joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422cf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f469
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4fdca8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
mov al, byte [ebp + 0x24]
mov byte [edx + 4], al
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00401cad
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00401e29
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], 0xffffffff
lea edx, [ebp + 0x14]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.004027b6
mov byte [ebp - 4], 3
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0040198d
push 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00452af0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.004016bd
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x434c60
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0
mov ecx, dword [ebp + 8]
call fcn.00401280
mov dword [ebp - 4], eax
push 1
mov ecx, dword [ebp + 8]
call fcn.00401280
mov dword [ebp - 8], eax
push 0x4cc35c
mov ecx, dword [ebp - 4]
call fcn.00450270
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x434caf
mov eax, 1
jmp 0x434d62
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
push 0x4cc360
mov ecx, dword [ebp - 8]
call fcn.00450270
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x434cfb
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 8]
call fcn.00450270
push eax
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
mov ecx, dword [ebp - 8]
call fcn.00450270
push eax
mov ecx, dword [ebp - 4]
call fcn.00450270
push eax
call dword [sym.imp.MSVCR100.dll_rename]
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x434d60
push 0x4cc364
mov ecx, dword [ebp - 8]
call fcn.00450270
push eax
mov ecx, dword [ebp - 4]
call fcn.00450270
push eax
call fcn.00434d70
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x434d4e
mov eax, 0xa
jmp 0x434d62
mov ecx, dword [ebp - 4]
call fcn.00450270
push eax
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x434d70
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x4fdca8]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00433ff0
add esp, 4
test eax, eax
jg 0x434d9b
or eax, 0xffffffff
jmp 0x434e72
push 0x4cc358
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x434dbe
or eax, 0xffffffff
jmp 0x434e72
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x434ded
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
or eax, 0xffffffff
jmp 0x434e72
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_ftell]
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
push 1
push 0x800
lea ecx, [ebp - 0x818]
push ecx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_ftell]
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x818]
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCR100.dll_feof]
add esp, 4
test eax, eax
je 0x434ded
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00469394
mov esp, ebp
pop ebp
ret
Function at 0x435160
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4fdca8]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x43518b
mov eax, dword [ebp + 0xc]
push eax
push str.system__s_..._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00402c34
mov ecx, eax
call fcn.00402761
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
movzx eax, byte [edx]
test eax, eax
je 0x4351d3
push str..._aborted_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
jmp 0x4352b6
cmp dword [ebp - 4], 0
je 0x4352a1
cmp dword [ebp + 8], 0
je 0x4352a1
mov cx, word [0x4cc394]
mov word [ebp - 0x210], cx
mov dl, byte [0x4cc396]
mov byte [ebp - 0x20e], dl
push 0x1fd
push 0
lea eax, [ebp - 0x20d]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x435246
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x21c], eax
jmp 0x435250
mov dword [ebp - 0x21c], 0
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x218], edx
call dword [sym.imp.MSVCR100.dll__errno]
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCR100.dll__errno]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x218]
push edx
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [0x4fca30]
push ecx
mov edx, dword [ebp - 8]
push edx
push str._d__d:_CWD__s___d_n____system__s__returned__d__0x_X__errno_d__0x_X__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0x28
cmp dword [ebp - 4], 0
je 0x4352b6
mov eax, dword [ebp - 8]
cmp eax, dword [0x4fca30]
jle 0x435192
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00469394
mov esp, ebp
pop ebp
ret
Function at 0x43cbb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.0043c6a0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43cbd5
mov eax, 0xfffffff5
jmp 0x43cd09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x320]
and edx, 1
jne 0x43cbed
mov eax, 0xfffffff4
jmp 0x43cd09
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
shr ecx, 2
and ecx, 1
je 0x43cc1b
mov edx, dword [ebp - 4]
push edx
call fcn.0043b910
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43cc1b
mov eax, dword [ebp - 8]
jmp 0x43cd09
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 4]
cmp ecx, 1
je 0x43cc8a
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043c930
add esp, 4
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x43cc8a
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2aa]
test edx, edx
jne 0x43cc8a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
push 1
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0x316]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2d0
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2c4], 0
je 0x43ccc6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c4]
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c4], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2cc], 0
je 0x43ccf2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2cc]
push ecx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2cc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffe
mov edx, dword [ebp - 4]
mov dword [edx + 0x320], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x43e510
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.WNC_BUFFER_TOO_SMALL_OPTION
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43e552
push str.crash
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x43e552
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 1
mov esp, ebp
pop ebp
ret
Function at 0x43ef80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x4cd01c
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x43efa5
call fcn.0043f700
jmp 0x43f0a4
push str.WNCZONE
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x43efbf
call fcn.0043fc20
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43efdd
mov eax, dword [ebp - 4]
jmp 0x43f0a4
cmp dword [0x4ff1d8], 0
jne 0x43efeb
call fcn.0043f0b0
push 0x4cd028
mov eax, dword [0x4ff1d8]
push eax
call fcn.00441410
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x43f011
xor eax, eax
jmp 0x43f0a4
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0x4ff1d8]
push ecx
call fcn.00441ad0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43f0a1
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
jmp 0x43f043
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x43f04f
jmp 0x43f03a
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
jmp 0x43f063
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 4]
jb 0x43f082
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x43f082
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
test eax, eax
jl 0x43f082
jmp 0x43f05a
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x43f0a1
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x43fc40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0x4cd02c
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x43fc82
push str.WNCTMPDIR
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x43fc80
push str.from_environment_variable_WNCTMPDIR
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x43fcc0
jmp 0x43fca9
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x43fca9
push str.from_environment
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x43fcc0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x4ff1d8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00441380
add esp, 0xc
pop ebp
ret

Function at 0x43fd40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x4fdca8]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x43fd60
xor eax, eax
jmp 0x43fe98
mov eax, dword [ebp + 8]
push eax
push 0x4cd078
lea ecx, [ebp - 0x190]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x190]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43fd9a
mov eax, dword [ebp - 4]
jmp 0x43fe98
cmp dword [0x4ff1d8], 0
jne 0x43fda8
call fcn.0043f0b0
push str.path
mov eax, dword [0x4ff1d8]
push eax
call fcn.00441410
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x43fdce
xor eax, eax
jmp 0x43fe98
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0x4ff1d8]
push ecx
call fcn.00441ad0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43fe95
mov edx, dword [ebp - 4]
mov dword [ebp - 0x194], edx
jmp 0x43fe0d
mov eax, dword [ebp - 0x194]
add eax, 1
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
movsx edx, byte [ecx]
test edx, edx
je 0x43fe1c
jmp 0x43fdfe
mov eax, dword [ebp - 0x194]
sub eax, 1
mov dword [ebp - 0x194], eax
jmp 0x43fe3c
mov ecx, dword [ebp - 0x194]
sub ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
cmp edx, dword [ebp - 4]
jb 0x43fe64
mov eax, dword [ebp - 0x194]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x43fe64
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
jl 0x43fe64
jmp 0x43fe2d
mov ecx, dword [ebp - 0x194]
add ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
je 0x43fe95
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x198]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00469394
mov esp, ebp
pop ebp
ret
Function at 0x43feb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4fdca8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str._sPATH
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x43ff01
lea eax, [ebp - 0x58]
push eax
push str.from_environment__s
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
xor eax, eax
jmp 0x43ff17
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x4ff1d8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00441380
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00469394
mov esp, ebp
pop ebp
ret
Function at 0x443600
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x44361b
xor eax, eax
jmp 0x443627
mov eax, dword [ebp - 4]
and eax, 0x10
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x443710
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll__mkdir]
add esp, 4
test eax, eax
je 0x443734
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 0xd
je 0x443734
or eax, 0xffffffff
jmp 0x443736
xor eax, eax
pop ebp
ret
Function at 0x4439c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4fdca8]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0x4cd468
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4439f2
mov eax, dword [ebp - 4]
jmp 0x443b79
push str.WNCHOME_LS
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x443b3d
push 0x200
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x443a31
xor eax, eax
jmp 0x443b79
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x443a4e
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x443a74
mov edx, dword [ebp - 0x21c]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x443a72
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], 0x2f
jmp 0x443a3f
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00443b90
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x443a95
xor eax, eax
jmp 0x443b79
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00443b90
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x443ac5
xor eax, eax
jmp 0x443b79
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00443b90
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x443af5
xor eax, eax
jmp 0x443b79
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
push 0x4cd47c
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
jne 0x443b30
push 0x4cd480
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x443b34
xor eax, eax
jmp 0x443b79
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp + 8]
test edx, edx
je 0x443b76
push 0x4cd484
push 0x4ff418
call sub.MSVCR100.dll_strcpy
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x4ff418
call sub.MSVCR100.dll_strcat
add esp, 8
push 0x4ff418
call dword [sym.imp.MSVCR100.dll__putenv]
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00469394
mov esp, ebp
pop ebp
ret
Function at 0x443bf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x4fdca8]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00443d20
add esp, 8
cmp eax, 0xffffffff
je 0x443cef
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
je 0x443cce
push 0x101
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR100.dll__read]
add esp, 0xc
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x443ca4
lea edx, [ebp - 0x148]
push edx
call dword [sym.imp.MSVCR100.dll_atol]
add esp, 4
cmp dword [ebp + 0xc], eax
jne 0x443c80
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x443ca2
cmp dword [0x4ff618], 0
je 0x443ca2
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._nverif_error_:_startpid___lu___lockpid___s_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
jmp 0x443cbf
cmp dword [0x4ff618], 0
je 0x443cbf
mov eax, dword [ebp - 0x40]
push eax
push str._nread_error_:_nblu___d_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
jmp 0x443ced
cmp dword [0x4ff618], 0
je 0x443ced
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x3c]
push eax
push str._nopen_error_:_handle___d___nomfic___s_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
jmp 0x443d0a
cmp dword [0x4ff618], 0
je 0x443d0a
mov ecx, dword [ebp + 8]
push ecx
push str._nstat_error_:_nomfic___s_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00469394
mov esp, ebp
pop ebp
ret
Function at 0x443d40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4fdca8]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
push 0x180
push 0x502
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x443dc2
mov ecx, dword [ebp - 4]
push ecx
push 0x4cd524
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call sub.MSVCR100.dll_strlen
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.MSVCR100.dll__write]
add esp, 0xc
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
jmp 0x443e58
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 0x11
jne 0x443e51
push 0x100
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x443e4f
push 0x14
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x13
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.MSVCR100.dll__read]
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x443e2c
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR100.dll_atol]
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x443e33
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
je 0x443e4f
mov dword [ebp - 0x28], 0xffffffff
jmp 0x443e58
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00469394
mov esp, ebp
pop ebp
ret

Function at 0x444860
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.WNC_WNCFILES_VERBOSE
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x444899
push 0x4cd574
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
je 0x444899
mov eax, 1
jmp 0x44489b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x446b60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491981
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4fdca8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0
push str.WNCHOME
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x446bc5
push 0x4cd910
mov ecx, dword [ebp + 8]
call fcn.00448020
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
or eax, 1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
jmp 0x446c0e
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.00451ec0
add esp, 8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
call fcn.00451b30
push eax
mov ecx, dword [ebp + 8]
call fcn.00445ca0
mov ecx, dword [ebp - 0x18]
or ecx, 1
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004518f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret