joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x1a93700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.01a9378f
jae 0x1a9370e
xor ecx, ecx
call fcn.01a9378f
jae 0x1a9373d
xor eax, eax
call fcn.01a9378f
jae 0x1a9374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.01a9378f
adc al, al
jae 0x1a9372f
jne 0x1a93779
stosb byte es:[edi], al
jmp 0x1a93711
call fcn.01a9379b
sub ecx, ebx
jne 0x1a93756
call fcn.01a93799
jmp 0x1a93775
lodsb al, byte [esi]
shr eax, 1
je 0x1a93783
adc ecx, ecx
jmp 0x1a93772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.01a93799
cmp eax, 0x7d00
jae 0x1a93772
cmp ah, 5
jae 0x1a93773
cmp eax, 0x7f
ja 0x1a93774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1a93711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x4012f8
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
push esi
push edi
push str.CUSTOM
push eax
push dword [0x412c48]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 8], eax
cmp edi, esi
jne 0x401331
xor al, al
jmp 0x401382
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x40132d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0x80
push 2
push esi
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
mov edi, eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
cmp edi, esi
je 0x401380
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebp
ret

Function at 0x401386
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x40d8ee
call fcn.00409683
mov eax, dword [0x41204c]
mov ecx, 0x41204c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push str.zlib1.dll
lea ecx, [ebp - 0x14]
call fcn.004010f5
pop ecx
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00401792
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401f7c
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
push eax
push 0x82
call fcn.004012f8
pop ecx
mov bl, al
pop ecx
lea eax, [esi - 0x10]
call fcn.00401f7c
mov al, bl
call fcn.00409722
ret

Function at 0x4013f9
Capabilities:
Delete file

Disassembly:
push 0xc
mov eax, 0x40d8c3
call fcn.00409683
mov eax, dword [0x41204c]
mov ecx, 0x41204c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push str.RootGenius.zip
lea ecx, [ebp - 0x14]
call fcn.004010f5
pop ecx
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00401792
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401f7c
mov edi, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
lea eax, [ebp - 0x10]
push eax
push 0x84
call fcn.004012f8
mov bl, al
pop ecx
pop ecx
test bl, bl
je 0x4014a0
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x40fc84
call fcn.004010f5
lea eax, [edi - 0x10]
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], esp
mov ebx, esp
call fcn.00401b0b
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0
call fcn.00401fac
add esp, 0xc
push edi
mov bl, al
call esi
lea eax, [edi - 0x10]
call fcn.00401f7c
mov al, bl
call fcn.00409722
ret
Function at 0x4625e0
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x403506
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x402fe8
mov ebx, dword [ebp + 0x14]
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
jge 0x46263c
mov eax, dword [ebp + 0xc]
push eax
call fcn.0045add0
mov esi, dword [ebp + 0x10]
mov ebx, eax
sub ebx, esi
jo 0x4627d1
jmp 0x46263f
mov esi, dword [ebp + 0x10]
cmp ebx, edi
jle 0x4626a1
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20]
mov edx, dword [ecx]
push edx
push eax
call dword [0x4012f4]
mov ecx, dword [ebp - 0x20]
cmp ecx, edi
je 0x462679
cmp word [ecx], 1
jne 0x462679
mov edx, dword [ecx + 0x14]
mov eax, dword [ecx + 0x10]
sub esi, edx
cmp esi, eax
jb 0x462675
call dword [fcn.0040117c]
mov ecx, dword [ebp - 0x20]
mov eax, esi
jmp 0x462682
call dword [fcn.0040117c]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx + 0xc]
add ecx, eax
push ecx
call dword [fcn.00401274]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x28], eax
push edx
call dword [fcn.00401364]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
push 0x4140e0
push 0x40efb4
call dword [fcn.004010a0]
mov edx, eax
lea ecx, [ebp - 0x24]
call dword [fcn.0040132c]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x24]
push ecx
push 0x14
push esi
call fcn.0045ac50
lea ecx, [ebp - 0x24]
call dword [fcn.00401380]
mov eax, dword [0x479234]
lea edx, [ebp - 0x18]
push edx
push edi
push edi
push 0x8004
push eax
call fcn.0040d3d0
mov edi, dword [fcn.004010ac]
mov dword [ebp - 0x28], eax
call edi
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x46278f
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push 0
push ebx
push ecx
push edx
call fcn.0040d47c
mov dword [ebp - 0x28], eax
call edi
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x46278f
mov eax, dword [esi]
lea ecx, [ebp - 0x20]
push eax
push ecx
mov dword [ebp - 0x28], 0x14
call dword [0x4012f4]
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x462756
cmp word [ecx], 1
jne 0x462756
mov esi, dword [ecx + 0x14]
mov eax, dword [ecx + 0x10]
neg esi
cmp esi, eax
jb 0x462752
call dword [fcn.0040117c]
mov ecx, dword [ebp - 0x20]
mov eax, esi
jmp 0x46275f
call dword [fcn.0040117c]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx + 0xc]
lea edx, [ebp - 0x28]
push 0
add ecx, eax
push edx
mov edx, dword [ebp - 0x18]
push ecx
push 2
push edx
call fcn.0040d4c8
mov esi, eax
call edi
lea eax, [ebp - 0x20]
push eax
call dword [fcn.00401364]
test esi, esi
je 0x46278f
mov dword [ebp - 0x14], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x46279e
push eax
call fcn.0040d41c
call edi
push 0x4627ba
jmp 0x4627b9
ret
call dword [fcn.00401284]
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x462de0
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x403506
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x403028
mov eax, dword [ebp + 0x14]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
jge 0x462e31
mov eax, dword [ebp + 0xc]
push eax
call fcn.0045add0
mov esi, dword [ebp + 0x10]
sub eax, esi
jo 0x462f83
mov dword [ebp + 0x14], eax
jmp 0x462e34
mov esi, dword [ebp + 0x10]
cmp dword [ebp + 0x14], ebx
jle 0x462e92
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20]
mov edx, dword [ecx]
push edx
push eax
call dword [0x4012f4]
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
je 0x462e6f
cmp word [ecx], 1
jne 0x462e6f
mov edx, dword [ecx + 0x14]
mov eax, dword [ecx + 0x10]
sub esi, edx
cmp esi, eax
jb 0x462e6b
call dword [fcn.0040117c]
mov ecx, dword [ebp - 0x20]
mov eax, esi
jmp 0x462e78
call dword [fcn.0040117c]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx + 0xc]
add ecx, eax
push ecx
call dword [fcn.00401274]
lea edx, [ebp - 0x20]
mov esi, eax
push edx
call dword [fcn.00401364]
mov ebx, esi
push 0x414130
push 0x40efb4
call dword [fcn.004010a0]
mov edx, eax
lea ecx, [ebp - 0x24]
call dword [fcn.0040132c]
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
push 0x40
push edi
call fcn.0045ac50
lea ecx, [ebp - 0x24]
call dword [fcn.00401380]
push 0x4790ac
call dword [fcn.00401274]
mov ecx, dword [0x479080]
mov esi, eax
push esi
push ecx
call fcn.00465e50
mov edx, dword [ebp + 0x14]
mov eax, dword [0x479084]
push edx
push ebx
push esi
push eax
call fcn.00465e60
mov ecx, dword [edi]
lea edx, [ebp - 0x20]
push ecx
push edx
call dword [0x4012f4]
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x462f23
cmp word [ecx], 1
jne 0x462f23
mov edi, dword [ecx + 0x14]
mov eax, dword [ecx + 0x10]
neg edi
cmp edi, eax
jb 0x462f1f
call dword [fcn.0040117c]
mov ecx, dword [ebp - 0x20]
mov eax, edi
jmp 0x462f2c
call dword [fcn.0040117c]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx + 0xc]
mov edx, dword [0x479088]
add ecx, eax
push ecx
push esi
push edx
call fcn.00465e30
call dword [fcn.00401284]
nop
nop
nop
nop
nop
nop
nop
Function at 0x465eb0
Capabilities:
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x403506
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x403138
mov eax, dword [0x479028]
lea ecx, [ebp - 0x14]
push eax
push ecx
mov dword [ebp - 0x14], 0
call dword [0x4012f4]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x465f1c
cmp word [ecx], 1
jne 0x465f1c
mov esi, dword [0x47902c]
mov edx, dword [ecx + 0x14]
mov eax, dword [ecx + 0x10]
sub esi, edx
cmp esi, eax
jb 0x465f18
call dword [fcn.0040117c]
mov ecx, dword [ebp - 0x14]
mov eax, esi
jmp 0x465f25
call dword [fcn.0040117c]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0xc]
lea edx, [ebp + 8]
push 0x80
add ecx, eax
push edx
push ecx
call fcn.0040a1a4
call dword [fcn.004010ac]
lea edx, [ebp - 0x14]
push edx
call dword [fcn.00401364]
mov eax, dword [0x47902c]
push 0x465f6d
add eax, 0x80
jo 0x465f80
mov dword [0x47902c], eax
jmp 0x465f6c
ret
call dword [fcn.00401284]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x482c10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x482d1c
test eax, eax
je 0x482d1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x49dfe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x482d03
lea edi, [eax + 4]
jmp 0x482c67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x482c7c
mov dword [ebp - 4], 2
jmp 0x482c9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x482c93
mov dword [ebp - 4], 1
jmp 0x482c9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x482d13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x482cd6
mov byte [ecx], 0x3d
jmp 0x482ce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x482ced
mov byte [ecx], 0x3d
jmp 0x482cf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x482c64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x412800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x43ac08]
mov edi, dword [ebp + 8]
mov dword [esp + 0x1c], 4
mov edx, dword [ebp + 0xc]
test eax, eax
je 0x41282d
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
test byte [edi], 1
je 0x412990
cmp edx, 1
lea ecx, [edi + 8]
mov eax, 2
sbb eax, 0xffffffff
mov edx, ecx
call sym._init_xpoint
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x4128f1
cmp dword [edi + 0x18], 0xffffffff
je 0x412914
lea eax, [esp + 0x20]
mov dword [esp + 4], 2
mov dword [esp + 8], eax
lea eax, [edi + 0x18]
mov dword [esp], eax
call sym._types_get_info
test eax, eax
je 0x412900
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov ebx, edx
mov esi, ecx
mov dword [esp + 0x14], ecx
add ebx, 0xffffffff
mov dword [esp + 0x10], edx
adc esi, 0xffffffff
mov eax, ebx
mov ebx, ecx
mov ecx, edx
and eax, edx
and esi, ebx
or esi, eax
jne 0x4129d0
mov eax, dword [esp + 0x1c]
cmp eax, edx
mov edx, 0
mov esi, edx
sbb esi, ebx
jb 0x4129d0
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
dec eax
and eax, dword [edi + 8]
je 0x412914
mov dword [esp], str.Watchpoint_on_unaligned_address_is_not_supported_n
call sym._dbg_printf
mov eax, dword [esp + 0x18]
lea eax, [eax + eax*2]
shl eax, 4
add eax, dword [0x43ac08]
and word [eax + 0x50], 7
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov dword [esp], str.Cannot_get_watch_size__defaulting_to__lu_n
mov dword [esp + 4], eax
call sym._dbg_printf
mov esi, dword [esp + 0x18]
mov eax, dword [0x43ac08]
movzx ebx, byte [esp + 0x1c]
lea edi, [esi + esi*2]
shl edi, 4
dec ebx
lea edx, [eax + edi + 0x50]
and ebx, 3
movzx ecx, byte [edx + 8]
and ecx, 0xfffffffc
or ebx, ecx
mov byte [edx + 8], bl
lea edx, [eax + edi + 0x60]
mov eax, esi
call sym._get_watched_value
test eax, eax
je 0x4129a8
mov eax, dword [esp + 0x18]
mov dword [esp], str.Watchpoint__d_at
mov dword [esp + 4], eax
call sym._dbg_printf
mov eax, dword [0x43ac08]
mov dword [esp + 4], 1
lea eax, [eax + edi + 0x40]
mov dword [esp], eax
call sym._print_address
mov dword [ebp + 8], 0x43e63e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._dbg_printf
mov dword [ebp + 8], str.Cannot_set_a_watch_point_on_register_or_register_based_variable_n
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._dbg_printf
mov dword [esp], str.Bad_address._Watchpoint_not_set_n
call sym._dbg_printf
add edi, dword [0x43ac08]
and word [edi + 0x50], 7
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov dword [esp], str.Unsupported_length___I64x__for_watch_points__defaulting_to__lu_n
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sym._dbg_printf
jmp 0x4128c6
Function at 0x4131a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test eax, eax
jle 0x4131f0
mov edx, dword [0x43ac08]
cmp dword [edx + 0x1300], eax
jbe 0x4131f0
lea ecx, [eax + eax*2]
shl ecx, 4
add edx, ecx
movzx ecx, word [edx + 0x50]
shr cx, 3
je 0x4131f0
mov eax, dword [edx + 0x50]
xor ecx, ecx
and eax, 0xfffe
test ebx, ebx
setne cl
or eax, ecx
mov dword [edx + 0x50], eax
mov ebx, dword [ebp - 4]
leave
ret
mov dword [ebp + 0xc], eax
mov ebx, dword [ebp - 4]
mov dword [ebp + 8], str.Invalid_breakpoint_number__d_n
leave
jmp sym._dbg_printf
Function at 0x413fc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x40
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], sym._details_dlg_proc_16
mov dword [esp + 8], 0
mov dword [esp + 4], 0x65
mov dword [esp], eax
call dword [0x4ac800]
mov dword [ebp - 0x30], eax
sub esp, 0x14
test eax, eax
je 0x4140b0
mov esi, dword [0x4ac8a8]
lea edi, [ebp - 0x28]
lea eax, [ebp + 8]
mov dword [esp + 0x10], 0x1cff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 1
call dword [0x4ac888]
sub esp, 0x14
test eax, eax
je 0x4140bf
mov ebx, dword [0x4ac88c]
jmp 0x41406c
mov dword [esp], edi
call esi
sub esp, 4
mov dword [esp], edi
call dword [0x4ac808]
sub esp, 4
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call ebx
sub esp, 0x14
test eax, eax
je 0x414019
cmp dword [ebp - 0x24], 0x12
jne 0x414058
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 4
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov ebx, eax
mov eax, dword [0x43ac18]
mov dword [esp], 0x10000
mov esi, eax
mov dword [ebp - 0x34], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp], esi
mov esi, 0xffff
mov dword [0x43a908], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [ebp - 0x38], 0x10000
mov eax, dword [0x43a908]
sub esp, 0x10
lea esi, [esi]
add eax, ebx
mov edx, esi
lea ecx, [ebp - 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
sub edx, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x414177
mov eax, dword [0x43a908]
mov edx, dword [ebp - 0x2c]
mov ecx, eax
test edx, edx
je 0x41417d
add ebx, edx
cmp ebx, esi
jne 0x414118
shl dword [ebp - 0x38], 1
mov esi, dword [ebp - 0x38]
mov dword [esp], eax
mov dword [esp + 4], esi
dec esi
call dword [sym.imp.ucrtbase.dll_realloc]
mov dword [0x43a908], eax
jmp 0x414118
mov ecx, dword [0x43a908]
mov esi, dword [ebp - 0x30]
mov byte [ecx + ebx], 0
mov dword [esp + 8], ecx
mov dword [esp], esi
mov dword [esp + 4], 0x67
call dword [0x4ac898]
mov dword [ebp - 0x30], esi
sub esp, 0xc
mov dword [esp], esi
mov esi, dword [0x4ac834]
mov dword [esp + 4], 0x67
call esi
mov ebx, dword [0x4ac80c]
sub esp, 8
mov dword [esp + 4], 1
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x30]
sub esp, 8
mov dword [esp + 4], 0xca
mov dword [esp], eax
call esi
sub esp, 8
mov dword [esp + 4], 1
mov dword [esp], eax
call ebx
mov ebx, dword [0x4ac840]
mov esi, dword [0x4ac808]
sub esp, 8
jmp 0x414214
mov dword [esp], edi
call dword [0x4ac8a8]
sub esp, 4
mov dword [esp], edi
call esi
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call ebx
sub esp, 0x10
test eax, eax
jne 0x414200
jmp 0x41409e
Function at 0x4144e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea ebx, [ebp - 0x418]
sub esp, 0x42c
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
sub esp, 8
test eax, eax
jne 0x414518
lea esp, [ebp - 8]
mov eax, 0xffffffff
pop ebx
pop esi
pop ebp
ret
lea esi, [ebp - 0x210]
mov dword [esp + 8], 0
mov dword [esp + 0xc], esi
mov dword [esp + 4], 0x442c06
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
sub esp, 0x10
test eax, eax
je 0x414509
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x4000080
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0xc0010000
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x415080
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x224
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], 0xfffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
lea ecx, [ebx + 4]
mov dword [0x43ac80], 0
mov dword [0x43ac18], eax
sub esp, 4
cmp esi, 3
je 0x4150e0
lea edx, [esi - 1]
cmp edx, 3
je 0x415200
mov eax, 1
cmp edx, 1
je 0x4151e0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 4], ecx
mov dword [esp], 2
call sym._dbg_active_attach
test eax, eax
jne 0x415278
mov eax, 0x2220
lea ebx, [ebp - 0x117]
mov dword [ebp - 0x117], 0x696e696d
mov dword [ebp - 0x113], 0x706d7564
mov word [ebp - 0x10f], ax
lea esi, [ebp - 0x21b]
mov dword [esp], 0x104
mov dword [esp + 4], esi
call dword [sym.imp.kernel32.dll_GetTempPathA]
lea eax, [ebp - 0x10d]
sub esp, 8
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x443366
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
sub esp, 0x10
mov dword [esp], ebx
call sym._strlen
mov ecx, 0x22
mov word [ebx + eax], cx
lea eax, [ebp - 0x10e]
mov dword [esp + 4], eax
mov dword [esp], str.Capturing_program_state_in__s_n
call sym._dbg_printf
mov dword [esp], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], str.detach
call sym._parser_generate_command_file
mov ebx, eax
cmp eax, 0xffffffff
je 0x4152a8
mov eax, dword [0x43ac08]
mov eax, dword [eax + 0x34]
test eax, eax
jne 0x415290
mov dword [esp + 4], ebx
mov dword [esp], 0
mov dword [0x43ac20], 1
call sym._parser_handle
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 4], ecx
mov dword [esp], 1
call sym._dbg_active_attach
test eax, eax
je 0x4150f8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov esi, dword [ebx + 4]
add ebx, 8
mov dword [esp], 2
mov dword [esp + 4], ebx
call sym._dbg_active_attach
test eax, eax
jne 0x4150d2
mov eax, 0x2220
lea ebx, [ebp - 0x117]
mov dword [ebp - 0x117], 0x696e696d
mov dword [ebp - 0x113], 0x706d7564
mov word [ebp - 0x10f], ax
test esi, esi
je 0x41511e
lea eax, [ebp - 0x10d]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strcpy]
mov dword [esp], ebx
call sym._strlen
mov edx, 0x22
mov word [ebx + eax], dx
jmp 0x415185
mov esi, dword [ebx + 4]
add ebx, 8
mov dword [esp], 1
mov dword [esp + 4], ebx
call sym._dbg_active_attach
jmp 0x415216
mov dword [0x43ac20], 0
call sym._wait_exception
jmp 0x4151b8
mov eax, 1
jmp 0x4150d2