0x429766
leave
jmp sym._packet_reply_status
mov dword [esp + 8], 0x433
mov dword [esp + 4], str..._src_wine_programs_winedbg_gdbproxy.c
mov dword [esp], str.gdbctx__in_packet_len__0
call dword [sym.imp.ucrtbase.dll__assert]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x42cea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ecx, 1
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
mov edx, 0x43f31c
lea edi, [esi + 0x1c]
sub esp, 8
call sym._packet_reply_add_data
mov eax, ebx
movzx ebx, bl
mov ecx, 2
and eax, 0xf
shr ebx, 4
movzx eax, byte [eax + 0x43f30b]
mov byte [ebp - 0x13], al
movzx eax, byte [ebx + 0x43f30b]
lea ebx, [ebp - 0x14]
mov edx, ebx
mov byte [ebp - 0x14], al
mov eax, edi
call sym._reply_buffer_append
mov edx, str.thread:
mov eax, esi
mov ecx, 7
call sym._packet_reply_add_data
mov eax, dword [esi + 0x44]
lea edx, [ebp - 0xc]
lea esi, cs:[esi]
nop
mov ecx, eax
dec edx
shr eax, 4
and ecx, 0xf
movzx ecx, byte [ecx + 0x43f30b]
mov byte [edx], cl
cmp edx, ebx
jne 0x42cf10
mov eax, edi
mov ecx, 8
call sym._reply_buffer_append
add esp, 8
mov eax, esi
mov ecx, 1
pop ebx
mov edx, 0x43f326
pop esi
pop edi
pop ebp
jmp sym._packet_reply_add_data

Function at 0x42df80
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x214]
lea esi, [ebp - 0x110]
push ebx
sub esp, 0x230
mov ebx, dword [ebp + 8]
mov dword [esp + 4], edi
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
sub esp, 8
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x444c34
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x4000080
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0xc0010000
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
je 0x42e10f
mov eax, dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp], ebx
lea edi, [ebp + 0x10]
mov dword [ebp - 0x220], eax
call eax
lea edx, [ebp - 0x218]
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov eax, dword [sym.imp.kernel32.dll_WriteFile]
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [ebp - 0x21c], eax
call eax
sub esp, 0x14
jmp 0x42e0b1
mov dword [esp + 8], 1
mov eax, dword [ebp - 0x21c]
mov dword [esp + 4], 0x444655
mov dword [esp], esi
call eax
mov edx, dword [ebp - 0x220]
sub esp, 0x14
mov dword [esp], ebx
call edx
lea ecx, [ebp - 0x218]
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x21c]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], ebx
mov dword [esp], esi
call eax
sub esp, 0x14
mov ebx, dword [edi - 4]
lea eax, [ebp - 0x218]
add edi, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
test ebx, ebx
jne 0x42e060
mov dword [esp + 8], 6
mov eax, dword [ebp - 0x21c]
mov dword [esp + 4], str._nquit_n
mov dword [esp], esi
call eax
sub esp, 0x14
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_SetFilePointer]
sub esp, 0x10
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42e5d0
Capabilities:
Get process heap flags
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x14
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x42e698
test bl, bl
jne 0x42e648
cmp eax, 0xffffff1d
je 0x42e610
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
jmp sym._print_typed_basic
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sym._types_extract_as_lgint
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], 0x44215b
call sym._dbg_printf
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x10]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._types_extract_as_lgint
lea ecx, [ebx - 0x62]
cmp cl, 0x16
ja case.0x42e66b.3
movzx ecx, cl
jmp dword [ecx*4 + 0x44223c]
movsx ebx, bl
mov dword [esp], 0x442200
mov dword [esp + 4], ebx
call sym._dbg_printf
mov eax, dword [esi + 0x18]
jmp 0x42e5f2
mov dword [ebp + 8], str.Unable_to_evaluate_expression_n
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._dbg_printf
mov edi, edx
or edi, eax
jne 0x42e710
mov dword [esp], 0x4420a2
call sym._dbg_printf
jmp 0x42e63c
movzx eax, ax
mov dword [esp], str._d___lc
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call sym._dbg_printf
jmp 0x42e63c
movsx eax, al
mov dword [esp], str._d___c
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call sym._dbg_printf
jmp 0x42e63c
mov ecx, 8
sub ecx, dword [esp + 0x10]
mov edi, 0xffffffff
mov esi, 0xffffffff
shl ecx, 3
xor ebx, ebx
mov dword [esp], 0x4420a4
shrd esi, edi, cl
shr edi, cl
test cl, 0x20
cmovne esi, edi
cmovne edi, ebx
and eax, esi
and edx, edi
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call sym._dbg_printf
jmp 0x42e63c
Function at 0x42fcd0
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Get common file path
Terminate process

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x10
mov ebp, esp
push edi
push ebx
lea edx, [ebp - 0x250]
lea ebx, [ebp - 0x210]
mov edi, edx
sub esp, 0x28c
mov dword [ebp - 0x254], 0x44
rep stosd dword es:[edi], eax
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov edx, ebx
sub esp, 8
cmp word [ebp - 0x210], 0
je 0x42fd29
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x42fd20
xor eax, eax
mov ecx, 0x5c
jmp 0x42fd3f
movzx ecx, word [eax + str.winedbg.exe]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x42fd38
lea eax, [ebp - 0x26c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_Wow64DisableWow64FsRedirection]
sub esp, 4
call dword [sym.imp.kernel32.dll_GetCommandLineW]
lea edx, [ebp - 0x264]
mov dword [esp], ebx
mov dword [esp + 0x24], edx
lea edx, [ebp - 0x254]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
jne 0x42fe1b
test byte [0x4391a8], 2
jne 0x42fddd
mov eax, dword [ebp - 0x26c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_Wow64RevertWow64FsRedirection]
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
mov eax, dword fs:[0x18]
mov edi, dword [eax + 0x34]
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [esp + 0xc], str.failed_to_restart_64_bit__s__err__ld_n
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.restart_if_wow64
mov dword [esp + 4], 0x4391a8
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_10
jmp 0x42fdc4
test byte [0x4391a8], 8
jne 0x42fe7e
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_SetConsoleCtrlHandler]
push eax
push eax
mov eax, dword [ebp - 0x264]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea eax, [ebp - 0x268]
push edx
push edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x264]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x268]
push ecx
push ecx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [esp + 0xc], str.restarting__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.restart_if_wow64
mov dword [esp + 4], 0x4391a8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_10
jmp 0x42fe24
Function at 0x430b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
test esi, esi
je 0x430be8
test edi, edi
je 0x430bc8
mov ebx, dword [esi + 0xc]
test ebx, ebx
je 0x430c50
mov eax, dword [edi + 0xc]
test eax, eax
je 0x430b5f
mov dword [ebp - 0x10], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strcmp]
mov edx, dword [ebp - 0x10]
test eax, eax
jne 0x430c80
mov esi, dword [esi + 8]
mov edi, dword [edi + 8]
mov eax, edi
and eax, esi
cmp eax, 0xffffffff
je 0x430c10
cmp esi, 0xffffffff
je 0x430bff
cmp edi, 0xffffffff
je 0x430bdf
mov edx, esi
mov eax, ebx
mov ecx, edi
call sym._source_display.isra.0
mov edx, dword [0x43ac08]
lea eax, [edx + 0x1314]
cmp eax, ebx
je 0x430bae
mov dword [ebp - 0x10], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strcpy]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1418], esi
mov dword [edx + 0x141c], edi
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x430be8
mov ebx, dword [esi + 0xc]
test ebx, ebx
je 0x430c5b
mov esi, dword [esi + 8]
cmp esi, 0xffffffff
je 0x430c10
lea edi, [edx + esi]
jmp 0x430b80
test edi, edi
je 0x430c30
mov ebx, dword [edi + 0xc]
test ebx, ebx
je 0x430c98
mov edi, dword [edi + 8]
cmp edi, 0xffffffff
je 0x430c10
lea esi, [edx + edi]
jmp 0x430b80
mov eax, dword [0x43ac08]
test edx, edx
js 0x430c40
mov esi, dword [eax + 0x141c]
lea edi, [edx + esi]
jmp 0x430b80
mov eax, dword [0x43ac08]
lea ebx, [eax + 0x1314]
jmp 0x430c15
mov edi, dword [eax + 0x1418]
lea esi, [edx + edi]
jmp 0x430b80
mov ebx, dword [edi + 0xc]
test ebx, ebx
jne 0x430b5f
mov eax, dword [0x43ac08]
mov esi, dword [esi + 8]
lea ebx, [eax + 0x1314]
test edi, edi
je 0x430bda
jmp 0x430b62
mov dword [ebp + 8], str.Ambiguous_source_file_specification._n
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
jmp sym._dbg_printf
mov eax, dword [0x43ac08]
lea ebx, [eax + 0x1314]
jmp 0x430bf7
Function at 0x430d60
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
sub esp, 0x1c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x430e5c
mov ebx, eax
test edi, edi
je 0x430dd3
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [edi], eax
sub esp, 8
cmp eax, 0xffffffff
je 0x430e50
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateFileMappingW]
sub esp, 0x18
mov dword [esi], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi]
sub esp, 4
test eax, eax
je 0x430e5c
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4310f0
Capabilities:
Enumerate threads
Resume thread
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
cmp edx, 0xffffffff
je 0x431120
mov eax, dword [0x43ac08]
test eax, eax
je 0x431130
cmp dword [0x43ac10], edx
je 0x431118
pop ebp
jmp sym._backtrace_tid
pop ebp
jmp sym._backtrace
pop ebp
jmp sym._backtrace_all
mov dword [ebp + 8], str.You_must_be_attached_to_a_process_to_run_this_command._n
pop ebp
jmp sym._dbg_printf

Function at 0x433290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], str.No_longer_supported_n
pop ebp
jmp sym._dbg_printf
Function at 0x433610
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x43ac08]
test edx, edx
je 0x433660
xor edx, edx
cmp ebx, eax
je 0x433680
mov dword [esp + 4], edx
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
sub esp, 8
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.dbghelp.dll_SymCleanup]
sub esp, 4
mov dword [esp], ebx
call sym._dbg_del_process
mov ebx, dword [ebp - 4]
mov eax, 1
leave
ret
cmp ebx, eax
je 0x433698
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DebugActiveProcessStop]
sub esp, 4
test eax, eax
jne 0x43363f
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [0x43ac0c]
mov ecx, dword [eax + 0x64]
test ecx, ecx
je 0x43362c
mov edx, dword [eax + 0x6c]
jmp 0x43362c
mov dword [esp], 0
call sym._break_set_xpoints
mov eax, dword [0x43ac08]
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], 0x43a920
call dword [eax + 0x18]
mov eax, dword [0x43ac0c]
mov edx, dword [eax + 0x64]
test edx, edx
je 0x433664
mov edx, dword [0x43ac08]
mov edx, dword [edx + 0x2c]
mov dword [esp + 4], 0x43a920
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [edx + 0x58]
mov eax, dword [0x43ac10]
mov dword [esp + 8], 0x10002
mov dword [esp + 4], eax
mov eax, dword [0x43ac04]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ContinueDebugEvent]
sub esp, 0xc
jmp 0x433664

Function at 0x434490
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x1c
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
mov dword [esp + 8], eax
lea eax, [ebp - 0x18]
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x14], edx
call sym._types_get_info
mov ebx, eax
test eax, eax
jne 0x4344d0
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
lea eax, [ebp - 0xc]
mov dword [esp + 4], 1
mov dword [esp + 8], eax
lea eax, [ebp + 8]
mov dword [esp], eax
call sym._types_get_info
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov ebx, eax
test eax, eax
jne 0x434528
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ebx, 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
xor edx, edx
test eax, eax
mov eax, dword [ebp + 0x10]
sete dl
mov dword [eax], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
jmp 0x4344f6
Function at 0x436510
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x52c]
push ebx
sub esp, 0x544
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0xffffffff
lea ebx, [eax + 0x18]
jne 0x436553
jmp 0x43656b
mov eax, dword [ebp - 0x52c]
cmp eax, 0x11
jne 0x436578
mov dword [esp + 8], ebx
mov dword [esp + 4], 3
mov dword [esp], ebx
call sym._types_get_info
test eax, eax
je 0x43656b
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], ebx
call sym._types_get_info
test eax, eax
jne 0x436530
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0xb
jne 0x43656b
lea eax, [ebp - 0x528]
mov dword [esp + 4], 0xd
mov dword [esp + 8], eax
mov dword [esp], ebx
call sym._types_get_info
test eax, eax
je 0x43656b
mov dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x528]
test eax, eax
je 0x43656b
mov dword [ebp - 0x530], ebx
lea esi, [ebp - 0x418]
jmp 0x4365e3
cmp eax, 0x100
mov edx, 0x100
cmovbe edx, eax
add dword [ebp - 0x414], 0x100
sub eax, edx
mov dword [ebp - 0x528], eax
test eax, eax
je 0x43656b
mov edx, 0x100
cmp eax, 0x100
mov dword [esp + 8], esi
cmova eax, edx
mov dword [esp + 4], 7
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x530]
mov dword [esp], eax
call sym._types_get_info
mov edx, eax
mov eax, dword [ebp - 0x528]
test edx, edx
je 0x4365c0
mov ecx, dword [ebp + 8]
cmp dword [ebp - 0x418], eax
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x51c], edx
mov edx, eax
cmovbe edx, dword [ebp - 0x418]
test edx, edx
je 0x4365c0
xor ebx, ebx
lea edi, [ebp - 0x524]
jmp 0x436666
mov eax, dword [ebp - 0x528]
inc ebx
cmp dword [ebp - 0x418], eax
mov edx, eax
cmovbe edx, dword [ebp - 0x418]
cmp edx, ebx
jbe 0x4365c0
mov eax, dword [esi + ebx*4 + 8]
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [ebp - 0x520], eax
lea eax, [ebp - 0x520]
mov dword [esp], eax
call sym._types_get_info
test eax, eax
je 0x436648
mov eax, dword [ebp - 0x524]
test eax, eax
je 0x436648
lea ecx, [ebp - 0x518]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x100
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0x524]
sub esp, 0x20
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
sub esp, 0xc
mov dword [esp + 4], eax
lea eax, [ebp - 0x518]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strcmp]
test eax, eax
jne 0x436648
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x520]
call sym._types_get_udt_element_lvalue
jmp 0x43656d
Function at 0x4379f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0xc
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x444c40
mov dword [esp], eax
call sym._fprintf.constprop.0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x403015
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x403024
pop dword [ebp - 0x24]
mov eax, 0xda685544
add eax, 0x25d7dae0
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x4d1648d8
add dword [ebp - 0x34], 0x13bfc73
mov dword [ebp - 0x30], 0x39bed718
add dword [ebp - 0x30], 0xf874752d
mov dword [ebp - 0x2c], 0xc445cc25
sub dword [ebp - 0x2c], 0x77f987f7
mov dword [ebp - 0x28], 0x540f94df
sub dword [ebp - 0x28], 0x540f94df
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x729b9826
add dword [ebp - 0x34], 0x1d6d130
mov dword [ebp - 0x30], 0xc7ff55dc
sub dword [ebp - 0x30], 0x8692f467
mov dword [ebp - 0x2c], 0x119350a4
add dword [ebp - 0x2c], 0x51dc1bc8
mov dword [ebp - 0x28], 0xe8fee353
sub dword [ebp - 0x28], 0xe8fee353
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x33fbc
push 0
call eax
mov ecx, 0x3bc8
mov edi, eax
mov ebx, 0x451400
add ebx, dword [ebp - 0x24]
mov esi, 0x90687d89
sub esi, 0x17c07311
add dword [ebp - 0xc], edi
mov edx, dword [ebx]
xor dword [ebp - 0x1c], ecx
xor edx, esi
mov dword [ebp - 0xc], 0x6e1c0692
mov dword [edi], edx
add dword [ebp - 4], ebx
add edi, 0xac3895e
sub edi, 0xac3895a
add ebx, 0xe2817e46
sub ebx, 0xe2817e42
loop 0x403130
add eax, 0xe1f3
mov ebx, eax
add eax, 0xd5ac696
sub eax, 0xd5ac691
mov ecx, 0xddf7f717
sub ecx, 0xddb7f717
add ecx, dword [ebp - 0x24]
call ebx
leave
ret