joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4080c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4260a5
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x435080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp + 8]
push eax
push str.INFO:init_no_console:opening_gateway_configuration_file__s
lea ecx, [ebp - 0x28]
push ecx
call fcn.00418d50
add esp, 0xc
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x4c]
call fcn.00404660
push eax
call fcn.004194a0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406240
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
push 0x428874
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
mov ecx, dword [ebp - 0x44]
cmp dword [ecx], 0
jne 0x4081a5
push str.can_not_load_config_file
push str.CONFIG:ERR:_s
lea edx, [ebp - 0x40]
push edx
call fcn.00418d50
add esp, 0xc
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x54]
call fcn.00404660
push eax
call fcn.004194a0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00406240
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, dword [ebp - 0x44]
mov dword [eax + 0xc], 0
push 1
push 3
push 0
push str.use_display
mov ecx, dword [ebp - 0x44]
add ecx, 0xc
push ecx
mov ecx, 0x435558
call fcn.00407250
mov edx, dword [ebp - 0x44]
mov dword [edx + 0x14], 0
push 1
push 1
push 0
push str.show_gui
mov eax, dword [ebp - 0x44]
add eax, 0x14
push eax
mov ecx, 0x435558
call fcn.00407250
mov ecx, dword [ebp - 0x44]
mov dword [ecx + 0x10], 0
push 1
push 2
push 0
push str.start_minimized
mov edx, dword [ebp - 0x44]
add edx, 0x10
push edx
mov ecx, 0x435558
call fcn.00407250
mov eax, dword [ebp - 0x44]
mov dword [eax + 0x6d4], 0
push 1
push 1
push 0
push str.sdl_alpha_blending
mov ecx, dword [ebp - 0x44]
add ecx, 0x6d4
push ecx
mov ecx, 0x435558
call fcn.00407250
mov edx, dword [ebp - 0x44]
mov dword [edx + 8], 0
push 1
push 2
push 0
push str.sdl_renderer
mov eax, dword [ebp - 0x44]
add eax, 8
push eax
mov ecx, 0x435558
call fcn.00407250
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424a63
mov esp, ebp
pop ebp
ret 4
Function at 0x408d00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x408d20
jl 0x408d17
cmp dword [ebp + 0xc], 0
ja 0x408d20
xor eax, eax
xor edx, edx
jmp 0x408e5d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x408d43
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x408e5d
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x408db5
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.004024b0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00404620
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x408e4e
mov ecx, dword [ebp - 8]
call fcn.004068d0
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x408e26
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x408e24
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x408e5d
jmp 0x408dd1
cmp dword [ebp - 4], 0
jbe 0x408e4e
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x408e9c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x408f82
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x408f33
jg 0x408ec5
cmp dword [ebp + 0xc], 0
jbe 0x408f33
cmp dword [ebp - 8], 0
jl 0x408f33
jg 0x408ed3
cmp dword [ebp - 0xc], 0
jbe 0x408f33
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x408ef1
jl 0x408ee5
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jae 0x408ef1
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.00404620
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x408f76
jg 0x408f41
cmp dword [ebp + 0xc], 0
jbe 0x408f76
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x408f76
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40b4a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.sdl_mutex::mutex_t.0
call sub.SDL2.dll_SDL_CreateMutex
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x40b4eb
call sub.SDL2.dll_SDL_GetError
push eax
push str.mutex_t:create_mutex_failed_because__s_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00405420
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x40dd20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x40dd51
push str.mutex_t:lock:mutex_must_be_created_before_use_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00405420
add esp, 8
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call sub.SDL2.dll_SDL_LockMutex
add esp, 4
cmp eax, 0xffffffff
jne 0x40dd8c
call sub.SDL2.dll_SDL_GetError
push eax
push str.mutex_t:lock:failed_because__s_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00405420
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esp, ebp
pop ebp
ret
Function at 0x413fb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4263ad
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x435080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], 0
push 0
movzx eax, word [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_recv
mov dword [ebp - 0x30], eax
call sub.WS2_32.dll_WSAGetLastError
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x2733
je 0x414062
cmp dword [ebp - 0x2c], 0
je 0x414062
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.SOCKET:_s:ERR:read_d
lea edx, [ebp - 0x28]
push edx
call fcn.00418d50
add esp, 0x10
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
call fcn.00404660
push eax
mov ecx, 0x438c48
call fcn.0041ff00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406240
call fcn.0040ced0
or eax, 0xffffffff
jmp 0x414065
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424a63
mov esp, ebp
pop ebp
ret

Function at 0x414660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x414691
push str.mutex_t:unlock:mutex_must_be_created_before_use_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00405420
add esp, 8
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call sub.SDL2.dll_SDL_UnlockMutex
add esp, 4
cmp eax, 0xffffffff
jne 0x4146cc
call sub.SDL2.dll_SDL_GetError
push eax
push str.mutex_t:unlock:failed_because__s_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00405420
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esp, ebp
pop ebp
ret
Function at 0x4159e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4263ad
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x435080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], 0
push 0
movzx eax, word [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_send
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x415a98
call sub.WS2_32.dll_WSAGetLastError
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x2733
jne 0x415a43
xor eax, eax
jmp 0x415a9b
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.SOCKET:_s:ERR:write_d
lea edx, [ebp - 0x28]
push edx
call fcn.00418d50
add esp, 0x10
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
call fcn.00404660
push eax
mov ecx, 0x438c48
call fcn.0041ff00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406240
call fcn.0040ced0
or eax, 0xffffffff
jmp 0x415a9b
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424a63
mov esp, ebp
pop ebp
ret
Function at 0x415b90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426ca5
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x435080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74], 0
cmp dword [ebp + 8], 0
je 0x415dab
mov ecx, 0x435c7c
call fcn.0040dd20
lea ecx, [ebp - 0x28]
call fcn.00406070
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040c8a0
cmp dword [0x435b00], 0
je 0x415c25
push 0
push 0x428ff0
lea ecx, [ebp - 0x28]
call fcn.0040d300
test eax, eax
jne 0x415c25
push str.COM:ERR:EXG.1.PWR0_is_not_allowed
mov ecx, 0x438c48
call fcn.0041ff00
jmp 0x415d92
mov edx, 1
test edx, edx
je 0x415d92
mov eax, 1
test eax, eax
je 0x415c87
lea ecx, [ebp - 0x28]
call fcn.00404660
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.COM:INFO:writeToSerialPort__lu_hSerial___lu_Bytes__s
lea eax, [ebp - 0x40]
push eax
call fcn.00418d50
add esp, 0x14
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0x7c], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x7c]
call fcn.00404660
push eax
call fcn.004194a0
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00406240
push 0
lea edx, [ebp - 0x74]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x415d2f
lea ecx, [ebp - 0x28]
call fcn.00404660
push eax
push str.COM:ERR:writeToSerialPort_s
lea eax, [ebp - 0x58]
push eax
call fcn.00418d50
add esp, 0xc
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x84], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x84]
call fcn.00404660
push eax
mov ecx, 0x438c48
call fcn.0041ff00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00406240
push 0
mov ecx, 0x435c88
call fcn.00414120
mov ecx, 0x435c7c
call fcn.00414660
mov dword [ebp - 0x88], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406240
mov eax, dword [ebp - 0x88]
jmp 0x415dae
lea ecx, [ebp - 0x28]
call fcn.00405170
cmp dword [ebp - 0x74], eax
je 0x415d92
lea ecx, [ebp - 0x28]
call fcn.00405170
push eax
mov edx, dword [ebp - 0x74]
push edx
push str.COM:INFO:writeToSerialPort:incomplete__d_BytesWritten_of__d_
lea eax, [ebp - 0x70]
push eax
call fcn.00418d50
add esp, 0x10
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x90]
call fcn.00404660
push eax
mov ecx, 0x438c48
call fcn.0041ff00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00406240
mov ecx, 0x435c7c
call fcn.00414660
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406240
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424a63
mov esp, ebp
pop ebp
ret
Function at 0x4196e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4272cb
mov eax, dword fs:[0]
push eax
sub esp, 0x448
mov eax, dword [0x435080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x444], eax
mov ecx, dword [ebp - 0x444]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x3ff
lea eax, [ebp - 0x410]
push eax
call fcn.00409050
add esp, 0x10
mov dword [ebp - 0x444], 0
mov ecx, 0x438c48
call fcn.0041feb0
movzx ecx, al
test ecx, ecx
je 0x4197be
lea edx, [ebp - 0x410]
push edx
push 0x42b004
lea eax, [ebp - 0x428]
push eax
call fcn.00418d50
add esp, 0xc
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x44c], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x44c]
call fcn.00404660
push eax
mov ecx, 0x438c48
call fcn.0041ff00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.00406240
push str.Hit_ESC_key_for_exit_to_OS...
mov ecx, 0x438c48
call fcn.0041ff00
call fcn.00419610
lea edx, [ebp - 0x410]
push edx
push str.DEBUG:_s
lea eax, [ebp - 0x440]
push eax
call fcn.00418d50
add esp, 0xc
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp - 0x450]
mov dword [ebp - 0x454], ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x454]
call fcn.00404660
push eax
call fcn.004194a0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.00406240
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424a63
mov esp, ebp
pop ebp
ret

Function at 0x41ba00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4263ad
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x435080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
add eax, 4
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x41ba9c
mov ecx, dword [ebp - 0x2c]
add ecx, 4
push ecx
push str.IPC_path:__s
lea edx, [ebp - 0x28]
push edx
call fcn.00418d50
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
call fcn.00404660
push eax
mov ecx, 0x438c48
call fcn.0041ff00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406240
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x109], 1
jmp 0x41bab5
push str.IPC_path:_ERR
mov ecx, 0x438c48
call fcn.0041ff00
mov edx, dword [ebp - 0x2c]
mov byte [edx + 0x109], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424a63
mov esp, ebp
pop ebp
ret
Function at 0x41bad0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4274a5
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x435080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74], ecx
mov eax, dword [ebp - 0x74]
movzx ecx, byte [eax + 0x109]
test ecx, ecx
je 0x41bc66
cmp dword [ebp + 0xc], 0
je 0x41bc21
push 0x42bd68
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x74]
add eax, 4
push eax
push 0x42bd6c
lea ecx, [ebp - 0x28]
push ecx
call fcn.00418d50
add esp, 0x10
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 0x7c]
call fcn.00404660
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
mov dword [ebp - 0x78], eax
lea ecx, [ebp - 0x28]
call fcn.00406240
cmp dword [ebp - 0x78], 0
je 0x41bbc7
mov edx, dword [ebp - 0x78]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, dword [ebp + 8]
push eax
push str.IPC_set:__s__1
lea ecx, [ebp - 0x40]
push ecx
call fcn.00418d50
add esp, 0xc
mov dword [ebp - 0x80], eax
mov edx, dword [ebp - 0x80]
mov dword [ebp - 0x84], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x84]
call fcn.00404660
push eax
mov ecx, 0x438c48
call fcn.0041ff00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00406240
mov eax, 1
jmp 0x41bc78
mov eax, dword [ebp + 8]
push eax
push str.IPC_set:__s__1:ERR:could_not_write
lea ecx, [ebp - 0x58]
push ecx
call fcn.00418d50
add esp, 0xc
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x8c], edx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x8c]
call fcn.00404660
push eax
mov ecx, 0x438c48
call fcn.0041ff00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00406240
or eax, 0xffffffff
jmp 0x41bc78
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x74]
add ecx, 4
push ecx
push str._s_s
lea edx, [ebp - 0x70]
push edx
call fcn.00418d50
add esp, 0x10
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x90]
call fcn.00404660
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
lea ecx, [ebp - 0x70]
call fcn.00406240
xor eax, eax
jmp 0x41bc78
push str.IPC_set:ERR:not_initialized
mov ecx, 0x438c48
call fcn.0041ff00
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424a63
mov esp, ebp
pop ebp
ret 8