joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515e40
Capabilities:
Terminate process

Disassembly:
call fcn.0050ecb0
test al, al
jne 0x515eaa
push ebx
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
push 0x594c74
push 0x594ca8
mov byte [0x77af32], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.API_ComputeWMAT:_VD_not_known_or_not_up_to_date_
push 0x594cec
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
pop esi
pop ebx
call fcn.00512230
fldz
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
sub esp, 0x10
fst qword [esp + 8]
fstp qword [esp]
call fcn.00512410
add esp, 0x1c
ret
Function at 0x519050
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
test eax, eax
je 0x5190ec
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ecx, esi
imul ecx, edi
push ecx
push eax
call dword [sym.imp.MSVCR100.dll_realloc]
add esp, 8
test eax, eax
jne 0x51915a
push edi
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x594e64
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x40
push eax
call edi
add esp, 0x10
push 0x594ea0
push 0x594ed4
mov byte [0x77af32], 1
call esi
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReallocateArray_____memory_reallocation_failed__n
push 0x594f18
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push esi
push edi
call dword [sym.imp.MSVCR100.dll_calloc]
add esp, 8
test eax, eax
jne 0x51915a
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
push str.ReallocateArray_____Cannot_get__d_elements_of__d_bytes..._n
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x40
push eax
call edi
add esp, 0x10
push 0x594f64
push 0x594f94
mov byte [0x77af32], 1
call esi
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReallocateArray_____memory_allocation_failed__n
push 0x594fd4
jmp 0x5190d1
pop edi
pop esi
pop ebx
ret
Function at 0x51c620
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
test eax, eax
jne 0x51c698
push ebx
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
push 0x595d38
push 0x595d68
mov byte [0x77af32], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.vd_OpenFile_____I_O_file_could_not_be_opened__n
push 0x595da8
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
pop esi
pop ebx
ret
Function at 0x51c8b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x595758
push eax
mov dword [esp + 0x28], 0
call fcn.0051c620
lea ecx, [esp + 0x28]
mov esi, eax
push ecx
push esi
call fcn.0052dae0
add esp, 0x10
test al, al
jne 0x51c941
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x59575c
push 0x595784
mov byte [0x77af32], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadPoly_____premature_end_of_file__n
push 0x5957bc
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x51c962
add eax, 0xa
push eax
call fcn.005108a0
mov edx, dword [esp + 0x24]
add edx, 0xa
push edx
call fcn.00510970
add esp, 8
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
push esi
call fcn.0052db70
add esp, 0x10
test al, al
jne 0x51c9c3
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x5957cc
push 0x5957f4
mov byte [0x77af32], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadContour_____premature_end_of_file__n
push 0x59582c
jmp 0x51c926
mov eax, dword [0x583f6c]
fld qword [esp + 0x30]
push eax
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x4c]
fstp qword [esp]
call fcn.00510da0
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x48]
mov dword [esp + 0x40], eax
mov edi, eax
push edx
lea eax, [esp + 0x54]
push eax
push esi
call fcn.0052db70
add esp, 0x24
test al, al
je 0x51ca3f
mov ecx, dword [esp + 0x24]
fld qword [esp + 0x30]
push ecx
sub esp, 0x10
fstp qword [esp + 8]
lea edx, [esp + 0x3c]
fld qword [esp + 0x4c]
fstp qword [esp]
push edx
call fcn.00510e20
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x58]
push edx
push esi
call fcn.0052db70
add esp, 0x28
test al, al
jne 0x51ca02
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push edi
push ecx
call fcn.00510f80
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [ebp + 0xc]
add esp, 0x10
cmp edi, 0xffffffff
pop edi
setne dl
pop esi
mov byte [eax], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51ca70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x59583c
or edi, 0xffffffff
push eax
mov dword [esp + 0x30], edi
call fcn.0051c620
lea ecx, [esp + 0x30]
mov esi, eax
push ecx
push esi
call fcn.0052dae0
add esp, 0x10
test al, al
jne 0x51cb00
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x595840
push 0x595868
mov byte [0x77af32], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadPoints_____premature_end_of_file__n
push 0x5958a0
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov eax, dword [esp + 0x28]
test eax, eax
jle 0x51cb14
add eax, 0xa
push eax
call fcn.005108a0
add esp, 4
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
call fcn.0052db40
add esp, 0x10
test al, al
je 0x51cb6a
mov edx, dword [esp + 0x2c]
fld qword [esp + 0x30]
push edx
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x4c]
fstp qword [esp]
call fcn.00510da0
mov edi, eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x54]
push edx
push esi
call fcn.0052db40
add esp, 0x24
test al, al
jne 0x51cb30
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
mov ecx, dword [ebp + 0xc]
add esp, 4
cmp edi, 0xffffffff
pop edi
setne al
pop esi
mov byte [ecx], al
mov byte [0x5f42b8], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51cb90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x5958b0
push eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x2c], 0
call fcn.0051c620
lea ecx, [esp + 0x2c]
mov edi, eax
push ecx
push edi
call fcn.0052db20
add esp, 0x10
test al, al
je 0x51cca2
mov ebx, 1
jmp 0x51cbe0
cmp dword [esp + 0x24], ebx
jl 0x51ccc0
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x3c]
push eax
push edi
call fcn.0052dba0
add esp, 0xc
test al, al
je 0x51cd1a
mov ecx, dword [0x583f6c]
fld qword [esp + 0x30]
push ecx
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x4c]
fstp qword [esp]
call fcn.00510da0
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
add esp, 0x14
cmp eax, ebx
jne 0x51cc38
mov byte [0x5f42b8], bl
mov esi, ebx
cmp eax, ebx
jle 0x51cc8c
mov edi, edi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
call fcn.0052db70
add esp, 0x10
test al, al
je 0x51cd5b
mov edx, dword [esp + 0x2c]
fld qword [esp + 0x30]
push edx
sub esp, 0x10
fstp qword [esp + 8]
lea eax, [esp + 0x3c]
fld qword [esp + 0x4c]
fstp qword [esp]
push eax
call fcn.00510e20
add esi, ebx
add esp, 0x18
cmp esi, dword [esp + 0x24]
jl 0x51cc40
lea ecx, [esp + 0x24]
push ecx
push edi
call fcn.0052db20
add esp, 8
test al, al
jne 0x51cbe0
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [ebp + 0xc]
add esp, 4
cmp dword [esp + 0x24], 0
pop edi
setne dl
pop esi
mov byte [eax], dl
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x5958b4
push 0x5958e8
mov byte [0x77af32], bl
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadPolylines_____less_than_one_vertex_per_chain__n
push 0x59592c
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x59593c
push 0x595968
mov byte [0x77af32], bl
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x595978
push 0x5959a4
jmp 0x51ccff
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x5959b4
push 0x5959e0
mov byte [0x77af32], bl
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadPolylines_____premature_end_of_file__n
push 0x595a1c
jmp 0x51ccff
Function at 0x52bde0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x596680
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
mov dword [0x5f43a8], eax
test eax, eax
je 0x52be1e
mov esi, dword [sym.imp.MSVCR100.dll_fprintf]
push str.__0_nSECTION_n__2_nHEADER_n__0_nENDSEC_n
push eax
call esi
mov ecx, dword [0x5f43a8]
push str.__0_nSECTION_n__2_nENTITIES_n
push ecx
call esi
add esp, 0x10
pop esi
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0x77af32], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push str.DXF_output_file_could_not_be_opened__n
push 0x5966ec
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
int3

Function at 0x52be70
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x5f43a8]
test eax, eax
je 0x52be9f
push str.__0_nENDSEC_n__0_nEOF_n
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
mov eax, dword [0x5f43a8]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0xc
mov dword [0x5f43a8], 0
ret
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0x77af32], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push 0x596710
push 0x596738
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
pop esi
int3

Function at 0x52c330
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x5f43a8]
push esi
test eax, eax
je 0x52c38c
mov esi, dword [sym.imp.MSVCR100.dll_fprintf]
push str.__0_nPOLYLINE_n
push eax
call esi
add esp, 8
cmp byte [esp + 8], 0
je 0x52c35f
mov eax, dword [0x5f43a8]
push str._70_n__1_n
push eax
jmp 0x52c36b
mov ecx, dword [0x5f43a8]
push str._70_n__0_n
push ecx
call esi
mov eax, dword [esp + 0x14]
add esp, 8
test eax, eax
js 0x52c38a
mov edx, dword [0x5f43a8]
push eax
push str._62_n_3d_n
push edx
call esi
add esp, 0xc
pop esi
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0x77af32], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push 0x5969c8
push 0x5969f0
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
int3

Function at 0x52c3e0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x5f43a8]
test eax, eax
je 0x52c3f9
push str.__0_nSEQEND_n
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 8
ret
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0x77af32], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push 0x596a0c
push 0x596a34
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
pop esi
int3
Function at 0x52c500
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x5f43a8]
push esi
test eax, eax
je 0x52c563
mov esi, dword [sym.imp.MSVCR100.dll_fprintf]
push str.__0_nVERTEX_n
push eax
call esi
fld qword [esp + 0x18]
mov eax, dword [0x5f43a8]
fstp qword [esp]
fld qword [esp + 0x10]
sub esp, 8
fstp qword [esp]
push str._10_n_f_n_20_n_f_n_30_n0.0_n
push eax
call esi
fld qword [esp + 0x30]
fld st(0)
add esp, 0x18
fldz
fucompp
fnstsw ax
test ah, 0x44
jnp 0x52c5ac
mov ecx, dword [0x5f43a8]
sub esp, 8
fstp qword [esp]
push str._42_n_f_n
push ecx
call esi
add esp, 0x10
pop esi
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0x77af32], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push str.DXF_output_file_not_properly_opened__n
push 0x596af0
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
fstp st(0)
pop esi
ret

Function at 0x52c600
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, dword [ebp + 8]
sub esp, 0x34
push ebx
push esi
push edi
push 0x596b00
push eax
xor esi, esi
call fcn.0051c620
mov ecx, dword [ebp + 0xc]
mov ebx, dword [sym.imp.MSVCR100.dll_fscanf]
lea edx, [esp + 0x38]
push edx
mov edi, eax
push 0x596b04
mov byte [ecx], 0
push edi
mov byte [0x5f42b8], 0
call ebx
add esp, 0x14
cmp eax, 0xffffffff
je 0x52c6ec
fldz
fcomp qword [esp + 0x30]
fnstsw ax
test ah, 0x41
jne 0x52c671
test esi, esi
jle 0x52c66d
cmp esi, 1
jne 0x52c667
mov byte [0x5f42b8], 1
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
xor esi, esi
jmp 0x52c6d3
lea ecx, [esp + 0x38]
push ecx
push 0x596b08
push edi
call ebx
add esp, 0xc
cmp eax, 0xffffffff
je 0x52c6fd
fld qword [esp + 0x38]
test esi, esi
jne 0x52c6b1
mov edx, dword [0x583f6c]
push edx
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x44]
fstp qword [esp]
call fcn.00510da0
add esp, 0x14
mov dword [esp + 0x2c], eax
jmp 0x52c6d2
mov eax, dword [0x583f70]
push eax
sub esp, 0x10
fstp qword [esp + 8]
lea ecx, [esp + 0x40]
fld qword [esp + 0x44]
fstp qword [esp]
push ecx
call fcn.00510e20
add esp, 0x18
inc esi
lea edx, [esp + 0x30]
push edx
push 0x596b04
push edi
call ebx
add esp, 0xc
cmp eax, 0xffffffff
jne 0x52c64a
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x596b0c
push 0x596b34
mov byte [0x77af32], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadUSGS_____premature_end_of_file__n
push 0x596b6c
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x52c760
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov bl, byte [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.MSVCR100.dll_fscanf]
lea eax, [esp + 0xf]
push eax
push 0x596b7c
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
je 0x52c792
cmp byte [esp + 0xf], bl
jne 0x52c772
pop edi
pop esi
pop ebx
pop ecx
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x596b80
push 0x596ba8
mov byte [0x77af32], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x596bb8
push 0x596be0
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
int3

Function at 0x52c7f0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.MSVCR100.dll_fscanf]
lea eax, [esp + 0xf]
push eax
push 0x596bf0
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x52c86e
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x596bf4
push 0x596c1c
mov byte [0x77af32], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x596c2c
push 0x596c54
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov al, byte [esp + 0xf]
cmp al, byte [esp + 0x18]
je 0x52c94e
mov bl, byte [esp + 0x1c]
cmp al, bl
je 0x52c94e
lea ecx, [esp + 0xf]
push ecx
push 0x596c64
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x52c8e2
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x596c68
push 0x596c90
mov byte [0x77af32], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x596ca0
push 0x596cc8
jmp 0x52c853
mov al, byte [esp + 0xf]
cmp al, byte [esp + 0x18]
je 0x52c94e
cmp al, bl
je 0x52c94e
lea edx, [esp + 0xf]
push edx
push 0x596cd8
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x52c94a
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x596cdc
push 0x596d04
mov byte [0x77af32], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x596d14
push 0x596d3c
jmp 0x52c853
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x534300
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.00533df0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x534325
mov eax, 0xfffffff5
jmp 0x534459
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x320]
and edx, 1
jne 0x53433d
mov eax, 0xfffffff4
jmp 0x534459
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
shr ecx, 2
and ecx, 1
je 0x53436b
mov edx, dword [ebp - 4]
push edx
call fcn.005345d0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x53436b
mov eax, dword [ebp - 8]
jmp 0x534459
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 4]
cmp ecx, 1
je 0x5343da
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.00534080
add esp, 4
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x5343da
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2aa]
test edx, edx
jne 0x5343da
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
push 1
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0x316]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2d0
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2c4], 0
je 0x534416
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c4]
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c4], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2cc], 0
je 0x534442
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2cc]
push ecx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2cc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffe
mov edx, dword [ebp - 4]
mov dword [edx + 0x320], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x5345a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
pop ebp
ret
Function at 0x5358f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.WNC_BUFFER_TOO_SMALL_OPTION
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x535932
push str.crash
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x535932
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 1
mov esp, ebp
pop ebp
ret

Function at 0x5393b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x5846b4
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x5393d5
call fcn.00539b10
jmp 0x5394ba
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5393f3
mov eax, dword [ebp - 4]
jmp 0x5394ba
cmp dword [0x5f43b0], 0
jne 0x539401
call fcn.005394c0
push 0x5846b8
mov edx, dword [0x5f43b0]
push edx
call fcn.00537ae0
add esp, 8
mov word [ebp - 8], ax
movsx eax, word [ebp - 8]
test eax, eax
jge 0x539428
xor eax, eax
jmp 0x5394ba
mov ecx, dword [ebp + 8]
push ecx
movzx edx, word [ebp - 8]
push edx
mov eax, dword [0x5f43b0]
push eax
call fcn.005381a0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5394b7
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
jmp 0x539459
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x539465
jmp 0x539450
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
jmp 0x539479
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jb 0x539498
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
cmp eax, 0x20
jg 0x539498
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
jl 0x539498
jmp 0x539470
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x5394b7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov byte [ecx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret