joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30002350
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
test esi, esi
je 0x30002387
cmp dword [0x302728a4], 0
jne 0x3000238e
push 0x302728a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x302728a4], 0
jne 0x3000238e
push str.GetAllocationBase:_Failed_to_obtain_system_page_size._n
call fcn.30009b20
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x30002387
mov eax, dword [ebp - 0x18]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x300023b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
test esi, esi
je 0x300023e7
cmp dword [0x302728a4], 0
jne 0x300023ee
push 0x302728a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x302728a4], 0
jne 0x300023ee
push str.GetBaseAddress:_Failed_to_obtain_system_page_size._n
call fcn.30009b20
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x300023e7
mov eax, dword [ebp - 0x1c]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x30002410
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x300024b3
cmp dword [0x302728a4], 0
jne 0x30002456
push 0x302728a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x302728a4], 0
jne 0x30002456
push str.GetAllocationSize:_Failed_to_obtain_system_page_size._n
call fcn.30009b20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [ebp - 0x1c]
push 0x1c
push eax
push esi
call ebx
test eax, eax
jne 0x30002480
push esi
push str.GetAllocationSize:_unable_to_query_memory_address_0x_p
call fcn.30009b20
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x18]
mov esi, edi
add esi, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push 0x1c
push eax
push esi
call ebx
test eax, eax
je 0x300024a5
cmp dword [ebp - 0x18], edi
je 0x30002485
sub esi, edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str.GetAllocationSize:_unable_to_query_memory_page_0x_p
call fcn.30009b20
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x300024c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
test esi, esi
je 0x3000251b
cmp dword [0x302728a4], 0
jne 0x300024fc
push 0x302728a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x302728a4], 0
jne 0x300024fc
push str.GetMemoryInfo:_Failed_to_obtain_system_page_size._n
call fcn.30009b20
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x3000251b
push esi
push str.GetMemoryInfo:_unable_to_query_memory_address_0x_p
call fcn.30009b20
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x30002520
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x300025f0
cmp dword [0x302728a4], 0
jne 0x30002566
push 0x302728a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x302728a4], 0
jne 0x30002566
push str.GetAccessibleSize:_Failed_to_obtain_system_page_size._n
call fcn.30009b20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [ebp - 0x1c]
push 0x1c
push eax
push esi
call ebx
test eax, eax
jne 0x30002590
push esi
push str.GetAccessibleSize:_unable_to_query_memory_address_0x_p
call fcn.30009b20
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
test al, 0xee
je 0x300025f0
test eax, 0x101
jne 0x300025f0
test eax, eax
je 0x300025f0
mov edi, dword [ebp - 0x18]
mov esi, edi
add esi, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push 0x1c
push eax
push esi
call ebx
test eax, eax
je 0x300025db
mov ecx, dword [ebp - 8]
test cl, 0xee
je 0x300025d0
test ecx, 0x101
jne 0x300025d0
test ecx, ecx
je 0x300025d0
cmp dword [ebp - 0x18], edi
je 0x300025a7
sub esi, edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x302728a4]
add eax, esi
push eax
push str.GetAccessibleSize:_unable_to_query_memory_page_0x_p
call fcn.30009b20
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x300028c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
test esi, esi
je 0x300028f7
cmp dword [0x302728a4], 0
jne 0x300028fe
push 0x302728a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x302728a4], 0
jne 0x300028fe
push str.IsAddressAccessible:_Failed_to_obtain_system_page_size._n
call fcn.30009b20
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x300028f7
mov eax, dword [ebp - 8]
test al, 0xee
je 0x300028f7
test eax, 0x101
jne 0x300028f7
test eax, eax
je 0x300028f7
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x30002930
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
je 0x30002999
mov esi, dword [0x302728c4]
test esi, esi
je 0x30002999
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
cmp dword [0x302728a4], 0
jne 0x3000297a
push 0x302728a0
call edi
cmp dword [0x302728a4], 0
jne 0x3000297a
