joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414f60
Capabilities:
Get process heap flags

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 0x60
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test ebx, ebx
je 0x414f87
mov dword [esp + 4], 0xfffffffa
mov dword [esp], ebx
call fcn.00429b5c
sub esp, 8
test esi, esi
je 0x4150a8
lea edx, [ebp - 0x38]
mov dword [esp + 4], esi
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.00429c8c
sub esp, 0xc
mov dword [esp + 4], esi
test eax, eax
je 0x415020
mov dword [esp], str.Class__s:_n
call fcn.004242a0
mov eax, dword [ebp - 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], str.style0x_08x__wndProc_p_ninst_p__icon_p__cursor_p__bkgnd_p_nclsExtra_d__winExtra_d_n
mov dword [esp + 4], eax
call fcn.004242a0
test ebx, ebx
je 0x415008
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x415038
mov dword [esp], 0x436a31
call fcn.004242a0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp], str.Cannot_find_class__s_n
call fcn.004242a0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp], str.Extra_bytes:
call fcn.004242a0
cmp dword [ebp - 0x2c], 1
jle 0x415093
xor esi, esi
lea esi, [esi]
lea eax, [esi + esi]
mov dword [esp], ebx
add esi, 1
mov dword [esp + 4], eax
call fcn.00429c5c
movzx edx, al
shr ax, 8
sub esp, 8
movzx eax, ax
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.__02x__02x
call fcn.004242a0
mov edx, dword [ebp - 0x2c]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
cmp eax, esi
jg 0x415050
mov dword [esp], 0x436a31
call fcn.004242a0
jmp 0x415008
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
call fcn.00429c2c
lea edx, [ebp - 0x38]
call fcn.00415100
mov edx, dword [ebp - 0x38]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x415c30
Capabilities:
Resume thread
Suspend thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov edx, dword [0x4425b8]
mov dword [ebp - 0x2c], eax
test edx, edx
je 0x415da0
mov eax, dword [0x4425b4]
test eax, eax
je 0x415da0
mov dword [esp], str.Exception_frames:_n
call fcn.004242a0
mov eax, dword [ebp - 0x2c]
mov edi, dword [0x4425b4]
cmp dword [0x4425b0], eax
jne 0x415cc0
mov eax, dword [0x4425b8]
lea ecx, [ebp - 0x28]
lea ebx, [ebp - 0x20]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 4
mov dword [esp + 8], ecx
mov ecx, dword [edi + 0x14]
mov dword [esp + 4], ecx
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [edx + 4]
test eax, eax
jne 0x415d10
mov dword [esp], str.Cant_read_TEB:except_frame_n
call fcn.004242a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [0x4425b8]
mov dword [esp], eax
call fcn.00424a50
mov edi, eax
test eax, eax
je 0x415de8
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SuspendThread]
sub esp, 4
cmp eax, 0xffffffff
jne 0x415c77
mov eax, dword [ebp - 0x2c]
mov dword [esp], str.Cant_suspend_thread_id___04lx__n
mov dword [esp + 4], eax
call fcn.004242a0
jmp 0x415cb5
cmp dword [ebp - 0x20], 4
jne 0x415ca9
mov eax, dword [ebp - 0x28]
lea esi, [ebp - 0x24]
cmp eax, 0xffffffff
je 0x415d76
lea esi, [esi]
mov dword [esp + 4], eax
mov dword [esp], str._p:
call fcn.004242a0
mov eax, dword [0x4425b8]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 8
mov dword [esp + 8], ebx
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [edx + 4]
test eax, eax
je 0x415d6a
cmp dword [ebp - 0x24], 8
je 0x415db8
mov dword [esp], str.Invalid_frame_address_n
call fcn.004242a0
mov eax, dword [ebp - 0x2c]
cmp dword [0x4425b0], eax
je 0x415cb5
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResumeThread]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp + 8], str.Cannot_get_info_on_exceptions_while_no_process_is_loaded_n
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004242a0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], str.prev_p_handler_p_n
mov dword [esp + 4], eax
call fcn.004242a0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
cmp eax, 0xffffffff
jne 0x415d28
jmp 0x415d76
mov eax, dword [ebp - 0x2c]
mov dword [esp], str.Unknown_thread_id___04lx__in_current_process_n
mov dword [esp + 4], eax
call fcn.004242a0
jmp 0x415cb5
Function at 0x415f40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 8]
cmp dword [0x4425ac], ebx
jne 0x416128
mov eax, dword [0x4425b8]
test eax, eax
je 0x416161
mov eax, dword [eax + 8]
mov dword [ebp - 0x40], eax
mov dword [esp], str.Address__End______State___Type____RWX_n
xor edi, edi
call fcn.004242a0
mov dword [ebp - 0x44], ebx
jmp 0x416064
cmp eax, 0x1000
mov edx, str.commit
mov eax, 0x436d41
cmove eax, edx
mov edx, dword [ebp - 0x1c]
mov esi, eax
cmp edx, 0x40000
je 0x4160f4
ja 0x4160c0
mov eax, 0x436d61
test edx, edx
je 0x415fcd
cmp edx, 0x20000
mov eax, str.private
mov edx, 0x436d41
cmovne eax, edx
mov edx, 0x2020
mov byte [ebp - 0x36], 0x20
mov word [ebp - 0x38], dx
mov edx, dword [ebp - 0x2c]
lea ebx, [ebp - 0x38]
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x35], 0
test dl, 0xee
je 0x415ff0
mov byte [ebp - 0x38], 0x52
test dl, 0x44
je 0x415ff9
mov byte [ebp - 0x37], 0x57
test dl, 0x88
je 0x416002
mov byte [ebp - 0x37], 0x43
and edx, 0xf0
je 0x41600e
mov byte [ebp - 0x36], 0x58
mov edx, dword [ebp - 0x28]
mov ecx, dword [0x4425b8]
lea ebx, [edi + edx - 1]
mov edx, 8
test ecx, ecx
je 0x41602c
mov edx, dword [ecx + 0x24]
mov edx, dword [edx + 4]
add edx, edx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov dword [esp], str._0Ix__0Ix__s__s__s_n
call fcn.004242a0
mov eax, dword [ebp - 0x28]
test eax, eax
js 0x416100
add edi, eax
lea eax, [ebp - 0x34]
mov dword [esp + 0xc], 0x1c
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_VirtualQueryEx]
sub esp, 0x10
cmp eax, 0x1b
jbe 0x416100
mov eax, dword [ebp - 0x24]
cmp eax, 0x2000
je 0x4160e0
cmp eax, 0x10000
jne 0x415f88
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x38], 0
mov esi, str.free
mov eax, 0x43679c
mov dword [ebp - 0x3c], ecx
jmp 0x41600e
cmp edx, 0x1000000
mov eax, 0x436d41
mov ebx, str.image
cmove eax, ebx
jmp 0x415fcd
mov edx, dword [ebp - 0x1c]
mov esi, str.reserve
cmp edx, 0x40000
jne 0x415fab
mov eax, str.mapped
jmp 0x415fcd
mov ebx, dword [ebp - 0x44]
cmp dword [0x4425ac], ebx
je 0x41611a
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0x410
call dword [sym.imp.kernel32.dll_OpenProcess]
sub esp, 0xc
mov dword [ebp - 0x40], eax
test eax, eax
jne 0x415f6b
mov dword [esp + 4], ebx
mov dword [esp], str.Cannot_open_process___04lx__n
call fcn.004242a0
jmp 0x41611a
mov dword [ebp + 8], str.Cannot_look_at_mapping_of_current_process__while_no_process_is_loaded_n
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004242a0
Function at 0x416d30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x1c]
mov byte [ebx], 0
test edx, edx
je 0x416de8
mov ecx, dword [ebp + 0x10]
mov eax, esi
test ecx, ecx
je 0x416da0
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x416df8
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov edi, dword [ebp + 8]
mov edx, dword [edi + 8]
mov dword [esp], edx
call dword [eax + 4]
mov edx, eax
test esi, esi
je 0x416d91
mov byte [ebx + esi - 1], 0
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp esi, 1
ja 0x416dc1
jmp 0x416dc8
sub eax, 1
add ebx, 1
add edx, 1
mov byte [ebx - 1], cl
cmp eax, 1
je 0x416de0
movzx ecx, byte [edx]
test cl, cl
jne 0x416db0
