joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4118c0
Capabilities:
Resume thread
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 8]
mov ebx, dword [0x4ab5d8]
mov dword [ebp - 0x20], eax
test ebx, ebx
je 0x411a28
mov ecx, dword [0x4ab5d4]
test ecx, ecx
je 0x411a28
mov dword [esp], str.Exception_frames:_n
call fcn.004218d0
mov eax, dword [ebp - 0x20]
cmp dword [0x4ab5d0], eax
mov edi, dword [0x4ab5d4]
jne 0x411950
mov eax, dword [0x4ab5d8]
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 4
mov dword [esp + 8], ecx
mov ecx, dword [edi + 0x14]
mov dword [esp + 4], ecx
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [edx + 4]
test eax, eax
jne 0x411998
mov dword [esp], str.Cant_read_TEB:except_frame_n
call fcn.004218d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [0x4ab5d8]
mov dword [esp], eax
call fcn.00422430
mov edi, eax
test eax, eax
je 0x411a70
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SuspendThread]
inc eax
push edx
jne 0x411908
mov eax, dword [ebp - 0x20]
mov dword [esp], str.Cant_suspend_thread_id___04lx__n
mov dword [esp + 4], eax
call fcn.004218d0
jmp 0x411946
cmp dword [ebp - 0x14], 4
jne 0x41193a
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x18]
cmp eax, 0xffffffff
je 0x4119fe
lea esi, [esi]
mov dword [esp + 4], eax
mov dword [esp], str._p:
call fcn.004218d0
mov eax, dword [0x4ab5d8]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 8
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [edx + 4]
test eax, eax
je 0x4119f2
cmp dword [ebp - 0x18], 8
je 0x411a40
mov dword [esp], str.Invalid_frame_address_n
call fcn.004218d0
mov eax, dword [ebp - 0x20]
cmp dword [0x4ab5d0], eax
je 0x411946
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResumeThread]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp + 8], str.Cannot_get_info_on_exceptions_while_no_process_is_loaded_n
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004218d0
mov eax, dword [ebp - 0x10]
mov dword [esp], str.prev_p_handler_p_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
call fcn.004218d0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x4119b0
jmp 0x4119fe
mov eax, dword [ebp - 0x20]
mov dword [esp], str.Unknown_thread_id___04lx__in_current_process_n
mov dword [esp + 4], eax
call fcn.004218d0
jmp 0x411946
Function at 0x411bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x48
mov eax, dword [ebp + 8]
cmp dword [0x4ab5cc], eax
mov dword [ebp - 0x34], eax
jne 0x411db0
mov eax, dword [0x4ab5d8]
test eax, eax
je 0x411def
mov eax, dword [eax + 8]
mov dword [ebp - 0x30], eax
mov dword [esp], str.Address__End______State___Type____RWX_n
xor ebx, ebx
call fcn.004218d0
jmp 0x411cdb
mov ecx, 0x43d421
cmp eax, 0x1000
jne 0x411c29
mov ecx, str.commit
mov eax, dword [ebp - 0x10]
cmp eax, 0x40000
je 0x411d73
ja 0x411d38
mov edx, 0x43d419
test eax, eax
je 0x411c56
cmp eax, 0x20000
jne 0x411d80
mov edx, str.private
mov eax, dword [ebp - 0x20]
lea edi, [ebp - 0x2c]
mov word [ebp - 0x2c], 0x2020
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0
test al, 0xee
je 0x411c72
mov byte [ebp - 0x2c], 0x52
test al, 0x44
je 0x411c7a
mov byte [ebp - 0x2b], 0x57
test al, 0x88
je 0x411c82
mov byte [ebp - 0x2b], 0x43
test al, 0xf0
je 0x411c8a
mov byte [ebp - 0x2a], 0x58
mov eax, dword [ebp - 0x1c]
lea esi, [ebx + eax - 1]
mov eax, dword [0x4ab5d8]
test eax, eax
je 0x411d50
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 4]
add eax, eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], str._0Ix__0Ix__s__s__s_n
call fcn.004218d0
mov eax, dword [ebp - 0x1c]
test eax, eax
js 0x411d90
add ebx, eax
lea eax, [ebp - 0x28]
mov dword [esp + 0xc], 0x1c
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_VirtualQueryEx]
sub esp, 0x10
cmp eax, 0x1b
jbe 0x411d90
mov eax, dword [ebp - 0x18]
cmp eax, 0x2000
je 0x411d60
cmp eax, 0x10000
jne 0x411c18
mov byte [ebp - 0x2c], 0
mov ecx, str.free
mov edx, 0x43cd00
lea edi, [ebp - 0x2c]
jmp 0x411c8a
cmp eax, 0x1000000
jne 0x411d80
mov edx, str.image
jmp 0x411c56
mov eax, 8
jmp 0x411ca6
mov eax, dword [ebp - 0x10]
mov ecx, str.reserve
cmp eax, 0x40000
jne 0x411c37
mov edx, str.mapped
jmp 0x411c56
mov edx, 0x43d421
jmp 0x411c56
mov eax, dword [ebp - 0x34]
cmp dword [0x4ab5cc], eax
je 0x411da8
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], 0x410
call dword [sym.imp.kernel32.dll_OpenProcess]
sub esp, 0xc
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x411bfe
mov eax, dword [ebp - 0x34]
mov dword [esp], str.Cannot_open_process___04lx__n
mov dword [esp + 4], eax
call fcn.004218d0
jmp 0x411da8
mov dword [ebp + 8], str.Cannot_look_at_mapping_of_current_process__while_no_process_is_loaded_n
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004218d0
Function at 0x415990
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, ecx
push ebx
mov esi, edx
sub esp, 0x1c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x415a8a
mov ebx, eax
test edi, edi
je 0x415a04
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [edi], eax
inc eax
push ecx
push ecx
je 0x415a80
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateFileMappingW]
sub esp, 0x18
mov dword [esi], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
mov eax, dword [esi]
test eax, eax
je 0x415a8a
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
push edx
lea esp, [ebp - 0xc]
or eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4160f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
test esi, esi
je 0x4161b8
test edi, edi
je 0x4161a0
mov ebx, dword [esi + 0xc]
test ebx, ebx
je 0x416210
mov eax, dword [edi + 0xc]
test eax, eax
je 0x41613f
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [ebp - 0x10], edx
call dword [sym.imp.ucrtbase.dll_strcmp]
mov edx, dword [ebp - 0x10]
test eax, eax
jne 0x416238
mov esi, dword [esi + 8]
mov edi, dword [edi + 8]
mov eax, edi
and eax, esi
inc eax
je 0x4161d8
cmp esi, 0xffffffff
je 0x4161cf
cmp edi, 0xffffffff
je 0x4161b3
mov edx, esi
mov eax, ebx
mov ecx, edi
call fcn.00415af0
mov edx, dword [0x4ab5d8]
lea eax, [edx + 0x1314]
cmp eax, ebx
je 0x416188
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [ebp - 0x10], edx
call dword [sym.imp.ucrtbase.dll_strcpy]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1418], esi
mov dword [edx + 0x141c], edi
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x4161b8
mov ebx, dword [esi + 0xc]
test ebx, ebx
je 0x41621b
mov esi, dword [esi + 8]
cmp esi, 0xffffffff
je 0x4161d8
lea edi, [edx + esi]
jmp 0x41615a
test edi, edi
je 0x4161f0
mov ebx, dword [edi + 0xc]
test ebx, ebx
je 0x416250
mov edi, dword [edi + 8]
cmp edi, 0xffffffff
je 0x4161d8
lea esi, [edx + edi]
jmp 0x41615a
mov eax, dword [0x4ab5d8]
test edx, edx
js 0x416200
mov esi, dword [eax + 0x141c]
lea edi, [edx + esi]
jmp 0x41615a
mov eax, dword [0x4ab5d8]
lea ebx, [eax + 0x1314]
jmp 0x4161dd
mov edi, dword [eax + 0x1418]
lea esi, [edx + edi]
jmp 0x41615a
mov ebx, dword [edi + 0xc]
test ebx, ebx
jne 0x41613f
mov eax, dword [0x4ab5d8]
mov esi, dword [esi + 8]
test edi, edi
lea ebx, [eax + 0x1314]
je 0x4161ae
jmp 0x416142
mov dword [ebp + 8], str.Ambiguous_source_file_specification._n
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004218d0
mov eax, dword [0x4ab5d8]
lea ebx, [eax + 0x1314]
jmp 0x4161c7

Function at 0x417410
Capabilities:
Enumerate threads
Resume thread
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
cmp edx, 0xffffffff
je 0x417440
mov eax, dword [0x4ab5d8]
test eax, eax
je 0x417448
cmp dword [0x4ab5d0], edx
je 0x417438
pop ebp
jmp fcn.004170b0
pop ebp
jmp fcn.00416730
pop ebp
jmp fcn.004171d0
mov dword [ebp + 8], str.You_must_be_attached_to_a_process_to_run_this_command._n
pop ebp
jmp fcn.004218d0

Function at 0x418aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], str.No_longer_supported_n
pop ebp
jmp fcn.004218d0
Function at 0x419430
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x4ab5d8]
test edx, edx
je 0x419480
xor edx, edx
cmp ebx, eax
je 0x4194a0
mov dword [esp + 4], edx
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
push ecx
push ecx
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.dbghelp.dll_SymCleanup]
push ecx
mov dword [esp], ebx
call fcn.00421db0
mov ebx, dword [ebp - 4]
mov esp, ebp
mov eax, 1
pop ebp
ret
cmp ebx, eax
je 0x4194b8
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DebugActiveProcessStop]
test eax, eax
push edx
jne 0x41945e
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4ab5d4]
mov ecx, dword [eax + 0x64]
test ecx, ecx
je 0x41944c
mov edx, dword [eax + 0x6c]
jmp 0x41944c
mov dword [esp], 0
call fcn.00402ce0
mov eax, dword [0x4ab5d8]
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], 0x4ab300
call dword [eax + 0x18]
mov eax, dword [0x4ab5d4]
mov edx, dword [eax + 0x64]
test edx, edx
je 0x419484
mov edx, dword [0x4ab5d8]
mov edx, dword [edx + 0x2c]
mov dword [esp + 4], 0x4ab300
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [edx + 0x58]
mov eax, dword [0x4ab5d0]
mov dword [esp + 4], eax
mov eax, dword [0x4ab5cc]
mov dword [esp + 8], 0x10002
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ContinueDebugEvent]
sub esp, 0xc
jmp 0x419484
Function at 0x419820
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0xc0
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
xor eax, eax
mov ecx, 0x10
mov dword [ebp - 0x94], 0x44
push edx
lea edx, [ebp - 0x90]
mov edi, edx
rep stosd dword es:[edi], eax
test byte [ebp - 0x24], 1
mov dword [ebp - 0x68], 1
mov eax, 1
je 0x41986b
mov eax, dword [ebp - 0x20]
cmp dword [0x4ab2d0], 1
mov word [ebp - 0x64], ax
lea edx, [ebp - 0xa4]
sbb eax, eax
mov dword [esp + 0x24], edx
and eax, 2
lea edx, [ebp - 0x94]
add eax, 0x11
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov esi, eax
test eax, eax
je 0x419990
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x419958
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], fcn.00419430
mov dword [0x4ab5cc], eax
call fcn.00421be0
mov dword [0x4ab5d8], eax
test eax, eax
je 0x4199b0
mov dword [eax + 0x34], 1
mov eax, dword [0x4ab238]
cmp eax, ebx
je 0x41992f
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov dword [0x4ab238], ebx
mov eax, dword [0x4ab5cc]
mov dword [esp], str.WineDbg_starting_on_pid__04lx_n
mov dword [esp + 4], eax
mov esi, 1
call fcn.004218d0
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
mov dword [esp], str.Debuggee_has_been_started___s__nBut_WineDbg_isnt_attached_to_it._Maybe_youre_trying_to_debug_a_winelib_wrapper____nTry_to_attach_to_one_of_those_processes:_n
call fcn.004218d0
mov dword [esp], 0x64
call dword [sym.imp.kernel32.dll_Sleep]
mov esi, 1
push eax
call fcn.00411310
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
mov dword [esp], str.Couldnt_start_process__s_n
call fcn.004218d0
lea esp, [ebp - 0xc]
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
xor esi, esi
jmp 0x419949

Function at 0x4199c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x42c
lea ebx, [ebp - 0x418]
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
test eax, eax
push edx
push edx
jne 0x4199f8
lea esp, [ebp - 8]
or eax, 0xffffffff
pop ebx
pop esi
pop ebp
ret
lea esi, [ebp - 0x210]
mov dword [esp + 8], 0
mov dword [esp + 0xc], esi
mov dword [esp + 4], 0x43f420
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
sub esp, 0x10
test eax, eax
je 0x4199e8
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x4000080
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0xc0010000
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x419ea0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
mov edi, dword fs:[0x18]
cmp dword [edi + 0x20], esi
je 0x419f48
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], fcn.00419430
call fcn.00421be0
mov dword [0x4ab5d8], eax
test eax, eax
je 0x419f38
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_DebugActiveProcess]
mov ebx, eax
test eax, eax
push edx
je 0x419f60
mov dword [esp + 4], 0
mov dword [esp], str.DBGHELP_NOLIVE
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
mov ebx, 1
push eax
push eax
mov eax, dword [0x4ab5d8]
mov dword [eax + 0x34], 1
mov eax, dword [0x4ab5cc]
mov dword [esp + 4], eax
mov dword [esp], str.WineDbg_attached_to_pid__04lx_n
call fcn.004218d0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.WineDbg_cant_debug_its_own_process._Please_use_another_process_ID._n
xor ebx, ebx
call fcn.004218d0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 0x34]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.Cant_attach_process__04lx:_error__lu_n
call fcn.004218d0
mov eax, dword [0x4ab5d8]
mov dword [esp], eax
call fcn.00421db0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x41b550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov eax, dword [0x4ab5d8]
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x41b618
mov esi, dword [0x4ab23c]
test esi, esi
je 0x41b650
test ebx, ebx
je 0x41b630
mov eax, ebx
mov edx, 2
nop
mov eax, dword [eax + 4]
inc edx
test eax, eax
jne 0x41b588
shl edx, 2
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x41b60a
mov dword [eax], esi
mov eax, 1
lea esi, [esi]
mov edx, dword [ebx]
mov dword [edi + eax*4], edx
inc eax
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x41b5b0
mov dword [edi + eax*4], 0
mov eax, edi
call fcn.00419580
mov dword [esp], edi
mov ebx, eax
mov esi, dword [sym.imp.ucrtbase.dll_free]
call esi
test ebx, ebx
je 0x41b640
mov eax, ebx
call fcn.00419820
test eax, eax
je 0x41b640
mov dword [0x4ab2f4], 0
call fcn.0041b2a0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00416260
pop eax
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp + 8], str.Already_attached_to_a_process._Use_detach_or_kill_before_using_run_n
pop esi
pop edi
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004218d0
mov eax, dword [0x4ab238]
test eax, eax
je 0x41b659
call fcn.00419820
jmp 0x41b5e7
mov dword [ebp + 8], ebx
pop ecx
pop ebx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
jmp eax
mov dword [ebp + 8], str.No_active_target_to_be_restarted_n
jmp 0x41b61f
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll__strdup]
mov dword [0x4ab238], eax
jmp 0x41b639
Function at 0x41bb10
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x228
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [esp], 0xfffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [0x4ab280], 0
mov dword [0x4ab2f0], eax
lea ecx, [ebx + 4]
push edx
cmp esi, 3
je 0x41bb68
lea edx, [esi - 1]
cmp edx, 3
je 0x41bc80
mov eax, 1
dec edx
je 0x41bc60
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 4], ecx
mov dword [esp], 2
call fcn.0041b670
test eax, eax
jne 0x41bcf0
mov dword [ebp - 0x117], 0x696e696d
mov dword [ebp - 0x113], 0x706d7564
mov word [ebp - 0x10f], 0x2220
lea ebx, [ebp - 0x117]
lea esi, [ebp - 0x21b]
mov dword [esp], 0x104
mov dword [esp + 4], esi
call dword [sym.imp.kernel32.dll_GetTempPathA]
lea eax, [ebp - 0x10d]
push ecx
push ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x43fb46
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
sub esp, 0x10
mov dword [esp], ebx
call sub.ucrtbase.dll_strlen
mov word [ebx + eax], 0x22
lea eax, [ebp - 0x10e]
mov dword [esp + 4], eax
mov dword [esp], str.Capturing_program_state_in__s_n
call fcn.004218d0
mov dword [esp + 8], 0
mov dword [esp + 4], str.detach
mov dword [esp], ebx
call fcn.004251c0
cmp eax, 0xffffffff
je 0x41bd28
mov edx, dword [0x4ab5d8]
mov edx, dword [edx + 0x34]
test edx, edx
jne 0x41bd08
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [0x4ab2f4], 1
call fcn.00422ef0
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 4], ecx
mov dword [esp], 1
call fcn.0041b670
test eax, eax
je 0x41bb80
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov esi, dword [ebx + 4]
add ebx, 8
mov dword [esp + 4], ebx
mov dword [esp], 2
call fcn.0041b670
test eax, eax
jne 0x41bb5e
lea ebx, [ebp - 0x117]
mov dword [ebp - 0x117], 0x696e696d
mov dword [ebp - 0x113], 0x706d7564
mov word [ebp - 0x10f], 0x2220
test esi, esi
je 0x41bba3
lea eax, [ebp - 0x10d]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strcpy]
mov dword [esp], ebx
call sub.ucrtbase.dll_strlen
mov word [ebx + eax], 0x22
jmp 0x41bc06
mov esi, dword [ebx + 4]
add ebx, 8
mov dword [esp + 4], ebx
mov dword [esp], 1
call fcn.0041b670
jmp 0x41bc96
mov dword [ebp - 0x220], eax
mov dword [0x4ab2f4], 0
call fcn.0041b2a0
mov eax, dword [ebp - 0x220]
jmp 0x41bc38
mov eax, 1
jmp 0x41bb5e
Function at 0x41d470
Capabilities:
Create process memory minidump

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x41d52e
mov ebx, eax
test esi, esi
je 0x41d4ea
mov eax, dword [0x4ab5d4]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0x4ab300
mov dword [ebp - 0xc], 0
mov eax, dword [eax + 0x10]
lea esi, [ebp - 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [0x4ab5d8]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov edx, dword [eax + 0xc]
mov dword [esp + 4], edx
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.dbghelp.dll_MiniDumpWriteDump
sub esp, 0x1c
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x41d540
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x7c
mov eax, dword [0x4ab5d8]
mov dword [ebp - 0x60], 1
test eax, eax
je 0x41d578
mov dword [esp], str.Already_attached_to_a_process._Use_detach_or_kill_before_loading_a_minidump_file_n
call fcn.004218d0
mov dword [ebp - 0x60], 2
mov eax, dword [ebp - 0x60]
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], 0xc
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
mov dword [ebp - 0x64], eax
test eax, eax
je 0x41d563
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x41d6b6
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebx + 8], eax
test eax, eax
je 0x41d708
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebx], eax
test eax, eax
je 0x41d6ca
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x4367a0
mov dword [esp + 4], eax
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call fcn.00436850
test eax, eax
jne 0x41d713
lea eax, [ebp - 0x5c]
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
cmp dword [eax], 0x504d444d
je 0x41d738
mov eax, dword [ebp - 0x5c]
mov dword fs:[0], eax
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x41d56a
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
test eax, eax
je 0x41d6ca
nop
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
push ecx
mov eax, dword [ebp - 0x64]
mov eax, dword [eax + 8]
test eax, eax
je 0x41d6de
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push edx
mov eax, dword [ebp - 0x64]
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x41d6f3
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x41d56a
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
test eax, eax
jne 0x41d6c0
jmp 0x41d6de
mov eax, dword [ebp + 8]
mov dword [esp], str.Unexpected_fault_while_reading_minidump__s_n
mov dword [esp + 4], eax
call fcn.004218d0
mov dword [0x4ab5cc], 0
jmp 0x41d6ab
mov eax, dword [ebp - 0x64]
call fcn.0041c590
mov dword [ebp - 0x60], eax
jmp 0x41d6a2
Function at 0x41d750
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
cmp dword [ebp + 8], 1
mov ebx, dword [ebp + 0xc]
jne 0x41d778
test byte [0x4387a4], 8
jne 0x41d788
mov eax, dword [ebx]
mov dword [ebp + 8], eax
add esp, 0x14
pop ebx
pop ebp
jmp fcn.0041d540
add esp, 0x14
mov eax, 1
pop ebx
pop ebp
ret
mov eax, dword [ebx]
mov dword [esp + 0xc], str.Processing_Minidump_file__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.minidump_start
mov dword [esp + 4], 0x4387a4
mov dword [esp], 3
call fcn.0041c540
mov eax, dword [ebx]
mov dword [ebp + 8], eax
add esp, 0x14
pop ebx
pop ebp
jmp fcn.0041d540