push str.GetAllocationBase:_Failed_to_obtain_system_page_size._n
call fcn.30009b20
add esp, 4
xor eax, eax
jmp 0x3000298e
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x18]
cmp eax, dword [esi]
je 0x300029a2
mov esi, dword [esi + 0x60]
test esi, esi
jne 0x30002950
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x30002d00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, edx
call fcn.30002c10
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [0x302727e8]
test edx, edx
je 0x30002d2e
lea ebx, [ebx]
cmp dword [edx], eax
je 0x30002d50
mov edx, dword [edx + 0x88]
test edx, edx
jne 0x30002d20
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.ContextClearAllBreakpoints:_No_breakpoints_found_for_current_thread__d._n
call fcn.30009b00
push str.ContextClearTrackedRegion:_Failed_to_clear_breakpoints._n
call fcn.30009b00
add esp, 0xc
xor eax, eax
pop esi
ret
test edx, edx
je 0x30002d2e
mov dword [edx + 0xc], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0
mov dword [edx + 0x1c], 0
mov dword [edx + 0x20], 0
mov dword [edx + 0x2c], 0
mov dword [edx + 0x30], 0
mov dword [edx + 0x34], 0
mov dword [edx + 0x38], 0
mov dword [edx + 0x3c], 0
mov dword [edx + 0x40], 0
mov dword [edx + 0x4c], 0
mov dword [edx + 0x50], 0
mov dword [edx + 0x54], 0
mov dword [edx + 0x58], 0
mov dword [edx + 0x5c], 0
mov dword [edx + 0x60], 0
mov dword [edx + 0x6c], 0
mov dword [edx + 0x70], 0
mov dword [edx + 0x74], 0
mov dword [edx + 0x78], 0
mov dword [edx + 0x7c], 0
mov dword [edx + 0x80], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
cmp dword [0x3026f224], 1
jle 0x30002e37
call fcn.30007100
mov eax, 1
pop esi
ret
Function at 0x30003370
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 4]
test eax, eax
jne 0x30003392
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3000339b
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
push 0x104
push 8
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x300033cc
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x300033cc
push eax
popfd
test esi, esi
jne 0x300033e6
push str.GetResultsPath:_Error_allocating_memory_for_full_path_string
call fcn.30009b20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x3026da8c
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x300033f0
sub ecx, edx
lea eax, [ecx + 1]
push eax
push 0x3026da8c
push 0x104
push esi
call fcn.30168341
mov ebx, dword [ebp - 8]
add esp, 0x10
test ebx, ebx
je 0x300034a2
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30003420
sub ecx, edx
mov edx, ebx
lea edi, [edx + 1]
mov edi, edi
mov al, byte [edx]
inc edx
test al, al
jne 0x30003430
sub edx, edi
lea eax, [edx + 1]
add eax, ecx
cmp eax, 0x104
jb 0x30003462
push str.GetResultsPath:_Error__destination_path_too_long._n
call fcn.30009b00
add esp, 4
mov ecx, esi
call fcn.300011f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x300034a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x300034a2
push esi
push str.GetResultsPath:_Error_creating_output_directory__s
call fcn.30009b20
add esp, 8
mov ecx, esi
call fcn.300011f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x30003b50
Capabilities:
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x30003c02
cmp dword [0x302728a4], 0
jne 0x30003b91
push 0x302728a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x302728a4], 0
jne 0x30003b91
push str.GetAllocationBase:_Failed_to_obtain_system_page_size._n
call fcn.30009b20
add esp, 4
xor edx, edx
jmp 0x30003ba7
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, eax
neg edx
sbb edx, edx
and edx, dword [ebp - 0x28]
mov ecx, dword [edx + 0x3c]
xor esi, esi
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov eax, dword [ecx + 0x20]
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x1c]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0x24]
add eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x30003c02
mov ebx, edi
sub ebx, edx
jmp 0x30003be0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
cmp ebx, ecx
jle 0x30003bfc
mov eax, edi
sub eax, ecx
sub eax, edx
cmp eax, 0x18
jbe 0x30003c0b
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x30003be0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
pop edi
mov eax, dword [eax + esi*4]
pop esi
add eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x30004000
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, edx
mov esi, ecx
mov dword [ebp - 4], esi
push edi
test ebx, ebx
jne 0x3000402a
push str.ScanForDisguisedPE:_Error__zero_size_given_n
call fcn.30009b00
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x302728a4]
test eax, eax
jne 0x3000405d
push 0x302728a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x302728a4]
test eax, eax
jne 0x3000405d
push str.ScanForDisguisedPE:_Failed_to_obtain_system_page_size._n
call fcn.30009b20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, eax
ja 0x30004077
push str.ScanForDisguisedPE:_Size_too_small._n
call fcn.30009b00
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ebx
mov ecx, esi
call fcn.30003830
cmp ebx, eax
jbe 0x30004086
mov ebx, eax
mov eax, ebx
xor edi, edi
sub eax, dword [0x302728a4]
je 0x300040ae
mov ecx, esi
call fcn.30003f40
test eax, eax
jne 0x300040c9
mov eax, ebx
inc edi
sub eax, dword [0x302728a4]
inc esi
cmp edi, eax
jb 0x30004092
mov esi, dword [ebp - 4]
lea eax, [esi + ebx]
push eax
push esi
push str.ScanForDisguisedPE:_No_PE_image_located_in_range_0x_p_0x_p._n
call fcn.30009b00
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0xffffffff
jne 0x300040ec
push esi
push str.ScanForDisguisedPE:_Exception_occurred_scanning_buffer_at_0x_x_n
call fcn.30009b00
add esp, 8
mov ecx, esi
call fcn.300024c0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test eax, eax
je 0x300040f5
mov dword [eax], esi
push esi
push str.ScanForDisguisedPE:_PE_image_located_at:_0x_p_n
call fcn.30009b00
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x30005950
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x3026f260], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
je 0x30005a12
cmp dword [0x30272804], 6
jne 0x30005982
cmp dword [0x30272808], 1
ja 0x30005988
jmp 0x30005a12
jbe 0x30005a12
push str.win32u
call esi
push 0x301f4e50
mov dword [0x3026c320], eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x3026c31c], eax
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], 0x30093a80
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x300059db
push str.Syscall_hooks_cannot_be_used_on_32_bit_OS_n
call fcn.30009b00
add esp, 4
jmp 0x30005a12
push 0xc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x30093a80
push eax
push 0x28
call edi
push eax
call dword [0x302727dc]
test eax, eax
js 0x30005a04
push dword [0x3026f260]
push str.Syscall_hook_installed__syscall_logging_level__d
jmp 0x30005a0a
push eax
push str.Failed_to_install_syscall_hook__NtSetInformationProcess_returned_0x_x
call fcn.30009b00
add esp, 8
cmp dword [0x3026f264], 0
je 0x30005a38
call fcn.30007e20
test eax, eax
je 0x30005a38
cmp dword [0x3026ec1c], 0
jne 0x30005a38
push 0
call esi
mov ecx, eax
call fcn.3001b260
cmp dword [0x3026f224], 0
je 0x30005a7e
call fcn.30007e20
test eax, eax
jne 0x30005a57
push str.UnpackerInit:_Failed_to_initialise_debugger._n
call fcn.30009b00
add esp, 4
mov ecx, dword [0x3026c324]
xor edx, edx
call fcn.300029b0
test eax, eax
je 0x30005a71
mov dword [eax + 0x28], 1
jmp 0x30005a7e
push str.UnpackerInit:_Error_adding_monitor_image_base_to_tracked_regions._n
call fcn.30009b00
add esp, 4
cmp dword [0x3026f22c], 0
je 0x30005a9c
mov edx, dword [0x3026c324]
mov ecx, 0x30271380
push 0
call fcn.30049990
add esp, 4
push 0
call esi
mov esi, eax
mov ecx, dword [esi + 0x3c]
mov edi, dword [ecx + esi + 0x80]
mov eax, dword [ecx + esi + 0x84]
add edi, esi
add eax, edi
mov dword [ebp - 8], eax
cmp dword [eax], 0x4550
jne 0x30005b61
lea eax, [ebp - 4]
push eax
push 0x40
push 0xf8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x30005aef
push str.RestoreHeaders:_Failed_to_modify_memory_page_protection_of_NtHeaders
call fcn.30009b20
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
push 0xf8
push dword [ebp - 8]
add eax, esi
push eax
call fcn.30160350
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0xf8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x30005b2f
push str.RestoreHeaders:_Failed_to_restore_previous_memory_page_protection
call fcn.30009b20
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x30005b54
push str.RestoreHeaders:_Failed_to_free_memory_for_patched_IAT
call fcn.30009b20
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.RestoreHeaders:_Restored_original_import_table._n
call fcn.30009b00
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x30006070
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov bl, dl
test esi, esi
je 0x300060aa
call fcn.300028c0
test eax, eax
je 0x300060aa
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x300060b2
push esi
push str.PatchByte:_Unable_to_change_memory_protection_at_0x_p
call fcn.30009b00
add esp, 8
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
mov byte [esi], bl
push eax
push dword [ebp - 4]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x30007100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x3021ae88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x302727e8]
push edi
test esi, esi
je 0x30007267
mov edi, dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov ebx, dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [esi]
test eax, eax
je 0x300072c0
cmp dword [esi + 4], 0
je 0x3000729f
lea eax, [ebp - 0x2d8]
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
push eax
mov dword [ebp - 0x2d8], 0x10010
push dword [esi + 4]
call edi
test eax, eax
je 0x300072ce
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d4], 0
push eax
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0x2c0], 0
push dword [esi + 4]
call ebx
test eax, eax
je 0x3000727d
mov esi, dword [esi + 0x88]
test esi, esi
jne 0x30007130
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret
push dword [esi]
push str.ClearAllBreakpoints:_Error_setting_thread_context__thread__d_._n
call fcn.30009b00
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret
push eax
push str.ClearAllBreakpoints:_Error_no_thread_handle_for_thread__d._n
call fcn.30009b00
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret
push esi
push str.ClearAllBreakpoints:_Error:_no_thread_id_for_thread_breakpoints_0x_x._n
call fcn.30009b00
add esp, 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret
Function at 0x300077f0
Capabilities:
Allocate or change rwx memory
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
test esi, esi
je 0x3000784c
call fcn.300028c0
test eax, eax
je 0x3000784c
mov eax, dword [0x30244584]
test eax, eax
je 0x30007822
cmp dword [eax + 4], esi
je 0x3000781d
mov eax, dword [eax]
test eax, eax
jne 0x30007810
jmp 0x30007822
add eax, 0xc
jne 0x3000784c
mov bl, byte [esi]
cmp bl, 0xcc
je 0x3000784c
push 0
mov edx, esi
mov ecx, 0x3024456c
call fcn.30049990
add esp, 4
test eax, eax
jne 0x30007854
push esi
push str.SetSoftwareBreakpoint:_Unable_to_store_instruction_byte_at_0x_p
call fcn.30009b00
add esp, 8
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [eax], bl
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x3000787f
push esi
push str.SetSoftwareBreakpoint:_Unable_to_change_memory_protection_at_0x_p
call fcn.30009b00
add esp, 8
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
mov byte [esi], 0xcc
push eax
push dword [ebp - 4]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x30008ad0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x3021ae88]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, eax
je 0x30008c5e
mov esi, dword [0x302727d0]
test esi, esi
je 0x30008b1f
lea esp, [esp]
cmp dword [esi], edi
je 0x30008bbf
mov esi, dword [esi + 0x2c]
test esi, esi
jne 0x30008b10
mov ecx, edi
call fcn.30008210
mov esi, eax
test esi, esi
je 0x30008c51
push ebx
push edi
push str.OpenProcessHandler:_Injection_info_created_for_Pid__d__handle_0x_x._n
call fcn.30009b00
add esp, 0xc
mov dword [esi + 4], ebx
mov ecx, ebx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.3004d390
mov dword [esi + 0xc], eax
test eax, eax
je 0x30008b6e
push eax
push ebx
push edi
push str.OpenProcessHandler:_Image_base_for_process__d__handle_0x_x_:_0x_p._n
call fcn.30009b00
add esp, 0x10
push 0x104
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]
test eax, eax
je 0x30008c00
lea ecx, [esp + 0x10]
call fcn.30002130
mov ecx, dword [0x302728d0]
mov dword [ecx + 0x14], eax
test eax, eax
jne 0x30008c5e
push str.OpenProcessHandler:_Error_translating_target_process_path
call fcn.30009b20
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0xc], 0
jne 0x30008c5e
mov ecx, ebx
call fcn.3004d390
mov dword [esi + 0xc], eax
test eax, eax
je 0x30008c5e
push eax
push ebx
push edi
push str.OpenProcessHandler:_Image_base_for_process__d__handle_0x_x_:_0x_p._n
call fcn.30009b00
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret
mov edx, 1
mov ecx, 0x104
call fcn.300011a0
mov ecx, dword [0x302728d0]
mov dword [ecx + 0x14], eax
test eax, eax
je 0x30008c2f
push str.Error_obtaining_target_process_name
push 0x104
push eax
call fcn.300081f0
add esp, 0xc
push str.OpenProcessHandler:_Error_obtaining_target_process_name
call fcn.30009b20
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret
push str.OpenProcessHandler:_Error___cannot_create_new_injection_info._n
call fcn.30009b00
add esp, 4
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret