joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aaf0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov edi, dword [ebx + 0x9c]
test edi, edi
je 0x40abd8
cmp byte [ebx + 0xb4], 0
jne 0x40abc0
mov eax, dword [edi + 0x18]
test eax, eax
je 0x40abc0
mov dword [esp], eax
call sym._wine_get_unix_file_name
mov esi, eax
test eax, eax
je 0x40abe2
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [edi + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsWow64Process]
sub esp, 8
test eax, eax
je 0x40ab77
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40ab77
mov dword [esp + 4], str.system32
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strstr]
test eax, eax
je 0x40ab77
mov dword [eax], 0x77737973
mov dword [eax + 4], 0x3436776f
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov edx, esi
mov ecx, eax
lea eax, [ebx + 0x1b8]
call sym._reply_buffer_append
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, 3
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 1
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.packet_reply_error
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword fs:[0x18]
mov edx, 0xc
cmp dword [eax + 0x34], 8
mov eax, 2
cmovne edx, eax
jmp 0x40abc5
Function at 0x40e020
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x14]
cmp esi, 3
jle 0x40e050
mov ebx, dword [edi + 0x10]
cmp dword [ebx], 0x746e6f43
je 0x40e0a0
xor eax, eax
cmp esi, 0xe
jne 0x40e052
cmp dword [ebx], 0x7473754d
je 0x40e060
nop
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [ebx + 4], 0x6c706552
jne 0x40e050
cmp dword [ebx + 8], 0x706d4579
jne 0x40e050
cmp word [ebx + 0xc], 0x7974
jne 0x40e050
mov eax, edi
call sym._packet_reply_open
xor ecx, ecx
mov edx, 0x43c4fa
mov eax, edi
call dbg.packet_reply_add_data
mov eax, edi
call dbg.packet_reply_close
mov eax, 2
jmp 0x40e052
add esi, ebx
cmp byte [ebx + 4], 0x3f
je 0x40e210
cmp ebx, esi
jae 0x40e1fb
mov eax, esi
mov dword [esp + 4], 0x3b
sub eax, ebx
add ebx, 1
sub eax, 1
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.ucrtbase.dll_memchr]
mov ebx, eax
test eax, eax
je 0x40e1fb
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
movzx edx, byte [ebx + 1]
cmp dl, 0x63
je 0x40e199
jg 0x40e190
mov eax, edx
and eax, 0xffffffef
cmp al, 0x43
jne 0x40e050
lea eax, [ebp - 0x1c]
mov dword [esp + 4], str.__c_2x
mov dword [esp + 8], eax
mov dword [esp], ebx
mov byte [ebp - 0x29], dl
call sym._sscanf
test eax, eax
jle 0x40e050
mov ecx, dword [edi + 0x38]
movzx edx, byte [ebp - 0x29]
mov eax, 0xf
cmp ecx, 5
je 0x40e148
mov eax, 5
cmp ecx, 1
je 0x40e1a0
cmp dword [ebp - 0x1c], eax
jne 0x40e050
add ebx, 4
cmp esi, ebx
jb 0x40e050
jbe 0x40e1e0
cmp byte [ebx], 0x3a
je 0x40e1b8
mov eax, dword [ebp - 0x1c]
and edx, 0xffffffdf
xor ecx, ecx
cmp dl, 0x53
mov edx, dword [ebp - 0x20]
mov dword [esp], eax
sete cl
mov eax, edi
call dbg.handle_step_or_continue
jmp 0x40e0b4
cmp dl, 0x73
jne 0x40e050
add ebx, 2
jmp 0x40e154
mov eax, dword [edi + 0x44]
call sym._signal_from_debug_event.part.0.isra.0
movzx edx, byte [ebp - 0x29]
movzx eax, al
jmp 0x40e148
lea eax, [ebp - 0x20]
mov dword [esp + 4], 0x43d4bd
mov dword [esp + 8], eax
mov dword [esp], ebx
mov byte [ebp - 0x29], dl
call sym._sscanf
movzx edx, byte [ebp - 0x29]
test eax, eax
jg 0x40e167
jmp 0x40e050
mov eax, dword [ebp - 0x1c]
and edx, 0xffffffdf
xor ecx, ecx
cmp dl, 0x53
mov edx, dword [ebp - 0x20]
mov dword [esp], eax
sete cl
mov eax, edi
call dbg.handle_step_or_continue
mov eax, edi
call dbg.wait_for_debuggee
add esp, 0x3c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.packet_reply_status
mov eax, edi
call sym._packet_reply_open
mov ecx, 5
mov edx, str.vCont
mov eax, edi
call dbg.packet_reply_add_data
mov ecx, 2
mov edx, 0x43d4a9
mov eax, edi
call dbg.packet_reply_add_data
mov ecx, 2
mov edx, 0x43d4ac
mov eax, edi
call dbg.packet_reply_add_data
mov ecx, 2
