joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d6b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x4c1db8
push eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x2c], 0
call fcn.0045d140
lea ecx, [esp + 0x2c]
mov edi, eax
push ecx
push edi
call fcn.0046d310
add esp, 0x10
test al, al
je 0x45d7c2
mov ebx, 1
jmp 0x45d700
cmp dword [esp + 0x24], ebx
jl 0x45d7e0
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x3c]
push eax
push edi
call fcn.0046d390
add esp, 0xc
test al, al
je 0x45d83a
mov ecx, dword [0x4b95e8]
fld qword [esp + 0x30]
push ecx
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x4c]
fstp qword [esp]
call fcn.004530e0
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
add esp, 0x14
cmp eax, ebx
jne 0x45d758
mov byte [0x4d30d8], bl
mov esi, ebx
cmp eax, ebx
jle 0x45d7ac
mov edi, edi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
call fcn.0046d360
add esp, 0x10
test al, al
je 0x45d87b
mov edx, dword [esp + 0x2c]
fld qword [esp + 0x30]
push edx
sub esp, 0x10
fstp qword [esp + 8]
lea eax, [esp + 0x3c]
fld qword [esp + 0x4c]
fstp qword [esp]
push eax
call fcn.00453160
add esi, ebx
add esp, 0x18
cmp esi, dword [esp + 0x24]
jl 0x45d760
lea ecx, [esp + 0x24]
push ecx
push edi
call fcn.0046d310
add esp, 8
test al, al
jne 0x45d700
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [ebp + 0xc]
add esp, 4
cmp dword [esp + 0x24], 0
pop edi
setne dl
pop esi
mov byte [eax], dl
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c1dbc
push 0x4c1df0
mov byte [0x652212], bl
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadPolylines_____less_than_one_vertex_per_chain__n
push 0x4c1e34
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c1e44
push 0x4c1e70
mov byte [0x652212], bl
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4c1e80
push 0x4c1eac
jmp 0x45d81f
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c1ebc
push 0x4c1ee8
mov byte [0x652212], bl
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadPolylines_____premature_end_of_file__n
push 0x4c1f24
jmp 0x45d81f
Function at 0x46b5d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x4c2b88
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
mov dword [0x4d31c8], eax
test eax, eax
je 0x46b60e
mov esi, dword [sym.imp.MSVCR100.dll_fprintf]
push str.__0_nSECTION_n__2_nHEADER_n__0_nENDSEC_n
push eax
call esi
mov ecx, dword [0x4d31c8]
push str.__0_nSECTION_n__2_nENTITIES_n
push ecx
call esi
add esp, 0x10
pop esi
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0x652212], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push str.DXF_output_file_could_not_be_opened__n
push 0x4c2bf4
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
int3

Function at 0x46b660
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x4d31c8]
test eax, eax
je 0x46b68f
push str.__0_nENDSEC_n__0_nEOF_n
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
mov eax, dword [0x4d31c8]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0xc
mov dword [0x4d31c8], 0
ret
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0x652212], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push 0x4c2c18
push 0x4c2c40
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
pop esi
int3

Function at 0x46bb20
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x4d31c8]
push esi
test eax, eax
je 0x46bb7c
mov esi, dword [sym.imp.MSVCR100.dll_fprintf]
push str.__0_nPOLYLINE_n
push eax
call esi
add esp, 8
cmp byte [esp + 8], 0
je 0x46bb4f
mov eax, dword [0x4d31c8]
push str._70_n__1_n
push eax
jmp 0x46bb5b
mov ecx, dword [0x4d31c8]
push str._70_n__0_n
push ecx
call esi
mov eax, dword [esp + 0x14]
add esp, 8
test eax, eax
js 0x46bb7a
mov edx, dword [0x4d31c8]
push eax
push str._62_n_3d_n
push edx
call esi
add esp, 0xc
pop esi
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0x652212], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push 0x4c2ed0
push 0x4c2ef8
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
int3

Function at 0x46bbd0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x4d31c8]
test eax, eax
je 0x46bbe9
push str.__0_nSEQEND_n
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 8
ret
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0x652212], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push 0x4c2f14
push 0x4c2f3c
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
pop esi
int3
Function at 0x46bcf0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x4d31c8]
push esi
test eax, eax
je 0x46bd53
mov esi, dword [sym.imp.MSVCR100.dll_fprintf]
push str.__0_nVERTEX_n
push eax
call esi
fld qword [esp + 0x18]
mov eax, dword [0x4d31c8]
fstp qword [esp]
fld qword [esp + 0x10]
sub esp, 8
fstp qword [esp]
push str._10_n_f_n_20_n_f_n_30_n0.0_n
push eax
call esi
fld qword [esp + 0x30]
fld st(0)
add esp, 0x18
fldz
fucompp
fnstsw ax
test ah, 0x44
jnp 0x46bd9c
mov ecx, dword [0x4d31c8]
sub esp, 8
fstp qword [esp]
push str._42_n_f_n
push ecx
call esi
add esp, 0x10
pop esi
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0x652212], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push str.DXF_output_file_not_properly_opened__n
push 0x4c2ff8
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
fstp st(0)
pop esi
ret

Function at 0x46bdf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, dword [ebp + 8]
sub esp, 0x34
push ebx
push esi
push edi
push 0x4c3008
push eax
xor esi, esi
call fcn.0045d140
mov ecx, dword [ebp + 0xc]
mov ebx, dword [sym.imp.MSVCR100.dll_fscanf]
lea edx, [esp + 0x38]
push edx
mov edi, eax
push 0x4c300c
mov byte [ecx], 0
push edi
mov byte [0x4d30d8], 0
call ebx
add esp, 0x14
cmp eax, 0xffffffff
je 0x46bedc
fldz
fcomp qword [esp + 0x30]
fnstsw ax
test ah, 0x41
jne 0x46be61
test esi, esi
jle 0x46be5d
cmp esi, 1
jne 0x46be57
mov byte [0x4d30d8], 1
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
xor esi, esi
jmp 0x46bec3
lea ecx, [esp + 0x38]
push ecx
push 0x4c3010
push edi
call ebx
add esp, 0xc
cmp eax, 0xffffffff
je 0x46beed
fld qword [esp + 0x38]
test esi, esi
jne 0x46bea1
mov edx, dword [0x4b95e8]
push edx
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x44]
fstp qword [esp]
call fcn.004530e0
add esp, 0x14
mov dword [esp + 0x2c], eax
jmp 0x46bec2
mov eax, dword [0x4b95ec]
push eax
sub esp, 0x10
fstp qword [esp + 8]
lea ecx, [esp + 0x40]
fld qword [esp + 0x44]
fstp qword [esp]
push ecx
call fcn.00453160
add esp, 0x18
inc esi
lea edx, [esp + 0x30]
push edx
push 0x4c300c
push edi
call ebx
add esp, 0xc
cmp eax, 0xffffffff
jne 0x46be3a
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c3014
push 0x4c303c
mov byte [0x652212], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadUSGS_____premature_end_of_file__n
push 0x4c3074
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x46bf50
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov bl, byte [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.MSVCR100.dll_fscanf]
lea eax, [esp + 0xf]
push eax
push 0x4c3084
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
je 0x46bf82
cmp byte [esp + 0xf], bl
jne 0x46bf62
pop edi
pop esi
pop ebx
pop ecx
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c3088
push 0x4c30b0
mov byte [0x652212], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4c30c0
push 0x4c30e8
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
int3

Function at 0x46bfe0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.MSVCR100.dll_fscanf]
lea eax, [esp + 0xf]
push eax
push 0x4c30f8
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x46c05e
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c30fc
push 0x4c3124
mov byte [0x652212], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4c3134
push 0x4c315c
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov al, byte [esp + 0xf]
cmp al, byte [esp + 0x18]
je 0x46c13e
mov bl, byte [esp + 0x1c]
cmp al, bl
je 0x46c13e
lea ecx, [esp + 0xf]
push ecx
push 0x4c316c
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x46c0d2
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c3170
push 0x4c3198
mov byte [0x652212], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4c31a8
push 0x4c31d0
jmp 0x46c043
mov al, byte [esp + 0xf]
cmp al, byte [esp + 0x18]
je 0x46c13e
cmp al, bl
je 0x46c13e
lea edx, [esp + 0xf]
push edx
push 0x4c31e0
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x46c13a
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c31e4
push 0x4c320c
mov byte [0x652212], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4c321c
push 0x4c3244
jmp 0x46c043
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x473b00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.004735f0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x473b25
mov eax, 0xfffffff5
jmp 0x473c59
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x320]
and edx, 1
jne 0x473b3d
mov eax, 0xfffffff4
jmp 0x473c59
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
shr ecx, 2
and ecx, 1
je 0x473b6b
mov edx, dword [ebp - 4]
push edx
call fcn.004758b0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x473b6b
mov eax, dword [ebp - 8]
jmp 0x473c59
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 4]
cmp ecx, 1
je 0x473bda
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.00473880
add esp, 4
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x473bda
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2aa]
test edx, edx
jne 0x473bda
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
push 1
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0x316]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2d0
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2c4], 0
je 0x473c16
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c4]
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c4], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2cc], 0
je 0x473c42
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2cc]
push ecx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2cc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffe
mov edx, dword [ebp - 4]
mov dword [edx + 0x320], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4749d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffd
mov edx, dword [ebp + 8]
mov dword [edx + 0x320], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [str.WKNC_Id:_fbread.cpp_7003_2011_05_16_16:32:53Z_jsturton___WORKNC]
mov dword [eax + 0x210], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x214], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x21c], 0xa0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x218], 0xa0
mov edx, dword [ebp + 8]
mov dword [edx + 0x220], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x224], 0
call fcn.00473400
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x228
push ecx
call sub.MSVCR100.dll_strcpy
add esp, 8
mov edx, dword [ebp + 8]
mov byte [edx + 0x2a8], 1
mov eax, dword [ebp + 8]
mov byte [eax + 0x2a9], 1
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2aa], 1
mov edx, dword [ebp + 8]
mov byte [edx + 0x2ac], 0
call fcn.00473350
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2ab], al
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
push 0xa0
push 1
mov ecx, dword [ebp + 8]
add ecx, 0x210
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 0xa0
je 0x474abb
mov eax, 0xffffffe6
jmp 0x474abd
xor eax, eax
pop ebp
ret

Function at 0x474ac0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
pop ebp
ret
Function at 0x475880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
pop ebp
ret
Function at 0x477910
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.WNC_BUFFER_TOO_SMALL_OPTION
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x477952
push str.crash
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x477952
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 1
mov esp, ebp
pop ebp
ret

Function at 0x478f80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x4b9ba4
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x478fa5
call fcn.004796e0
jmp 0x47908a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x478fc3
mov eax, dword [ebp - 4]
jmp 0x47908a
cmp dword [0x4d31d0], 0
jne 0x478fd1
call fcn.00479090
push 0x4b9ba8
mov edx, dword [0x4d31d0]
push edx
call fcn.0047beb0
add esp, 8
mov word [ebp - 8], ax
movsx eax, word [ebp - 8]
test eax, eax
jge 0x478ff8
xor eax, eax
jmp 0x47908a
mov ecx, dword [ebp + 8]
push ecx
movzx edx, word [ebp - 8]
push edx
mov eax, dword [0x4d31d0]
push eax
call fcn.0047c570
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x479087
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
jmp 0x479029
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x479035
jmp 0x479020
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
jmp 0x479049
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jb 0x479068
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
cmp eax, 0x20
jg 0x479068
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
jl 0x479068
jmp 0x479040
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x479087
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov byte [ecx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x479c00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0x4b9bac
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x479c42
push str.WNCTMPDIR
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x479c40
push str.from_environment_variable_WNCTMPDIR
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x479c80
jmp 0x479c69
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x479c69
push str.from_environment
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x479c80
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x4d31d0]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0047be20
add esp, 0xc
pop ebp
ret

Function at 0x479d00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x4c8bb0]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x479d20
xor eax, eax
jmp 0x479e58
mov eax, dword [ebp + 8]
push eax
push 0x4b9bf8
lea ecx, [ebp - 0x190]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x190]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x479d5a
mov eax, dword [ebp - 4]
jmp 0x479e58
cmp dword [0x4d31d0], 0
jne 0x479d68
call fcn.00479090
push str.path
mov eax, dword [0x4d31d0]
push eax
call fcn.0047beb0
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x479d8e
xor eax, eax
jmp 0x479e58
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0x4d31d0]
push ecx
call fcn.0047c570
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x479e55
mov edx, dword [ebp - 4]
mov dword [ebp - 0x194], edx
jmp 0x479dcd
mov eax, dword [ebp - 0x194]
add eax, 1
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
movsx edx, byte [ecx]
test edx, edx
je 0x479ddc
jmp 0x479dbe
mov eax, dword [ebp - 0x194]
sub eax, 1
mov dword [ebp - 0x194], eax
jmp 0x479dfc
mov ecx, dword [ebp - 0x194]
sub ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
cmp edx, dword [ebp - 4]
jb 0x479e24
mov eax, dword [ebp - 0x194]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x479e24
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
jl 0x479e24
jmp 0x479ded
mov ecx, dword [ebp - 0x194]
add ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
je 0x479e55
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x198]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0049f322
mov esp, ebp
pop ebp
ret
Function at 0x479e70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4c8bb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str._sPATH
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x479ec1
lea eax, [ebp - 0x58]
push eax
push str.from_environment__s
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
xor eax, eax
jmp 0x479ed7
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x4d31d0]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0047be20
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049f322
mov esp, ebp
pop ebp
ret

Function at 0x480950
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4c8bb0]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
push ecx
push 0x1ff
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00477e30
push 0x2c
lea edx, [ebp - 0x208]
push edx
call fcn.004364e0
add esp, 8
test eax, eax
je 0x4809f1
mov eax, dword [ebp + 0x10]
push eax
push 0x1ff
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0047b9a0
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x4809f1
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0xffffffd5
jne 0x4809ef
push 0x2c
lea eax, [ebp - 0x208]
push eax
call fcn.004364e0
add esp, 8
test eax, eax
jne 0x4809ef
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
jmp 0x4809f1
jmp 0x480a52
lea edx, [ebp - 9]
mov dword [ebp - 4], edx
jmp 0x480a02
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x208]
cmp ecx, edx
jb 0x480a26
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x480a26
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
jl 0x480a26
jmp 0x4809f9
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov byte [edx], 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
test eax, eax
je 0x480a52
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffeb
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0049f322
mov esp, ebp
pop ebp
ret 0xc