joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462730
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
add eax, 1
push eax
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0xc], ecx
jle 0x462759
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x20], edx
jmp 0x46275f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCR100.dll_strncpy]
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
mov byte [edx], 0
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strlen
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4627b2
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x14]
movsx edx, byte [ecx - 1]
cmp edx, 0x20
jne 0x4627b2
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
jmp 0x462792
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x14]
mov byte [ecx], 0
mov edx, dword [ebp + 0x14]
add edx, 1
push edx
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 0x14], eax
jle 0x4627de
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x24], ecx
jmp 0x4627e4
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_strncpy]
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x18]
mov byte [ecx], 0
mov edx, dword [ebp - 0xc]
push edx
call sub.MSVCR100.dll_strlen
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x462837
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x1c]
movsx ecx, byte [eax - 1]
cmp ecx, 0x20
jne 0x462837
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x462817
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x1c]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCR100.dll_rename]
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x463560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.00463050
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x463585
mov eax, 0xfffffff5
jmp 0x4636b9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x320]
and edx, 1
jne 0x46359d
mov eax, 0xfffffff4
jmp 0x4636b9
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
shr ecx, 2
and ecx, 1
je 0x4635cb
mov edx, dword [ebp - 4]
push edx
call fcn.00465b50
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4635cb
mov eax, dword [ebp - 8]
jmp 0x4636b9
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 4]
cmp ecx, 1
je 0x46363a
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.004632e0
add esp, 4
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x46363a
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2aa]
test edx, edx
jne 0x46363a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
push 1
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0x316]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2d0
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2c4], 0
je 0x463676
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c4]
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c4], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2cc], 0
je 0x4636a2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2cc]
push ecx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2cc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffe
mov edx, dword [ebp - 4]
mov dword [edx + 0x320], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x464340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
add eax, 0x210
push eax
call fcn.004643b0
add esp, 4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x320]
and edx, 0xfffffffd
mov eax, dword [ebp + 8]
mov dword [eax + 0x320], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
push 0xa0
push 1
mov eax, dword [ebp + 8]
add eax, 0x210
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xa0
je 0x46439d
mov eax, 0xffffffe6
jmp 0x46439f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x464d60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
pop ebp
ret
Function at 0x465b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
pop ebp
ret
Function at 0x468800
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.WNC_BUFFER_TOO_SMALL_OPTION
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x468842
push str.crash
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x468842
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 1
mov esp, ebp
pop ebp
ret

Function at 0x46b700
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x4b92d4
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x46b725
call fcn.0046be80
jmp 0x46b824
push str.WNCZONE
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x46b73f
call fcn.0046c3b0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46b75d
mov eax, dword [ebp - 4]
jmp 0x46b824
cmp dword [0x529b50], 0
jne 0x46b76b
call fcn.0046b830
push 0x4b92e0
mov eax, dword [0x529b50]
push eax
call fcn.00469e10
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x46b791
xor eax, eax
jmp 0x46b824
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0x529b50]
push ecx
call fcn.0046a4d0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46b821
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
jmp 0x46b7c3
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x46b7cf
jmp 0x46b7ba
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
jmp 0x46b7e3
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 4]
jb 0x46b802
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x46b802
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
test eax, eax
jl 0x46b802
jmp 0x46b7da
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x46b821
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x46c3d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0x4b92e4
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x46c412
push str.WNCTMPDIR
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x46c410
push str.from_environment_variable_WNCTMPDIR
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x46c450
jmp 0x46c439
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x46c439
push str.from_environment
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x46c450
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x529b50]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00469d80
add esp, 0xc
pop ebp
ret

Function at 0x46c4d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ee1f0]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x46c4f0
xor eax, eax
jmp 0x46c628
mov eax, dword [ebp + 8]
push eax
push 0x4b9330
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46c52a
mov eax, dword [ebp - 4]
jmp 0x46c628
cmp dword [0x529b50], 0
jne 0x46c538
call fcn.0046b830
push str.path
mov eax, dword [0x529b50]
push eax
call fcn.00469e10
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x46c55e
xor eax, eax
jmp 0x46c628
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0x529b50]
push ecx
call fcn.0046a4d0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46c625
mov edx, dword [ebp - 4]
mov dword [ebp - 0x214], edx
jmp 0x46c59d
mov eax, dword [ebp - 0x214]
add eax, 1
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
movsx edx, byte [ecx]
test edx, edx
je 0x46c5ac
jmp 0x46c58e
mov eax, dword [ebp - 0x214]
sub eax, 1
mov dword [ebp - 0x214], eax
jmp 0x46c5cc
mov ecx, dword [ebp - 0x214]
sub ecx, 1
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x214]
cmp edx, dword [ebp - 4]
jb 0x46c5f4
mov eax, dword [ebp - 0x214]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x46c5f4
mov edx, dword [ebp - 0x214]
movsx eax, byte [edx]
test eax, eax
jl 0x46c5f4
jmp 0x46c5bd
mov ecx, dword [ebp - 0x214]
add ecx, 1
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x214]
movsx eax, byte [edx]
test eax, eax
je 0x46c625
mov ecx, dword [ebp - 0x214]
mov dword [ebp - 0x218], ecx
mov edx, dword [ebp - 0x218]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0048ca5e
mov esp, ebp
pop ebp
ret
Function at 0x46c640
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4ee1f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str._sPATH
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x46c691
lea eax, [ebp - 0x58]
push eax
push str.from_environment__s
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
xor eax, eax
jmp 0x46c6a7
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x529b50]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00469d80
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ca5e
mov esp, ebp
pop ebp
ret

Function at 0x4718f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4ee1f0]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
push ecx
push 0x1ff
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00468d20
push 0x2c
lea edx, [ebp - 0x208]
push edx
call fcn.00469c20
add esp, 8
test eax, eax
je 0x471991
mov eax, dword [ebp + 0x10]
push eax
push 0x1ff
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004698e0
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x471991
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0xffffffd5
jne 0x47198f
push 0x2c
lea eax, [ebp - 0x208]
push eax
call fcn.00469c20
add esp, 8
test eax, eax
jne 0x47198f
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
jmp 0x471991
jmp 0x4719f2
lea edx, [ebp - 9]
mov dword [ebp - 4], edx
jmp 0x4719a2
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x208]
cmp ecx, edx
jb 0x4719c6
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x4719c6
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
jl 0x4719c6
jmp 0x471999
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov byte [edx], 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
test eax, eax
je 0x4719f2
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffeb
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0048ca5e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x471a50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x4ee1f0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00471b80
add esp, 8
cmp eax, 0xffffffff
je 0x471b4f
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
je 0x471b2e
push 0x101
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR100.dll__read]
add esp, 0xc
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x471b04
lea edx, [ebp - 0x148]
push edx
call dword [sym.imp.MSVCR100.dll_atol]
add esp, 4
cmp dword [ebp + 0xc], eax
jne 0x471ae0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x471b02
cmp dword [0x52bdb0], 0
je 0x471b02
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._nverif_error_:_startpid___lu___lockpid___s_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
jmp 0x471b1f
cmp dword [0x52bdb0], 0
je 0x471b1f
mov eax, dword [ebp - 0x40]
push eax
push str._nread_error_:_nblu___d_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
jmp 0x471b4d
cmp dword [0x52bdb0], 0
je 0x471b4d
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x3c]
push eax
push str._nopen_error_:_handle___d___nomfic___s_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
jmp 0x471b6a
cmp dword [0x52bdb0], 0
je 0x471b6a
mov ecx, dword [ebp + 8]
push ecx
push str._nstat_error_:_nomfic___s_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0048ca5e
mov esp, ebp
pop ebp
ret
Function at 0x471ba0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4ee1f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
push 0x180
push 0x502
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x471c22
mov ecx, dword [ebp - 4]
push ecx
push 0x4b9bcc
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call sub.MSVCR100.dll_strlen
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.MSVCR100.dll__write]
add esp, 0xc
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
jmp 0x471cb8
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 0x11
jne 0x471cb1
push 0x100
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x471caf
push 0x14
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x13
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.MSVCR100.dll__read]
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x471c8c
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR100.dll_atol]
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x471c93
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
je 0x471caf
mov dword [ebp - 0x28], 0xffffffff
jmp 0x471cb8
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048ca5e
mov esp, ebp
pop ebp
ret

Function at 0x4726e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.WNC_WNCFILES_VERBOSE
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x472719
push 0x4b9c1c
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
je 0x472719
mov eax, 1
jmp 0x47271b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x473200
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x47321b
xor eax, eax
jmp 0x473227
mov eax, dword [ebp - 4]
and eax, 0x10
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x473310
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll__mkdir]
add esp, 4
test eax, eax
je 0x473334
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 0xd
je 0x473334
or eax, 0xffffffff
jmp 0x473336
xor eax, eax
pop ebp
ret
Function at 0x4735c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4ee1f0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0x4b9c70
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4735f2
mov eax, dword [ebp - 4]
jmp 0x473779
push str.WNCHOME_LS
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47373d
push 0x200
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x473631
xor eax, eax
jmp 0x473779
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x47364e
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x473674
mov edx, dword [ebp - 0x21c]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x473672
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], 0x2f
jmp 0x47363f
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00472580
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x473695
xor eax, eax
jmp 0x473779
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00472580
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4736c5
xor eax, eax
jmp 0x473779
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00472580
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4736f5
xor eax, eax
jmp 0x473779
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
push 0x4b9c84
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
jne 0x473730
push 0x4b9c88
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x473734
xor eax, eax
jmp 0x473779
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp + 8]
test edx, edx
je 0x473776
push str.WNCHOME
push 0x52bdf0
call sub.MSVCR100.dll_strcpy
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x52bdf0
call sub.MSVCR100.dll_strcat
add esp, 8
push 0x52bdf0
call dword [sym.imp.MSVCR100.dll__putenv]
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0048ca5e
mov esp, ebp
pop ebp
ret
Function at 0x482ec0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a393b
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4ee1f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
push 1
mov ecx, dword [ebp + 8]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
lea ecx, [ebp - 0x18]
call fcn.00483650
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004836a0
movzx edx, al
test edx, edx
jne 0x482f3b
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00483680
mov eax, dword [ebp - 0x2c]
jmp 0x483030
mov byte [ebp - 0xd], 0
cmp dword [ebp + 0x10], 0
jbe 0x482f65
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x18]
call fcn.00489990
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x482f65
mov byte [ebp - 0xd], 1
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
jne 0x482fe3
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x18]
call fcn.00489990
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x482fa9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00483680
mov eax, dword [ebp - 0x30]
jmp 0x483030
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x18]
call fcn.00489990
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x102
jne 0x482fe3
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00483680
mov eax, dword [ebp - 0x34]
jmp 0x483030
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00482da0
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x483017
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00483680
mov eax, dword [ebp - 0x38]
jmp 0x483030
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00483680
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret