joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fa90
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x18]
push eax
push ecx
push ebp
push esi
push ebx
push edi
push edx
call fcn.0041f280
mov ecx, eax
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov dword [eax], ecx
mov ax, word [esi + 6]
mov word [edx + 0x16], ax
mov al, byte [esi + 0x12]
and al, 3
mov byte [edx + 0x18], al
mov al, byte [esi + 0x12]
shr al, 2
and al, 7
movzx ax, al
mov word [edx + 0x1a], ax
mov ax, word [esi + 0x10]
mov word [edx + 0x1c], ax
mov al, byte [esp + 0x28]
test al, al
je 0x41fb3e
mov al, byte [esp + 0x2c]
test al, al
je 0x41fb06
mov ax, word [edx + 0x16]
jmp 0x41fb0a
mov ax, word [ebp]
push 0
push edx
mov edx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x48]
push edx
mov dl, byte [edi + 0x10]
push eax
mov eax, dword [esp + 0x48]
push ebp
push ebx
push esi
push eax
push edx
call fcn.004227d0
mov byte [edi + 0x10], 0
pop edi
pop esi
pop ebp
pop ebx
ret 0x3c
mov eax, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x54]
push ebp
push eax
push edx
push esi
push ebx
call fcn.0041fb70
pop edi
pop esi
pop ebp
pop ebx
ret 0x3c
Function at 0x4256a0
Capabilities:
Terminate process

Disassembly:
mov al, byte [0x4692e8]
test al, al
je 0x4256ae
call fcn.00463e00
push 0x404490
call dword [sym.imp.MSVCRT.dll_puts]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 8
push 0x44c
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x42f460
Capabilities:
Copy file
Terminate process

Disassembly:
mov al, byte [0x4692e8]
test al, al
je 0x42f46e
call fcn.00463e00
push 0x406a60
call dword [sym.imp.MSVCRT.dll_puts]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 8
push 0x44c
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x42f4a0
Capabilities:
Copy file

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0xc]
push 1
push 0
push 0x8002
mov eax, dword [edi]
push eax
call fcn.0040b4e0
push eax
call fcn.0040ba00
mov ebp, dword [edi + 4]
test ebp, ebp
je 0x42f539
push ebx
push esi
mov esi, dword [edi]
mov eax, ebp
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42f4f2
test cl, cl
je 0x42f4ee
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42f4f2
add eax, 2
add esi, 2
test cl, cl
jne 0x42f4ca
xor eax, eax
jmp 0x42f4f7
sbb eax, eax
sbb eax, 0xffffffff
pop esi
pop ebx
test eax, eax
je 0x42f539
push 1
push 0
push 0x8002
push ebp
call fcn.0040b4e0
push eax
call fcn.0040ba00
mov eax, dword [edi]
mov ecx, dword [edi + 4]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x42f539
mov edx, dword [edi + 4]
mov eax, dword [edi]
push edx
push 0x47c
push eax
call fcn.00431660
add esp, 0xc
pop edi
pop ebp
ret 4
Function at 0x431590
Capabilities:
Terminate process

Disassembly:
mov al, byte [0x496368]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x14]
test al, al
jne 0x431638
mov al, byte [0x4690c4]
mov byte [0x496368], 1
test al, al
je 0x4315bd
call fcn.00415270
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push ebx
push eax
push ebp
push edi
push ecx
call fcn.00431460
mov al, byte [0x481160]
mov bl, byte [esp + 0x1c]
test al, al
je 0x4315e5
test bl, bl
je 0x4315e5
call fcn.004516e0
call fcn.0040bbb0
call fcn.004104e0
test bl, bl
pop ebx
je 0x431638
mov eax, dword [0x481170]
mov esi, dword [sym.imp.MSVCRT.dll__unlink]
test eax, eax
je 0x43160e
cmp byte [eax], 0
je 0x43160e
push eax
call esi
add esp, 4
mov al, byte [0x481160]
test al, al
je 0x431638
mov edx, dword [0x481154]
push 0
push edx
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jne 0x431638
mov eax, dword [0x481154]
push eax
call esi
add esp, 4
cmp edi, 2
jne 0x43164c
push 0x4c2
push 0
call fcn.00431530
add esp, 8
push ebp
call dword [sym.imp.MSVCRT.dll_exit]
pop edi
pop esi
pop ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x432320
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor edx, edx
push esi
push edi
mov eax, dword [ebp + 0xc]
shl eax, 4
div dword [ebp + 8]
cmp eax, 0x30
jbe 0x432343
mov eax, dword [esp + 0x20]
push eax
push ebp
call fcn.00432460
mov edx, dword [esp + 0x14]
xor eax, eax
mov cl, byte [edx]
test cl, cl
je 0x43236b
movsx ecx, cl
mov esi, eax
mov edi, ecx
shr esi, 1
shl edi, 0x12
xor esi, eax
add eax, edi
add ecx, eax
inc edx
lea eax, [ecx + esi]
mov cl, byte [edx]
test cl, cl
jne 0x43234f
xor edx, edx
mov ecx, 0x1eca9d3b
div ecx
mov edi, dword [ebp + 4]
mov esi, edx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [ebp]
mov ecx, edx
cmp ecx, eax
jae 0x432393
lea ecx, [edi + edi]
mov eax, esi
xor edx, edx
div ecx
mov ecx, edx
mov esi, dword [ebp + 0x18]
mov eax, ecx
xor edx, edx
div esi
mov edx, dword [ebp + 0x28]
mov edi, dword [edx + eax*4]
mov eax, ecx
xor edx, edx
div esi
mov eax, dword [edi]
mov edi, dword [eax + edx*4]
test edi, edi
lea ebx, [eax + edx*4]
je 0x4323f9
mov ecx, dword [esp + 0x20]
mov edx, dword [edi]
push ecx
push edx
call dword [ebp + 0x20]
mov esi, eax
mov ecx, dword [esp + 0x14]
mov dl, byte [ecx]
mov al, dl
cmp dl, byte [esi]
jne 0x4323e9
test al, al
je 0x4323e5
mov dl, byte [ecx + 1]
mov al, dl
cmp dl, byte [esi + 1]
jne 0x4323e9
add ecx, 2
add esi, 2
test al, al
jne 0x4323c5
xor eax, eax
jmp 0x4323ee
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43240a
mov edi, dword [edi + 4]
test edi, edi
jne 0x4323b4
mov al, byte [esp + 0x1c]
test al, al
jne 0x432413
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x14
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esp + 0x24]
push 8
mov byte [eax], 1
mov al, byte [ebp + 0x34]
test al, al
je 0x43242a
call fcn.004519d0
jmp 0x432433
lea ecx, [ebp + 0x30]
push ecx
call fcn.004512e0
mov ecx, eax
xor edx, edx
pop edi
pop esi
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov edx, dword [ebx]
mov dword [eax + 4], edx
mov dword [ebx], eax
mov ecx, dword [ebp + 0xc]
inc ecx
mov dword [ebp + 0xc], ecx
pop ebp
pop ebx
ret 0x14
Function at 0x432460
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push edi
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
mov edi, dword [esi]
mov eax, dword [esi + 4]
imul edx, ecx
lea ebp, [eax + edi]
cmp ebp, edx
mov dword [esp + 0x18], ebp
jb 0x43249d
push esi
call fcn.00432130
or al, 1
push eax
push esi
call fcn.00432120
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov edx, dword [esi + 0x10]
mov eax, edi
inc edx
mov dword [esi + 0x10], edx
xor edx, edx
div ecx
mov edx, dword [esi + 0x28]
mov eax, dword [edx + eax*4]
xor edx, edx
mov dword [esp + 0x2c], eax
mov eax, edi
div ecx
mov eax, ebp
mov edi, edx
xor edx, edx
div ecx
mov dword [esp + 0x24], edi
test edx, edx
jne 0x432508
push 4
lea ecx, [esi + 0x2c]
push 1
push ecx
push esi
call fcn.00432140
mov ecx, eax
mov eax, ebp
xor edx, edx
push 4
div dword [esi + 0x18]
mov edx, dword [esi + 0x28]
mov dword [edx + eax*4], ecx
mov eax, dword [esi + 0x18]
lea ecx, [esi + 0x30]
push eax
push ecx
push esi
call fcn.00432140
mov ecx, eax
mov eax, ebp
xor edx, edx
div dword [esi + 0x18]
mov edx, dword [esi + 0x28]
mov eax, dword [edx + eax*4]
mov dword [eax], ecx
mov ecx, dword [esi + 0x18]
mov eax, ebp
xor edx, edx
div ecx
mov edx, dword [esi + 0x28]
mov ebx, dword [edx + eax*4]
mov eax, ebp
xor edx, edx
mov dword [esp + 0x1c], ebx
div ecx
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov ecx, eax
mov eax, dword [esi + 4]
cmp ecx, eax
mov dword [esp + 0x20], edx
jne 0x43253e
add eax, eax
mov dword [esi], 0
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
xor ebp, ebp
inc ecx
mov dword [esp + 0x14], ebp
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], ebp
mov eax, dword [ecx]
mov ecx, dword [ebx]
mov edi, dword [eax + edi*4]
mov dword [ecx + edx*4], ebp
cmp edi, ebp
je 0x432617
mov edx, dword [esp + 0x30]
mov eax, dword [edi]
push edx
push eax
call dword [esi + 0x20]
mov edx, eax
xor eax, eax
mov cl, byte [edx]
test cl, cl
je 0x43259a
movsx ecx, cl
mov ebx, eax
mov ebp, ecx
shr ebx, 1
shl ebp, 0x12
xor ebx, eax
add eax, ebp
add ecx, eax
inc edx
lea eax, [ecx + ebx]
mov cl, byte [edx]
test cl, cl
jne 0x43257a
mov ebp, dword [esp + 0x10]
xor edx, edx
mov ecx, 0x1eca9d3b
div ecx
mov ebx, dword [esi + 4]
mov ecx, edx
xor edx, edx
mov eax, ecx
div ebx
cmp edx, dword [esi]
jae 0x4325ba
add ebx, ebx
mov eax, ecx
xor edx, edx
div ebx
cmp edx, dword [esp + 0x18]
jne 0x432608
test ebp, ebp
jne 0x4325d3
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov eax, dword [edx]
mov dword [eax + ecx*4], edi
jmp 0x4325d6
mov dword [ebp + 4], edi
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4325f0
mov edx, dword [esp + 0x2c]
mov ecx, dword [edi + 4]
mov eax, dword [edx]
mov edx, dword [esp + 0x24]
mov dword [eax + edx*4], ecx
jmp 0x4325f6
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov ebp, edi
mov edi, dword [edi + 4]
mov dword [esp + 0x10], ebp
mov dword [ebp + 4], 0
jmp 0x43260f
mov dword [esp + 0x14], edi
mov edi, dword [edi + 4]
test edi, edi
jne 0x432565
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x439610
Capabilities:
Delete file

Disassembly:
mov eax, dword [0x481198]
mov dword [0x4690d8], 0x407108
cmp eax, 0x1b
ja case.0x439628.20
jmp dword [eax*4 + 0x439854]
mov al, byte [0x480ed4]
test al, al
je case.0x439628.15
push 0x177b
jmp 0x439688
mov al, byte [0x480ed4]
test al, al
je case.0x439628.15
jmp 0x439683
mov al, byte [0x480ed4]
test al, al
je case.0x439628.15
push 0x177c
jmp 0x439688
mov al, byte [0x480ed4]
test al, al
je case.0x439628.15
push 0x178a
jmp 0x439688
mov al, byte [0x480ed4]
test al, al
je case.0x439628.15
push 0x177e
jmp 0x439688
mov al, byte [0x480ed4]
test al, al
je case.0x439628.15
push 0x177d
push 0
call fcn.00431710
add esp, 8
mov eax, dword [0x481184]
test eax, eax
je case.0x439628.2
push 1
push eax
call fcn.0040ba00
mov dword [0x481184], 0
jmp case.0x439628.2
mov al, byte [0x480ed4]
test al, al
je case.0x439628.2
push 0x177e
jmp 0x43975b
mov al, byte [0x480ed4]
test al, al
je case.0x439628.2
push 0x177f
jmp 0x43975b
mov al, byte [0x480ed4]
test al, al
je case.0x439628.2
push 0x1780
jmp 0x43975b
mov al, byte [0x480ed4]
test al, al
je case.0x439628.2
push 0x1781
jmp 0x43975b
mov al, byte [0x480ed4]
test al, al
je case.0x439628.2
push 0x1789
jmp 0x43975b
mov al, byte [0x480ed4]
test al, al
je case.0x439628.2
push 0
push 0
push 0x177d
push 0
call fcn.00431710
add esp, 0x10
jmp case.0x439628.2
mov al, byte [0x480ed4]
test al, al
je case.0x439628.2
push 0
push 0
push 0x1783
push 0
call fcn.00431710
add esp, 0x10
jmp case.0x439628.2
mov al, byte [0x480ed4]
test al, al
je case.0x439628.2
push 0x177d
push 0
call fcn.00431710
add esp, 8
push ebp
mov ebp, dword [esp + 8]
mov byte [0x481161], 0
push edi
mov eax, dword [ebp]
mov edi, dword [eax + 0x2a4]
test edi, edi
je 0x4397ce
mov cl, byte [eax + 0x148]
test cl, cl
je 0x4397ce
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push esi
push ecx
push 1
call dword [sym.imp.MSVCRT.dll_calloc]
mov edx, eax
or ecx, 0xffffffff
mov dword [0x496464], edx
mov eax, dword [ebp]
add esp, 8
mov edi, dword [eax + 0x2a4]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 1
push ebp
call fcn.004358c0
mov ecx, dword [0x481154]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
call fcn.0040bbb0
call fcn.004104e0
mov eax, dword [0x481164]
pop edi
test eax, eax
pop ebp
je 0x439812
mov edx, dword [sym.imp.MSVCRT.dll__iob]
add edx, 0x20
cmp eax, edx
je 0x439812
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, dword [0x481148]
test eax, eax
je case.0x439628.20
push 0x481140
call fcn.0045f340
or eax, 0xffffffff
ret 4
mov eax, dword [0x481184]
push 1
push eax
call fcn.0040ba00
mov dword [0x481184], 0
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
push edx
call fcn.0044a530
xor eax, eax
ret 4
Function at 0x43bdf0
Capabilities:
Terminate process

Disassembly:
mov al, byte [0x4692e8]
test al, al
je 0x43bdfe
call fcn.00463e00
push 0x407150
call dword [sym.imp.MSVCRT.dll_puts]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 8
push 0x44c
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x43fdd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push edi
mov edi, ecx
mov dword [esp + 8], edi
mov al, byte [edi + 0x147]
test al, al
je 0x43fdf7
mov eax, dword [esp + 0x30]
pop edi
mov dword [eax], 0
xor eax, eax
add esp, 0x28
ret 4
mov ecx, dword [edi + 0x1c8]
push ebx
push ebp
push esi
lea edx, [esp + 0x28]
xor ebp, ebp
push ecx
push edx
xor ebx, ebx
mov dword [esp + 0x18], ebp
call fcn.0040f860
lea eax, [esp + 0x28]
push eax
call fcn.0040f890
test al, al
je 0x43fea6
mov esi, 1
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0040f8e0
lea eax, [esp + 0x18]
push eax
call fcn.0040f910
test al, al
je 0x43fe8a
test ebx, ebx
mov eax, ebx
je 0x43fe63
mov ecx, dword [esp + 0x24]
mov ecx, dword [ecx + 0x30]
cmp dword [eax + 4], ecx
je 0x43ff76
mov eax, dword [eax]
test eax, eax
jne 0x43fe54
push 0xc
call fcn.00451b20
mov dword [eax], ebx
mov edx, dword [esp + 0x24]
mov ebx, eax
inc ebp
mov ecx, dword [edx + 0x30]
mov dword [eax + 8], esi
mov dword [eax + 4], ecx
lea edx, [esp + 0x18]
push edx
call fcn.0040f910
test al, al
jne 0x43fe47
lea eax, [esp + 0x18]
push eax
call fcn.0040f8d0
lea ecx, [esp + 0x28]
push ecx
call fcn.0040f890
test al, al
jne 0x43fe2a
mov dword [esp + 0x10], ebp
lea edx, [esp + 0x28]
push edx
call fcn.0040f8d0
mov esi, dword [edi + 0x1e8]
xor ecx, ecx
test esi, esi
mov edi, esi
jbe 0x43feda
mov eax, dword [esp + 0x14]
mov ebp, dword [eax + 0x1e4]
xor edx, edx
mov dl, byte [ecx + ebp]
rol edx, cl
add edi, edx
inc ecx
cmp ecx, esi
jb 0x43fec8
mov ebp, dword [esp + 0x10]
test ebx, ebx
mov eax, ebx
je 0x43fef0
mov edx, dword [eax + 4]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
rol edx, cl
add edi, edx
test eax, eax
jne 0x43fee0
mov eax, edi
xor edx, edx
shr eax, 5
mov ecx, 3
div ecx
add edx, ebp
lea ebp, [edx*8 + 0x20]
push ebp
call fcn.00451b40
mov edx, dword [esp + 0x3c]
mov esi, eax
mov dword [edx], esi
mov eax, dword [0x4693b0]
xor eax, edi
mov dword [esi + 4], edi
xor eax, 0xaa559966
mov dword [esi], eax
add esi, 8
mov eax, ebx
mov dword [esi], edi
mov dword [esi + 4], edi
add esi, 8
test ebx, ebx
je 0x43ff5b
mov ecx, dword [eax + 4]
push eax
xor ecx, edi
mov dword [esi], ecx
mov edx, dword [eax + 8]
xor edx, edi
mov dword [esi + 4], edx
mov ebx, dword [eax]
add esi, 8
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, ebx
test ebx, ebx
jne 0x43ff37
mov eax, dword [0x4693b4]
mov dword [esi + 4], edi
xor eax, 0xaa559966
mov dword [esi], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x28
ret 4
test eax, eax
je 0x43fe63
inc dword [eax + 8]
jmp 0x43fe7c
Function at 0x446730
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x208
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_getenv]
push 0x407838
call edi
add esp, 4
mov dword [0x480f08], eax
test eax, eax
je 0x446842
mov esi, dword [sym.imp.MSVCRT.dll__fullpath]
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call esi
push 0x104
lea ecx, [esp + 0x11c]
push 0x4076c8
push ecx
call esi
lea edx, [esp + 0x124]
lea eax, [esp + 0x20]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0x20
test eax, eax
jne 0x4467be
mov ecx, dword [0x480f08]
push ecx
push 0xfce
push eax
call fcn.00431730
add esp, 0xc
mov dword [0x480f08], 0
pop edi
pop esi
add esp, 0x208
ret
mov edx, dword [0x480f08]
push edx
push 0xfcd
push 0
call fcn.00431730
push 0x407828
call edi
add esp, 0x10
test eax, eax
jne 0x4467e4
mov eax, 0x40781c
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push 0x20
and ecx, 3
lea eax, [esp + 0x10]
push 0x40468c
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__fsopen]
add esp, 0xc
mov dword [0x480f04], eax
test eax, eax
pop ebx
jne 0x446842
lea ecx, [esp + 8]
push ecx
push 0x478
push eax
call fcn.00431660
add esp, 0xc
pop edi
pop esi
add esp, 0x208
ret
Function at 0x446850
Capabilities:
Copy file
Query environment variable

Disassembly:
mov al, byte [0x496445]
sub esp, 0x308
test al, 1
push ebx
push ebp
push esi
push edi
jne 0x446886
mov bl, al
push 0x407828
or bl, 1
mov byte [0x496445], bl
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
setne al
mov byte [0x496444], al
mov eax, dword [esp + 0x31c]
lea ecx, [esp + 0x218]
lea edx, [esp + 0x118]
push ecx
push edx
push 0
push 0
push eax
call dword [sym.imp.MSVCRT.dll__splitpath]
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, 1
not ecx
dec ecx
mov dword [esp + 0x10], ecx
mov edi, dword [0x480f08]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x407870
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1c]
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x124]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x24]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x22c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x2c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
cmp eax, 0xffffffff
jne 0x4469bd
mov al, byte [0x496444]
test al, al
jne 0x4469f7
mov ecx, dword [esp + 0x10]
inc ebp
push ebp
push 0x40786c
lea edx, [esp + ecx + 0x120]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x4468cb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
push 0
mov esi, dword [esp + 0x320]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
mov eax, 0x4028f4
jne 0x4469e7
mov eax, 0x407860
push eax
push esi
push 0x407850
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 0xc
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
add ecx, 0x20
push ecx
call dword [sym.imp.MSVCRT.dll_fflush]
mov al, byte [esp + 0x324]
add esp, 4
test al, al
pop edi
pop esi
pop ebp
pop ebx
je 0x446a3e
mov ecx, dword [0x480f04]
lea edx, [esp + 0x208]
lea eax, [esp + 0x108]
push edx
push eax
push 0x407844
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0x10
add esp, 0x308
ret 8
Function at 0x446b80
Capabilities:
Terminate process

Disassembly:
mov al, byte [0x4692e8]
test al, al
je 0x446b8e
call fcn.00463e00
push 0x4078a0
call dword [sym.imp.MSVCRT.dll_puts]
add esp, 4
push 0x44c
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x44a240
Capabilities:
Resolve path using msvcrt

Disassembly:
sub esp, 0x40
push ebx
push esi
push edi
call fcn.0040bbb0
call fcn.004104e0
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0xc]
push eax
push 0x408224
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
push 0
call dword [sym.imp.MSVCRT.dll_fflush]
mov edx, dword [0x496470]
add esp, 0x10
lea eax, [edx*4 + 0xc]
push eax
call fcn.00451b20
mov ecx, dword [0x496470]
mov esi, eax
xor eax, eax
test ecx, ecx
jle 0x44a2aa
mov ecx, dword [0x49646c]
inc eax
mov edx, dword [ecx + eax*4 - 4]
mov dword [esi + eax*4 - 4], edx
mov ecx, dword [0x496470]
cmp eax, ecx
jl 0x44a291
lea eax, [esp + 0xc]
mov dword [esi + ecx*4], eax
mov ecx, dword [0x496470]
mov dword [esi + ecx*4 + 4], 0x4017d4
mov edx, dword [0x496470]
mov dword [esi + edx*4 + 8], 0
call fcn.0044a200
mov ebx, dword [sym.imp.MSVCRT.dll___p__pgmptr]
push esi
call ebx
mov eax, dword [eax]
push eax
push 0
call dword [sym.imp.MSVCRT.dll__spawnv]
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
jne 0x44a304
call ebx
mov ecx, dword [eax]
push ecx
push 0x486
push 0
call fcn.00431660
add esp, 0xc
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4

Function at 0x44a320
Capabilities:
Accept command line arguments
Resolve path using msvcrt

Disassembly:
push ebx
push ebp
push esi
push edi
push 0
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 4
push 0x18
call fcn.00451b20
mov esi, eax
mov eax, dword [0x49646c]
or ecx, 0xffffffff
mov edi, dword [eax]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 2
push ecx
call fcn.00451b20
mov ecx, dword [0x49646c]
mov ebp, eax
mov edx, dword [ecx]
push edx
push 0x408264
push ebp
call dword [sym.imp.MSVCRT.dll_sprintf]
mov bl, byte [esp + 0x20]
add esp, 0xc
test bl, bl
mov dword [esi], ebp
je 0x44a3a1
mov eax, dword [0x496464]
test eax, eax
je 0x44a3a1
mov dword [esi + 4], eax
mov al, byte [0x480ed4]
test al, al
je 0x44a3c9
mov eax, dword [0x496464]
push eax
push 0x178b
push 0
call fcn.00431710
add esp, 0xc
jmp 0x44a3c9
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dl, byte [eax]
mov cl, 0x20
cmp dl, 0x22
jne 0x44a3b3
mov cl, 0x22
inc eax
cmp byte [eax], cl
je 0x44a3bf
mov dl, byte [eax + 1]
inc eax
cmp dl, cl
jne 0x44a3b7
cmp byte [eax], 0x22
jne 0x44a3c5
inc eax
inc eax
mov dword [esi + 4], eax
test bl, bl
je 0x44a3d6
mov dword [esi + 8], 0x408250
jmp 0x44a3dd
mov dword [esi + 8], 0x408240
mov dword [esi + 0xc], 0x4017d4
mov dword [esi + 0x10], 0x408234
mov dword [esi + 0x14], 0
call fcn.0044a200
mov ebx, dword [sym.imp.MSVCRT.dll___p__pgmptr]
push esi
call ebx
mov ecx, dword [eax]
push ecx
push 0
call dword [sym.imp.MSVCRT.dll__spawnv]
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
jne 0x44a429
call ebx
mov edx, dword [eax]
push edx
push 0x486
push 0
call fcn.00431660
add esp, 0xc
push esi
mov esi, dword [sym.imp.MSVCRT.dll_free]
call esi
push ebp
call esi
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4