joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464bdc
Capabilities:
Write file on windows

Disassembly:
lea eax, [ebp + 8]
push eax
call fcn.00468fa5
mov byte [ebp - 0x34], bl
mov byte [ebp - 9], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 0x63], bl
mov byte [ebp - 0x2d], bl
jmp 0x464bcc
test al, al
je 0x464a9e
mov dword [ebp - 0x18], 0x6423d
jmp 0x464a0a
push 5
push esi
push str._BIG5
call fcn.0049cfcb
add esp, 0xc
test al, al
invalid
je 0x464abe
mov dword [ebp - 0x18], 0x6426b
jmp 0x464a0a
push 5
push esi
push str._ANSI
call fcn.0049cfeb
add esp, 0xc
test al, al
je 0x464ada
mov dword [ebp - 0x18], ebx
mov esi, 0xff00056f
cmp di, 0x2d
jne 0x464b0a
xor eax, eax
lea ecx, [esi + 2]
mov ax, word [ecx]
push eax
call fcn.004768b4
add esp, 4
test al, al
je 0x464b0a
push ecx
mov dword [ebp + 8], ecx
call fcn.004a2817
cmp eax, ebx
pop ecx
mov dword [ebp - 0x18], eax
jge 0x464a0a
xor ebx, ebx
inc ebx
jmp 0x4650b5
push 4
lea eax, [ebp + 8]
push eax
push str.fix
call fcn.004a3b1b
add esp, 0xc
test al, al
je 0x464b32
mov byte [ebp - 0x34], 2
jmp 0x464bcd
push 4
lea eax, [ebp + 8]
push eax
push str._nl
call fcn.004a3b3b
add esp, 0xc
test al, al
je 0x464b4f
mov byte [ebp - 9], 1
jmp 0x464bcd
push 2
lea eax, [ebp + 8]
push eax
push 0x4b079c
call fcn.004a3b58
add esp, 0xc
test al, al
je 0x464b6c
mov byte [ebp - 0xa], 1
jmp 0x464bcd
push 3
lea eax, [ebp + 8]
push eax
push 0x4b0798
call 0x4a3b75
add esp, 0xc
test al, al
je 0x464b89
mov byte [ebp - 0x63], 1
jmp 0x464bcd
push 2
lea eax, [ebp + 8]
push eax
push 0x4ab404
call fcn.004a3b92
add esp, 0xc
test al, al
je 0x464ba6
mov byte [ebp - 0x2d], 1
jmp 0x464bcd
push 7
lea eax, [ebp + 8]
push eax
push str.sparse
call fcn.004a3baf
add esp, 0xc
test al, al
je 0x464bc3
mov byte [ebp - 0x62], 1
jmp 0x464bcd
lea eax, [ebp + 8]
push eax
call fcn.0046915e
pop ecx
mov eax, dword [ebp + 8]
cmp word [eax], 0x2a
je 0x464b12
mov esi, 0x4a69d4
push esi
lea ecx, [ebp - 0x78]
call 0x4aa47b
push 0x4b0788
lea ecx, [ebp - 0x74]
call 0x4aa488
push 1
push 0x2c
sub al, 0x5f
push edi
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
call 0x4b2dc4
push ebx
lea ecx, [ebp - 0x78]
lea ecx, [ebp - 0x88]
call fcn.0049c2d6
mov eax, ebx
jmp 0x4657dd
Function at 0x464bf8
Capabilities:
Write file on windows

Disassembly:
lea eax, [ebp + 8]
push eax
call fcn.00468fa5
mov byte [ebp - 0x34], bl
mov byte [ebp - 9], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 0x63], bl
mov byte [ebp - 0x2d], bl
jmp 0x464bcc
test al, al
je 0x464a9e
mov dword [ebp - 0x18], 0x6423d
jmp 0x464a0a
push 5
push esi
push str._BIG5
call fcn.0049cfcb
add esp, 0xc
test al, al
invalid
je 0x464abe
mov dword [ebp - 0x18], 0x6426b
jmp 0x464a0a
push 5
push esi
push str._ANSI
call fcn.0049cfeb
add esp, 0xc
test al, al
je 0x464ada
mov dword [ebp - 0x18], ebx
mov esi, 0xff00056f
cmp di, 0x2d
jne 0x464b0a
xor eax, eax
lea ecx, [esi + 2]
mov ax, word [ecx]
push eax
call fcn.004768b4
add esp, 4
test al, al
je 0x464b0a
push ecx
mov dword [ebp + 8], ecx
call fcn.004a2817
cmp eax, ebx
pop ecx
mov dword [ebp - 0x18], eax
jge 0x464a0a
xor ebx, ebx
inc ebx
jmp 0x4650b5
push 4
lea eax, [ebp + 8]
push eax
push str.fix
call fcn.004a3b1b
add esp, 0xc
test al, al
je 0x464b32
mov byte [ebp - 0x34], 2
jmp 0x464bcd
push 4
lea eax, [ebp + 8]
push eax
push str._nl
call fcn.004a3b3b
add esp, 0xc
test al, al
je 0x464b4f
mov byte [ebp - 9], 1
jmp 0x464bcd
push 2
lea eax, [ebp + 8]
push eax
push 0x4b079c
call fcn.004a3b58
add esp, 0xc
test al, al
je 0x464b6c
mov byte [ebp - 0xa], 1
jmp 0x464bcd
push 3
lea eax, [ebp + 8]
push eax
push 0x4b0798
call 0x4a3b75
add esp, 0xc
test al, al
je 0x464b89
mov byte [ebp - 0x63], 1
jmp 0x464bcd
push 2
lea eax, [ebp + 8]
push eax
push 0x4ab404
call fcn.004a3b92
add esp, 0xc
test al, al
je 0x464ba6
mov byte [ebp - 0x2d], 1
jmp 0x464bcd
push 7
lea eax, [ebp + 8]
push eax
push str.sparse
call fcn.004a3baf
add esp, 0xc
test al, al
je 0x464bc3
mov byte [ebp - 0x62], 1
jmp 0x464bcd
lea eax, [ebp + 8]
push eax
call fcn.0046915e
pop ecx
mov eax, dword [ebp + 8]
cmp word [eax], 0x2a
je 0x464b12
mov esi, 0x4a69d4
push esi
lea ecx, [ebp - 0x78]
call 0x4aa47b
push 0x4b0788
lea ecx, [ebp - 0x74]
call 0x4aa488
push 1
push 0x2c
sub al, 0x5f
push edi
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
call 0x4b2dc4
push ebx
lea ecx, [ebp - 0x78]
lea ecx, [ebp - 0x88]
call fcn.0049c2d6
mov eax, ebx
jmp 0x4657dd
Function at 0x464e8f
Capabilities:
Write file on windows

Disassembly:
push edi
push dword [ebp - 0x60]
lea ecx, [ebp - 8]
call fcn.00469469
mov esi, dword [ebp - 8]
cmp esi, ebx
jne 0x464ebc
push ebx
push 0x2000080
push 4
push ebx
push 7
push edi
push dword [ebp - 0x60]
lea ecx, [ebp - 8]
call fcn.00469487
mov esi, dword [ebp - 8]

Function at 0x464fe9
Capabilities:
Write file on windows

Disassembly:
shl eax, 1
cmp ecx, 0x4b0
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
je 0x465058
cmp ecx, 0x4b1
jne 0x46500f
push eax
push dword [ebp - 0x20]
call fcn.004a05c7
add eax, dword [eax]
pop ecx
pop ecx
jmp 0x465058
cmp ecx, 0xfde9
jne 0x465028
lea ecx, [ebp - 0x20]
call fcn.00472b62
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
jmp 0x465058
mov eax, dword [ebp - 0x20]
movzx ecx, cx
push ecx
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x20], ebx
call fcn.004a2142
push dword [ebp - 0x20]
call dword [0x4a64cc]

Function at 0x469d60
Capabilities:
Write file on windows

Disassembly:
add byte [eax], al
cmp byte [ebp + 0x6d], bl
jg 0x469eab
add dword [eax], eax
invalid
cmp dword [ebp + 0x3c], ebx
jne 0x469d78

Function at 0x469d68
Capabilities:
Write file on windows

Disassembly:
add byte [eax], al
cmp byte [ebp + 0x6d], bl
jg 0x469eab
add dword [eax], eax
invalid
cmp dword [ebp + 0x3c], ebx
jne 0x469d78

Function at 0x469d70
Capabilities:
Write file on windows

Disassembly:
add dword [eax], eax
add byte [ecx], bh
pop ebp
cmp al, 0x75
or byte [ebp + 0x56e8584d], cl
lea ecx, [ebp + 0x58]
call fcn.0046bcce

Function at 0x469e22
Capabilities:
Write file on windows

Disassembly:
lea ecx, [ebp + 0x58]
call fcn.0046b9b1
lea ecx, [ebp - 0x68]
call fcn.004a0c79
mov ebx, 0x80070057
lea ecx, [ebp + 0x58]
call fcn.0046bcce
cmp byte [ebp + 0x6e], bl
je 0x469d8a
push ebx
push ebx
push dword [ebp - 8]
call 0x4ad120
add esp, 0xc
cmp dword [ebp + 0x3c], ebx
jne 0x469dc3
push ebx
push ebx
push 4
push ebx
push 3
push esi
push dword [ebp - 8]
lea ecx, [ebp + 0x58]
call fcn.0046e370
inc ebp
add byte [eax], al
cmp eax, ebx
mov dword [ebp + 0x68], eax
jne 0x469dcc
push ebx
push 0x2000000
push 4
push ebx
push 3
push esi
push dword [ebp - 8]
lea ecx, [ebp + 0x58]
call fcn.0046e38e
mov dword [ebp + 0x68], eax
cmp dword [ebp + 0x68], ebx
je 0x469d43
cmp byte [ebp + 0x22], bl
je 0x469eab
cmp dword [ebp + 0x44], ebx
jl 0x46a86b
jg 0x469de9
cmp dword [ebp + 0x40], ebx
jb 0x469eab
push dword [ebp + 0x44]
push dword [ebp + 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call 0x4fc106
cmp dword [ebp + 0x50], ebx
jl 0x469e18
jg 0x469e06
cmp dword [ebp + 0x4c], ebx
jb 0x469e18
cmp edx, dword [ebp + 0x50]
jl 0x469e18
jg 0x469e12
cmp eax, dword [ebp + 0x4c]
jbe 0x469e18
mov eax, dword [ebp + 0x4c]
mov edx, dword [ebp + 0x50]
add eax, dword [ebp + 8]
mov esi, 0x7fffffff
adc edx, dword [ebp + 0xc]
or al, 0x39
jne 0x469e6a
mov dword [ebp - 0x50], eax
mov edi, edx
jl 0x469e3e
invalid
jg 0x469e35
cmp dword [ebp + 0x40], 0xffffffff
jb 0x469e3e
invalid
inc ebp
mov al, 0xff
Function at 0x46a0ef
Capabilities:
Write file on windows

Disassembly:
lea ecx, [ebp - 0x18]
call fcn.00437e1a
add byte [edx], al
push 3
add edx, dword [ebx + 0x6a]
add ebp, dword [eax]
add byte [eax], al
cmp bh, 0x75
call 0xe86aee5e
std
mov al, 0xf9
invalid
cmp dword [ebp + 0x24], ebx
jne 0x46a0e7
lea ecx, [ebp + 0x24]
call fcn.0046c038
jmp 0x469d43
cmp dword [ebp - 0x14], ebx
je 0x46a112
push 0x200
push dword [ebp + 0x24]
call fcn.004a4b6a
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
mov dword [ebp + 0x30], eax
jle 0x46a112
mov eax, edi
cdq
idiv dword [ebp + 0x30]
mov eax, edx
cdq
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], edx
sub edi, dword [ebp + 0x10]
sbb esi, dword [ebp + 0x14]
mov ecx, edi
mov eax, esi
jg 0x46a126
cmp ecx, ebx
jbe 0x46a151
push ebx
push eax
push ecx
push dword [ebp + 0x24]
call fcn.004a25b8
add esp, 0x10
cmp eax, edi
jne 0x46a13c
cmp edx, esi
je 0x46a151
call dword [0x4a6498]
lea ecx, [ebp + 0x24]
mov ebx, eax
call fcn.0046c0a2
jmp 0x469f3f
cmp dword [ebp - 0x24], ebx

Function at 0x46a11b
Capabilities:
Write file on windows

Disassembly:
lea ecx, [ebp - 0x18]
call fcn.00437e1a
add byte [edx], al
push 3
add edx, dword [ebx + 0x6a]
add ebp, dword [eax]
add byte [eax], al
cmp bh, 0x75
call 0xe86aee5e
std
mov al, 0xf9
invalid
cmp dword [ebp + 0x24], ebx
jne 0x46a0e7
lea ecx, [ebp + 0x24]
call fcn.0046c038
jmp 0x469d43
cmp dword [ebp - 0x14], ebx
je 0x46a112
push 0x200
push dword [ebp + 0x24]
call fcn.004a4b6a
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
mov dword [ebp + 0x30], eax
jle 0x46a112
mov eax, edi
cdq
idiv dword [ebp + 0x30]
mov eax, edx
cdq
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], edx
sub edi, dword [ebp + 0x10]
sbb esi, dword [ebp + 0x14]
mov ecx, edi
mov eax, esi
jg 0x46a126
cmp ecx, ebx
jbe 0x46a151
push ebx
push eax
push ecx
push dword [ebp + 0x24]
call fcn.004a25b8
add esp, 0x10
cmp eax, edi
jne 0x46a13c
cmp edx, esi
je 0x46a151
call dword [0x4a6498]
lea ecx, [ebp + 0x24]
mov ebx, eax
call fcn.0046c0a2
jmp 0x469f3f
cmp dword [ebp - 0x24], ebx

Function at 0x46a207
Capabilities:
Write file on windows

Disassembly:
lea edi, [esi + eax]
lea eax, [edi + 0x100000]
push eax
lea ecx, [ebp + 0x2c]
mov dword [ebp - 0x7c], edx
call str._Service
mov eax, dword [ebp + 0x2c]
add eax, 0x100000
and eax, 0xfff00000
push edi
push dword [ebp - 0x74]
add esi, eax
push eax
Function at 0x46a265
Capabilities:
Write file on windows

Disassembly:
push dword [ebp + 0x24]
mov dword [ebp - 0x1c], ebx
call dword [0x4a64e8]
mov eax, dword [ebp + 0x30]
cdq
sub eax, dword [ebp + 0x10]
sbb edx, dword [ebp + 0x14]
sub dword [ebp + 0x4c], eax

Function at 0x46a27e
Capabilities:
Write file on windows

Disassembly:
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
sbb dword [ebp + 0x50], edx
cmp dword [ebp + 0x50], ebx
jg 0x46a29f
jl 0x46a293
cmp dword [ebp + 0x4c], ebx
jae 0x46a29f
add eax, dword [ebp + 0x4c]
adc edx, dword [ebp + 0x50]
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
push eax
mov eax, dword [ebp + 0x10]
add eax, edi
push eax
push edi
call fcn.0047bf14
add dword [eax], eax
add esp, 0xc
Function at 0x46a568
Capabilities:
Write file on windows

Disassembly:
jg 0x46a572
cmp edi, ebx
jbe 0x46a5f4
cmp byte [ebp + 0x6d], bl
je 0x46a59a
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp + 8]
push edi
push dword [ebp - 0x30]
add ecx, eax
push ecx
call fcn.0047c1f1
add esp, 0xc
add dword [ebp + 8], edi
mov dword [ebp + 0x1c], edi
adc dword [ebp + 0xc], esi
jmp 0x46a786
push dword [ebp - 0x28]
lea eax, [ebp + 0x1c]
push eax
push edi
push dword [ebp - 0x30]
push dword [ebp + 0x68]
call 0x4a60a9
add esp, 0x14
test eax, eax
jne 0x46a786
cmp byte [ebp + 0x57], bl
jne 0x46a6f7

Function at 0x46a606
Capabilities:
Write file on windows

Disassembly:
add byte [eax], al
push dword [ebp - 0x28]
fcom dword [ebx - 1]
jne 0x46a60b
call 0x4fc810
invalid
cmp dword [ebp + 0x38], ebx
mov dword [ebp + 0x1c], ebx
jl 0x46a7bf
jg 0x46a6ce
cmp dword [ebp + 0x34], ebx
jbe 0x46a7bf
push ebx
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x34]
push dword [ebp - 0x30]
push dword [ebp + 0x68]
call dword [0x4a6194]
test eax, eax
jne 0x46a7bf
cmp byte [ebp + 0x57], bl
je 0x46a830
mov byte [ebp + 0x57], 2
call dword [0x4a6498]
mov al, byte [ebp + 0x57]
lea ecx, [ebp + 0x58]
mov byte [ebp + 0x4a], al
mov byte [ebp + 0x57], bl
mov dword [ebp + 0x1c], ebx
call fcn.0046c667
push ebx
push ebx
push 4
push ebx
push ebx
mov esi, 0xc0000000
push esi
push dword [ebp - 8]
lea ecx, [ebp + 0x58]
call fcn.0046ecf6
cmp eax, ebx
mov dword [ebp + 0x68], eax
jne 0x46a762
push ebx
mov dword [ebp - 0x6c], 1
cmp dword [ebp - 0x6c], ebx
jne 0x46a5c7
cmp dword [ebp + 0x50], ebx
jl 0x46a863
jg 0x46a84c
cmp dword [ebp + 0x4c], ebx
jbe 0x46a863
cmp dword [ebp + 0x4c], 0xffffffff
jne 0x46a5c7
cmp dword [ebp + 0x50], 0x7fffffff
jne 0x46a5c7
mov dword [ebp - 4], ebx
jmp 0x46a5d7
std
invalid
invalid

Function at 0x46a65c
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ebp - 0x28]
cdq
push 1
mov esi, eax
push ebx
mov edi, edx
mov dword [ebp - 0xa0], esi
sub esi, dword [ebp + 0x10]
push ebx
push dword [ebp + 0x68]
mov dword [ebp - 0x9c], edi
sbb edi, dword [ebp + 0x14]
call fcn.004a2ac1
add esp, 0x1c
push ebx
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0x94], edx
push dword [ebp - 4]
mov dword [ebp - 0x20], ebx
push dword [ebp + 0x68]
mov dword [ebp - 0x1c], ebx
in al, 0xff
adc eax, 0x4a64e8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
add eax, ecx
mov ecx, dword [ebp - 0x30]
push esi
push eax
mov eax, dword [ebp + 0x60]
add eax, ecx
push eax
call fcn.0047c2e3
mov eax, dword [ebp - 0xa0]
add dword [ebp + 0x60], esi
push ebx
push dword [ebp - 0x94]
adc dword [ebp + 0x64], edi
push dword [ebp - 0x98]
mov dword [ebp + 0x34], eax
mov eax, dword [ebp - 0x9c]
push dword [ebp + 0x68]
push 0xe8384589
xchg dword [ebx + eax - 0x7f827500], eax
add esp, 0x1c
cmp byte [ebp + 0x22], bl
je 0x46a6b7
mov byte [ebp + 0x6f], 1
Function at 0x46a69f
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ebp - 0x28]
cdq
push 1
mov esi, eax
push ebx
mov edi, edx
mov dword [ebp - 0xa0], esi
sub esi, dword [ebp + 0x10]
push ebx
push dword [ebp + 0x68]
mov dword [ebp - 0x9c], edi
sbb edi, dword [ebp + 0x14]
call fcn.004a2ac1
add esp, 0x1c
push ebx
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0x94], edx
push dword [ebp - 4]
mov dword [ebp - 0x20], ebx
push dword [ebp + 0x68]
mov dword [ebp - 0x1c], ebx
in al, 0xff
adc eax, 0x4a64e8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
add eax, ecx
mov ecx, dword [ebp - 0x30]
push esi
push eax
mov eax, dword [ebp + 0x60]
add eax, ecx
push eax
call fcn.0047c2e3
mov eax, dword [ebp - 0xa0]
add dword [ebp + 0x60], esi
push ebx
push dword [ebp - 0x94]
adc dword [ebp + 0x64], edi
push dword [ebp - 0x98]
mov dword [ebp + 0x34], eax
mov eax, dword [ebp - 0x9c]
push dword [ebp + 0x68]
push 0xe8384589
xchg dword [ebx + eax - 0x7f827500], eax
add esp, 0x1c
cmp byte [ebp + 0x22], bl
je 0x46a6b7
mov byte [ebp + 0x6f], 1

Function at 0x46a6b5
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ebp - 0x28]
cdq
push 1
mov esi, eax
push ebx
mov edi, edx
mov dword [ebp - 0xa0], esi
sub esi, dword [ebp + 0x10]
push ebx
push dword [ebp + 0x68]
mov dword [ebp - 0x9c], edi
sbb edi, dword [ebp + 0x14]
call fcn.004a2ac1
add esp, 0x1c
push ebx
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0x94], edx
push dword [ebp - 4]
mov dword [ebp - 0x20], ebx
push dword [ebp + 0x68]
mov dword [ebp - 0x1c], ebx
in al, 0xff
adc eax, 0x4a64e8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
add eax, ecx
mov ecx, dword [ebp - 0x30]
push esi
push eax
mov eax, dword [ebp + 0x60]
add eax, ecx
push eax
call fcn.0047c2e3
mov eax, dword [ebp - 0xa0]
add dword [ebp + 0x60], esi
push ebx
push dword [ebp - 0x94]
adc dword [ebp + 0x64], edi
push dword [ebp - 0x98]
mov dword [ebp + 0x34], eax
mov eax, dword [ebp - 0x9c]
push dword [ebp + 0x68]
push 0xe8384589
xchg dword [ebx + eax - 0x7f827500], eax
add esp, 0x1c
cmp byte [ebp + 0x22], bl
je 0x46a6b7
mov byte [ebp + 0x6f], 1
Function at 0x46a730
Capabilities:
Write file on windows

Disassembly:
call dword [0x4a6498]
call dword [0x4a6498]
cmp eax, ebx
jne 0x46a5d4
xor eax, eax
inc eax
mov dword [ebp - 4], eax
lea ecx, [ebp + 0x2c]
call fcn.004a17f5
push ebx
push 3
push ebx
push ebx
push esi
push dword [ebp - 8]
lea ecx, [ebp + 0x58]
call fcn.0046ed0f
into
inc ebp
add byte [eax], al
cmp eax, ebx
mov dword [ebp + 0x68], eax
jne 0x46a762
push ebx
mov eax, 0x2000000
push eax
push 3
push ebx
push ebx
push esi
push dword [ebp - 8]
lea ecx, [ebp + 0x58]
call fcn.0046ed2d
mov dword [ebp + 0x68], eax
push dword [ebp - 0x28]
lea eax, [ebp + 0x1c]
push eax
push edi
push dword [ebp - 0x30]
push dword [ebp + 0x68]
call 0x4a6271
add esp, 0x14
test eax, eax
je 0x46a5c1
test byte [ecx - 2], al
invalid
invalid
cmp byte [ebp + 0x4a], 2
je 0x46a7bf
cmp dword [ebp + 0x1c], edi
jbe 0x46a78e
mov dword [ebp + 0x1c], edi
cmp byte [ebp + 0x6f], bl
je 0x46a7a5
push dword [ebp + 0x1c]
push ebx
push dword [ebp - 0x30]
call 0x4fc99b
add esp, 0xc
mov byte [ebp + 0x6f], bl
mov eax, dword [ebp + 0x1c]
sub dword [ebp + 0x34], eax
mov byte [ebp + 0x57], bl
sbb dword [ebp + 0x38], ebx
sub dword [ebp + 0x60], eax
sbb dword [ebp + 0x64], ebx
add dword [ebp - 0x30], edi
jmp 0x46a5f4
cmp byte [ebp + 0x6f], bl
je 0x46a7d6
push dword [ebp + 0x1c]
push ebx
push dword [ebp - 0x30]
call 0x4fc9cc
add esp, 0xc
mov byte [ebp + 0x6f], bl
pop ebp
outsd dx, dword [esi]
mov eax, dword [ebp + 0x1c]
add dword [ebp - 0x30], eax
sub dword [ebp + 0x60], eax
sbb dword [ebp + 0x64], ebx
mov eax, dword [ebp + 0x44]
cmp dword [ebp + 0x64], eax
jg 0x46a504
jl 0x46a7fc
mov eax, dword [ebp + 0x40]
cmp dword [ebp + 0x60], eax
invalid
or dword [eax], 0xfffffffd
invalid
Function at 0x46a7d4
Capabilities:
Write file on windows