test eax, eax
jne 0x416de0
lea esp, [ebp - 0xc]
mov edx, 1
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
mov byte [ebx], 0
jmp 0x416dcc
lea esp, [ebp - 0xc]
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + esi]
mov dword [ebp + 0xc], edx
mov dword [ebp - 0x2c], eax
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
sub esp, 0xc
mov edx, eax
mov eax, dword [ecx + 0x10]
lea ecx, [ebp - 0x1c]
mov dword [esp + 0x10], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 0xc], ecx
mov dword [ebp - 0x2c], edx
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [esp], edx
call dword [eax + 4]
mov dword [ebp - 0x30], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebp - 0x1c]
shr eax, 1
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x2c]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], edx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0x2c]
sub esp, 0x20
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [ebp - 0x30]
sub esp, 0xc
jmp 0x416d88
Function at 0x416ed0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov word [esi], cx
test eax, eax
je 0x416f1e
lea edi, [ebp - 0x1c]
mov edx, dword [ebx + 0x10]
mov dword [esp + 0x10], edi
mov ecx, dword [ebx + 0x24]
mov ecx, dword [ecx + 4]
mov dword [esp + 4], eax
mov dword [esp + 0xc], ecx
lea ecx, [ebp - 0x20]
mov dword [esp + 8], ecx
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [edx + 4]
test eax, eax
jne 0x416f30
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x24]
mov edx, dword [ebp - 0x1c]
cmp dword [eax + 4], edx
jne 0x416f1e
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x416f1e
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x416f90
mov edx, dword [ebx + 0x10]
mov dword [esp + 0x10], edi
mov edi, dword [ebp + 0x18]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
lea ecx, [edi + edi]
mov dword [esp + 0xc], ecx
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [edx + 4]
test eax, eax
je 0x417058
mov edi, dword [ebp - 0x1c]
xor ebx, ebx
test edi, edi
setne bl
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x416f20
mov eax, dword [ebp + 0x18]
xor edx, edx
mov word [esi + eax*2 - 2], dx
jmp 0x416f20
mov edx, dword [ebp + 0x18]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x417058
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x10], edi
mov edi, dword [ebp + 0x18]
mov dword [esp + 8], edx
mov dword [esp + 0xc], edi
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov dword [esp + 4], ecx
mov ecx, dword [ebx + 8]
mov dword [esp], ecx
call dword [eax + 4]
mov edx, dword [ebp - 0x2c]
mov ebx, eax
mov eax, dword [ebp - 0x1c]
test ebx, ebx
je 0x416ff9
xor ebx, ebx
test eax, eax
setne bl
mov edi, dword [ebp + 0x18]
mov dword [esp + 8], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edi
mov dword [ebp - 0x2c], edx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov edx, dword [ebp - 0x2c]
sub esp, 0x18
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x416f7d
xor ebx, ebx
jmp 0x416f7d
Function at 0x418030
Capabilities:
Get process heap flags
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
cmp eax, 0xffffffff
je 0x4180f8
mov edx, esi
test dl, dl
jne 0x4180a8
cmp eax, 0xffffff14
je 0x418070
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00417780
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.00421b90
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], 0x437f1b
call fcn.004242a0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x1c]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00421b90
lea ecx, [esi - 0x62]
cmp cl, 0x16
ja case.0x4180ca.3
movzx ecx, cl
jmp dword [ecx*4 + 0x437ffc]
mov eax, esi
mov dword [esp], 0x437fc0
movsx esi, al
mov dword [esp + 4], esi
call fcn.004242a0
mov eax, dword [ebx + 0x18]
jmp 0x418051
mov dword [ebp + 8], str.Unable_to_evaluate_expression_n
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004242a0
mov edi, edx
mov ebx, dword [ebp - 0x1c]
or edi, eax
jne 0x418170
mov dword [esp], 0x437e64
call fcn.004242a0
jmp 0x41809c
movzx eax, ax
mov dword [esp], str._d___lc
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call fcn.004242a0
jmp 0x41809c
movsx eax, al
mov dword [esp], str._d___c
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call fcn.004242a0
jmp 0x41809c
mov ecx, 8
mov edi, 0xffffffff
mov esi, 0xffffffff
mov dword [esp], 0x437e66
sub ecx, ebx
xor ebx, ebx
shl ecx, 3
shrd esi, edi, cl
shr edi, cl
test cl, 0x20
cmovne esi, edi
cmovne edi, ebx
and eax, esi
and edx, edi
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.004242a0
jmp 0x41809c
Function at 0x419400
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
mov ebx, edx
sub esp, 0x2c
mov esi, dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp], eax
call esi
mov dword [ebp - 0x1c], eax
test ebx, ebx
je 0x4194d0
mov dword [esp], ebx
call esi
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 4], 0
mov edx, eax
mov eax, dword fs:[0x18]
lea edx, [ecx + edx + 0x1a]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x4194c0
lea ecx, [eax + 0x18]
mov dword [eax], ecx
mov dword [esp + 4], edi
mov edi, dword [sym.imp.ucrtbase.dll_strcpy]
mov dword [esp], ecx
mov dword [ebp - 0x20], ecx
call edi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax + 1]
mov dword [esi + 4], eax
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
mov eax, dword [0x4425b8]
mov ecx, dword [eax + 0x12fc]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], ecx
mov dword [eax + 0x12fc], esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebp - 0x1c]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
add esi, 0x19
mov dword [esp + 8], esi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x4194c0
lea eax, [esi + 0x18]
mov dword [esi], eax
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strcpy]
mov dword [esi + 4], 0
jmp 0x419488

Function at 0x419520
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
sub esp, 0x2c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x419620
mov ebx, eax
test edi, edi
je 0x419593
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileSize]
sub esp, 8
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x419610
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateFileMappingW]
sub esp, 0x18
mov dword [esi], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi]
sub esp, 4
test eax, eax
je 0x419620
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esi, [esi]
mov eax, 0xffffffff
jmp 0x419607
Function at 0x419bc0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp], eax
call edi
lea ebx, [eax + 1]
mov eax, dword [0x4425b8]
mov ecx, dword [eax + 0x1300]
test ecx, ecx
je 0x419c58
mov dword [esp], ecx
mov dword [ebp - 0x1c], ecx
call edi
lea esi, [eax + 1]
mov edi, eax
add ebx, esi
mov dword [esp + 0xc], ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword fs:[0x18]
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
mov ebx, eax
test eax, eax
je 0x419c4b
mov byte [eax + edi], 0x3b
mov eax, dword [ebp + 8]
lea edx, [ebx + esi]
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_strcpy]
mov eax, dword [0x4425b8]
mov dword [eax + 0x1300], ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x419c4b
mov eax, dword [ebp + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_strcpy]
jmp 0x419c40

Function at 0x419ca0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov eax, dword fs:[0x18]
mov edx, dword [ebx + 0x1300]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebx + 0x1300], 0
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret
Function at 0x419cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
test esi, esi
je 0x419de0
test ecx, ecx
je 0x419db0
mov ebx, dword [esi + 0xc]
mov eax, dword [ecx + 0xc]
test ebx, ebx
je 0x419e30
test eax, eax
je 0x419d3f
mov dword [ebp - 0x20], ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strcmp]
mov ecx, dword [ebp - 0x20]
test eax, eax
jne 0x419e58
mov edx, dword [esi + 8]
mov ecx, dword [ecx + 8]
mov eax, ecx
and eax, edx
cmp eax, 0xffffffff
je 0x419df7
cmp edx, 0xffffffff
je 0x419e10
cmp ecx, 0xffffffff
je 0x419dd2
movd xmm0, edx
movd xmm1, ecx
mov eax, ebx
punpckldq xmm0, xmm1
movq qword [ebp - 0x20], xmm0
call fcn.00419680
mov esi, dword [0x4425b8]
lea eax, [esi + 0x1304]
cmp eax, ebx
je 0x419d95
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strcpy]
movq xmm2, qword [ebp - 0x20]
movq qword [esi + 0x1408], xmm2
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x419de0
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x419e40
mov eax, dword [0x4425b8]
mov edx, dword [esi + 8]
lea ebx, [eax + 0x1304]
cmp edx, 0xffffffff
je 0x419df7
lea ecx, [edi + edx]
jmp 0x419d60
test ecx, ecx
je 0x419e48
mov ebx, dword [ecx + 0xc]
test ebx, ebx
je 0x419e80
mov ecx, dword [ecx + 8]
cmp ecx, 0xffffffff
jne 0x419e10
mov eax, dword [0x4425b8]
test edi, edi
js 0x419e20
mov edx, dword [eax + 0x140c]
lea ecx, [edi + edx]
jmp 0x419d60
lea edx, [edi + ecx]
jmp 0x419d60
mov ecx, dword [eax + 0x1408]
lea edx, [edi + ecx]
jmp 0x419d60
test eax, eax
je 0x419e70
mov edx, dword [esi + 8]
mov ebx, eax
jmp 0x419d42
mov edx, dword [esi + 8]
jmp 0x419dcd
mov eax, dword [0x4425b8]
lea ebx, [eax + 0x1304]
jmp 0x419dfc
mov dword [ebp + 8], str.Ambiguous_source_file_specification._n
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004242a0
mov eax, dword [0x4425b8]
lea ebx, [eax + 0x1304]
jmp 0x419d3f
mov eax, dword [0x4425b8]
lea ebx, [eax + 0x1304]
jmp 0x419def
Function at 0x41c530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], str.No_longer_supported_n
pop ebp
jmp fcn.004242a0

Function at 0x41ce10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x4425b8]
test edx, edx
je 0x41ce60
xor edx, edx
cmp ebx, eax
je 0x41ce80
mov dword [esp + 4], edx
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
sub esp, 8
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.dbghelp.dll_SymCleanup
sub esp, 4
mov dword [esp], ebx
call fcn.00424c00
mov ebx, dword [ebp - 4]
mov eax, 1
leave
ret
cmp ebx, eax
je 0x41ce98
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DebugActiveProcessStop]
sub esp, 4
test eax, eax
jne 0x41ce3f
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [0x4425b4]
mov ecx, dword [eax + 0x64]
test ecx, ecx
je 0x41ce2c
mov edx, dword [eax + 0x6c]
jmp 0x41ce2c
mov dword [esp], 0
call fcn.00402d70
mov eax, dword [0x4425b8]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], 0
mov dword [esp], 0x4422e0
call dword [eax + 0x18]
mov eax, dword [0x4425b4]
mov edx, dword [eax + 0x64]
test edx, edx
je 0x41ce64
mov edx, dword [0x4425b8]
mov edx, dword [edx + 0x24]
mov dword [esp + 4], 0x4422e0
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [edx + 0x58]
mov dword [esp + 8], 0x10002
mov eax, dword [0x4425b0]
mov dword [esp + 4], eax
mov eax, dword [0x4425ac]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ContinueDebugEvent]
sub esp, 0xc
jmp 0x41ce64