joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447d80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
pop ebp
ret
Function at 0x449e10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.WNC_BUFFER_TOO_SMALL_OPTION
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x449e52
push str.crash
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR90.dll_strcmp
add esp, 8
test eax, eax
jne 0x449e52
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 1
mov esp, ebp
pop ebp
ret

Function at 0x44d8f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x467774
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR90.dll_strcmp
add esp, 8
test eax, eax
jne 0x44d915
call fcn.0044e050
jmp 0x44d9fa
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44d933
mov eax, dword [ebp - 4]
jmp 0x44d9fa
cmp dword [0x4c7b30], 0
jne 0x44d941
call fcn.0044da00
push 0x467778
mov edx, dword [0x4c7b30]
push edx
call fcn.0044c020
add esp, 8
mov word [ebp - 8], ax
movsx eax, word [ebp - 8]
test eax, eax
jge 0x44d968
xor eax, eax
jmp 0x44d9fa
mov ecx, dword [ebp + 8]
push ecx
movzx edx, word [ebp - 8]
push edx
mov eax, dword [0x4c7b30]
push eax
call fcn.0044c6e0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44d9f7
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
jmp 0x44d999
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x44d9a5
jmp 0x44d990
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
jmp 0x44d9b9
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jb 0x44d9d8
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
cmp eax, 0x20
jg 0x44d9d8
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
jl 0x44d9d8
jmp 0x44d9b0
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x44d9f7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov byte [ecx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x44e570
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0x46777c
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR90.dll_strcmp
add esp, 8
test eax, eax
jne 0x44e5b2
push str.WNCTMPDIR
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
test eax, eax
je 0x44e5b0
push str.from_environment_variable_WNCTMPDIR
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x44e5f0
jmp 0x44e5d9
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
test eax, eax
je 0x44e5d9
push str.from_environment
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x44e5f0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x4c7b30]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0044bf90
add esp, 0xc
pop ebp
ret

Function at 0x44e670
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x470530]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x44e690
xor eax, eax
jmp 0x44e7c8
mov eax, dword [ebp + 8]
push eax
push 0x4677c8
lea ecx, [ebp - 0x190]
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x190]
push edx
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44e6ca
mov eax, dword [ebp - 4]
jmp 0x44e7c8
cmp dword [0x4c7b30], 0
jne 0x44e6d8
call fcn.0044da00
push str.path
mov eax, dword [0x4c7b30]
push eax
call fcn.0044c020
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x44e6fe
xor eax, eax
jmp 0x44e7c8
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0x4c7b30]
push ecx
call fcn.0044c6e0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44e7c5
mov edx, dword [ebp - 4]
mov dword [ebp - 0x194], edx
jmp 0x44e73d
mov eax, dword [ebp - 0x194]
add eax, 1
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
movsx edx, byte [ecx]
test edx, edx
je 0x44e74c
jmp 0x44e72e
mov eax, dword [ebp - 0x194]
sub eax, 1
mov dword [ebp - 0x194], eax
jmp 0x44e76c
mov ecx, dword [ebp - 0x194]
sub ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
cmp edx, dword [ebp - 4]
jb 0x44e794
mov eax, dword [ebp - 0x194]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x44e794
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
jl 0x44e794
jmp 0x44e75d
mov ecx, dword [ebp - 0x194]
add ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
je 0x44e7c5
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x198]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004555a2
mov esp, ebp
pop ebp
ret
Function at 0x44e7e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x470530]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str._sPATH
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
test eax, eax
je 0x44e831
lea eax, [ebp - 0x58]
push eax
push str.from_environment__s
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
xor eax, eax
jmp 0x44e847
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x4c7b30]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044bf90
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004555a2
mov esp, ebp
pop ebp
ret

Function at 0x452980
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x470530]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
push ecx
push 0x1ff
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044a330
push 0x2c
lea edx, [ebp - 0x208]
push edx
call fcn.0044b210
add esp, 8
test eax, eax
je 0x452a21
mov eax, dword [ebp + 0x10]
push eax
push 0x1ff
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0044aed0
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x452a21
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0xffffffd5
jne 0x452a1f
push 0x2c
lea eax, [ebp - 0x208]
push eax
call fcn.0044b210
add esp, 8
test eax, eax
jne 0x452a1f
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
jmp 0x452a21
jmp 0x452a82
lea edx, [ebp - 9]
mov dword [ebp - 4], edx
jmp 0x452a32
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x208]
cmp ecx, edx
jb 0x452a56
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x452a56
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
jl 0x452a56
jmp 0x452a29
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov byte [edx], 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCR90.dll_remove]
add esp, 4
test eax, eax
je 0x452a82
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffeb
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004555a2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x452ae0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x470530]
xor eax, ebp
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00452c10
add esp, 8
cmp eax, 0xffffffff
je 0x452bdf
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR90.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
je 0x452bbe
push 0x101
lea eax, [ebp - 0x150]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR90.dll__read]
add esp, 0xc
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x452b94
lea edx, [ebp - 0x150]
push edx
call dword [sym.imp.MSVCR90.dll_atol]
add esp, 4
cmp dword [ebp + 0xc], eax
jne 0x452b70
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x452b92
cmp dword [0x4c7d48], 0
je 0x452b92
lea ecx, [ebp - 0x150]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._nverif_error_:_startpid___lu___lockpid___s_n_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 0xc
jmp 0x452baf
cmp dword [0x4c7d48], 0
je 0x452baf
mov eax, dword [ebp - 0x40]
push eax
push str._nread_error_:_nblu___d_n_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR90.dll__close]
add esp, 4
jmp 0x452bdd
cmp dword [0x4c7d48], 0
je 0x452bdd
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x3c]
push eax
push str._nopen_error_:_handle___d___nomfic___s_n_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 0xc
jmp 0x452bfa
cmp dword [0x4c7d48], 0
je 0x452bfa
mov ecx, dword [ebp + 8]
push ecx
push str._nstat_error_:_nomfic___s_n_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x44]
xor ecx, ebp
call fcn.004555a2
mov esp, ebp
pop ebp
ret
Function at 0x452c30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x470530]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
push 0x180
push 0x502
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR90.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x452cb2
mov ecx, dword [ebp - 4]
push ecx
push 0x467fb0
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call sub.MSVCR90.dll_strlen
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.MSVCR90.dll__write]
add esp, 0xc
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR90.dll__close]
add esp, 4
jmp 0x452d48
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 0x11
jne 0x452d41
push 0x100
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x452d3f
push 0x14
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x13
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.MSVCR90.dll__read]
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x452d1c
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR90.dll_atol]
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x452d23
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR90.dll__close]
add esp, 4
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
je 0x452d3f
mov dword [ebp - 0x28], 0xffffffff
jmp 0x452d48
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004555a2
mov esp, ebp
pop ebp
ret

Function at 0x453760
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.WNC_WNCFILES_VERBOSE
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x453799
push 0x468000
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR90.dll_strcmp
add esp, 8
test eax, eax
je 0x453799
mov eax, 1
jmp 0x45379b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x454260
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x45427b
xor eax, eax
jmp 0x454287
mov eax, dword [ebp - 4]
and eax, 0x10
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x454370
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR90.dll__mkdir]
add esp, 4
test eax, eax
je 0x454394
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 0xd
je 0x454394
or eax, 0xffffffff
jmp 0x454396
xor eax, eax
pop ebp
ret
Function at 0x454600
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x470530]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0x468054
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x454632
mov eax, dword [ebp - 4]
jmp 0x4547b9
push str.WNCHOME_LS
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x45477d
push 0x200
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x454671
xor eax, eax
jmp 0x4547b9
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x45468e
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4546b4
mov edx, dword [ebp - 0x21c]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x4546b2
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], 0x2f
jmp 0x45467f
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00453600
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4546d5
xor eax, eax
jmp 0x4547b9
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00453600
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x454705
xor eax, eax
jmp 0x4547b9
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00453600
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x454735
xor eax, eax
jmp 0x4547b9
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
push 0x468068
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 8
test eax, eax
jne 0x454770
push 0x46806c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 8
test eax, eax
je 0x454774
xor eax, eax
jmp 0x4547b9
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp + 8]
test edx, edx
je 0x4547b6
push str.WNCHOME
push 0x4c7d88
call sub.MSVCR90.dll_strcpy
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x4c7d88
call sub.MSVCR90.dll_strcat
add esp, 8
push 0x4c7d88
call dword [sym.imp.MSVCR90.dll__putenv]
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004555a2
mov esp, ebp
pop ebp
ret

Function at 0x4555a2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x470530]
jne 0x4555ac
repz ret
jmp fcn.00455a3e
Function at 0x4560b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x470530]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00421da0
test eax, eax
je 0x4560e3
call fcn.00421d00
push eax
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR90.dll_strcpy
add esp, 8
jmp 0x45612c
push str.WNCZONE
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x456116
push 0x468f0c
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCR90.dll_strcpy
add esp, 8
jmp 0x45612c
mov edx, dword [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR90.dll_strcpy
add esp, 8
push str..inf
push 0x468f18
push 0x5c
lea ecx, [ebp - 0x210]
push ecx
push 0x468f20
push 0x4c8de0
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x18
mov byte [0x4c8fe0], 0
push 0x468f2c
push 0x4c8de0
call dword [sym.imp.MSVCR90.dll_strcspn]
add esp, 8
mov byte [eax + 0x4c8de0], 0
push 0x201
push 0x4c8de0
call fcn.00455f40
add esp, 8
push str..lck
push str.zone
push 0x5c
lea edx, [ebp - 0x210]
push edx
push str._s_c_s_s
push 0x4c8fe8
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x18
mov byte [0x4c91e8], 0
push 0x468f4c
push 0x4c8fe8
call dword [sym.imp.MSVCR90.dll_strcspn]
add esp, 8
mov byte [eax + 0x4c8fe8], 0
push 0x201
push 0x4c8fe8
call fcn.00455f40
add esp, 8
cmp dword [0x4c91f4], 0
jne 0x4561fe
push 0x456060
call fcn.0045565d
add esp, 4
mov dword [0x4c91f4], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004555a2
mov esp, ebp
pop ebp
ret

Function at 0x45ab80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x4c9228]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR90.dll_strlen
add esp, 4
push eax
push 1
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR90.dll_strlen
add esp, 4
cmp esi, eax
je 0x45abda
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffe6
jmp 0x45ac10
mov dx, word [0x469028]
mov word [ebp - 8], dx
mov al, byte [0x46902a]
mov byte [ebp - 6], al
mov ecx, dword [ebp - 4]
push ecx
push 2
push 1
lea edx, [ebp - 8]
push edx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, 2
je 0x45ac10
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xffffffe6
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45ad00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x4c9228]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
push eax
push 1
push 1
lea ecx, [ebp - 5]
push ecx
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x45ad55
mov edx, dword [ebp + 0x14]
mov dword [edx], 0xffffffe7
mov byte [ebp - 5], 0
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
jmp 0x45ad69
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
mov dl, byte [ebp - 5]
mov byte [ecx], dl
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 1
cmp dword [ebp - 4], ecx
jge 0x45ad85
movsx edx, byte [ebp - 5]
cmp edx, 0xa
je 0x45ad85
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
je 0x45ad23
mov ecx, dword [ebp + 0x10]
sub ecx, 1
cmp dword [ebp - 4], ecx
jne 0x45ae00
movsx edx, byte [ebp - 5]
cmp edx, 0xa
je 0x45ae00
mov eax, dword [ebp + 0x14]
mov dword [eax], 0xffffffd6
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 1]
cmp edx, 0xa
je 0x45adbc
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0xa
jmp 0x45adc5
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0xd
je 0x45ade1
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0xa
jne 0x45adfb
cmp dword [ebp - 4], 0
jl 0x45adfb
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x45adc5
jmp 0x45ae97
mov edx, dword [ebp + 0x14]
cmp dword [edx], 0xffffffe7
je 0x45ae11
movsx eax, byte [ebp - 5]
cmp eax, 0xa
jne 0x45ae22
cmp dword [ebp - 4], 0
jne 0x45ae22
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0xffffffe9
jmp 0x45ae97
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0xd
je 0x45ae4e
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0xa
jne 0x45ae97
cmp dword [ebp - 4], 0
jl 0x45ae97
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0xa
jne 0x45ae83
cmp dword [ebp - 0x10], 0
jne 0x45ae81
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x45ae95
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x45ae32
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x406371
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40e86a
call fcn.0040d30f
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x4166e8]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x4064e2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4064e2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4064e2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x4064e2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x40645b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x4064d4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x4064d4
mov ecx, 0x1234
cmp cx, ax
jne 0x4064d4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x4064ae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x4063c9
mov eax, edi
call fcn.0040d2ca
ret 4

Function at 0x409413
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x409422
pop dword [ebp - 0x14]
mov eax, 0xd5aaebca
sub eax, 0xd56a57a8
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3a042
push 0
mov eax, 0x40f4ba8
add eax, 0xfc31a4e8
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xd0055fd1
sub ecx, 0xd0051128
mov edi, eax
mov edx, 0x41aa00
add edx, dword [ebp - 0x14]
mov esi, 0xe450abc2
xor dword [ebp - 0xc], 0x4085516b
mov ebx, dword [edx]
xor dword [ebp - 4], esi
sub ebx, esi
sub dword [ebp - 0xc], 0x7ed91d45
mov dword [edi], ebx
sub dword [ebp - 0xc], esi
add edi, 4
add edx, 4
loop 0x409475
add eax, 0x12d77
mov ebx, eax
add eax, 0x555d646e
add eax, 0xaaa29b97
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x408939
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
add eax, 0x8bdf79ac
dec esi
call fcn.0040896a
sub eax, eax
dec eax
xor dword [ecx], ebx
add eax, 0x9c389200
inc ecx
sub esi, 0xa1edc96c
or eax, esi
cmp ecx, edx
jne fcn.00408939
ret