Disassembly:
call dword [0x4a6498]
call dword [0x4a6498]
cmp eax, ebx
jne 0x46a5d4
xor eax, eax
inc eax
mov dword [ebp - 4], eax
lea ecx, [ebp + 0x2c]
call fcn.004a17f5
push ebx
push 3
push ebx
push ebx
push esi
push dword [ebp - 8]
lea ecx, [ebp + 0x58]
call fcn.0046ed0f
into
inc ebp
add byte [eax], al
cmp eax, ebx
mov dword [ebp + 0x68], eax
jne 0x46a762
push ebx
mov eax, 0x2000000
push eax
push 3
push ebx
push ebx
push esi
push dword [ebp - 8]
lea ecx, [ebp + 0x58]
call fcn.0046ed2d
mov dword [ebp + 0x68], eax
push dword [ebp - 0x28]
lea eax, [ebp + 0x1c]
push eax
push edi
push dword [ebp - 0x30]
push dword [ebp + 0x68]
call 0x4a6271
add esp, 0x14
test eax, eax
je 0x46a5c1
test byte [ecx - 2], al
invalid
invalid
cmp byte [ebp + 0x4a], 2
je 0x46a7bf
cmp dword [ebp + 0x1c], edi
jbe 0x46a78e
mov dword [ebp + 0x1c], edi
cmp byte [ebp + 0x6f], bl
je 0x46a7a5
push dword [ebp + 0x1c]
push ebx
push dword [ebp - 0x30]
call 0x4fc99b
add esp, 0xc
mov byte [ebp + 0x6f], bl
mov eax, dword [ebp + 0x1c]
sub dword [ebp + 0x34], eax
mov byte [ebp + 0x57], bl
sbb dword [ebp + 0x38], ebx
sub dword [ebp + 0x60], eax
sbb dword [ebp + 0x64], ebx
add dword [ebp - 0x30], edi
jmp 0x46a5f4
cmp byte [ebp + 0x6f], bl
je 0x46a7d6
push dword [ebp + 0x1c]
push ebx
push dword [ebp - 0x30]
call 0x4fc9cc
add esp, 0xc
mov byte [ebp + 0x6f], bl
pop ebp
outsd dx, dword [esi]
mov eax, dword [ebp + 0x1c]
add dword [ebp - 0x30], eax
sub dword [ebp + 0x60], eax
sbb dword [ebp + 0x64], ebx
mov eax, dword [ebp + 0x44]
cmp dword [ebp + 0x64], eax
jg 0x46a504
jl 0x46a7fc
mov eax, dword [ebp + 0x40]
cmp dword [ebp + 0x60], eax
invalid
or dword [eax], 0xfffffffd
invalid

Function at 0x46a810
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ebp + 0x3c]
cmp eax, dword [ebp - 0x30]
je 0x46a342
push dword [ebp + 0x60]
push dword [ebp - 0x30]
push eax
call fcn.0047c490
add esp, 0xc
jmp 0x46a342

Function at 0x46ccba
Capabilities:
Create thread

Disassembly:
je 0x46cd5c
cmp dword [ebp - 0xc], eax
jne 0x46cd5c
push 0x18
lea ecx, [ebp - 0x20]
call 0x4a9d43
mov esi, dword [ebp - 0x20]
push esi
call fcn.004a3ec4
mov eax, dword [ebp - 4]
and dword [esi], 0
or dword [esi + 0xc], 0xffffffff
mov dword [esp], 0x4c0bcc
mov ebx, 0x10000
push ebx
push esi
push 0x43cffb
push ebx
mov dword [esi + 4], edi
mov edi, dword [0x4a61b0]
push 0
mov dword [esi + 8], eax
mov dword [esi + 0x10], 3
call edi
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x46cd37
push eax
call dword [0x4a6484]
push 0x4c0bcc
push ebx
push esi
push 0x43cffb
push ebx
push 0
call edi
test eax, eax
mov dword [ebp - 0x10], eax
je 0x46cd4c
and dword [ebp - 0x20], 0
Function at 0x471118
Capabilities:
Create thread

Disassembly:
cmp byte [esi + 0x77], bl
jg 0x4711b4
lea edi, [esi + 0x78]
mov eax, dword [edi]
cmp word [eax], bx
je 0x471158
push edi
lea ecx, [ebp - 8]
call 0x4b6a18
push str..Visible
lea ecx, [ebp - 8]
call 0x4ae327
push 0x4ab2d4
push dword [ebp - 8]
mov ecx, esi
call 0x4be4d4
lea ecx, [ebp - 8]
call 0x4a836e
mov eax, dword [edi]
cmp word [eax], bx
je 0x47118c
invalid
push edi
lea ecx, [ebp - 8]
call 0x4b6a4c
push str..Visable
lea ecx, [ebp - 8]
call 0x4ae35b
push 0x4ab2d4
push dword [ebp - 8]
mov ecx, esi
call 0x4be508
lea ecx, [ebp - 8]
call 0x4a83a2
cmp byte [esi + 0x75], bl
jne 0x4711b7
test byte [esi + 0x49], 0x10
je 0x4711a9
push 0x57
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esi + 0x18]
call dword [0x4a6834]
jmp 0x4711b4
push 5
push dword [esi + 0x18]
call dword [0x4a6838]
cmp byte [esi + 0x75], bl
jl 0x4711cd
push ebx
push 0x1f4
push 0x270c
push dword [esi + 0x18]
call dword [0x4a6844]
mov eax, 0x20000
test dword [esi + 0x48], eax
je 0x47120a
cmp dword [0x4c10f8], ebx
jne 0x47120a
push 0x4c0bcc
push 0x10000
mov dword [0x4c10fc], esi
push dword [esi + 0x18]
jbe 0x47120a

Function at 0x4711e3
Capabilities:
Create thread

Disassembly:
cmp byte [esi + 0x77], bl
jg 0x4711b4
lea edi, [esi + 0x78]
mov eax, dword [edi]
cmp word [eax], bx
je 0x471158
push edi
lea ecx, [ebp - 8]
call 0x4b6a18
push str..Visible
lea ecx, [ebp - 8]
call 0x4ae327
push 0x4ab2d4
push dword [ebp - 8]
mov ecx, esi
call 0x4be4d4
lea ecx, [ebp - 8]
call 0x4a836e
mov eax, dword [edi]
cmp word [eax], bx
je 0x47118c
invalid
push edi
lea ecx, [ebp - 8]
call 0x4b6a4c
push str..Visable
lea ecx, [ebp - 8]
call 0x4ae35b
push 0x4ab2d4
push dword [ebp - 8]
mov ecx, esi
call 0x4be508
lea ecx, [ebp - 8]
call 0x4a83a2
cmp byte [esi + 0x75], bl
jne 0x4711b7
test byte [esi + 0x49], 0x10
je 0x4711a9
push 0x57
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esi + 0x18]
call dword [0x4a6834]
jmp 0x4711b4
push 5
push dword [esi + 0x18]
call dword [0x4a6838]
cmp byte [esi + 0x75], bl
jl 0x4711cd
push ebx
push 0x1f4
push 0x270c
push dword [esi + 0x18]
call dword [0x4a6844]
mov eax, 0x20000
test dword [esi + 0x48], eax
je 0x47120a
cmp dword [0x4c10f8], ebx
jne 0x47120a
push 0x4c0bcc
push 0x10000
mov dword [0x4c10fc], esi
push dword [esi + 0x18]
jbe 0x47120a