joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417ac0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x44dd70]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0041cb40
test eax, eax
je 0x417af3
call fcn.0041caa0
push eax
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR90.dll_strcpy
add esp, 8
jmp 0x417b3c
push 0x443c1c
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x417b26
push 0x443c24
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCR90.dll_strcpy
add esp, 8
jmp 0x417b3c
mov edx, dword [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR90.dll_strcpy
add esp, 8
push 0x443c28
push 0x443c30
push 0x5c
lea ecx, [ebp - 0x210]
push ecx
push 0x443c38
push 0x44e070
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x18
mov byte [0x44e270], 0
push 0x443c44
push 0x44e070
call dword [sym.imp.MSVCR90.dll_strcspn]
add esp, 8
mov byte [eax + 0x44e070], 0
push 0x201
push 0x44e070
call fcn.00417950
add esp, 8
push 0x443c48
push str.zone
push 0x5c
lea edx, [ebp - 0x210]
push edx
push str._s_c_s_s
push 0x44e278
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x18
mov byte [0x44e478], 0
push 0x443c64
push 0x44e278
call dword [sym.imp.MSVCR90.dll_strcspn]
add esp, 8
mov byte [eax + 0x44e278], 0
push 0x201
push 0x44e278
call fcn.00417950
add esp, 8
cmp dword [0x44e484], 0
jne 0x417c0e
push 0x417a70
call fcn.0043d0d0
add esp, 4
mov dword [0x44e484], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043cde0
mov esp, ebp
pop ebp
ret

Function at 0x41c530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x44dd70]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x45391c], 0
je 0x41c596
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s___d__:__d_n
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x14
mov ecx, dword [0x453918]
push ecx
lea edx, [ebp - 0x408]
push edx
call sub.MSVCR90.dll_strlen
add esp, 4
push eax
push 1
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043cde0
mov esp, ebp
pop ebp
ret

Function at 0x41caa0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x443e78
cmp dword [0x44f454], 0
je 0x41cabf
mov eax, 0x44f458
jmp 0x41cae0
push 0x443e7c
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41cadd
mov eax, dword [ebp - 8]
jmp 0x41cae0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x41cb50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x44f454], 0
je 0x41cb71
push 0x44f458
push 0x4536e0
call sub.MSVCR90.dll_strcpy
add esp, 8
jmp 0x41cbad
push str.WNCZONE
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41cb9c
push 0x443e98
push 0x4536e0
call sub.MSVCR90.dll_strcpy
add esp, 8
jmp 0x41cbad
mov eax, dword [ebp - 4]
push eax
push 0x4536e0
call sub.MSVCR90.dll_strcpy
add esp, 8
push 0x443e9c
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043cbf0
add esp, 8
push eax
push 0x5c
push 0x4536e0
push 0x443ea4
push 0x4534d8
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x14
push 0x201
push 0x4534d8
call fcn.004323f0
add esp, 8
cmp dword [0x4538ec], 0
jne 0x41cc0b
push 0x41ca40
call fcn.0043d0d0
add esp, 4
mov dword [0x4538ec], 1
mov esp, ebp
pop ebp
ret
Function at 0x42c6b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x191
mov eax, dword [ebp - 4]
sub eax, 1
cmp eax, 0x190
je 0x42c6ef
push 0x190
mov ecx, dword [ebp - 4]
sub ecx, 1
push ecx
push str._RCSfile:_outilparutils.cxx_v__
push str.file__s_:_internal_error__size_mismatch:_._noutilpar.inc_size_d__dtbmax.inc_size_d_nAborting._n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 0x10
push 0xffffffffffffffff
call dword [sym.imp.MSVCR90.dll_exit]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42e1b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.0042dd10
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42e1d5
mov eax, 0xfffffff5
jmp 0x42e309
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x320]
and edx, 1
jne 0x42e1ed
mov eax, 0xfffffff4
jmp 0x42e309
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
shr ecx, 2
and ecx, 1
je 0x42e21b
mov edx, dword [ebp - 4]
push edx
call fcn.0042ff40
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42e21b
mov eax, dword [ebp - 8]
jmp 0x42e309
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 4]
cmp ecx, 1
je 0x42e28a
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042df30
add esp, 4
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x42e28a
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2aa]
test edx, edx
jne 0x42e28a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
push 1
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0x316]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2d0
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2c4], 0
je 0x42e2c6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c4]
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c4], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2cc], 0
je 0x42e2f2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2cc]
push ecx
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2cc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffe
mov edx, dword [ebp - 4]
mov dword [edx + 0x320], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42f060
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffd
mov edx, dword [ebp + 8]
mov dword [edx + 0x320], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [str.WKNC_Id:_fbread.cpp_7003_2011_05_16_16:32:53Z_jsturton___WORKNC]
mov dword [eax + 0x210], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x214], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x21c], 0xa0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x218], 0xa0
mov edx, dword [ebp + 8]
mov dword [edx + 0x220], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x224], 0
call fcn.0042dba0
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x228
push ecx
call sub.MSVCR90.dll_strcpy
add esp, 8
mov edx, dword [ebp + 8]
mov byte [edx + 0x2a8], 1
mov eax, dword [ebp + 8]
mov byte [eax + 0x2a9], 1
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2aa], 1
mov edx, dword [ebp + 8]
mov byte [edx + 0x2ac], 0
call fcn.0042db30
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2ab], al
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
push 0xa0
push 1
mov ecx, dword [ebp + 8]
add ecx, 0x210
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, 0xa0
je 0x42f14b
mov eax, 0xffffffe6
jmp 0x42f14d
xor eax, eax
pop ebp
ret

Function at 0x42f150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
pop ebp
ret
Function at 0x42ff10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
pop ebp
ret
Function at 0x431fa0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.WNC_BUFFER_TOO_SMALL_OPTION
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x431fe2
push str.crash
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR90.dll_strcmp
add esp, 8
test eax, eax
jne 0x431fe2
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 1
mov esp, ebp
pop ebp
ret

Function at 0x435a60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x448a2c
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR90.dll_strcmp
add esp, 8
test eax, eax
jne 0x435a85
call fcn.004361c0
jmp 0x435b6a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x435aa3
mov eax, dword [ebp - 4]
jmp 0x435b6a
cmp dword [0x454830], 0
jne 0x435ab1
call fcn.00435b70
push 0x448a30
mov edx, dword [0x454830]
push edx
call fcn.00433570
add esp, 8
mov word [ebp - 8], ax
movsx eax, word [ebp - 8]
test eax, eax
jge 0x435ad8
xor eax, eax
jmp 0x435b6a
mov ecx, dword [ebp + 8]
push ecx
movzx edx, word [ebp - 8]
push edx
mov eax, dword [0x454830]
push eax
call fcn.00433c30
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x435b67
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
jmp 0x435b09
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x435b15
jmp 0x435b00
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
jmp 0x435b29
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jb 0x435b48
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
cmp eax, 0x20
jg 0x435b48
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
jl 0x435b48
jmp 0x435b20
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x435b67
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov byte [ecx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4366e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0x448a34
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR90.dll_strcmp
add esp, 8
test eax, eax
jne 0x436722
push str.WNCTMPDIR
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
test eax, eax
je 0x436720
push str.from_environment_variable_WNCTMPDIR
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x436760
jmp 0x436749
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
test eax, eax
je 0x436749
push str.from_environment
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x436760
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x454830]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004334e0
add esp, 0xc
pop ebp
ret

Function at 0x4367e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x44dd70]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x436800
xor eax, eax
jmp 0x436938
mov eax, dword [ebp + 8]
push eax
push 0x448a80
lea ecx, [ebp - 0x190]
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x190]
push edx
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43683a
mov eax, dword [ebp - 4]
jmp 0x436938
cmp dword [0x454830], 0
jne 0x436848
call fcn.00435b70
push str.path
mov eax, dword [0x454830]
push eax
call fcn.00433570
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x43686e
xor eax, eax
jmp 0x436938
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0x454830]
push ecx
call fcn.00433c30
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x436935
mov edx, dword [ebp - 4]
mov dword [ebp - 0x194], edx
jmp 0x4368ad
mov eax, dword [ebp - 0x194]
add eax, 1
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
movsx edx, byte [ecx]
test edx, edx
je 0x4368bc
jmp 0x43689e
mov eax, dword [ebp - 0x194]
sub eax, 1
mov dword [ebp - 0x194], eax
jmp 0x4368dc
mov ecx, dword [ebp - 0x194]
sub ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
cmp edx, dword [ebp - 4]
jb 0x436904
mov eax, dword [ebp - 0x194]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x436904
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
jl 0x436904
jmp 0x4368cd
mov ecx, dword [ebp - 0x194]
add ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
je 0x436935
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x198]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0043cde0
mov esp, ebp
pop ebp
ret
Function at 0x436950
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x44dd70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str._sPATH
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
test eax, eax
je 0x4369a1
lea eax, [ebp - 0x58]
push eax
push str.from_environment__s
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
xor eax, eax
jmp 0x4369b7
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x454830]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004334e0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043cde0
mov esp, ebp
pop ebp
ret

Function at 0x43a560
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x44dd70]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
push ecx
push 0x1ff
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004324c0
push 0x2c
lea edx, [ebp - 0x208]
push edx
call fcn.0042cfc0
add esp, 8
test eax, eax
je 0x43a601
mov eax, dword [ebp + 0x10]
push eax
push 0x1ff
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00433060
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x43a601
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0xffffffd5
jne 0x43a5ff
push 0x2c
lea eax, [ebp - 0x208]
push eax
call fcn.0042cfc0
add esp, 8
test eax, eax
jne 0x43a5ff
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
jmp 0x43a601
jmp 0x43a662
lea edx, [ebp - 9]
mov dword [ebp - 4], edx
jmp 0x43a612
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x208]
cmp ecx, edx
jb 0x43a636
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x43a636
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
jl 0x43a636
jmp 0x43a609
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov byte [edx], 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCR90.dll_remove]
add esp, 4
test eax, eax
je 0x43a662
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffeb
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043cde0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43a6c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x44dd70]
xor eax, ebp
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043a7f0
add esp, 8
cmp eax, 0xffffffff
je 0x43a7bf
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR90.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
je 0x43a79e
push 0x101
lea eax, [ebp - 0x150]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR90.dll__read]
add esp, 0xc
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x43a774
lea edx, [ebp - 0x150]
push edx
call dword [sym.imp.MSVCR90.dll_atol]
add esp, 4
cmp dword [ebp + 0xc], eax
jne 0x43a750
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x43a772
cmp dword [0x454a48], 0
je 0x43a772
lea ecx, [ebp - 0x150]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._nverif_error_:_startpid___lu___lockpid___s_n_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 0xc
jmp 0x43a78f
cmp dword [0x454a48], 0
je 0x43a78f
mov eax, dword [ebp - 0x40]
push eax
push str._nread_error_:_nblu___d_n_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR90.dll__close]
add esp, 4
jmp 0x43a7bd
cmp dword [0x454a48], 0
je 0x43a7bd
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x3c]
push eax
push str._nopen_error_:_handle___d___nomfic___s_n_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 0xc
jmp 0x43a7da
cmp dword [0x454a48], 0
je 0x43a7da
mov ecx, dword [ebp + 8]
push ecx
push str._nstat_error_:_nomfic___s_n_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x44]
xor ecx, ebp
call fcn.0043cde0
mov esp, ebp
pop ebp
ret
Function at 0x43a810
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x44dd70]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
push 0x180
push 0x502
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR90.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x43a892
mov ecx, dword [ebp - 4]
push ecx
push 0x449268
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call sub.MSVCR90.dll_strlen
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.MSVCR90.dll__write]
add esp, 0xc
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR90.dll__close]
add esp, 4
jmp 0x43a928
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 0x11
jne 0x43a921
push pe_nt_image_headers32
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x43a91f
push 0x14
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x13
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.MSVCR90.dll__read]
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x43a8fc
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR90.dll_atol]
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x43a903
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR90.dll__close]
add esp, 4
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
je 0x43a91f
mov dword [ebp - 0x28], 0xffffffff
jmp 0x43a928
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043cde0
mov esp, ebp
pop ebp
ret

Function at 0x43b340
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.WNC_WNCFILES_VERBOSE
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43b379
push 0x4492b8
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR90.dll_strcmp
add esp, 8
test eax, eax
je 0x43b379
mov eax, 1
jmp 0x43b37b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x43be40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x43be5b
xor eax, eax
jmp 0x43be67
mov eax, dword [ebp - 4]
and eax, 0x10
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x43bf50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR90.dll__mkdir]
add esp, 4
test eax, eax
je 0x43bf74
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 0xd
je 0x43bf74
or eax, 0xffffffff
jmp 0x43bf76
xor eax, eax
pop ebp
ret
Function at 0x43c1e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x44dd70]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0x44930c
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43c212
mov eax, dword [ebp - 4]
jmp 0x43c399
push str.WNCHOME_LS
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43c35d
push 0x200
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x43c251
xor eax, eax
jmp 0x43c399
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x43c26e
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x43c294
mov edx, dword [ebp - 0x21c]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x43c292
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], 0x2f
jmp 0x43c25f
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.0043b1e0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43c2b5
xor eax, eax
jmp 0x43c399
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.0043b1e0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43c2e5
xor eax, eax
jmp 0x43c399
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.0043b1e0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43c315
xor eax, eax
jmp 0x43c399
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
push 0x449320
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 8
test eax, eax
jne 0x43c350
push 0x449324
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 8
test eax, eax
je 0x43c354
xor eax, eax
jmp 0x43c399
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp + 8]
test edx, edx
je 0x43c396
push str.WNCHOME
push 0x454a88
call sub.MSVCR90.dll_strcpy
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x454a88
call sub.MSVCR90.dll_strcat
add esp, 8
push 0x454a88
call dword [sym.imp.MSVCR90.dll__putenv]
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0043cde0
mov esp, ebp
pop ebp
ret

Function at 0x43cde0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44dd70]
jne 0x43cdea
repz ret
jmp fcn.0043d428
Function at 0x43dae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x4554b0]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR90.dll_strlen
add esp, 4
push eax
push 1
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR90.dll_strlen
add esp, 4
cmp esi, eax
je 0x43db3a
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffe6
jmp 0x43db70
mov dx, word [0x449620]
mov word [ebp - 8], dx
mov al, byte [0x449622]
mov byte [ebp - 6], al
mov ecx, dword [ebp - 4]
push ecx
push 2
push 1
lea edx, [ebp - 8]
push edx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, 2
je 0x43db70
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xffffffe6
pop esi
mov esp, ebp
pop ebp
ret