joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e800
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, dword [ebp + 8]
sub esp, 0x34
push ebx
push esi
push edi
push 0x4911d0
push eax
xor esi, esi
call fcn.0045dc60
mov ecx, dword [ebp + 0xc]
mov ebx, dword [sym.imp.MSVCR90.dll_fscanf]
lea edx, [esp + 0x38]
push edx
mov edi, eax
push 0x4911d4
mov byte [ecx], 0
push edi
mov byte [0x49a19c], 0
call ebx
add esp, 0x14
cmp eax, 0xffffffff
je 0x45e8ec
fldz
fcomp qword [esp + 0x30]
fnstsw ax
test ah, 0x41
jne 0x45e871
test esi, esi
jle 0x45e86d
cmp esi, 1
jne 0x45e867
mov byte [0x49a19c], 1
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
xor esi, esi
jmp 0x45e8d3
lea ecx, [esp + 0x38]
push ecx
push 0x4911d8
push edi
call ebx
add esp, 0xc
cmp eax, 0xffffffff
je 0x45e8fd
fld qword [esp + 0x38]
test esi, esi
jne 0x45e8b1
mov edx, dword [0x48b3c0]
push edx
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x44]
fstp qword [esp]
call fcn.0045b100
add esp, 0x14
mov dword [esp + 0x2c], eax
jmp 0x45e8d2
mov eax, dword [0x48b3c4]
push eax
sub esp, 0x10
fstp qword [esp + 8]
lea ecx, [esp + 0x40]
fld qword [esp + 0x44]
fstp qword [esp]
push ecx
call fcn.0045b180
add esp, 0x18
inc esi
lea edx, [esp + 0x30]
push edx
push 0x4911d4
push edi
call ebx
add esp, 0xc
cmp eax, 0xffffffff
jne 0x45e84a
push edi
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push 0x4911dc
push 0x491204
mov byte [0x49a922], 1
call esi
mov edi, dword [sym.imp.MSVCR90.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR90.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadUSGS_____premature_end_of_file__n
push 0x49123c
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR90.dll_exit]
int3

Function at 0x45e960
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov bl, byte [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.MSVCR90.dll_fscanf]
lea eax, [esp + 0xf]
push eax
push 0x49124c
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
je 0x45e992
cmp byte [esp + 0xf], bl
jne 0x45e972
pop edi
pop esi
pop ebx
pop ecx
ret
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push 0x491250
push 0x491278
mov byte [0x49a922], 1
call esi
mov edi, dword [sym.imp.MSVCR90.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR90.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x491288
push 0x4912b0
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR90.dll_exit]
int3
Function at 0x45e9f0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.MSVCR90.dll_fscanf]
lea eax, [esp + 0xf]
push eax
push 0x4912c0
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x45ea6e
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push 0x4912c4
push 0x4912ec
mov byte [0x49a922], 1
call esi
mov edi, dword [sym.imp.MSVCR90.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR90.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4912fc
push 0x491324
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR90.dll_exit]
mov al, byte [esp + 0xf]
cmp al, byte [esp + 0x18]
je 0x45eb4e
mov bl, byte [esp + 0x1c]
cmp al, bl
je 0x45eb4e
lea ecx, [esp + 0xf]
push ecx
push 0x491334
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x45eae2
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push 0x491338
push 0x491360
mov byte [0x49a922], 1
call esi
mov edi, dword [sym.imp.MSVCR90.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR90.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x491370
push 0x491398
jmp 0x45ea53
mov al, byte [esp + 0xf]
cmp al, byte [esp + 0x18]
je 0x45eb4e
cmp al, bl
je 0x45eb4e
lea edx, [esp + 0xf]
push edx
push 0x4913a8
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x45eb4a
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push 0x4913ac
push 0x4913d4
mov byte [0x49a922], 1
call esi
mov edi, dword [sym.imp.MSVCR90.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR90.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4913e4
push 0x49140c
jmp 0x45ea53
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x461290
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x492078
push eax
call dword [sym.imp.MSVCR90.dll_fopen]
add esp, 8
mov dword [0x49a1a0], eax
test eax, eax
je 0x4612ce
mov esi, dword [sym.imp.MSVCR90.dll_fprintf]
push str.__0_nSECTION_n__2_nHEADER_n__0_nENDSEC_n
push eax
call esi
mov ecx, dword [0x49a1a0]
push str.__0_nSECTION_n__2_nENTITIES_n
push ecx
call esi
add esp, 0x10
pop esi
ret
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push edi
mov byte [0x49a922], 1
call esi
mov edi, dword [sym.imp.MSVCR90.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push str.DXF_output_file_could_not_be_opened__n
push 0x4920e4
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR90.dll_exit]
pop edi
int3

Function at 0x461320
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x49a1a0]
test eax, eax
je 0x46134f
push str.__0_nENDSEC_n__0_nEOF_n
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
mov eax, dword [0x49a1a0]
push eax
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 0xc
mov dword [0x49a1a0], 0
ret
push esi
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push edi
mov byte [0x49a922], 1
call esi
mov edi, dword [sym.imp.MSVCR90.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push 0x492108
push 0x492130
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR90.dll_exit]
pop edi
pop esi
int3

Function at 0x4617e0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x49a1a0]
push esi
test eax, eax
je 0x46183c
mov esi, dword [sym.imp.MSVCR90.dll_fprintf]
push str.__0_nPOLYLINE_n
push eax
call esi
add esp, 8
cmp byte [esp + 8], 0
je 0x46180f
mov eax, dword [0x49a1a0]
push str._70_n__1_n
push eax
jmp 0x46181b
mov ecx, dword [0x49a1a0]
push str._70_n__0_n
push ecx
call esi
mov eax, dword [esp + 0x14]
add esp, 8
test eax, eax
jl 0x46183a
mov edx, dword [0x49a1a0]
push eax
push str._62_n_3d_n
push edx
call esi
add esp, 0xc
pop esi
ret
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push edi
mov byte [0x49a922], 1
call esi
mov edi, dword [sym.imp.MSVCR90.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push 0x4923c0
push 0x4923e8
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR90.dll_exit]
pop edi
int3

Function at 0x461890
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x49a1a0]
test eax, eax
je 0x4618a9
push str.__0_nSEQEND_n
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 8
ret
push esi
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push edi
mov byte [0x49a922], 1
call esi
mov edi, dword [sym.imp.MSVCR90.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push 0x492404
push 0x49242c
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR90.dll_exit]
pop edi
pop esi
int3
Function at 0x4619b0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x49a1a0]
push esi
test eax, eax
je 0x461a13
mov esi, dword [sym.imp.MSVCR90.dll_fprintf]
push str.__0_nVERTEX_n
push eax
call esi
fld qword [esp + 0x18]
mov eax, dword [0x49a1a0]
fstp qword [esp]
fld qword [esp + 0x10]
sub esp, 8
fstp qword [esp]
push str._10_n_f_n_20_n_f_n_30_n0.0_n
push eax
call esi
fldz
fld qword [esp + 0x30]
add esp, 0x18
fucom st(1)
fnstsw ax
fstp st(1)
test ah, 0x44
jnp 0x461a5c
mov ecx, dword [0x49a1a0]
sub esp, 8
fstp qword [esp]
push str._42_n_f_n
push ecx
call esi
add esp, 0x10
pop esi
ret
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push edi
mov byte [0x49a922], 1
call esi
mov edi, dword [sym.imp.MSVCR90.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push str.DXF_output_file_not_properly_opened__n
push 0x4924e8
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR90.dll_exit]
pop edi
fstp st(0)
pop esi
ret

Function at 0x461ed0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
test eax, eax
je 0x461f6c
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ecx, esi
imul ecx, edi
push ecx
push eax
call dword [sym.imp.MSVCR90.dll_realloc]
add esp, 8
test eax, eax
jne 0x461fda
push edi
push esi
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push 0x4925d0
call esi
mov edi, dword [sym.imp.MSVCR90.dll_fprintf]
add eax, 0x40
push eax
call edi
add esp, 0x10
push 0x49260c
push 0x492640
mov byte [0x49a922], 1
call esi
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR90.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReallocateArray_____memory_reallocation_failed__n
push 0x492684
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR90.dll_exit]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push esi
push edi
call dword [sym.imp.MSVCR90.dll_calloc]
add esp, 8
test eax, eax
jne 0x461fda
push esi
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push edi
push str.ReallocateArray_____Cannot_get__d_elements_of__d_bytes..._n
call esi
mov edi, dword [sym.imp.MSVCR90.dll_fprintf]
add eax, 0x40
push eax
call edi
add esp, 0x10
push 0x4926d0
push 0x492700
mov byte [0x49a922], 1
call esi
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR90.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReallocateArray_____memory_allocation_failed__n
push str._nerror_in__s_n
jmp 0x461f51
pop edi
pop esi
pop ebx
ret
Function at 0x476f80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.00476ae0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x476fa5
mov eax, 0xfffffff5
jmp 0x4770d9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x320]
and edx, 1
jne 0x476fbd
mov eax, 0xfffffff4
jmp 0x4770d9
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
shr ecx, 2
and ecx, 1
je 0x476feb
mov edx, dword [ebp - 4]
push edx
call fcn.00478d10
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x476feb
mov eax, dword [ebp - 8]
jmp 0x4770d9
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 4]
cmp ecx, 1
je 0x47705a
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.00476d00
add esp, 4
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x47705a
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2aa]
test edx, edx
jne 0x47705a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
push 1
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0x316]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2d0
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2c4], 0
je 0x477096
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c4]
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c4], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2cc], 0
je 0x4770c2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2cc]
push ecx
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2cc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffe
mov edx, dword [ebp - 4]
mov dword [edx + 0x320], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x477e30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffd
mov edx, dword [ebp + 8]
mov dword [edx + 0x320], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [str.WKNC_Id:_fbread.cpp_7003_2011_05_16_16:32:53Z_jsturton___WORKNC]
mov dword [eax + 0x210], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x214], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x21c], 0xa0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x218], 0xa0
mov edx, dword [ebp + 8]
mov dword [edx + 0x220], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x224], 0
call fcn.00476970
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x228
push ecx
call sub.MSVCR90.dll_strcpy
add esp, 8
mov edx, dword [ebp + 8]
mov byte [edx + 0x2a8], 1
mov eax, dword [ebp + 8]
mov byte [eax + 0x2a9], 1
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2aa], 1
mov edx, dword [ebp + 8]
mov byte [edx + 0x2ac], 0
call fcn.00476900
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2ab], al
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
push 0xa0
push 1
mov ecx, dword [ebp + 8]
add ecx, 0x210
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, 0xa0
je 0x477f1b
mov eax, 0xffffffe6
jmp 0x477f1d
xor eax, eax
pop ebp
ret

Function at 0x477f20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
pop ebp
ret
Function at 0x478ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
pop ebp
ret
Function at 0x47a550
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x48f400]
xor eax, ebp
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0047a680
add esp, 8
cmp eax, 0xffffffff
je 0x47a64f
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR90.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
je 0x47a62e
push 0x101
lea eax, [ebp - 0x150]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR90.dll__read]
add esp, 0xc
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x47a604
lea edx, [ebp - 0x150]
push edx
call dword [sym.imp.MSVCR90.dll_atol]
add esp, 4
cmp dword [ebp + 0xc], eax
jne 0x47a5e0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x47a602
cmp dword [0x49a3b0], 0
je 0x47a602
lea ecx, [ebp - 0x150]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._nverif_error_:_startpid___lu___lockpid___s_n_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 0xc
jmp 0x47a61f
cmp dword [0x49a3b0], 0
je 0x47a61f
mov eax, dword [ebp - 0x40]
push eax
push str._nread_error_:_nblu___d_n_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR90.dll__close]
add esp, 4
jmp 0x47a64d
cmp dword [0x49a3b0], 0
je 0x47a64d
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x3c]
push eax
push str._nopen_error_:_handle___d___nomfic___s_n_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 0xc
jmp 0x47a66a
cmp dword [0x49a3b0], 0
je 0x47a66a
mov ecx, dword [ebp + 8]
push ecx
push str._nstat_error_:_nomfic___s_n_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x44]
xor ecx, ebp
call fcn.0042809b
mov esp, ebp
pop ebp
ret
Function at 0x47a6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x48f400]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
push 0x180
push 0x502
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR90.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x47a722
mov ecx, dword [ebp - 4]
push ecx
push 0x48b534
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call sub.MSVCR90.dll_strlen
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.MSVCR90.dll__write]
add esp, 0xc
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR90.dll__close]
add esp, 4
jmp 0x47a7b8
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 0x11
jne 0x47a7b1
push pe_nt_image_headers32
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x47a7af
push 0x14
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x13
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.MSVCR90.dll__read]
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x47a78c
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR90.dll_atol]
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x47a793
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR90.dll__close]
add esp, 4
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
je 0x47a7af
mov dword [ebp - 0x28], 0xffffffff
jmp 0x47a7b8
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042809b
mov esp, ebp
pop ebp
ret
Function at 0x10003f90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov dword [ebp - 4], ecx
mov byte [ebp - 0x28], 0x27
mov byte [ebp - 0x27], 0x62
mov byte [ebp - 0x26], 0x55
mov byte [ebp - 0x25], 0x55
mov byte [ebp - 0x24], 0x48
mov byte [ebp - 0x23], 0x55
mov byte [ebp - 0x22], 7
mov byte [ebp - 0x21], 0x54
mov byte [ebp - 0x20], 0x42
mov byte [ebp - 0x1f], 0x49
mov byte [ebp - 0x1e], 0x43
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x1c], 0x49
mov byte [ebp - 0x1b], 0x40
mov byte [ebp - 0x1a], 7
mov byte [ebp - 0x19], 0x4a
mov byte [ebp - 0x18], 0x42
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x16], 0x54
mov byte [ebp - 0x15], 0x46
mov byte [ebp - 0x14], 0x40
mov byte [ebp - 0x13], 0x42
mov byte [ebp - 0x12], 7
mov byte [ebp - 0x11], 0x53
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], 7
mov byte [ebp - 0xe], 0x54
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0xc], 0x55
mov byte [ebp - 0xb], 0x51
mov byte [ebp - 0xa], 0x42
mov byte [ebp - 9], 0x55
mov byte [ebp - 8], 0x16
mov byte [ebp - 7], 0
mov ecx, 8
lea esi, [ebp - 0x28]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10004190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov dword [ebp - 4], ecx
mov byte [ebp - 0x28], 0x25
mov byte [ebp - 0x27], 0x60
mov byte [ebp - 0x26], 0x57
mov byte [ebp - 0x25], 0x57
mov byte [ebp - 0x24], 0x4a
mov byte [ebp - 0x23], 0x57
mov byte [ebp - 0x22], 5
mov byte [ebp - 0x21], 0x56
mov byte [ebp - 0x20], 0x40
mov byte [ebp - 0x1f], 0x4b
mov byte [ebp - 0x1e], 0x41
mov byte [ebp - 0x1d], 0x4c
mov byte [ebp - 0x1c], 0x4b
mov byte [ebp - 0x1b], 0x42
mov byte [ebp - 0x1a], 5
mov byte [ebp - 0x19], 0x48
mov byte [ebp - 0x18], 0x40
mov byte [ebp - 0x17], 0x56
mov byte [ebp - 0x16], 0x56
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 0x40
mov byte [ebp - 0x12], 5
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0x10], 0x4a
mov byte [ebp - 0xf], 5
mov byte [ebp - 0xe], 0x56
mov byte [ebp - 0xd], 0x40
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x40
mov byte [ebp - 9], 0x57
mov byte [ebp - 8], 0x17
mov byte [ebp - 7], 0
mov ecx, 8
lea esi, [ebp - 0x28]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10004590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov dword [ebp - 4], ecx
mov byte [ebp - 0x28], 0x59
mov byte [ebp - 0x27], 0x1c
mov byte [ebp - 0x26], 0x2b
mov byte [ebp - 0x25], 0x2b
mov byte [ebp - 0x24], 0x36
mov byte [ebp - 0x23], 0x2b
mov byte [ebp - 0x22], 0x79
mov byte [ebp - 0x21], 0x2a
mov byte [ebp - 0x20], 0x3c
mov byte [ebp - 0x1f], 0x37
mov byte [ebp - 0x1e], 0x3d
mov byte [ebp - 0x1d], 0x30
mov byte [ebp - 0x1c], 0x37
mov byte [ebp - 0x1b], 0x3e
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x34
mov byte [ebp - 0x18], 0x3c
mov byte [ebp - 0x17], 0x2a
mov byte [ebp - 0x16], 0x2a
mov byte [ebp - 0x15], 0x38
mov byte [ebp - 0x14], 0x3e
mov byte [ebp - 0x13], 0x3c
mov byte [ebp - 0x12], 0x79
mov byte [ebp - 0x11], 0x2d
mov byte [ebp - 0x10], 0x36
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xe], 0x2a
mov byte [ebp - 0xd], 0x3c
mov byte [ebp - 0xc], 0x2b
mov byte [ebp - 0xb], 0x2f
mov byte [ebp - 0xa], 0x3c
mov byte [ebp - 9], 0x2b
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0
mov ecx, 8
lea esi, [ebp - 0x28]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10004fe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov dword [ebp - 4], ecx
mov byte [ebp - 0x28], 0x1d
mov byte [ebp - 0x27], 0x50
mov byte [ebp - 0x26], 0x78
mov byte [ebp - 0x25], 0x70
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x6f
mov byte [ebp - 0x22], 0x64
mov byte [ebp - 0x21], 0x3d
mov byte [ebp - 0x20], 0x7c
mov byte [ebp - 0x1f], 0x71
mov byte [ebp - 0x1e], 0x71
mov byte [ebp - 0x1d], 0x72
mov byte [ebp - 0x1c], 0x7e
mov byte [ebp - 0x1b], 0x7c
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x74
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x3d
mov byte [ebp - 0x15], 0x7b
mov byte [ebp - 0x14], 0x7c
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x71
mov byte [ebp - 0x11], 0x78
mov byte [ebp - 0x10], 0x79
mov byte [ebp - 0xf], 0x3d
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x3d
mov byte [ebp - 0xb], 0x51
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x7a
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x3c
mov byte [ebp - 5], 0
mov ecx, 9
lea esi, [ebp - 0x28]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4