joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101a5079
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3aa5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101a502d.0
test byte [0x10455eec], 1
jne 0x101a501f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101a502d.0
cmp edi, 3
ja case.0x101a502d.0
jmp dword [edi*4 + 0x101a50fc]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101a50a1
dec eax
je 0x101a509a
dec eax
je 0x101a5093
xor eax, eax
jmp 0x101a50a6
mov edi, 1
jmp 0x101a5039
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x101a50e0
mov eax, 6
jmp 0x101a50a6
mov eax, 2
jmp 0x101a50a6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x101a69d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3c35
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101a6a4d.0
test byte [0x10455eec], 1
jne 0x101a6a3f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101a6a4d.0
cmp edi, 3
ja case.0x101a6a4d.0
jmp dword [edi*4 + 0x101a6b1c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101a6ac1
dec eax
je 0x101a6aba
dec eax
je 0x101a6ab3
xor eax, eax
jmp 0x101a6ac6
mov edi, 1
jmp 0x101a6a59
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x101a6b00
mov eax, 6
jmp 0x101a6ac6
mov eax, 2
jmp 0x101a6ac6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x101a6a54
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3c35
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101a6a4d.0
test byte [0x10455eec], 1
jne 0x101a6a3f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101a6a4d.0
cmp edi, 3
ja case.0x101a6a4d.0
jmp dword [edi*4 + 0x101a6b1c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101a6ac1
dec eax
je 0x101a6aba
dec eax
je 0x101a6ab3
xor eax, eax
jmp 0x101a6ac6
mov edi, 1
jmp 0x101a6a59
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x101a6b00
mov eax, 6
jmp 0x101a6ac6
mov eax, 2
jmp 0x101a6ac6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x101a6a92
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3c35
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101a6a4d.0
test byte [0x10455eec], 1
jne 0x101a6a3f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101a6a4d.0
cmp edi, 3
ja case.0x101a6a4d.0
jmp dword [edi*4 + 0x101a6b1c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101a6ac1
dec eax
je 0x101a6aba
dec eax
je 0x101a6ab3
xor eax, eax
jmp 0x101a6ac6
mov edi, 1
jmp 0x101a6a59
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x101a6b00
mov eax, 6
jmp 0x101a6ac6
mov eax, 2
jmp 0x101a6ac6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x101a6a99
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3c35
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101a6a4d.0
test byte [0x10455eec], 1
jne 0x101a6a3f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101a6a4d.0
cmp edi, 3
ja case.0x101a6a4d.0
jmp dword [edi*4 + 0x101a6b1c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101a6ac1
dec eax
je 0x101a6aba
dec eax
je 0x101a6ab3
xor eax, eax
jmp 0x101a6ac6
mov edi, 1
jmp 0x101a6a59
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x101a6b00
mov eax, 6
jmp 0x101a6ac6
mov eax, 2
jmp 0x101a6ac6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x406880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x40a024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x4068a7
mov ecx, 5
int 0x29
push 2
call fcn.004052fb
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x4069b2
test esi, esi
jne 0x4069b2
push 2
call fcn.004052fb
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040454d
mov esp, ebp
pop ebp
ret
Function at 0x401640
Capabilities:
Create directory

Disassembly:
push ebp
mov eax, 0x105c
push edi
push esi
push ebx
call fcn.0040a450
sub esp, eax
mov eax, dword [0x420684]
add eax, dword [0x420028]
lea ebx, [esp + 0x50]
mov dword [esp + 4], str._s__s
mov dword [esp + 0xc], eax
mov eax, dword [0x4200b0]
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 8], 0x1a4
mov dword [esp + 4], 0x301
mov dword [esp], ebx
call sub.msvcrt.dll__open
test eax, eax
mov esi, eax
js 0x401716
mov edx, dword [0x40f1b8]
test edx, edx
jne 0x4016f3
mov dword [esp], esi
mov dword [esp + 4], 0x410085
call fcn.00403080
mov edx, str.fixinc_tests_inc
mov dword [esp + 4], str.___DO_NOT_EDIT_THIS_FILE._n_n____It_has_been_auto_edited_by_fixincludes_from:_n_n_t__s__s__n_n____This_had_to_be_done_to_correct_non_standard_usages_in_the_n____original__manufacturer_supplied_header_file.____n_n
mov ebx, eax
mov eax, dword [0x4200c0]
mov dword [esp], ebx
test eax, eax
mov eax, dword [0x420684]
cmovne edx, dword [0x4200b4]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_fprintf
add esp, 0x105c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x420684]
mov dword [esp + 4], str.Fixed:___s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x4016a4
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
cmp dword [eax], 2
je 0x401765
call edi
mov eax, dword [eax]
mov dword [esp], eax
call fcn.004030a0
mov esi, eax
call edi
mov eax, dword [eax]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 4], str.Error__d___s__creating__s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 1
call sub.msvcrt.dll_exit
lea eax, [esp + 0x51]
mov dword [esp + 4], 0x2f
lea ebp, [esp + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
mov esi, eax
jne 0x4017a1
jmp 0x4017c0
mov byte [esi], 0x2f
add esi, 1
mov dword [esp], esi
mov dword [esp + 4], 0x2f
call sub.msvcrt.dll_strchr
test eax, eax
mov esi, eax
je 0x4017c0
mov byte [esi], 0
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.0040a480
test eax, eax
jns 0x401785
mov dword [esp], ebx
call sub.msvcrt.dll__mkdir
jmp 0x401785
mov dword [esp + 8], 0x1a4
mov dword [esp + 4], 0x301
mov dword [esp], ebx
call sub.msvcrt.dll__open
test eax, eax
mov esi, eax
jns 0x40169a
jmp 0x401723
Function at 0x401ac0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov eax, dword [ebp]
mov dword [esp], eax
call fcn.004030f0
cmp ebx, 1
je 0x401b1d
cmp ebx, 2
jne 0x401b50
mov eax, dword [ebp + 4]
mov edi, 0x4100f1
mov ecx, 3
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x401d4a
mov edx, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], 0x4100c7
mov dword [esp], eax
mov dword [esp + 8], edx
call fcn.00403090
test eax, eax
je 0x401cff
call fcn.00402f20
mov edx, dword [0x4200a8]
movzx eax, byte [edx]
movzx ecx, al
test byte [ecx + ecx + 0x41ea20], 4
jne 0x401b84
sub eax, 0x41
cmp al, 0x33
ja case.0x401b46.1
movzx eax, al
jmp dword [eax*4 + 0x410178]
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x30
mov dword [esp + 4], 1
mov dword [esp], str.fixincl_ERROR:__too_many_command_line_arguments_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov dword [esp], edx
call sub.msvcrt.dll_atoi
cmp eax, 4
mov dword [0x40f1b8], eax
jbe 0x401bc8
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], str.fixinc_verbosity:__EVERYTHING_n
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [0x40f1b8], 5
call sub.msvcrt.dll_fwrite
mov eax, dword [0x4200a4]
cmp byte [eax], 0x2e
jne 0x401c00
movzx edx, byte [eax + 1]
cmp dl, 0x2f
jne 0x401cf2
add eax, 2
jmp 0x401bf4
add eax, 2
movzx edx, byte [eax - 1]
cmp dl, 0x2f
jne 0x401cf0
mov dword [0x4200a4], eax
mov ecx, eax
cmp byte [eax], 0x2e
je 0x401be4
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [0x420028], eax
call fcn.00401920
mov dword [esp + 4], str.fxinc
mov dword [esp], 0
call sub.msvcrt.dll__tempnam
mov dword [esp], eax
mov dword [0x420680], eax
call fcn.00402bc0
mov dword [esp + 4], 1
mov dword [esp], 0xf
call sub.msvcrt.dll_signal
mov dword [esp + 4], 1
mov dword [esp], 0xf
call sub.msvcrt.dll_signal
mov dword [esp + 4], 1
mov dword [esp], 0xf
call sub.msvcrt.dll_signal
mov dword [esp + 4], 1
mov dword [esp], 0xf
call sub.msvcrt.dll_signal
mov dword [esp + 0x44], 1
mov dword [esp + 0x40], 0xf
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp sub.msvcrt.dll_signal
mov dword [0x40f1b8], 4
jmp 0x401bc8
mov dword [0x40f1b8], 0
jmp 0x401bc8
mov dword [0x40f1b8], 2
jmp 0x401bc8
mov dword [0x40f1b8], 1
jmp 0x401bc8
mov dword [0x40f1b8], 3
jmp 0x401bc8
mov eax, ecx
test dl, dl
jne 0x401c00
jmp 0x401c0d
mov ebx, dword [sym.imp.msvcrt.dll__errno]
mov edi, dword [ebp + 4]
call ebx
mov eax, dword [eax]
mov dword [esp], eax
call fcn.004030a0
mov esi, eax
call ebx
mov eax, dword [eax]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 4], str.Error__d___s__reopening__s_as_stdin_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 1
call sub.msvcrt.dll_exit
call fcn.0040a848
nop
Function at 0x4028a0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
test esi, esi
je 0x4029a2
xor ebx, ebx
mov edi, 0xffffffff
mov dword [esp + 0x1c], 0
jmp 0x402910
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], 1
add eax, ebx
mov dword [esp], eax
call sub.msvcrt.dll_fread
test eax, eax
mov ebp, eax
jne 0x402900
mov dword [esp], esi
call sub.msvcrt.dll_feof
test eax, eax
jne 0x402938
mov dword [esp], esi
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x402957
mov dword [esp], esi
sub edi, ebp
add ebx, ebp
call sub.msvcrt.dll_feof
test eax, eax
jne 0x402938
cmp edi, 0x3ff
jg 0x4028c4
add edi, 0x1000
lea eax, [ebx + edi + 1]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.004031d0
mov dword [esp + 0x1c], eax
jmp 0x4028c4
lea eax, [ebx + 1]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.004031d0
mov byte [eax + ebx], 0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.msvcrt.dll__errno]
mov ebx, dword [eax]
cmp ebx, 0x15
je 0x40298c
mov dword [esp], ebx
call fcn.004030a0
mov dword [esp + 8], ebx
mov dword [esp + 4], str.error__d___s__reading_input_n
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_free
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x40294f
Function at 0x402bf0
Capabilities:
Execute command
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], str.CONFIG_SHELL
mov ebx, dword [esp + 0x30]
call sub.msvcrt.dll_getenv
mov edx, 0xa
mov ebp, eax
mov eax, ebx
call fcn.00402870
mov edx, 0x5c
mov esi, eax
mov eax, ebx
call fcn.00402870
mov edx, 0x22
mov edi, eax
mov eax, ebx
call fcn.00402870
mov edx, 0x60
add edi, eax
mov eax, ebx
call fcn.00402870
add edi, eax
test ebp, ebp
je 0x402d8a
mov dword [esp], ebp
call sub.msvcrt.dll_strlen
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_strlen
lea edx, [esi + esi*2]
lea edx, [edi + edx*2 + 7]
add edx, dword [esp + 0xc]
add eax, edx
mov dword [esp], eax
call fcn.00403150
mov dword [esp + 4], ebp
mov esi, eax
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov ecx, 0x22
add eax, esi
mov dword [eax], 0x20632d20
add eax, 5
mov word [eax - 1], cx
movzx edx, byte [ebx]
test dl, dl
je 0x402d00
xor ecx, ecx
jmp 0x402ccc
cmp dl, 0xa
je 0x402d40
cmp dl, 0x22
jne 0x402d33
mov byte [eax], 0x5c
movzx edx, byte [ebx]
add eax, 2
mov byte [eax - 1], dl
movzx edx, byte [ebx + 1]
add ebx, 1
test dl, dl
je 0x402d00
cmp dl, 0x27
je 0x402d24
jle 0x402ca7
cmp dl, 0x5c
je 0x402ce2
cmp dl, 0x60
nop
lea esi, [esi]
jne 0x402d33
test ecx, ecx
je 0x402cec
mov byte [eax], 0x5c
add eax, 1
movzx edx, byte [ebx]
add eax, 1
add ebx, 1
mov byte [eax - 1], dl
movzx edx, byte [ebx]
test dl, dl
jne 0x402ccc
nop
mov edx, 0x22
mov word [eax], dx
mov dword [esp], esi
call 0x40a7c8
mov dword [esp], esi
mov ebx, eax
call sub.msvcrt.dll_free
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov byte [eax], 0x27
xor ecx, 1
movzx edx, byte [ebx + 1]
add eax, 1
jmp 0x402cc5
mov byte [eax], dl
add eax, 1
movzx edx, byte [ebx + 1]
jmp 0x402cc5
test ecx, ecx
je 0x402d62
mov dword [eax], 0x5c272427
mov ecx, 1
add eax, 7
mov dword [eax - 3], 0x27276e
movzx edx, byte [ebx + 1]
jmp 0x402cc5
mov byte [eax], 0x3b
lea edi, [eax + 2]
mov byte [eax + 1], 0x20
jmp 0x402d73
add ebx, 1
movzx edx, byte [ebx + 1]
cmp dl, 0x20
je 0x402d70
lea eax, [edx - 9]
cmp al, 1
jbe 0x402d70
mov eax, edi
jmp 0x402cc5
mov dword [esp], str.SHELL
call sub.msvcrt.dll_getenv
test eax, eax
mov ebp, eax
jne 0x402c49
mov dword [esp + 0x30], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp 0x40a7c8
jmp dword [sym.imp.msvcrt.dll_system]
Function at 0x402f20
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
sub esp, 0x14
mov dword [esp], str.TARGET_MACHINE
call sub.msvcrt.dll_getenv
test eax, eax
mov dword [0x4200c0], eax
je 0x40300e
mov dword [esp], str.ORIGDIR
call sub.msvcrt.dll_getenv
test eax, eax
mov dword [0x4200bc], eax
je 0x403040
mov dword [esp], str.SRCDIR
call sub.msvcrt.dll_getenv
test eax, eax
mov dword [0x4200b8], eax
je 0x403036
mov dword [esp], str.INPUT
call sub.msvcrt.dll_getenv
test eax, eax
mov dword [0x4200b4], eax
je 0x40302c
mov dword [esp], str.DESTDIR
call sub.msvcrt.dll_getenv
test eax, eax
mov dword [0x4200b0], eax
je 0x403022
mov dword [esp], str.MN_NAME_PAT
call sub.msvcrt.dll_getenv
mov dword [esp], str.VERBOSE
mov dword [0x4200ac], eax
call sub.msvcrt.dll_getenv
mov dword [esp], str.FIND_BASE
mov dword [0x4200a8], eax
call sub.msvcrt.dll_getenv
test eax, eax
mov dword [0x4200a4], eax
je 0x403018
mov dword [esp], str.TEST_MODE
call sub.msvcrt.dll_getenv
test eax, eax
mov dword [0x4200a0], eax
je 0x403008
mov edi, str.true
mov ecx, 5
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x403008
mov dword [0x4200c4], 1
add esp, 0x14
pop esi
pop edi
ret
mov eax, str.TARGET_MACHINE
call fcn.0040aa00
mov eax, str.FIND_BASE
call fcn.0040aa00
mov eax, str.DESTDIR
call fcn.0040aa00
mov eax, str.INPUT
call fcn.0040aa00
mov eax, str.SRCDIR
call fcn.0040aa00
mov eax, str.ORIGDIR
call fcn.0040aa00
nop
nop
nop
nop
nop
nop
repz ret
Function at 0x409760
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.004097c0