joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b530
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x4ae918
or edi, 0xffffffff
push eax
mov dword [esp + 0x30], edi
call fcn.0043b0e0
lea ecx, [esp + 0x30]
mov esi, eax
push ecx
push esi
call fcn.0044f730
add esp, 0x10
test al, al
jne 0x43b5c0
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4ae91c
push 0x4ae944
mov byte [0x1cd46f3], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadPoints_____premature_end_of_file__n
push 0x4ae97c
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov eax, dword [esp + 0x28]
test eax, eax
jle 0x43b5d4
add eax, 0xa
push eax
call fcn.00435d10
add esp, 4
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
call fcn.0044f790
add esp, 0x10
test al, al
je 0x43b62a
mov edx, dword [esp + 0x2c]
fld qword [esp + 0x30]
push edx
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x4c]
fstp qword [esp]
call fcn.00436210
mov edi, eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x54]
push edx
push esi
call fcn.0044f790
add esp, 0x24
test al, al
jne 0x43b5f0
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
mov ecx, dword [ebp + 0xc]
add esp, 4
cmp edi, 0xffffffff
pop edi
setne al
pop esi
mov byte [ecx], al
mov byte [0x73b999], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b650
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x4ae98c
push eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x2c], 0
call fcn.0043b0e0
lea ecx, [esp + 0x2c]
mov edi, eax
push ecx
push edi
call fcn.0044f770
add esp, 0x10
test al, al
je 0x43b762
mov ebx, 1
jmp 0x43b6a0
cmp dword [esp + 0x24], ebx
jl 0x43b780
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x3c]
push eax
push edi
call fcn.0044f7f0
add esp, 0xc
test al, al
je 0x43b7da
mov ecx, dword [0x4a4dfc]
fld qword [esp + 0x30]
push ecx
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x4c]
fstp qword [esp]
call fcn.00436210
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
add esp, 0x14
cmp eax, ebx
jne 0x43b6f8
mov byte [0x73b999], bl
mov esi, ebx
cmp eax, ebx
jle 0x43b74c
mov edi, edi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
call fcn.0044f7c0
add esp, 0x10
test al, al
je 0x43b81b
mov edx, dword [esp + 0x2c]
fld qword [esp + 0x30]
push edx
sub esp, 0x10
fstp qword [esp + 8]
lea eax, [esp + 0x3c]
fld qword [esp + 0x4c]
fstp qword [esp]
push eax
call fcn.00436290
add esi, ebx
add esp, 0x18
cmp esi, dword [esp + 0x24]
jl 0x43b700
lea ecx, [esp + 0x24]
push ecx
push edi
call fcn.0044f770
add esp, 8
test al, al
jne 0x43b6a0
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [ebp + 0xc]
add esp, 4
cmp dword [esp + 0x24], 0
pop edi
setne dl
pop esi
mov byte [eax], dl
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4ae990
push 0x4ae9c4
mov byte [0x1cd46f3], bl
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadPolylines_____less_than_one_vertex_per_chain__n
push 0x4aea08
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4aea18
push 0x4aea44
mov byte [0x1cd46f3], bl
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4aea54
push 0x4aea80
jmp 0x43b7bf
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4aea90
push 0x4aeabc
mov byte [0x1cd46f3], bl
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadPolylines_____premature_end_of_file__n
push 0x4aeaf8
jmp 0x43b7bf
Function at 0x43bc80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, dword [ebp + 8]
sub esp, 0x34
push ebx
push esi
push edi
push 0x4aee94
push eax
xor esi, esi
call fcn.0043b0e0
mov ecx, dword [ebp + 0xc]
mov ebx, dword [sym.imp.MSVCR100.dll_fscanf]
lea edx, [esp + 0x38]
push edx
mov edi, eax
push 0x4aee98
mov byte [ecx], 0
push edi
mov byte [0x73b999], 0
call ebx
add esp, 0x14
cmp eax, 0xffffffff
je 0x43bd6c
fldz
fcomp qword [esp + 0x30]
fnstsw ax
test ah, 0x41
jne 0x43bcf1
test esi, esi
jle 0x43bced
cmp esi, 1
jne 0x43bce7
mov byte [0x73b999], 1
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
xor esi, esi
jmp 0x43bd53
lea ecx, [esp + 0x38]
push ecx
push 0x4aee9c
push edi
call ebx
add esp, 0xc
cmp eax, 0xffffffff
je 0x43bd7d
fld qword [esp + 0x38]
test esi, esi
jne 0x43bd31
mov edx, dword [0x4a4dfc]
push edx
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x44]
fstp qword [esp]
call fcn.00436210
add esp, 0x14
mov dword [esp + 0x2c], eax
jmp 0x43bd52
mov eax, dword [0x4a4e00]
push eax
sub esp, 0x10
fstp qword [esp + 8]
lea ecx, [esp + 0x40]
fld qword [esp + 0x44]
fstp qword [esp]
push ecx
call fcn.00436290
add esp, 0x18
inc esi
lea edx, [esp + 0x30]
push edx
push 0x4aee98
push edi
call ebx
add esp, 0xc
cmp eax, 0xffffffff
jne 0x43bcca
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4aeea0
push 0x4aeec8
mov byte [0x1cd46f3], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadUSGS_____premature_end_of_file__n
push 0x4aef00
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
int3