mov edx, 0x43d4af
mov eax, edi
call dbg.packet_reply_add_data
mov ecx, 2
mov edx, 0x43d4b2
jmp 0x40e088
Function at 0x411350
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
cmp eax, 0xffffffff
je 0x4114e0
mov dword [ebp - 0x28], 0xffffffff
mov ebx, eax
mov dword [ebp - 0x20], 0
mov dword [dp.entries], 0x10
mov dword [esp], 0x1300
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x411505
mov dword [eax], 0x128
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._Process32First_8
mov esi, dword [sym.imp.ucrtbase.dll_realloc]
sub esp, 8
test eax, eax
je 0x411440
lea esi, [esi]
nop
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
lea eax, [ecx + 1]
imul ecx, ecx, 0x130
mov dword [ebp - 0x20], eax
mov dword [edx + ecx + 0x128], 0xffffffff
mov ecx, dword [dp.entries]
cmp eax, ecx
jb 0x411416
imul ecx, ecx, 0x260
mov dword [esp], edx
mov dword [esp + 4], ecx
call esi
mov edx, eax
test eax, eax
je 0x411511
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
shl dword [dp.entries], 1
imul eax, eax, 0x130
mov dword [edx + eax], 0x128
imul eax, dword [ebp - 0x20], 0x130
add eax, dword [ebp - 0x24]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._Process32Next_8
sub esp, 8
test eax, eax
jne 0x4113d0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ebx, dword [ebp - 0x20]
xor ecx, ecx
sub esp, 4
test ebx, ebx
je 0x4114fe
lea esi, [esi]
imul esi, ecx, 0x130
mov edx, dword [ebp - 0x24]
xor eax, eax
add esi, edx
lea esi, [esi]
cmp eax, ecx
je 0x41147c
mov edi, dword [esi + 0x18]
cmp dword [edx + 8], edi
je 0x4114f0
add eax, 1
add edx, 0x130
cmp eax, ebx
jne 0x411470
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x28]
mov dword [esi + 0x12c], edx
mov dword [eax], ecx
mov ebx, dword [ebp - 0x20]
add ecx, 1
cmp ebx, ecx
ja 0x411460
mov ebx, dword [ebp - 0x28]
mov dword [esp + 0xc], str.executable
mov dword [esp + 8], str.threads
mov dword [esp + 4], 0x43e15c
mov dword [esp], str.___8.8s___8.8s__s__all_id:s_are_in_hex__n
call dbg.dbg_printf
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, ebx
call dbg.dump_proc_info
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [edx + 0x128]
mov edx, dword [edx + 0x128]
jmp 0x41148f
mov ebx, 0xffffffff
jmp 0x4114a4
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
jmp 0x4114e0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x4114e0
Function at 0x411d30
Capabilities:
Resume thread
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov edx, dword [0x4ad5f8]
mov dword [ebp - 0x2c], eax
test edx, edx
je 0x411ea0
mov eax, dword [0x4ad5f4]
test eax, eax
je 0x411ea0
mov dword [esp], str.Exception_frames:_n
call dbg.dbg_printf
mov eax, dword [ebp - 0x2c]
mov edi, dword [0x4ad5f4]
cmp dword [0x4ad5f0], eax
jne 0x411dc0
mov eax, dword [0x4ad5f8]
lea ecx, [ebp - 0x28]
lea ebx, [ebp - 0x20]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 4
mov dword [esp + 8], ecx
mov ecx, dword [edi + 0x14]
mov dword [esp + 4], ecx
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [edx + 4]
test eax, eax
jne 0x411e10
mov dword [esp], str.Cant_read_TEB:except_frame_n
call dbg.dbg_printf
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [0x4ad5f8]
mov dword [esp], eax
call dbg.dbg_get_thread
mov edi, eax
test eax, eax
je 0x411ee8
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SuspendThread]
sub esp, 4
cmp eax, 0xffffffff
jne 0x411d77
mov eax, dword [ebp - 0x2c]
mov dword [esp], str.Cant_suspend_thread_id___04lx__n
mov dword [esp + 4], eax
call dbg.dbg_printf
jmp 0x411db5
cmp dword [ebp - 0x20], 4
jne 0x411da9
mov eax, dword [ebp - 0x28]
lea esi, [ebp - 0x24]
cmp eax, 0xffffffff
je 0x411e76
lea esi, [esi]
mov dword [esp + 4], eax
mov dword [esp], str._p:
call dbg.dbg_printf
mov eax, dword [0x4ad5f8]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 8
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [edx + 4]
test eax, eax
je 0x411e6a
cmp dword [ebp - 0x24], 8
je 0x411eb8
mov dword [esp], str.Invalid_frame_address_n
call dbg.dbg_printf
mov eax, dword [ebp - 0x2c]
cmp dword [0x4ad5f0], eax
je 0x411db5
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResumeThread]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp + 8], str.Cannot_get_info_on_exceptions_while_no_process_is_loaded_n
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.dbg_printf
mov eax, dword [ebp - 0x1c]
mov dword [esp], str.prev_p_handler_p_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
call dbg.dbg_printf
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
cmp eax, 0xffffffff
jne 0x411e28
jmp 0x411e76
mov eax, dword [ebp - 0x2c]
mov dword [esp], str.Unknown_thread_id___04lx__in_current_process_n
mov dword [esp + 4], eax
call dbg.dbg_printf
jmp 0x411db5
Function at 0x412040
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
cmp dword [0x4ad5ec], eax
jne 0x412218
mov eax, dword [0x4ad5f8]
test eax, eax
je 0x412257
mov eax, dword [eax + 8]
mov dword [ebp - 0x44], eax
mov dword [esp], str.Address__End______State___Type____RWX_n
xor esi, esi
mov edi, 0x43e371
call dbg.dbg_printf
jmp 0x41215f
cmp eax, 0x1000
mov eax, str.commit
cmovne eax, edi
mov ebx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x40000
je 0x4121e3
ja 0x4121b8
mov edx, 0x43e369
test eax, eax
je 0x4120c9
cmp eax, 0x20000
mov edx, str.private
cmovne edx, edi
lea eax, [ebp - 0x38]
mov byte [ebp - 0x36], 0x20
mov dword [ebp - 0x40], eax
mov eax, 0x2020
mov word [ebp - 0x38], ax
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x35], 0
test al, 0xee
je 0x4120eb
mov byte [ebp - 0x38], 0x52
test al, 0x44
je 0x4120f3
mov byte [ebp - 0x37], 0x57
test al, 0x88
je 0x4120fb
mov byte [ebp - 0x37], 0x43
test al, 0xf0
je 0x412103
mov byte [ebp - 0x36], 0x58
mov eax, dword [ebp - 0x28]
mov ecx, dword [0x4ad5f8]
lea eax, [esi + eax - 1]
mov dword [ebp - 0x3c], eax
mov eax, 8
test ecx, ecx
je 0x412124
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 4]
add eax, eax
mov dword [esp + 0x14], ebx
mov ecx, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x3c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], str._0Ix__0Ix__s__s__s_n
call dbg.dbg_printf
mov eax, dword [ebp - 0x28]
test eax, eax
js 0x4121f0
add esi, eax
lea eax, [ebp - 0x34]
mov dword [esp + 0xc], 0x1c
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_VirtualQueryEx]
sub esp, 0x10
cmp eax, 0x1b
jbe 0x4121f0
mov eax, dword [ebp - 0x24]
cmp eax, 0x2000
je 0x4121d0
cmp eax, 0x10000
jne 0x412090
lea eax, [ebp - 0x38]
mov byte [ebp - 0x38], 0
mov ebx, str.free
mov edx, 0x43dc80
mov dword [ebp - 0x40], eax
jmp 0x412103
cmp eax, 0x1000000
mov edx, str.image
cmovne edx, edi
jmp 0x4120c9
mov eax, dword [ebp - 0x1c]
mov ebx, str.reserve
cmp eax, 0x40000
jne 0x4120ad
mov edx, str.mapped
jmp 0x4120c9
mov eax, dword [ebp - 0x48]
cmp dword [0x4ad5ec], eax
je 0x41220a
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], 0
mov dword [esp], 0x410
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_OpenProcess]
mov dword [ebp - 0x44], eax
sub esp, 0xc
test eax, eax
jne 0x41206e
mov eax, dword [ebp - 0x48]
mov dword [esp], str.Cannot_open_process___04lx__n
mov dword [esp + 4], eax
call dbg.dbg_printf
jmp 0x41220a
mov dword [ebp + 8], str.Cannot_look_at_mapping_of_current_process__while_no_process_is_loaded_n
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.dbg_printf
Function at 0x414210
Capabilities:
Get process heap flags
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x4142d0
test bl, bl
jne 0x414280
cmp eax, 0xffffff1d
je 0x414248
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.print_typed_basic
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call dbg.types_extract_as_lgint
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], 0x43f547
call dbg.dbg_printf
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x1c]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call dbg.types_extract_as_lgint
lea ecx, [ebx - 0x62]
cmp cl, 0x16
ja case.0x4142a2.3
movzx ecx, cl
jmp dword [ecx*4 + 0x43f628]
movsx ebx, bl
mov dword [esp], 0x43f5ec
mov dword [esp + 4], ebx
call dbg.dbg_printf
mov eax, dword [esi + 0x18]
jmp 0x41422f
mov dword [ebp + 8], str.Unable_to_evaluate_expression_n
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.dbg_printf
mov edi, edx
mov ebx, dword [ebp - 0x1c]
or edi, eax
jne 0x414348
mov dword [esp], 0x43f48e
call dbg.dbg_printf
jmp 0x414274
movzx eax, ax
mov dword [esp], str._d___lc
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call dbg.dbg_printf
jmp 0x414274
movsx eax, al
mov dword [esp], str._d___c
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call dbg.dbg_printf
jmp 0x414274
mov ecx, 8
mov edi, 0xffffffff
mov esi, 0xffffffff
mov dword [esp], 0x43f490
sub ecx, ebx
xor ebx, ebx
shl ecx, 3
shrd esi, edi, cl
shr edi, cl
test cl, 0x20
cmovne esi, edi
cmovne edi, ebx
and eax, esi
and edx, edi
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call dbg.dbg_printf
jmp 0x414274
Function at 0x415ce0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
sub esp, 0x2c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x415ddc
mov ebx, eax
test edi, edi
je 0x415d53
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [edi], eax
sub esp, 8
cmp eax, 0xffffffff
je 0x415dd0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateFileMappingW]
sub esp, 0x18
mov dword [esi], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi]
sub esp, 4
test eax, eax
je 0x415ddc
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x416470
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
test esi, esi
je 0x416548
test edi, edi
je 0x416528
mov ebx, dword [esi + 0xc]
test ebx, ebx
je 0x4165b0
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4164bf
mov dword [ebp - 0x1c], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strcmp]
mov edx, dword [ebp - 0x1c]
test eax, eax
jne 0x4165e0
mov esi, dword [esi + 8]
mov edi, dword [edi + 8]
mov eax, edi
and eax, esi
cmp eax, 0xffffffff
je 0x416570
cmp esi, 0xffffffff
je 0x41655f
cmp edi, 0xffffffff
je 0x41653f
mov edx, esi
mov eax, ebx
mov ecx, edi
call sym._source_display.isra.0
mov edx, dword [0x4ad5f8]
lea eax, [edx + 0x130c]
cmp eax, ebx
je 0x41650e
mov dword [ebp - 0x1c], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strcpy]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x1410], esi
mov dword [edx + 0x1414], edi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x416548
mov ebx, dword [esi + 0xc]
test ebx, ebx
je 0x4165bb
mov esi, dword [esi + 8]
cmp esi, 0xffffffff
je 0x416570
lea edi, [edx + esi]
jmp 0x4164e0
test edi, edi
je 0x416590
mov ebx, dword [edi + 0xc]
test ebx, ebx
je 0x4165f8
mov edi, dword [edi + 8]
cmp edi, 0xffffffff
je 0x416570
lea esi, [edx + edi]
jmp 0x4164e0
mov eax, dword [0x4ad5f8]
test edx, edx
js 0x4165a0
mov esi, dword [eax + 0x1414]
lea edi, [edx + esi]
jmp 0x4164e0
mov eax, dword [0x4ad5f8]
lea ebx, [eax + 0x130c]
jmp 0x416575
mov edi, dword [eax + 0x1410]
lea esi, [edx + edi]
jmp 0x4164e0
mov ebx, dword [edi + 0xc]
test ebx, ebx
jne 0x4164bf
mov eax, dword [0x4ad5f8]
mov esi, dword [esi + 8]
lea ebx, [eax + 0x130c]
test edi, edi
je 0x41653a
jmp 0x4164c2
mov dword [ebp + 8], str.Ambiguous_source_file_specification._n
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.dbg_printf
mov eax, dword [0x4ad5f8]
lea ebx, [eax + 0x130c]
jmp 0x416557

Function at 0x417720
Capabilities:
Enumerate threads
Resume thread
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
cmp edx, 0xffffffff
je 0x417750
mov eax, dword [0x4ad5f8]
test eax, eax
je 0x417760
cmp dword [0x4ad5f0], edx
je 0x417748
pop ebp
jmp dbg.backtrace_tid
pop ebp
jmp dbg.backtrace
pop ebp
jmp dbg.backtrace_all
mov dword [ebp + 8], str.You_must_be_attached_to_a_process_to_run_this_command._n
pop ebp
jmp dbg.dbg_printf

Function at 0x418d40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], str.No_longer_supported_n
pop ebp
jmp dbg.dbg_printf
Function at 0x419700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x4ad5f8]
test edx, edx
je 0x419750
xor edx, edx
cmp ebx, eax
je 0x419770
mov dword [esp + 4], edx
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
sub esp, 8
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym._SymCleanup_4
sub esp, 4
mov dword [esp], ebx
call dbg.dbg_del_process
mov ebx, dword [ebp - 4]
mov eax, 1
leave
ret
cmp ebx, eax
je 0x419788
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DebugActiveProcessStop]
sub esp, 4
test eax, eax
jne 0x41972f
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [0x4ad5f4]
mov ecx, dword [eax + 0x64]
test ecx, ecx
je 0x41971c
mov edx, dword [eax + 0x6c]
jmp 0x41971c
mov dword [esp], 0
call dbg.break_set_xpoints
mov eax, dword [0x4ad5f8]
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], 0x4ad320
call dword [eax + 0x18]
mov eax, dword [0x4ad5f4]
mov edx, dword [eax + 0x64]
test edx, edx
je 0x419754
mov edx, dword [0x4ad5f8]
mov edx, dword [edx + 0x2c]
mov dword [esp + 4], 0x4ad320
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [edx + 0x58]
mov eax, dword [0x4ad5f0]
mov dword [esp + 8], 0x10002
mov dword [esp + 4], eax
mov eax, dword [0x4ad5ec]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ContinueDebugEvent]
sub esp, 0xc
jmp 0x419754
Function at 0x419a40
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
lea eax, [ebp - 0x5c]
sub esp, 0xdc
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
lea edx, [ebp - 0x9c]
xor eax, eax
mov ecx, 0x10
mov dword [ebp - 0xa0], 0x44
mov edi, edx
sub esp, 4
test byte [ebp - 0x30], 1
rep stosd dword es:[edi], eax
mov eax, 1
cmovne ax, word [ebp - 0x2c]
lea edx, [ebp - 0xb0]
mov dword [esp + 0x24], edx
lea edx, [ebp - 0xa0]
cmp dword [0x4ad2f0], 1
mov word [ebp - 0x70], ax
sbb eax, eax
mov dword [ebp - 0x74], 1
and eax, 2
mov dword [esp + 0x20], edx
add eax, 0x11
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
test eax, eax
je 0x419b98
mov eax, dword [ebp - 0xa8]
test eax, eax
je 0x419b60
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], dbg.tgt_process_active_close_process
mov dword [0x4ad5ec], eax
call dbg.dbg_add_process
mov dword [0x4ad5f8], eax
test eax, eax
je 0x419bb8
mov dword [eax + 0x34], 1
mov eax, dword [0x4ad248]
mov esi, 1
cmp eax, ebx
je 0x419b54
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov dword [0x4ad248], ebx
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
mov esi, 1
mov dword [esp], str.Debuggee_has_been_started___s__nBut_WineDbg_isnt_attached_to_it._Maybe_youre_trying_to_debug_a_winelib_wrapper____nTry_to_attach_to_one_of_those_processes:_n
call dbg.dbg_printf
mov dword [esp], 0x64
call dword [sym.imp.kernel32.dll_Sleep]
sub esp, 4
call dbg.info_win32_processes
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
mov esi, eax
mov dword [esp], str.Couldnt_start_process__s_n
call dbg.dbg_printf
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
xor esi, esi
jmp 0x419b54

Function at 0x419bc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea ebx, [ebp - 0x418]
sub esp, 0x430
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
sub esp, 8
test eax, eax
jne 0x419bf8
lea esp, [ebp - 8]
mov eax, 0xffffffff
pop ebx
pop esi
pop ebp
ret
lea esi, [ebp - 0x210]
mov dword [esp + 8], 0
mov dword [esp + 0xc], esi
mov dword [esp + 4], 0x44005e
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
sub esp, 0x10
test eax, eax
je 0x419be9
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x4000080
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0xc0010000
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret