joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4465f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x4c0344
push eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x2c], 0
call fcn.00446080
lea ecx, [esp + 0x2c]
mov edi, eax
push ecx
push edi
call fcn.00459a40
add esp, 0x10
test al, al
je 0x446702
mov ebx, 1
jmp 0x446640
cmp dword [esp + 0x24], ebx
jl 0x446720
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x3c]
push eax
push edi
call fcn.00459ac0
add esp, 0xc
test al, al
je 0x44677a
mov ecx, dword [0x4b5c58]
fld qword [esp + 0x30]
push ecx
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x4c]
fstp qword [esp]
call fcn.00440d00
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
add esp, 0x14
cmp eax, ebx
jne 0x446698
mov byte [0xd2d3b8], bl
mov esi, ebx
cmp eax, ebx
jle 0x4466ec
mov edi, edi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
call fcn.00459a90
add esp, 0x10
test al, al
je 0x4467bb
mov edx, dword [esp + 0x2c]
fld qword [esp + 0x30]
push edx
sub esp, 0x10
fstp qword [esp + 8]
lea eax, [esp + 0x3c]
fld qword [esp + 0x4c]
fstp qword [esp]
push eax
call fcn.00440d80
add esi, ebx
add esp, 0x18
cmp esi, dword [esp + 0x24]
jl 0x4466a0
lea ecx, [esp + 0x24]
push ecx
push edi
call fcn.00459a40
add esp, 8
test al, al
jne 0x446640
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [ebp + 0xc]
add esp, 4
cmp dword [esp + 0x24], 0
pop edi
setne dl
pop esi
mov byte [eax], dl
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c0348
push 0x4c037c
mov byte [0xd34622], bl
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadPolylines_____less_than_one_vertex_per_chain__n
push 0x4c03c0
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c03d0
push 0x4c03fc
mov byte [0xd34622], bl
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4c040c
push 0x4c0438
jmp 0x44675f
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c0448
push 0x4c0474
mov byte [0xd34622], bl
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadPolylines_____premature_end_of_file__n
push 0x4c04b0
jmp 0x44675f
Function at 0x446c20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, dword [ebp + 8]
sub esp, 0x34
push ebx
push esi
push edi
push 0x4c084c
push eax
xor esi, esi
call fcn.00446080
mov ecx, dword [ebp + 0xc]
mov ebx, dword [sym.imp.MSVCR100.dll_fscanf]
lea edx, [esp + 0x38]
push edx
mov edi, eax
push 0x4c0850
mov byte [ecx], 0
push edi
mov byte [0xd2d3b8], 0
call ebx
add esp, 0x14
cmp eax, 0xffffffff
je 0x446d0c
fldz
fcomp qword [esp + 0x30]
fnstsw ax
test ah, 0x41
jne 0x446c91
test esi, esi
jle 0x446c8d
cmp esi, 1
jne 0x446c87
mov byte [0xd2d3b8], 1
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
xor esi, esi
jmp 0x446cf3
lea ecx, [esp + 0x38]
push ecx
push 0x4c0854
push edi
call ebx
add esp, 0xc
cmp eax, 0xffffffff
je 0x446d1d
fld qword [esp + 0x38]
test esi, esi
jne 0x446cd1
mov edx, dword [0x4b5c58]
push edx
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x44]
fstp qword [esp]
call fcn.00440d00
add esp, 0x14
mov dword [esp + 0x2c], eax
jmp 0x446cf2
mov eax, dword [0x4b5c5c]
push eax
sub esp, 0x10
fstp qword [esp + 8]
lea ecx, [esp + 0x40]
fld qword [esp + 0x44]
fstp qword [esp]
push ecx
call fcn.00440d80
add esp, 0x18
inc esi
lea edx, [esp + 0x30]
push edx
push 0x4c0850
push edi
call ebx
add esp, 0xc
cmp eax, 0xffffffff
jne 0x446c6a
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c0858
push 0x4c0880
mov byte [0xd34622], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadUSGS_____premature_end_of_file__n
push 0x4c08b8
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
int3

Function at 0x446d80
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov bl, byte [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.MSVCR100.dll_fscanf]
lea eax, [esp + 0xf]
push eax
push 0x4c08c8
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
je 0x446db2
cmp byte [esp + 0xf], bl
jne 0x446d92
pop edi
pop esi
pop ebx
pop ecx
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c08cc
push 0x4c08f4
mov byte [0xd34622], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4c0904
push 0x4c092c
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x446e10
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.MSVCR100.dll_fscanf]
lea eax, [esp + 0xf]
push eax
push 0x4c093c
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x446e8e
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c0940
push 0x4c0968
mov byte [0xd34622], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4c0978
push 0x4c09a0
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov al, byte [esp + 0xf]
cmp al, byte [esp + 0x18]
je 0x446f6e
mov bl, byte [esp + 0x1c]
cmp al, bl
je 0x446f6e
lea ecx, [esp + 0xf]
push ecx
push 0x4c09b0
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x446f02
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c09b4
push 0x4c09dc
mov byte [0xd34622], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4c09ec
push 0x4c0a14
jmp 0x446e73
mov al, byte [esp + 0xf]
cmp al, byte [esp + 0x18]
je 0x446f6e
cmp al, bl
je 0x446f6e
lea edx, [esp + 0xf]
push edx
push 0x4c0a24
push esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x446f6a
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c0a28
push 0x4c0a50
mov byte [0xd34622], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push 0x4c0a60
push 0x4c0a88
jmp 0x446e73
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x449820
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x4c16f4
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
mov dword [0xd2d3bc], eax
test eax, eax
je 0x44985e
mov esi, dword [sym.imp.MSVCR100.dll_fprintf]
push str.__0_nSECTION_n__2_nHEADER_n__0_nENDSEC_n
push eax
call esi
mov ecx, dword [0xd2d3bc]
push str.__0_nSECTION_n__2_nENTITIES_n
push ecx
call esi
add esp, 0x10
pop esi
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0xd34622], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push str.DXF_output_file_could_not_be_opened__n
push 0x4c1760
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
int3

Function at 0x4498b0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0xd2d3bc]
test eax, eax
je 0x4498df
push str.__0_nENDSEC_n__0_nEOF_n
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
mov eax, dword [0xd2d3bc]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0xc
mov dword [0xd2d3bc], 0
ret
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0xd34622], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push 0x4c1784
push 0x4c17ac
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
pop esi
int3

Function at 0x449d70
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0xd2d3bc]
push esi
test eax, eax
je 0x449dcc
mov esi, dword [sym.imp.MSVCR100.dll_fprintf]
push str.__0_nPOLYLINE_n
push eax
call esi
add esp, 8
cmp byte [esp + 8], 0
je 0x449d9f
mov eax, dword [0xd2d3bc]
push str._70_n__1_n
push eax
jmp 0x449dab
mov ecx, dword [0xd2d3bc]
push str._70_n__0_n
push ecx
call esi
mov eax, dword [esp + 0x14]
add esp, 8
test eax, eax
js 0x449dca
mov edx, dword [0xd2d3bc]
push eax
push str._62_n_3d_n
push edx
call esi
add esp, 0xc
pop esi
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0xd34622], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push 0x4c1a3c
push 0x4c1a64
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
int3

Function at 0x449e20
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0xd2d3bc]
test eax, eax
je 0x449e39
push str.__0_nSEQEND_n
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 8
ret
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0xd34622], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push 0x4c1a80
push 0x4c1aa8
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
pop esi
int3
Function at 0x449f40
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0xd2d3bc]
push esi
test eax, eax
je 0x449fa3
mov esi, dword [sym.imp.MSVCR100.dll_fprintf]
push str.__0_nVERTEX_n
push eax
call esi
fld qword [esp + 0x18]
mov eax, dword [0xd2d3bc]
fstp qword [esp]
fld qword [esp + 0x10]
sub esp, 8
fstp qword [esp]
push str._10_n_f_n_20_n_f_n_30_n0.0_n
push eax
call esi
fld qword [esp + 0x30]
fld st(0)
add esp, 0x18
fldz
fucompp
fnstsw ax
test ah, 0x44
jnp 0x449fec
mov ecx, dword [0xd2d3bc]
sub esp, 8
fstp qword [esp]
push str._42_n_f_n
push ecx
call esi
add esp, 0x10
pop esi
ret
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
mov byte [0xd34622], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call edi
add esp, 4
push str.DXF_output_file_not_properly_opened__n
push 0x4c1b64
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call edi
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
fstp st(0)
pop esi
ret

Function at 0x44aaf0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
xor bl, bl
push esi
cmp byte [esp + 0x34], bl
je 0x44ab8b
fld qword [0x4b18f0]
cmp byte [0xd2d270], bl
je 0x44ab15
fdiv qword [0x4bf858]
mov esi, dword [0xd2d288]
fst qword [esp + 0x24]
cmp esi, 0x1e
jle 0x44ab4c
fmul qword [0x4b5c78]
fstp qword [esp + 8]
fild dword [0xd2d288]
call sub.MSVCR100.dll__CIlog
call sub.MSVCR100.dll__CIlog
fdivr qword [esp + 8]
fst qword [esp + 0x2c]
fld qword [esp + 0x24]
jmp 0x44ab5a
fld qword [0x4b5c78]
fmul st(1)
fst qword [esp + 0x2c]
fxch st(1)
fld st(0)
fld qword [0x4b5c70]
fmul st(1), st(0)
fxch st(3)
fcom st(1)
fnstsw ax
test ah, 5
jp 0x44ab77
fstp st(0)
fst qword [esp + 0x2c]
jmp 0x44ab79
fstp st(1)
cmp esi, 0x3d090
jle 0x44ab91
fmulp st(2)
fxch st(1)
fstp qword [esp + 0x2c]
jmp 0x44ab95
fld qword [esp + 0x24]
jmp 0x44ab95
fstp st(0)
fstp st(1)
fcomp qword [0x4b5878]
fnstsw ax
test ah, 0x41
jnp 0x44ac69
cmp byte [esp + 0x38], bl
je 0x44abba
cmp byte [esp + 0x3c], bl
je 0x44abba
mov byte [esp + 0x3c], bl
mov byte [esp + 0x38], bl
call fcn.0043ec50
test al, al
jne 0x44ac20
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
push 0x4c2170
push 0x4c21a0
mov byte [0xd34622], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.API_ComputeOff:_VD_not_known_or_not_up_to_date_
push 0x4c21e0
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
mov eax, dword [esp + 0x3c]
fld qword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x3c]
push edx
mov edx, dword [esp + 0x24]
sub esp, 0x10
fstp qword [esp + 8]
mov byte [0x4c26c8], 1
fld qword [esp + 0x40]
fstp qword [esp]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
push eax
push 0x7fffffff
call fcn.00445710
add esp, 0x30
pop esi
pop ebx
add esp, 8
ret
Function at 0x44ac70
Capabilities:
Terminate process

Disassembly:
call fcn.0043ec50
test al, al
jne 0x44acda
push ebx
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
push 0x4c21f0
push 0x4c2224
mov byte [0xd34622], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.API_ComputeWMAT:_VD_not_known_or_not_up_to_date_
push 0x4c2268
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
pop esi
pop ebx
call fcn.00442190
fldz
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
sub esp, 0x10
fst qword [esp + 8]
fstp qword [esp]
call fcn.00442370
add esp, 0x1c
ret

Function at 0x44ade0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
test eax, eax
je 0x44ae7c
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ecx, esi
imul ecx, edi
push ecx
push eax
call dword [sym.imp.MSVCR100.dll_realloc]
add esp, 8
test eax, eax
jne 0x44aeea
push edi
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c2318
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x40
push eax
call edi
add esp, 0x10
push 0x4c2354
push 0x4c2388
mov byte [0xd34622], 1
call esi
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReallocateArray_____memory_reallocation_failed__n
push 0x4c23cc
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push esi
push edi
call dword [sym.imp.MSVCR100.dll_calloc]
add esp, 8
test eax, eax
jne 0x44aeea
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
push str.ReallocateArray_____Cannot_get__d_elements_of__d_bytes..._n
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x40
push eax
call edi
add esp, 0x10
push 0x4c2418
push 0x4c2448
mov byte [0xd34622], 1
call esi
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReallocateArray_____memory_allocation_failed__n
push str._nerror_in__s_n
jmp 0x44ae61
pop edi
pop esi
pop ebx
ret
Function at 0x460420
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x4b5d20
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x460462
push str.crash
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x460462
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 1
mov esp, ebp
pop ebp
ret

Function at 0x463f00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x4b637c
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x463f25
call fcn.00464660
jmp 0x46400a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x463f43
mov eax, dword [ebp - 4]
jmp 0x46400a
cmp dword [0xd2d54c], 0
jne 0x463f51
call fcn.00464010
push 0x4b6380
mov edx, dword [0xd2d54c]
push edx
call fcn.00462630
add esp, 8
mov word [ebp - 8], ax
movsx eax, word [ebp - 8]
test eax, eax
jge 0x463f78
xor eax, eax
jmp 0x46400a
mov ecx, dword [ebp + 8]
push ecx
movzx edx, word [ebp - 8]
push edx
mov eax, dword [0xd2d54c]
push eax
call fcn.00462cf0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x464007
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
jmp 0x463fa9
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x463fb5
jmp 0x463fa0
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
jmp 0x463fc9
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jb 0x463fe8
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
cmp eax, 0x20
jg 0x463fe8
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
jl 0x463fe8
jmp 0x463fc0
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x464007
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov byte [ecx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x464b80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0x4b6384
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x464bc2
push str.WNCTMPDIR
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x464bc0
push str.from_environment_variable_WNCTMPDIR
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x464c00
jmp 0x464be9
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x464be9
push str.from_environment
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x464c00
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0xd2d54c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004625a0
add esp, 0xc
pop ebp
ret

Function at 0x464c80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x4c4b80]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x464ca0
xor eax, eax
jmp 0x464dd8
mov eax, dword [ebp + 8]
push eax
push 0x4b63d0
lea ecx, [ebp - 0x190]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x190]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x464cda
mov eax, dword [ebp - 4]
jmp 0x464dd8
cmp dword [0xd2d54c], 0
jne 0x464ce8
call fcn.00464010
push str.path
mov eax, dword [0xd2d54c]
push eax
call fcn.00462630
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x464d0e
xor eax, eax
jmp 0x464dd8
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0xd2d54c]
push ecx
call fcn.00462cf0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x464dd5
mov edx, dword [ebp - 4]
mov dword [ebp - 0x194], edx
jmp 0x464d4d
mov eax, dword [ebp - 0x194]
add eax, 1
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
movsx edx, byte [ecx]
test edx, edx
je 0x464d5c
jmp 0x464d3e
mov eax, dword [ebp - 0x194]
sub eax, 1
mov dword [ebp - 0x194], eax
jmp 0x464d7c
mov ecx, dword [ebp - 0x194]
sub ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
cmp edx, dword [ebp - 4]
jb 0x464da4
mov eax, dword [ebp - 0x194]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x464da4
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
jl 0x464da4
jmp 0x464d6d
mov ecx, dword [ebp - 0x194]
add ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
je 0x464dd5
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x198]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0048d046
mov esp, ebp
pop ebp
ret
Function at 0x464df0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4c4b80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str._sPATH
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x464e41
lea eax, [ebp - 0x58]
push eax
push str.from_environment__s
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
xor eax, eax
jmp 0x464e57
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0xd2d54c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004625a0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048d046
mov esp, ebp
pop ebp
ret

Function at 0x469470
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4c4b80]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
push ecx
push 0x1ff
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00460940
push 0x2c
lea edx, [ebp - 0x208]
push edx
call fcn.00461820
add esp, 8
test eax, eax
je 0x469511
mov eax, dword [ebp + 0x10]
push eax
push 0x1ff
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004614e0
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x469511
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0xffffffd5
jne 0x46950f
push 0x2c
lea eax, [ebp - 0x208]
push eax
call fcn.00461820
add esp, 8
test eax, eax
jne 0x46950f
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
jmp 0x469511
jmp 0x469572
lea edx, [ebp - 9]
mov dword [ebp - 4], edx
jmp 0x469522
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x208]
cmp ecx, edx
jb 0x469546
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x469546
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
jl 0x469546
jmp 0x469519
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov byte [edx], 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
test eax, eax
je 0x469572
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffeb
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0048d046
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4696d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.WNC_WNCFILES_VERBOSE
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x469709
push 0x4b6ba8
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
je 0x469709
mov eax, 1
jmp 0x46970b
xor eax, eax
mov esp, ebp
pop ebp
ret