Function at 0x43bde0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov bl, byte [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.MSVCR100.dll_fscanf]
lea eax, [esp + 0xf]
push eax
push 0x4aef10
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
je 0x43be12
cmp byte [esp + 0xf], bl
jne 0x43bdf2
pop edi
pop esi
pop ebx
pop ecx
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4aef14
push 0x4aef3c
mov byte [0x1cd46f3], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4aef4c
push 0x4aef74
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x43be70
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.MSVCR100.dll_fscanf]
lea eax, [esp + 0xf]
push eax
push 0x4aef84
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x43beee
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4aef88
push 0x4aefb0
mov byte [0x1cd46f3], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4aefc0
push 0x4aefe8
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov al, byte [esp + 0xf]
cmp al, byte [esp + 0x18]
je 0x43bfce
mov bl, byte [esp + 0x1c]
cmp al, bl
je 0x43bfce
lea ecx, [esp + 0xf]
push ecx
push 0x4aeff8
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x43bf62
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4aeffc
push 0x4af024
mov byte [0x1cd46f3], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4af034
push 0x4af05c
jmp 0x43bed3
mov al, byte [esp + 0xf]
cmp al, byte [esp + 0x18]
je 0x43bfce
cmp al, bl
je 0x43bfce
lea edx, [esp + 0xf]
push edx
push 0x4af06c
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x43bfca
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4af070
push 0x4af098
mov byte [0x1cd46f3], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4af0a8
push 0x4af0d0
jmp 0x43bed3
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43e880
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x4afd3c
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
mov dword [0x73b99c], eax
test eax, eax
je 0x43e8be
mov esi, dword [sym.imp.MSVCR100.dll_fprintf]
push str.__0_nSECTION_n__2_nHEADER_n__0_nENDSEC_n
push eax
call esi
mov ecx, dword [0x73b99c]
push str.__0_nSECTION_n__2_nENTITIES_n
push ecx
call esi
add esp, 0x10
pop esi
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0x1cd46f3], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push str.DXF_output_file_could_not_be_opened__n
push 0x4afda8
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
int3

Function at 0x43e910
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x73b99c]
test eax, eax
je 0x43e93f
push str.__0_nENDSEC_n__0_nEOF_n
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
mov eax, dword [0x73b99c]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0xc
mov dword [0x73b99c], 0
ret
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0x1cd46f3], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push 0x4afdcc
push 0x4afdf4
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
pop esi
int3

Function at 0x43edd0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x73b99c]
push esi
test eax, eax
je 0x43ee2c
mov esi, dword [sym.imp.MSVCR100.dll_fprintf]
push str.__0_nPOLYLINE_n
push eax
call esi
add esp, 8
cmp byte [esp + 8], 0
je 0x43edff
mov eax, dword [0x73b99c]
push str._70_n__1_n
push eax
jmp 0x43ee0b
mov ecx, dword [0x73b99c]
push str._70_n__0_n
push ecx
call esi
mov eax, dword [esp + 0x14]
add esp, 8
test eax, eax
js 0x43ee2a
mov edx, dword [0x73b99c]
push eax
push str._62_n_3d_n
push edx
call esi
add esp, 0xc
pop esi
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0x1cd46f3], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push 0x4b0084
push 0x4b00ac
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
int3

Function at 0x43ee80
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x73b99c]
test eax, eax
je 0x43ee99
push str.__0_nSEQEND_n
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 8
ret
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0x1cd46f3], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push 0x4b00c8
push 0x4b00f0
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
pop esi
int3
Function at 0x43efa0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x73b99c]
push esi
test eax, eax
je 0x43f003
mov esi, dword [sym.imp.MSVCR100.dll_fprintf]
push str.__0_nVERTEX_n
push eax
call esi
fld qword [esp + 0x18]
mov eax, dword [0x73b99c]
fstp qword [esp]
fld qword [esp + 0x10]
sub esp, 8
fstp qword [esp]
push str._10_n_f_n_20_n_f_n_30_n0.0_n
push eax
call esi
fld qword [esp + 0x30]
fld st(0)
add esp, 0x18
fldz
fucompp
fnstsw ax
test ah, 0x44
jnp 0x43f04c
mov ecx, dword [0x73b99c]
sub esp, 8
fstp qword [esp]
push str._42_n_f_n
push ecx
call esi
add esp, 0x10
pop esi
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0x1cd46f3], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push str.DXF_output_file_not_properly_opened__n
push 0x4b01ac
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
fstp st(0)
pop esi
ret

Function at 0x43f4c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
test eax, eax
je 0x43f55c
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ecx, esi
imul ecx, edi
push ecx
push eax
call dword [sym.imp.MSVCR100.dll_realloc]
add esp, 8
test eax, eax
jne 0x43f5ca
push edi
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4b0294
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x40
push eax
call edi
add esp, 0x10
push 0x4b02d0
push 0x4b0304
mov byte [0x1cd46f3], 1
call esi
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReallocateArray_____memory_reallocation_failed__n
push 0x4b0348
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push esi
push edi
call dword [sym.imp.MSVCR100.dll_calloc]
add esp, 8
test eax, eax
jne 0x43f5ca
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
push str.ReallocateArray_____Cannot_get__d_elements_of__d_bytes..._n
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x40
push eax
call edi
add esp, 0x10
push 0x4b0394
push 0x4b03c4
mov byte [0x1cd46f3], 1
call esi
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReallocateArray_____memory_allocation_failed__n
push str._nerror_in__s_n
jmp 0x43f541
pop edi
pop esi
pop ebx
ret
Function at 0x456e50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.WNC_BUFFER_TOO_SMALL_OPTION
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x456e92
push str.crash
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x456e92
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 1
mov esp, ebp
pop ebp
ret

Function at 0x459e10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x4a56cc
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x459e35
call fcn.0045a570
jmp 0x459f1a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x459e53
mov eax, dword [ebp - 4]
jmp 0x459f1a
cmp dword [0x73bd30], 0
jne 0x459e61
call fcn.00459f20
push 0x4a56d0
mov edx, dword [0x73bd30]
push edx
call fcn.00458220
add esp, 8
mov word [ebp - 8], ax
movsx eax, word [ebp - 8]
test eax, eax
jge 0x459e88
xor eax, eax
jmp 0x459f1a
mov ecx, dword [ebp + 8]
push ecx
movzx edx, word [ebp - 8]
push edx
mov eax, dword [0x73bd30]
push eax
call fcn.004588e0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x459f17
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
jmp 0x459eb9
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x459ec5
jmp 0x459eb0
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
jmp 0x459ed9
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jb 0x459ef8
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
cmp eax, 0x20
jg 0x459ef8
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
jl 0x459ef8
jmp 0x459ed0
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x459f17
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov byte [ecx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x45aa90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0x4a56d4
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x45aad2
push str.WNCTMPDIR
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x45aad0
push str.from_environment_variable_WNCTMPDIR
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x45ab10
jmp 0x45aaf9
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x45aaf9
push str.from_environment
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x45ab10
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x73bd30]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00458190
add esp, 0xc
pop ebp
ret

Function at 0x45ab90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x4b3fa0]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x45abb0
xor eax, eax
jmp 0x45ace8
mov eax, dword [ebp + 8]
push eax
push 0x4a5720
lea ecx, [ebp - 0x190]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x190]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45abea
mov eax, dword [ebp - 4]
jmp 0x45ace8
cmp dword [0x73bd30], 0
jne 0x45abf8
call fcn.00459f20
push str.path
mov eax, dword [0x73bd30]
push eax
call fcn.00458220
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x45ac1e
xor eax, eax
jmp 0x45ace8
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0x73bd30]
push ecx
call fcn.004588e0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45ace5
mov edx, dword [ebp - 4]
mov dword [ebp - 0x194], edx
jmp 0x45ac5d
mov eax, dword [ebp - 0x194]
add eax, 1
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
movsx edx, byte [ecx]
test edx, edx
je 0x45ac6c
jmp 0x45ac4e
mov eax, dword [ebp - 0x194]
sub eax, 1
mov dword [ebp - 0x194], eax
jmp 0x45ac8c
mov ecx, dword [ebp - 0x194]
sub ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
cmp edx, dword [ebp - 4]
jb 0x45acb4
mov eax, dword [ebp - 0x194]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x45acb4
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
jl 0x45acb4
jmp 0x45ac7d
mov ecx, dword [ebp - 0x194]
add ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
je 0x45ace5
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x198]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00480dbe
mov esp, ebp
pop ebp
ret
Function at 0x45ad00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4b3fa0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str._sPATH
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x45ad51
lea eax, [ebp - 0x58]
push eax
push str.from_environment__s
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
xor eax, eax
jmp 0x45ad67
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x73bd30]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00458190
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00480dbe
mov esp, ebp
pop ebp
ret

Function at 0x45f7f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4b3fa0]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
push ecx
push 0x1ff
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00457370
push 0x2c
lea edx, [ebp - 0x208]
push edx
call fcn.004565d0
add esp, 8
test eax, eax
je 0x45f891
mov eax, dword [ebp + 0x10]
push eax
push 0x1ff
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00456290
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x45f891
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0xffffffd5
jne 0x45f88f
push 0x2c
lea eax, [ebp - 0x208]
push eax
call fcn.004565d0
add esp, 8
test eax, eax
jne 0x45f88f
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
jmp 0x45f891
jmp 0x45f8f2
lea edx, [ebp - 9]
mov dword [ebp - 4], edx
jmp 0x45f8a2
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x208]
cmp ecx, edx
jb 0x45f8c6
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x45f8c6
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
jl 0x45f8c6
jmp 0x45f899
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov byte [edx], 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
test eax, eax
je 0x45f8f2
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffeb
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00480dbe
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4602e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4602fb
xor eax, eax
jmp 0x460307
mov eax, dword [ebp - 4]
and eax, 0x10
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x4603f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll__mkdir]
add esp, 4
test eax, eax
je 0x460414
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 0xd
je 0x460414
or eax, 0xffffffff
jmp 0x460416
xor eax, eax
pop ebp
ret