joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456808
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x4568a0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, 0x4568b4
call fcn.0045248c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0045349c
mov eax, dword [0x460834]
cmp dword [eax], 0
je 0x45684d
mov eax, dword [0x460834]
mov eax, dword [eax]
call fcn.00455ec0
push 0
mov eax, dword [ebp - 4]
call fcn.00404fec
push eax
call sub.kernel32.dll_WinExec
lea edx, [ebp - 0xc]
mov eax, 2
call fcn.004536b8
lea eax, [ebp - 0xc]
mov edx, 0x456930
call fcn.00404df4
mov eax, dword [ebp - 0xc]
call fcn.00404fec
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4568a7
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b50
ret

Function at 0x456ac8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x456b93
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x412f34]
call fcn.00403d0c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x456b71
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x456bac
push 1
push 0
push 0x64
lea edx, [ebp - 8]
mov eax, 2
call fcn.004536b8
mov eax, dword [ebp - 8]
call fcn.00404fec
push eax
call fcn.00457154
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x456b5b
inc ebx
xor esi, esi
lea ecx, [ebp - 0xc]
mov edx, esi
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.00404fec
push eax
call sub.kernel32.dll_DeleteFileA
inc esi
dec ebx
jne 0x456b3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456b78
mov eax, dword [ebp - 4]
call fcn.00403d3c
ret
Function at 0x456fb4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4570f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.004536b8
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, 0x457114
call fcn.00404e38
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.00409030
test eax, eax
je 0x4570dd
mov byte [ebp - 1], 1
call fcn.00409144
lea edx, [ebp - 0x18]
mov eax, 1
call fcn.004536b8
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 0x457130
call fcn.00404e38
mov eax, dword [ebp - 0x10]
call fcn.004091b4
test al, al
jne 0x45705d
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404fec
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404fec
push eax
call sub.kernel32.dll_CopyFileA
mov dl, 1
mov eax, dword [0x412f34]
call fcn.00403d0c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4570d6
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
jne 0x45708b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x68]
jmp 0x457096
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x68]
push edi
push 0x45714c
push esi
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404eac
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4570dd
mov eax, dword [ebp - 8]
call fcn.00403d3c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4570ff
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00404b50
ret

Function at 0x4575e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fdc
mov eax, dword [ebp - 8]
call fcn.00404fdc
xor eax, eax
push ebp
push 0x4576a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
xor eax, eax
push ebp
push 0x457681
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 1
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.00404fec
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x457671
mov eax, 0x4576c0
call fcn.00455fc4
push 2
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 8]
call fcn.00405044
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45768b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4576ad
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b50
ret
Function at 0x4577d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4577d8
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fdc
xor eax, eax
push ebp
push 0x45796d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404b2c
mov eax, dword [ebp - 4]
mov edx, 0x457984
call fcn.00404f38
jne 0x457820
lea edx, [ebp - 4]
xor eax, eax
call fcn.004536b8
mov dl, 1
mov eax, dword [0x412f34]
call fcn.00403d0c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x457943
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 1
push 1
push 0x64
mov eax, dword [ebp - 4]
call fcn.00404fec
push eax
call fcn.00457154
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x45792d
inc ebx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x10]
push 0x457994
push 0x4579a0
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404eac
mov eax, dword [ebp - 0x14]
mov ecx, 2
mov edx, 0x4579b8
call fcn.004575e0
test al, al
je 0x457926
push dword [ebp - 0x10]
push 0x457994
push 0x4579a0
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404eac
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004576dc
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00408b9c
mov eax, dword [ebp - 0x18]
mov edx, 0x4579b8
call fcn.00404f38
jne 0x457926
push dword [ebp - 0x10]
push 0x457994
push 0x4579a0
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404eac
mov eax, dword [ebp - 0x24]
call fcn.00404fec
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00404b80
jmp 0x45792d
dec ebx
jne 0x45786c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45794a
mov eax, dword [ebp - 0xc]
call fcn.00403d3c
ret

Function at 0x459bbc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x459c14
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 8]
mov eax, 0x459c28
call fcn.0045248c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0045349c
mov eax, dword [ebp - 4]
call fcn.00404fec
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459c1b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b50
ret
Function at 0x45bbf8
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x45bc00
push ecx
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fdc
mov eax, dword [ebp - 8]
call fcn.00404fdc
xor eax, eax
push ebp
push 0x45be35
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
call fcn.00402eb4
mov dl, 1
mov eax, dword [0x451474]
call fcn.00451574
mov ebx, eax
mov dl, 1
mov eax, dword [0x412f34]
call fcn.00403d0c
mov dword [ebp - 0x14], eax
mov edx, 0x80000000
mov eax, ebx
call fcn.00451614
xor eax, eax
push ebp
push 0x45bdfe
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x45be50
push 1
push 1
push 0x64
lea edx, [ebp - 0x1c]
mov eax, 1
call fcn.004536b8
mov eax, dword [ebp - 0x1c]
call fcn.00404fec
push eax
call fcn.00457154
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
call fcn.004034dc
mov edx, eax
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
call fcn.0045349c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x10]
call fcn.00404bc4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0x10]
mov eax, 0x45be5c
call fcn.00405130
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.0040504c
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.0045349c
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00408b9c
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x10]
call fcn.00404bc4
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.00457d08
mov edx, dword [ebp - 0x2c]
mov cl, 1
mov eax, ebx
call fcn.00451678
test al, al
je 0x45bd28
mov byte [ebp - 9], 1
mov eax, ebx
call fcn.004515e4
push dword [ebp - 4]
push 0x45be5c
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404eac
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404fec
mov ebx, eax
push ebx
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.00402e50
mov eax, dword [ebp - 0x30]
call fcn.00404fec
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 0x18]
call fcn.004091b4
test al, al
je 0x45bde8
mov eax, dword [ebp - 0x18]
call fcn.0045b8cc
mov eax, 0xa
call fcn.004034dc
mov edx, eax
add edx, 0xa
mov eax, dword [ebp - 0x18]
call fcn.00457ee4
lea edx, [ebp - 0x34]
mov eax, 1
call fcn.004536b8
lea eax, [ebp - 0x34]
mov edx, 0x45be68
call fcn.00404df4
mov eax, dword [ebp - 0x34]
call fcn.00404fec
push eax
mov edx, ebx
pop eax
call fcn.00453f2c
push 1
push 0
push 0
push ebx
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x45be78
call fcn.00455fc4
call fcn.00456390
push 0
call sub.kernel32.dll_ExitProcess_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45be05
mov eax, dword [ebp - 0x14]
call fcn.00403d3c
ret
Function at 0x45c638
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x45c7b3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x45c78e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00455e84
test al, al
je 0x45c679
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45c798
lea eax, [ebp - 8]
call fcn.00404b2c
call fcn.0045c300
call fcn.0045c360
call fcn.00459b20
push 0x5dc
call sub.kernel32.dll_Sleep_1
call fcn.0045be7c
lea edx, [ebp - 0xc]
mov eax, 0xa
call fcn.00457cd8
lea eax, [ebp - 0x14]
call fcn.00457514
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00457478
push dword [ebp - 0x10]
push 0x45c7cc
push dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404eac
call fcn.00453af0
call fcn.00457d74
test al, al
jne 0x45c726
lea edx, [ebp - 4]
mov eax, dword [ebp - 4]
call fcn.004579bc
test al, al
je 0x45c70e
lea eax, [ebp - 8]
call fcn.00457b1c
call fcn.0045bea4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0045bbf8
jmp 0x45c784
call fcn.00456390
mov eax, 0x45c7d8
call fcn.0045c1c8
xor eax, eax
call fcn.004583c8
lea eax, [ebp - 8]
call fcn.00457b1c
lea edx, [ebp - 0x18]
mov eax, 1
call fcn.00402e50
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00404f38
je 0x45c77f
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00404fec
push eax
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402e50
mov eax, dword [ebp - 0x1c]
call fcn.00404fec
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess_1
call fcn.0045c600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45c798
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c7ba
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404b50
ret
Function at 0x402836
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
and dword [ebp - 0x28], 0
push ebx
push edi
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x428]
push eax
call fcn.00407145
lea eax, [ebp - 0x428]
mov dword [esp], str.JLSms.MDE
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x428]
push 0x41a178
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x4028f3
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push ebx
push 0x28
push 1
lea eax, [ebp - 0x28]
pop edi
push edi
push eax
call esi
add esp, 0x10
cmp dword [ebp - 0x28], 0x4653
jne 0x4028ea
cmp dword [ebp - 0x24], 0x1000
jl 0x4028ea
push ebx
push 0x65
push edi
push 0x41a0a8
call esi
push ebx
push 0x65
push edi
push 0x41a110
call esi
push ebx
push 0x65
push edi
push 0x53ff78
call esi
push ebx
push 0xc9
push edi
push 0x53ffe0
call esi
add esp, 0x40
mov dword [0x53ff74], edi
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
pop esi
pop edi
pop ebx
leave
ret
Function at 0x404883
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4124e4
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x430
push ebx
push esi
push edi
xor ebx, ebx
and byte [ebp - 0x38], bl
xor eax, eax
lea edi, [ebp - 0x37]
xor esi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], esi
xor edi, edi
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], esi
call sub.MFC42.DLL_AfxGetModuleState
mov ecx, dword [eax + 4]
call sub.MFC42.DLL_CCmdTarget::BeginWaitCursor
push 0x41a178
mov byte [ebp - 4], 1
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
cmp eax, esi
pop ecx
mov dword [ebp - 0x20], eax
jne 0x4048fa
and byte [ebp - 4], 0
call sub.MFC42.DLL_AfxGetModuleState
mov ecx, dword [eax + 4]
call sub.MFC42.DLL_CCmdTarget::EndWaitCursor
jmp 0x404a45
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::Empty
push dword [ebp - 0x20]
lea eax, [ebp - 0x43c]
push 0x400
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, esi
mov dword [ebp - 0x24], eax
mov dword [ebp + 8], esi
jle 0x404a15
lea eax, [ebx*4 + 0x1482550]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov bl, byte [ebp + eax - 0x43c]
mov eax, edi
sub eax, esi
je 0x4049fb
dec eax
je 0x4049c1
dec eax
je 0x40497c
sub eax, 0xd
jne 0x404a03
cmp bl, 0x39
je 0x40496b
cmp bl, 0x38
je 0x40496b
cmp bl, 0x33
je 0x40496b
cmp bl, 0x36
jne 0x4049cb
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x10]
push 2
mov byte [ebp + eax - 0x38], bl
jmp 0x404a02
cmp bl, 0x30
jl 0x4049cb
cmp bl, 0x39
jg 0x4049cb
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xb
mov byte [ebp + eax - 0x38], bl
jl 0x404a03
push ecx
lea eax, [ebp - 0x38]
mov ecx, esp
mov dword [ebp - 0x3c], esp
push eax
call sub.MFC42.DLL_CString::CString_2
call fcn.00407486
pop ecx
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x1c23750
mov dword [ecx], eax
jge 0x4049cb
inc dword [ebp - 0x18]
add dword [ebp - 0x14], 4
jmp 0x4049cb
cmp bl, 0x33
je 0x4049cf
cmp bl, 0x35
je 0x4049cf
xor edi, edi
jmp 0x404a03
push 0x14
lea eax, [ebp - 0x38]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp bl, 0x33
mov byte [ebp - 0x38], 0x31
push 2
pop edi
mov dword [ebp - 0x10], edi
jne 0x4049f2
mov byte [ebp - 0x37], bl
jmp 0x404a03
push 0xf
mov byte [ebp - 0x37], 0x35
pop edi
jmp 0x404a03
cmp bl, 0x31
jne 0x404a03
push 1
pop edi
inc dword [ebp + 8]
mov eax, dword [ebp - 0x24]
cmp dword [ebp + 8], eax
jl 0x404934
mov ebx, dword [ebp - 0x18]
cmp eax, 0x400
je 0x404902
push dword [ebp - 0x20]
call dword [sym.imp.MSVCRT.dll_fclose]
or dword [ebx*4 + 0x1482550], 0xffffffff
and byte [ebp - 4], 0
pop ecx
call sub.MFC42.DLL_AfxGetModuleState
mov ecx, dword [eax + 4]
call sub.MFC42.DLL_CCmdTarget::EndWaitCursor
mov esi, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004111d0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x404a64
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x412508
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x42c
push esi
push edi
and byte [ebp - 0x34], 0
xor eax, eax
lea edi, [ebp - 0x33]
xor esi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], esi
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 1
call sub.MFC42.DLL_AfxGetModuleState
mov ecx, dword [eax + 4]
call sub.MFC42.DLL_CCmdTarget::BeginWaitCursor
push 0x41a178
mov byte [ebp - 4], 2
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
cmp eax, esi
pop ecx
mov dword [ebp - 0x1c], eax
je 0x404bcd
push ebx
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::Empty
mov edi, 0x400
push dword [ebp - 0x1c]
lea eax, [ebp - 0x438]
push edi
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
xor ebx, ebx
test eax, eax
mov dword [ebp - 0x38], eax
jle 0x404b74
mov eax, dword [ebp - 0x10]
lea eax, [eax*4 + 0xce1344]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
mov al, byte [ebp + ebx - 0x438]
sub ecx, 0
je 0x404b5f
dec ecx
jne 0x404b6c
cmp al, 0x30
jl 0x404b2d
cmp al, 0x39
jg 0x404b2d
mov byte [ebp + esi - 0x34], al
inc esi
cmp esi, 0xc
jle 0x404b6c
and dword [ebp - 0x18], 0
jmp 0x404b6c
cmp esi, 0xa
jl 0x404b5b
cmp esi, 0xc
jg 0x404b5b
and byte [ebp + esi - 0x34], 0
cmp byte [ebp - 0x33], 0x31
jne 0x404b48
cmp byte [ebp - 0x32], 0x30
jne 0x404b5b
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x34]
push eax
call fcn.004111dc
inc dword [ebp - 0x10]
add dword [ebp - 0x14], 4
xor esi, esi
jmp 0x404b27
cmp al, 0x30
jne 0x404b6c
push 1
mov byte [ebp - 0x34], al
pop esi
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x38]
inc ebx
cmp ebx, eax
jl 0x404b03
cmp eax, edi
je 0x404ad7
cmp esi, 0xa
pop ebx
jl 0x404bae
cmp esi, 0xc
jg 0x404bae
and byte [ebp + esi - 0x34], 0
cmp byte [ebp - 0x33], 0x31
jne 0x404b98
cmp byte [ebp - 0x32], 0x30
jne 0x404bae
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x10]
lea ecx, [eax*4 + 0xce1344]
call fcn.004111dc
inc dword [ebp - 0x10]
push dword [ebp - 0x1c]
call dword [sym.imp.MSVCRT.dll_fclose]
mov esi, dword [ebp - 0x10]
mov dword [esp], 0x4758bc
lea ecx, [esi*4 + 0xce1344]
call fcn.004111dc
mov byte [ebp - 4], 1
call sub.MFC42.DLL_AfxGetModuleState
mov ecx, dword [eax + 4]
call sub.MFC42.DLL_CCmdTarget::EndWaitCursor
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.004111d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004111d0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4068fc
Capabilities:
Delete file

Disassembly:
mov eax, 0x4128fc
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x808
lea eax, [ebp - 0x814]
push esi
mov esi, ecx
push eax
call fcn.00407145
lea eax, [ebp - 0x814]
mov dword [esp], str.JLSms.MDE
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x414]
push eax
call fcn.00407145
lea eax, [ebp - 0x414]
push str.oemtmpii.bmp
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x414]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call sub.MFC42.DLL_CString::CString_2
and dword [ebp - 4], 0
push 5
push ecx
lea eax, [ebp - 0x814]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call sub.MFC42.DLL_CString::CString_2
or dword [ebp - 4], 0xffffffff
call fcn.00407777
add esp, 0xc
lea eax, [ebp - 0x414]
lea ecx, [esi + 0x704]
push eax
call fcn.00401290
push ecx
lea eax, [ebp - 0x414]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call sub.MFC42.DLL_CString::CString_2
push 6
push ecx
lea eax, [ebp - 0x814]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 4], 1
call sub.MFC42.DLL_CString::CString_2
or dword [ebp - 4], 0xffffffff
call fcn.00407777
add esp, 0xc
lea eax, [ebp - 0x414]
lea ecx, [esi + 0x720]
push eax
call fcn.00401290
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
pop ecx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x407145
Capabilities:
Accept command line arguments

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 8]
inc eax
push eax
push 0x41a1b0
push esi
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
xor eax, eax
cmp byte [esi], 0x22
je 0x407176
inc eax
cmp eax, 0x3e8
jg 0x407176
cmp byte [eax + esi], 0x22
jne 0x407168
cmp byte [eax + esi], 0x5c
je 0x40717f
dec eax
jne 0x407176
and byte [eax + esi], 0
pop esi
ret
Function at 0x407777
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x412a88
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x41c
push ebx
push esi
push edi
mov esi, dword [sym.imp.MSVCRT.dll_fopen]
push 1
and dword [ebp - 0x10], 0
pop ebx
push 0x41a178
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call esi
mov edi, eax
pop ecx
test edi, edi
pop ecx
mov dword [ebp - 0x20], edi
je 0x4078d1
push 0x4760b0
push dword [ebp + 0x10]
call esi
pop ecx
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
push edi
jne 0x4077d6
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 2
pop ebx
jmp 0x4078d1
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push 4
lea eax, [ebp - 0x10]
push ebx
push eax
call esi
push edi
push 4
lea eax, [ebp - 0x10]
push ebx
push eax
call esi
push edi
push 4
lea eax, [ebp - 0x24]
push ebx
push eax
call esi
mov eax, dword [ebp - 0x24]
and dword [ebp - 0x10], 0
and dword [ebp - 0x1c], 0
add esp, 0x30
lea ecx, [eax*4 + 0xc]
test eax, eax
mov dword [ebp - 0x14], ecx
jle 0x407839
push edi
push 4
lea eax, [ebp - 0x10]
push ebx
push eax
call esi
mov eax, dword [ebp - 0x1c]
add esp, 0x10
cmp eax, dword [ebp + 0xc]
je 0x407839
mov ecx, dword [ebp - 0x10]
add dword [ebp - 0x14], ecx
inc eax
cmp eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
jl 0x407815
push 0
push dword [ebp - 0x14]
push edi
call dword [sym.imp.MSVCRT.dll_fseek]
and byte [ebp - 0x428], 0
add esp, 0xc
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x427]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.MSVCRT.dll_fwrite]
push dword [ebp - 0x20]
lea eax, [ebp - 0x428]
push 0x400
push ebx
push eax
call esi
add esp, 0x10
mov dword [ebp + 0xc], eax
test eax, eax
jle 0x40789f
cmp dword [ebp - 0x10], eax
jle 0x4078aa
push dword [ebp - 0x18]
sub dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0x428]
push ebx
push eax
call edi
add esp, 0x10
cmp dword [ebp - 0x10], 0
jle 0x4078bd
cmp dword [ebp + 0xc], 0x400
jne 0x4078bd
jmp 0x407864
push dword [ebp - 0x18]
lea eax, [ebp - 0x428]
push dword [ebp - 0x10]
push ebx
push eax
call edi
add esp, 0x10
push dword [ebp - 0x20]
mov esi, dword [sym.imp.MSVCRT.dll_fclose]
call esi
push dword [ebp - 0x18]
call esi
pop ecx
xor ebx, ebx
pop ecx
and byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004111d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.004111d0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret