joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100055da
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x100055e4
repz ret
jmp fcn.100061e3

Function at 0x1000b1b3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000635b
and dword [ebp - 4], 0
cmp dword [0x10014904], 0
mov ebx, eax
jne 0x1000b264
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000b315
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000b315
push eax
call fcn.100062e9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10014904], eax
call esi
push eax
call fcn.100062e9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10014908], eax
call esi
push eax
call fcn.100062e9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1001490c], eax
call esi
push eax
call fcn.100062e9
pop ecx
mov dword [0x10014914], eax
test eax, eax
je 0x1000b264
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100062e9
pop ecx
mov dword [0x10014910], eax
mov eax, dword [0x10014910]
cmp eax, ebx
je 0x1000b2bc
cmp dword [0x10014914], ebx
je 0x1000b2bc
push eax
call fcn.10006364
push dword [0x10014914]
mov esi, eax
call fcn.10006364
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000b2bc
test edi, edi
je 0x1000b2bc
call esi
test eax, eax
je 0x1000b2b3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000b2b3
test byte [ebp - 0xc], 1
jne 0x1000b2bc
or dword [ebp + 0x10], 0x200000
jmp 0x1000b2f5
mov eax, dword [0x10014908]
cmp eax, ebx
je 0x1000b2f5
push eax
call fcn.10006364
pop ecx
test eax, eax
je 0x1000b2f5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000b2f5
mov eax, dword [0x1001490c]
cmp eax, ebx
je 0x1000b2f5
push eax
call fcn.10006364
pop ecx
test eax, eax
je 0x1000b2f5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10014904]
call fcn.10006364
pop ecx
test eax, eax
je 0x1000b315
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000b317
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x441bf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
push str._Erreur_:__s
call dword [sym.imp.MSVCR100.dll___iob_func]
add eax, 0x20
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 0xc
push 1
call dword [sym.imp.MSVCR100.dll_exit]
pop ebp
ret
Function at 0x455ad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x191
mov eax, dword [ebp - 4]
sub eax, 1
cmp eax, 0x190
je 0x455b0f
push 0x190
mov ecx, dword [ebp - 4]
sub ecx, 1
push ecx
push str._RCSfile:_outilparutils.cxx_v__
push str.file__s_:_internal_error__size_mismatch:_._noutilpar.inc_size_d__dtbmax.inc_size_d_nAborting._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0x10
push 0xffffffffffffffff
call dword [sym.imp.MSVCR100.dll_exit]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x45b160
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
add eax, 1
push eax
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0xc], ecx
jle 0x45b189
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x20], edx
jmp 0x45b18f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCR100.dll_strncpy]
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
mov byte [edx], 0
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strlen
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x45b1e2
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x14]
movsx edx, byte [ecx - 1]
cmp edx, 0x20
jne 0x45b1e2
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
jmp 0x45b1c2
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x14]
mov byte [ecx], 0
mov edx, dword [ebp + 0x14]
add edx, 1
push edx
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 0x14], eax
jle 0x45b20e
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x24], ecx
jmp 0x45b214
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_strncpy]
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x18]
mov byte [ecx], 0
mov edx, dword [ebp - 0xc]
push edx
call sub.MSVCR100.dll_strlen
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x45b267
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x1c]
movsx ecx, byte [eax - 1]
cmp ecx, 0x20
jne 0x45b267
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x45b247
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x1c]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCR100.dll_rename]
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45b2c0
Capabilities:
Read file on windows
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45b2fe
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._Cannot_open_file__s_in_mode__s._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.MSVCR100.dll_exit]
mov dword [ebp - 4], pe_nt_image_headers32
push 0x4b5188
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x45b331
mov edx, dword [ebp - 8]
push edx
push 1
push 4
lea eax, [ebp - 4]
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
jmp 0x45b37a
push 0x4b518c
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x45b37a
mov edx, dword [ebp - 8]
push edx
push 1
push 4
lea eax, [ebp - 4]
push eax
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
cmp dword [ebp - 4], 0x100
jne 0x45b370
mov dword [0x63a010], 0
jmp 0x45b37a
mov dword [0x63a010], 1
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x461e40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.00461930
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x461e65
mov eax, 0xfffffff5
jmp 0x461f99
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x320]
and edx, 1
jne 0x461e7d
mov eax, 0xfffffff4
jmp 0x461f99
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
shr ecx, 2
and ecx, 1
je 0x461eab
mov edx, dword [ebp - 4]
push edx
call fcn.00462110
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x461eab
mov eax, dword [ebp - 8]
jmp 0x461f99
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 4]
cmp ecx, 1
je 0x461f1a
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.00461bc0
add esp, 4
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x461f1a
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2aa]
test edx, edx
jne 0x461f1a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
push 1
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0x316]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2d0
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2c4], 0
je 0x461f56
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c4]
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c4], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2cc], 0
je 0x461f82
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2cc]
push ecx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2cc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffe
mov edx, dword [ebp - 4]
mov dword [edx + 0x320], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4620e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
pop ebp
ret
Function at 0x464e90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.WNC_BUFFER_TOO_SMALL_OPTION
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x464ed2
push str.crash
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x464ed2
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 1
mov esp, ebp
pop ebp
ret

Function at 0x467230
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x4b5ad4
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x467255
call fcn.00467990
jmp 0x46733a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x467273
mov eax, dword [ebp - 4]
jmp 0x46733a
cmp dword [0x77aa08], 0
jne 0x467281
call fcn.00467340
push 0x4b5ad8
mov edx, dword [0x77aa08]
push edx
call fcn.00465640
add esp, 8
mov word [ebp - 8], ax
movsx eax, word [ebp - 8]
test eax, eax
jge 0x4672a8
xor eax, eax
jmp 0x46733a
mov ecx, dword [ebp + 8]
push ecx
movzx edx, word [ebp - 8]
push edx
mov eax, dword [0x77aa08]
push eax
call fcn.00465d00
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x467337
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
jmp 0x4672d9
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4672e5
jmp 0x4672d0
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
jmp 0x4672f9
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jb 0x467318
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
cmp eax, 0x20
jg 0x467318
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
jl 0x467318
jmp 0x4672f0
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x467337
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov byte [ecx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x467eb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0x4b5adc
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x467ef2
push str.WNCTMPDIR
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x467ef0
push str.from_environment_variable_WNCTMPDIR
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x467f30
jmp 0x467f19
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x467f19
push str.from_environment
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x467f30
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x77aa08]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004655b0
add esp, 0xc
pop ebp
ret

Function at 0x467fb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x4c2020]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x467fd0
xor eax, eax
jmp 0x468108
mov eax, dword [ebp + 8]
push eax
push 0x4b5b28
lea ecx, [ebp - 0x190]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x190]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46800a
mov eax, dword [ebp - 4]
jmp 0x468108
cmp dword [0x77aa08], 0
jne 0x468018
call fcn.00467340
push str.path
mov eax, dword [0x77aa08]
push eax
call fcn.00465640
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x46803e
xor eax, eax
jmp 0x468108
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0x77aa08]
push ecx
call fcn.00465d00
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x468105
mov edx, dword [ebp - 4]
mov dword [ebp - 0x194], edx
jmp 0x46807d
mov eax, dword [ebp - 0x194]
add eax, 1
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
movsx edx, byte [ecx]
test edx, edx
je 0x46808c
jmp 0x46806e
mov eax, dword [ebp - 0x194]
sub eax, 1
mov dword [ebp - 0x194], eax
jmp 0x4680ac
mov ecx, dword [ebp - 0x194]
sub ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
cmp edx, dword [ebp - 4]
jb 0x4680d4
mov eax, dword [ebp - 0x194]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x4680d4
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
jl 0x4680d4
jmp 0x46809d
mov ecx, dword [ebp - 0x194]
add ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
je 0x468105
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x198]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0047e6b0
mov esp, ebp
pop ebp
ret
Function at 0x468120
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4c2020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str._sPATH
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x468171
lea eax, [ebp - 0x58]
push eax
push str.from_environment__s
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
xor eax, eax
jmp 0x468187
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x77aa08]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004655b0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047e6b0
mov esp, ebp
pop ebp
ret

Function at 0x46d090
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4c2020]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
push ecx
push 0x1ff
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004653b0
push 0x2c
lea edx, [ebp - 0x208]
push edx
call fcn.004639f0
add esp, 8
test eax, eax
je 0x46d131
mov eax, dword [ebp + 0x10]
push eax
push 0x1ff
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004636b0
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x46d131
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0xffffffd5
jne 0x46d12f
push 0x2c
lea eax, [ebp - 0x208]
push eax
call fcn.004639f0
add esp, 8
test eax, eax
jne 0x46d12f
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
jmp 0x46d131
jmp 0x46d192
lea edx, [ebp - 9]
mov dword [ebp - 4], edx
jmp 0x46d142
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x208]
cmp ecx, edx
jb 0x46d166
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x46d166
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
jl 0x46d166
jmp 0x46d139
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov byte [edx], 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
test eax, eax
je 0x46d192
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffeb
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0047e6b0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46db80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x46db9b
xor eax, eax
jmp 0x46dba7
mov eax, dword [ebp - 4]
and eax, 0x10
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x46dc90
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll__mkdir]
add esp, 4
test eax, eax
je 0x46dcb4
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 0xd
je 0x46dcb4
or eax, 0xffffffff
jmp 0x46dcb6
xor eax, eax
pop ebp
ret
Function at 0x46df40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4c2020]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0x4b6310
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46df72
mov eax, dword [ebp - 4]
jmp 0x46e0f9
push str.WNCHOME_LS
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x46e0bd
push 0x200
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x46dfb1
xor eax, eax
jmp 0x46e0f9
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x46dfce
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x46dff4
mov edx, dword [ebp - 0x21c]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x46dff2
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], 0x2f
jmp 0x46dfbf
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.0046e110
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46e015
xor eax, eax
jmp 0x46e0f9
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.0046e110
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46e045
xor eax, eax
jmp 0x46e0f9
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.0046e110
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x46e075
xor eax, eax
jmp 0x46e0f9
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
push 0x4b6324
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
jne 0x46e0b0
push 0x4b6328
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x46e0b4
xor eax, eax
jmp 0x46e0f9
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp + 8]
test edx, edx
je 0x46e0f6
push str.WNCHOME
push 0x77ca78
call sub.MSVCR100.dll_strcpy
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x77ca78
call sub.MSVCR100.dll_strcat
add esp, 8
push 0x77ca78
call dword [sym.imp.MSVCR100.dll__putenv]
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0047e6b0
mov esp, ebp
pop ebp
ret

Function at 0x46e270
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.WNC_WNCFILES_VERBOSE
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46e2a9
push 0x4b6350
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
je 0x46e2a9
mov eax, 1
jmp 0x46e2ab
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x47e6b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c2020]
jne 0x47e6ba
repz ret
jmp fcn.0047ecde
Function at 0x487b00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4c2020]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0048cb80
test eax, eax
je 0x487b33
call fcn.0048cae0
push eax
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x487b7c
push 0x4b7a54
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x487b66
push 0x4b7a5c
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x487b7c
mov edx, dword [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
push 0x4b7a60
push 0x4b7a68
push 0x5c
lea ecx, [ebp - 0x210]
push ecx
push 0x4b7a70
push 0x7e3e88
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov byte [0x7e4088], 0
push 0x4b7a7c
push 0x7e3e88
call dword [sym.imp.MSVCR100.dll_strcspn]
add esp, 8
mov byte [eax + 0x7e3e88], 0
push 0x201
push 0x7e3e88
call fcn.00487990
add esp, 8
push 0x4b7a80
push str.zone
push 0x5c
lea edx, [ebp - 0x210]
push edx
push str._s_c_s_s
push 0x7e4090
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov byte [0x7e4290], 0
push 0x4b7a9c
push 0x7e4090
call dword [sym.imp.MSVCR100.dll_strcspn]
add esp, 8
mov byte [eax + 0x7e4090], 0
push 0x201
push 0x7e4090
call fcn.00487990
add esp, 8
cmp dword [0x7e429c], 0
jne 0x487c4e
push 0x487ab0
call fcn.0047ec57
add esp, 4
mov dword [0x7e429c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047e6b0
mov esp, ebp
pop ebp
ret

Function at 0x48c560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4c2020]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x7e9734], 0
je 0x48c5c6
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s___d__:__d_n
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
mov ecx, dword [0x7e9730]
push ecx
lea edx, [ebp - 0x408]
push edx
call sub.MSVCR100.dll_strlen
add esp, 4
push eax
push 1
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047e6b0
mov esp, ebp
pop ebp
ret

Function at 0x48cae0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x4b7cb0
cmp dword [0x7e526c], 0
je 0x48caff
mov eax, 0x7e5270
jmp 0x48cb20
push 0x4b7cb4
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x48cb1d
mov eax, dword [ebp - 8]
jmp 0x48cb20
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret