joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c0d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0x465984
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x43c112
push str.WNCTMPDIR
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x43c110
push str.from_environment_variable_WNCTMPDIR
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x43c150
jmp 0x43c139
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x43c139
push str.from_environment
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x43c150
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x6e05f4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00439af0
add esp, 0xc
pop ebp
ret

Function at 0x43c1d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x46a570]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x43c1f0
xor eax, eax
jmp 0x43c328
mov eax, dword [ebp + 8]
push eax
push 0x4659d0
lea ecx, [ebp - 0x190]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x190]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43c22a
mov eax, dword [ebp - 4]
jmp 0x43c328
cmp dword [0x6e05f4], 0
jne 0x43c238
call fcn.0043b560
push str.path
mov eax, dword [0x6e05f4]
push eax
call fcn.00439b80
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x43c25e
xor eax, eax
jmp 0x43c328
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0x6e05f4]
push ecx
call fcn.0043a240
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43c325
mov edx, dword [ebp - 4]
mov dword [ebp - 0x194], edx
jmp 0x43c29d
mov eax, dword [ebp - 0x194]
add eax, 1
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
movsx edx, byte [ecx]
test edx, edx
je 0x43c2ac
jmp 0x43c28e
mov eax, dword [ebp - 0x194]
sub eax, 1
mov dword [ebp - 0x194], eax
jmp 0x43c2cc
mov ecx, dword [ebp - 0x194]
sub ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
cmp edx, dword [ebp - 4]
jb 0x43c2f4
mov eax, dword [ebp - 0x194]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x43c2f4
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
jl 0x43c2f4
jmp 0x43c2bd
mov ecx, dword [ebp - 0x194]
add ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
je 0x43c325
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x198]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00442f5b
mov esp, ebp
pop ebp
ret
Function at 0x43c340
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x46a570]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str._sPATH
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x43c391
lea eax, [ebp - 0x58]
push eax
push str.from_environment__s
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
xor eax, eax
jmp 0x43c3a7
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x6e05f4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00439af0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442f5b
mov esp, ebp
pop ebp
ret

Function at 0x441150
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x46a570]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
push ecx
push 0x1ff
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00437e70
push 0x2c
lea edx, [ebp - 0x208]
push edx
call fcn.00438d70
add esp, 8
test eax, eax
je 0x4411f1
mov eax, dword [ebp + 0x10]
push eax
push 0x1ff
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00438a30
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x4411f1
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0xffffffd5
jne 0x4411ef
push 0x2c
lea eax, [ebp - 0x208]
push eax
call fcn.00438d70
add esp, 8
test eax, eax
jne 0x4411ef
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
jmp 0x4411f1
jmp 0x441252
lea edx, [ebp - 9]
mov dword [ebp - 4], edx
jmp 0x441202
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x208]
cmp ecx, edx
jb 0x441226
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x441226
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
jl 0x441226
jmp 0x4411f9
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov byte [edx], 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
test eax, eax
je 0x441252
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffeb
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00442f5b
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4413b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.WNC_WNCFILES_VERBOSE
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4413e9
push 0x466178
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
je 0x4413e9
mov eax, 1
jmp 0x4413eb
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x441ed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x441eeb
xor eax, eax
jmp 0x441ef7
mov eax, dword [ebp - 4]
and eax, 0x10
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x441fe0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll__mkdir]
add esp, 4
test eax, eax
je 0x442004
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 0xd
je 0x442004
or eax, 0xffffffff
jmp 0x442006
xor eax, eax
pop ebp
ret
Function at 0x442290
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x46a570]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0x4661cc
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4422c2
mov eax, dword [ebp - 4]
jmp 0x442449
push str.WNCHOME_LS
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44240d
push 0x200
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x442301
xor eax, eax
jmp 0x442449
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x44231e
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x442344
mov edx, dword [ebp - 0x21c]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x442342
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], 0x2f
jmp 0x44230f
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00442460
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x442365
xor eax, eax
jmp 0x442449
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00442460
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x442395
xor eax, eax
jmp 0x442449
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00442460
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4423c5
xor eax, eax
jmp 0x442449
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
push 0x4661e0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
jne 0x442400
push 0x4661e4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x442404
xor eax, eax
jmp 0x442449
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp + 8]
test edx, edx
je 0x442446
push str.WNCHOME
push 0x6e2870
call sub.MSVCR100.dll_strcpy
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x6e2870
call sub.MSVCR100.dll_strcat
add esp, 8
push 0x6e2870
call dword [sym.imp.MSVCR100.dll__putenv]
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00442f5b
mov esp, ebp
pop ebp
ret

Function at 0x442f5b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46a570]
jne 0x442f65
repz ret
jmp fcn.00443404
Function at 0x445930
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x46a570]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0044a9b0
test eax, eax
je 0x445963
call fcn.0044a910
push eax
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x4459ac
push 0x4671e4
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x445996
push 0x4671ec
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x4459ac
mov edx, dword [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
push 0x4671f0
push 0x4671f8
push 0x5c
lea ecx, [ebp - 0x210]
push ecx
push 0x467200
push 0x6e3460
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov byte [0x6e3660], 0
push 0x46720c
push 0x6e3460
call dword [sym.imp.MSVCR100.dll_strcspn]
add esp, 8
mov byte [eax + 0x6e3460], 0
push 0x201
push 0x6e3460
call fcn.004457c0
add esp, 8
push 0x467210
push str.zone
push 0x5c
lea edx, [ebp - 0x210]
push edx
push str._s_c_s_s
push 0x6e3668
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov byte [0x6e3868], 0
push 0x46722c
push 0x6e3668
call dword [sym.imp.MSVCR100.dll_strcspn]
add esp, 8
mov byte [eax + 0x6e3668], 0
push 0x201
push 0x6e3668
call fcn.004457c0
add esp, 8
cmp dword [0x6e3874], 0
jne 0x445a7e
push 0x4458e0
call fcn.00443017
add esp, 4
mov dword [0x6e3874], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442f5b
mov esp, ebp
pop ebp
ret

Function at 0x44a390
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x46a570]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6e8d0c], 0
je 0x44a3f6
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s___d__:__d_n
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
mov ecx, dword [0x6e8d08]
push ecx
lea edx, [ebp - 0x408]
push edx
call sub.MSVCR100.dll_strlen
add esp, 4
push eax
push 1
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442f5b
mov esp, ebp
pop ebp
ret

Function at 0x44a910
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x467440
cmp dword [0x6e4844], 0
je 0x44a92f
mov eax, 0x6e4848
jmp 0x44a950
push 0x467444
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x44a94d
mov eax, dword [ebp - 8]
jmp 0x44a950
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x44a9c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x6e4844], 0
je 0x44a9e1
push 0x6e4848
push 0x6e8ad0
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x44aa1d
push str.WNCZONE
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44aa0c
push 0x467460
push 0x6e8ad0
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x44aa1d
mov eax, dword [ebp - 4]
push eax
push 0x6e8ad0
call sub.MSVCR100.dll_strcpy
add esp, 8
push 0x467464
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045b000
add esp, 8
push eax
push 0x5c
push 0x6e8ad0
push str._s_c_s
push 0x6e88c8
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
push 0x201
push 0x6e88c8
call fcn.00437da0
add esp, 8
cmp dword [0x6e8cdc], 0
jne 0x44aa7b
push 0x44a8b0
call fcn.00443017
add esp, 4
mov dword [0x6e8cdc], 1
mov esp, ebp
pop ebp
ret

Function at 0x454090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x6e8e20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR100.dll_strlen
add esp, 4
push eax
push 1
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100.dll_strlen
add esp, 4
cmp esi, eax
je 0x4540ea
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffe6
jmp 0x454120
mov dx, word [0x467d30]
mov word [ebp - 8], dx
mov al, byte [0x467d32]
mov byte [ebp - 6], al
mov ecx, dword [ebp - 4]
push ecx
push 2
push 1
lea edx, [ebp - 8]
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 2
je 0x454120
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xffffffe6
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x454210
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x6e8e20]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
push eax
push 1
push 1
lea ecx, [ebp - 5]
push ecx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x454265
mov edx, dword [ebp + 0x14]
mov dword [edx], 0xffffffe7
mov byte [ebp - 5], 0
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
jmp 0x454279
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
mov dl, byte [ebp - 5]
mov byte [ecx], dl
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 1
cmp dword [ebp - 4], ecx
jge 0x454295
movsx edx, byte [ebp - 5]
cmp edx, 0xa
je 0x454295
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
je 0x454233
mov ecx, dword [ebp + 0x10]
sub ecx, 1
cmp dword [ebp - 4], ecx
jne 0x454310
movsx edx, byte [ebp - 5]
cmp edx, 0xa
je 0x454310
mov eax, dword [ebp + 0x14]
mov dword [eax], 0xffffffd6
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 1]
cmp edx, 0xa
je 0x4542cc
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0xa
jmp 0x4542d5
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0xd
je 0x4542f1
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0xa
jne 0x45430b
cmp dword [ebp - 4], 0
jl 0x45430b
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x4542d5
jmp 0x4543a7
mov edx, dword [ebp + 0x14]
cmp dword [edx], 0xffffffe7
je 0x454321
movsx eax, byte [ebp - 5]
cmp eax, 0xa
jne 0x454332
cmp dword [ebp - 4], 0
jne 0x454332
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0xffffffe9
jmp 0x4543a7
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0xd
je 0x45435e
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0xa
jne 0x4543a7
cmp dword [ebp - 4], 0
jl 0x4543a7
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0xa
jne 0x454393
cmp dword [ebp - 0x10], 0
jne 0x454391
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x4543a5
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x454342
mov esp, ebp
pop ebp
ret
Function at 0x454e40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.00454930
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x454e65
mov eax, 0xfffffff5
jmp 0x454f99
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x320]
and edx, 1
jne 0x454e7d
mov eax, 0xfffffff4
jmp 0x454f99
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
shr ecx, 2
and ecx, 1
je 0x454eab
mov edx, dword [ebp - 4]
push edx
call fcn.00456bf0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x454eab
mov eax, dword [ebp - 8]
jmp 0x454f99
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 4]
cmp ecx, 1
je 0x454f1a
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.00454bc0
add esp, 4
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x454f1a
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2aa]
test edx, edx
jne 0x454f1a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
push 1
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0x316]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2d0
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2c4], 0
je 0x454f56
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c4]
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c4], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2cc], 0
je 0x454f82
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2cc]
push ecx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2cc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffe
mov edx, dword [ebp - 4]
mov dword [edx + 0x320], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x455d10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffd
mov edx, dword [ebp + 8]
mov dword [edx + 0x320], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [str.WKNC_Id:_fbread.cpp_7003_2011_05_16_16:32:53Z_jsturton___WORKNC]
mov dword [eax + 0x210], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x214], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x21c], 0xa0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x218], 0xa0
mov edx, dword [ebp + 8]
mov dword [edx + 0x220], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x224], 0
call fcn.00454740
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x228
push ecx
call sub.MSVCR100.dll_strcpy
add esp, 8
mov edx, dword [ebp + 8]
mov byte [edx + 0x2a8], 1
mov eax, dword [ebp + 8]
mov byte [eax + 0x2a9], 1
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2aa], 1
mov edx, dword [ebp + 8]
mov byte [edx + 0x2ac], 0
call fcn.00454690
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2ab], al
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
push 0xa0
push 1
mov ecx, dword [ebp + 8]
add ecx, 0x210
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 0xa0
je 0x455dfb
mov eax, 0xffffffe6
jmp 0x455dfd
xor eax, eax
pop ebp
ret

Function at 0x455e00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
pop ebp
ret
Function at 0x456bc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
pop ebp
ret
Function at 0x45a3d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x46a570]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045a500
add esp, 8
cmp eax, 0xffffffff
je 0x45a4cf
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
je 0x45a4ae
push 0x101
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR100.dll__read]
add esp, 0xc
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x45a484
lea edx, [ebp - 0x148]
push edx
call dword [sym.imp.MSVCR100.dll_atol]
add esp, 4
cmp dword [ebp + 0xc], eax
jne 0x45a460
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x45a482
cmp dword [0x6e8fb8], 0
je 0x45a482
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x467d88
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
jmp 0x45a49f
cmp dword [0x6e8fb8], 0
je 0x45a49f
mov eax, dword [ebp - 0x40]
push eax
push str._nread_error_:_nblu___d_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
jmp 0x45a4cd
cmp dword [0x6e8fb8], 0
je 0x45a4cd
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x3c]
push eax
push str._nopen_error_:_handle___d___nomfic___s_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
jmp 0x45a4ea
cmp dword [0x6e8fb8], 0
je 0x45a4ea
mov ecx, dword [ebp + 8]
push ecx
push str._nstat_error_:_nomfic___s_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00442f5b
mov esp, ebp
pop ebp
ret
Function at 0x45a520
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x46a570]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
push 0x180
push 0x502
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x45a5a2
mov ecx, dword [ebp - 4]
push ecx
push 0x467e1c
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call sub.MSVCR100.dll_strlen
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.MSVCR100.dll__write]
add esp, 0xc
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
jmp 0x45a638
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 0x11
jne 0x45a631
push 0x100
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x45a62f
push 0x14
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x13
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.MSVCR100.dll__read]
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x45a60c
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR100.dll_atol]
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x45a613
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
je 0x45a62f
mov dword [ebp - 0x28], 0xffffffff
jmp 0x45a638
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00442f5b
mov esp, ebp
pop ebp
ret