joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b1b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x141
mov eax, dword [ebp - 4]
sub eax, 1
cmp eax, 0x140
je 0x42b1ef
push 0x140
mov ecx, dword [ebp - 4]
sub ecx, 1
push ecx
push str._RCSfile:_outilparutils.cxx_v__
push str.file__s_:_internal_error__size_mismatch:_._noutilpar.inc_size_d__dtbmax.inc_size_d_nAborting._n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 0x10
push 0xffffffffffffffff
call dword [sym.imp.MSVCR90.dll_exit]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x42bac0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x4529dc
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42bb02
push str.crash
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR90.dll_strcmp
add esp, 8
test eax, eax
jne 0x42bb02
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 1
mov esp, ebp
pop ebp
ret

Function at 0x42e720
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x452fc4
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR90.dll_strcmp
add esp, 8
test eax, eax
jne 0x42e745
call fcn.0042ee80
jmp 0x42e82a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42e763
mov eax, dword [ebp - 4]
jmp 0x42e82a
cmp dword [0x4596e4], 0
jne 0x42e771
call fcn.0042e830
push 0x452fc8
mov edx, dword [0x4596e4]
push edx
call fcn.0042ce30
add esp, 8
mov word [ebp - 8], ax
movsx eax, word [ebp - 8]
test eax, eax
jge 0x42e798
xor eax, eax
jmp 0x42e82a
mov ecx, dword [ebp + 8]
push ecx
movzx edx, word [ebp - 8]
push edx
mov eax, dword [0x4596e4]
push eax
call fcn.0042d4f0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42e827
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
jmp 0x42e7c9
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x42e7d5
jmp 0x42e7c0
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
jmp 0x42e7e9
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jb 0x42e808
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
cmp eax, 0x20
jg 0x42e808
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
jl 0x42e808
jmp 0x42e7e0
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x42e827
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov byte [ecx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x42f3a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0x452fcc
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR90.dll_strcmp
add esp, 8
test eax, eax
jne 0x42f3e2
push str.WNCTMPDIR
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
test eax, eax
je 0x42f3e0
push str.from_environment_variable_WNCTMPDIR
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x42f420
jmp 0x42f409
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
test eax, eax
je 0x42f409
push str.from_environment
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x42f420
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x4596e4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042cda0
add esp, 0xc
pop ebp
ret

Function at 0x42f4a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x4584e4]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x42f4c0
xor eax, eax
jmp 0x42f5f8
mov eax, dword [ebp + 8]
push eax
push 0x453018
lea ecx, [ebp - 0x190]
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x190]
push edx
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42f4fa
mov eax, dword [ebp - 4]
jmp 0x42f5f8
cmp dword [0x4596e4], 0
jne 0x42f508
call fcn.0042e830
push str.path
mov eax, dword [0x4596e4]
push eax
call fcn.0042ce30
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x42f52e
xor eax, eax
jmp 0x42f5f8
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0x4596e4]
push ecx
call fcn.0042d4f0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42f5f5
mov edx, dword [ebp - 4]
mov dword [ebp - 0x194], edx
jmp 0x42f56d
mov eax, dword [ebp - 0x194]
add eax, 1
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
movsx edx, byte [ecx]
test edx, edx
je 0x42f57c
jmp 0x42f55e
mov eax, dword [ebp - 0x194]
sub eax, 1
mov dword [ebp - 0x194], eax
jmp 0x42f59c
mov ecx, dword [ebp - 0x194]
sub ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
cmp edx, dword [ebp - 4]
jb 0x42f5c4
mov eax, dword [ebp - 0x194]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x42f5c4
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
jl 0x42f5c4
jmp 0x42f58d
mov ecx, dword [ebp - 0x194]
add ecx, 1
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
movsx eax, byte [edx]
test eax, eax
je 0x42f5f5
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x198]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00435ab0
mov esp, ebp
pop ebp
ret
Function at 0x42f610
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4584e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str._sPATH
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
test eax, eax
je 0x42f661
lea eax, [ebp - 0x58]
push eax
push str.from_environment__s
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
xor eax, eax
jmp 0x42f677
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x4596e4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042cda0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435ab0
mov esp, ebp
pop ebp
ret

Function at 0x433d40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4584e4]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
push ecx
push 0x1ff
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042bfe0
push 0x2c
lea edx, [ebp - 0x208]
push edx
call fcn.0042e290
add esp, 8
test eax, eax
je 0x433de1
mov eax, dword [ebp + 0x10]
push eax
push 0x1ff
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00431200
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x433de1
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0xffffffd5
jne 0x433ddf
push 0x2c
lea eax, [ebp - 0x208]
push eax
call fcn.0042e290
add esp, 8
test eax, eax
jne 0x433ddf
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
jmp 0x433de1
jmp 0x433e42
lea edx, [ebp - 9]
mov dword [ebp - 4], edx
jmp 0x433df2
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x208]
cmp ecx, edx
jb 0x433e16
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x433e16
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
jl 0x433e16
jmp 0x433de9
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov byte [edx], 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCR90.dll_remove]
add esp, 4
test eax, eax
je 0x433e42
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffeb
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00435ab0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x433fa0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.WNC_WNCFILES_VERBOSE
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x433fd9
push 0x4537c8
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR90.dll_strcmp
add esp, 8
test eax, eax
je 0x433fd9
mov eax, 1
jmp 0x433fdb
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x434cf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x434d0b
xor eax, eax
jmp 0x434d17
mov eax, dword [ebp - 4]
and eax, 0x10
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x434e00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR90.dll__mkdir]
add esp, 4
test eax, eax
je 0x434e24
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 0xd
je 0x434e24
or eax, 0xffffffff
jmp 0x434e26
xor eax, eax
pop ebp
ret
Function at 0x435090
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4584e4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0x4538c4
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4350c2
mov eax, dword [ebp - 4]
jmp 0x435249
push str.WNCHOME_LS
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43520d
push 0x200
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x435101
xor eax, eax
jmp 0x435249
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x43511e
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x435144
mov edx, dword [ebp - 0x21c]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x435142
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], 0x2f
jmp 0x43510f
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00435260
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x435165
xor eax, eax
jmp 0x435249
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00435260
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x435195
xor eax, eax
jmp 0x435249
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00435260
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4351c5
xor eax, eax
jmp 0x435249
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
push 0x4538d8
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 8
test eax, eax
jne 0x435200
push 0x4538dc
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 8
test eax, eax
je 0x435204
xor eax, eax
jmp 0x435249
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp + 8]
test edx, edx
je 0x435246
push str.WNCHOME
push 0x459920
call sub.MSVCR90.dll_strcpy
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x459920
call sub.MSVCR90.dll_strcat
add esp, 8
push 0x459920
call dword [sym.imp.MSVCR90.dll__putenv]
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00435ab0
mov esp, ebp
pop ebp
ret

Function at 0x435ab0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4584e4]
jne 0x435aba
repz ret
jmp fcn.00436023
Function at 0x436730
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4584e4]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0043b7b0
test eax, eax
je 0x436763
call fcn.0043b710
push eax
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR90.dll_strcpy
add esp, 8
jmp 0x4367ac
push 0x453bf0
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x436796
push 0x453bf8
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCR90.dll_strcpy
add esp, 8
jmp 0x4367ac
mov edx, dword [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR90.dll_strcpy
add esp, 8
push 0x453bfc
push 0x453c04
push 0x5c
lea ecx, [ebp - 0x210]
push ecx
push 0x453c0c
push 0x45a340
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x18
mov byte [0x45a540], 0
push 0x453c18
push 0x45a340
call dword [sym.imp.MSVCR90.dll_strcspn]
add esp, 8
mov byte [eax + 0x45a340], 0
push 0x201
push 0x45a340
call fcn.004365c0
add esp, 8
push 0x453c1c
push str.zone
push 0x5c
lea edx, [ebp - 0x210]
push edx
push str._s_c_s_s
push 0x45a548
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x18
mov byte [0x45a748], 0
push 0x453c38
push 0x45a548
call dword [sym.imp.MSVCR90.dll_strcspn]
add esp, 8
mov byte [eax + 0x45a548], 0
push 0x201
push 0x45a548
call fcn.004365c0
add esp, 8
cmp dword [0x45a750], 0
jne 0x43687e
push 0x4366e0
call fcn.00435ef9
add esp, 4
mov dword [0x45a750], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435ab0
mov esp, ebp
pop ebp
ret

Function at 0x43b1a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4584e4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x45fbe4], 0
je 0x43b206
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s___d__:__d_n
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x14
mov ecx, dword [0x45fbe0]
push ecx
lea edx, [ebp - 0x408]
push edx
call sub.MSVCR90.dll_strlen
add esp, 4
push eax
push 1
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435ab0
mov esp, ebp
pop ebp
ret

Function at 0x43b710
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x453e68
cmp dword [0x45b71c], 0
je 0x43b72f
mov eax, 0x45b720
jmp 0x43b750
push 0x453e6c
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43b74d
mov eax, dword [ebp - 8]
jmp 0x43b750
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x43b7c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x45b71c], 0
je 0x43b7e1
push 0x45b720
push 0x45f9a8
call sub.MSVCR90.dll_strcpy
add esp, 8
jmp 0x43b81d
push str.WNCZONE
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43b80c
push 0x453e88
push 0x45f9a8
call sub.MSVCR90.dll_strcpy
add esp, 8
jmp 0x43b81d
mov eax, dword [ebp - 4]
push eax
push 0x45f9a8
call sub.MSVCR90.dll_strcpy
add esp, 8
push 0x453e8c
mov ecx, dword [ebp + 8]
push ecx
call fcn.00435870
add esp, 8
push eax
push 0x5c
push 0x45f9a8
push str._s_c_s
push 0x45f7a0
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x14
push 0x201
push 0x45f7a0
call fcn.0042bf10
add esp, 8
cmp dword [0x45fbb4], 0
jne 0x43b87b
push 0x43b6b0
call fcn.00435ef9
add esp, 4
mov dword [0x45fbb4], 1
mov esp, ebp
pop ebp
ret
Function at 0x446740
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x45fcf8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR90.dll_strlen
add esp, 4
push eax
push 1
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR90.dll_strlen
add esp, 4
cmp esi, eax
je 0x44679a
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffe6
jmp 0x4467d0
mov dx, word [0x45498c]
mov word [ebp - 8], dx
mov al, byte [0x45498e]
mov byte [ebp - 6], al
mov ecx, dword [ebp - 4]
push ecx
push 2
push 1
lea edx, [ebp - 8]
push edx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, 2
je 0x4467d0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xffffffe6
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4468c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x45fcf8]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
push eax
push 1
push 1
lea ecx, [ebp - 5]
push ecx
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x446915
mov edx, dword [ebp + 0x14]
mov dword [edx], 0xffffffe7
mov byte [ebp - 5], 0
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
jmp 0x446929
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
mov dl, byte [ebp - 5]
mov byte [ecx], dl
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 1
cmp dword [ebp - 4], ecx
jge 0x446945
movsx edx, byte [ebp - 5]
cmp edx, 0xa
je 0x446945
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
je 0x4468e3
mov ecx, dword [ebp + 0x10]
sub ecx, 1
cmp dword [ebp - 4], ecx
jne 0x4469c0
movsx edx, byte [ebp - 5]
cmp edx, 0xa
je 0x4469c0
mov eax, dword [ebp + 0x14]
mov dword [eax], 0xffffffd6
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 1]
cmp edx, 0xa
je 0x44697c
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0xa
jmp 0x446985
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0xd
je 0x4469a1
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0xa
jne 0x4469bb
cmp dword [ebp - 4], 0
jl 0x4469bb
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x446985
jmp 0x446a57
mov edx, dword [ebp + 0x14]
cmp dword [edx], 0xffffffe7
je 0x4469d1
movsx eax, byte [ebp - 5]
cmp eax, 0xa
jne 0x4469e2
cmp dword [ebp - 4], 0
jne 0x4469e2
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0xffffffe9
jmp 0x446a57
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0xd
je 0x446a0e
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0xa
jne 0x446a57
cmp dword [ebp - 4], 0
jl 0x446a57
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0xa
jne 0x446a43
cmp dword [ebp - 0x10], 0
jne 0x446a41
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x446a55
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x4469f2
mov esp, ebp
pop ebp
ret
Function at 0x4479a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.00447500
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4479c5
mov eax, 0xfffffff5
jmp 0x447af9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x320]
and edx, 1
jne 0x4479dd
mov eax, 0xfffffff4
jmp 0x447af9
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
shr ecx, 2
and ecx, 1
je 0x447a0b
mov edx, dword [ebp - 4]
push edx
call fcn.00449730
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x447a0b
mov eax, dword [ebp - 8]
jmp 0x447af9
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 4]
cmp ecx, 1
je 0x447a7a
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.00447720
add esp, 4
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x447a7a
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2aa]
test edx, edx
jne 0x447a7a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
push 1
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0x316]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2d0
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2c4], 0
je 0x447ab6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c4]
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c4], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2cc], 0
je 0x447ae2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2cc]
push ecx
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2cc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffe
mov edx, dword [ebp - 4]
mov dword [edx + 0x320], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x448850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffd
mov edx, dword [ebp + 8]
mov dword [edx + 0x320], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [str.WKNC_Id:_fbread.cpp_7003_2011_05_16_16:32:53Z_jsturton___WORKNC]
mov dword [eax + 0x210], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x214], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x21c], 0xa0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x218], 0xa0
mov edx, dword [ebp + 8]
mov dword [edx + 0x220], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x224], 0
call fcn.00447390
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x228
push ecx
call sub.MSVCR90.dll_strcpy
add esp, 8
mov edx, dword [ebp + 8]
mov byte [edx + 0x2a8], 1
mov eax, dword [ebp + 8]
mov byte [eax + 0x2a9], 1
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2aa], 1
mov edx, dword [ebp + 8]
mov byte [edx + 0x2ac], 0
call fcn.00447320
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2ab], al
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
push 0xa0
push 1
mov ecx, dword [ebp + 8]
add ecx, 0x210
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, 0xa0
je 0x44893b
mov eax, 0xffffffe6
jmp 0x44893d
xor eax, eax
pop ebp
ret

Function at 0x448940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
pop ebp
ret
Function at 0x449700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
pop ebp
ret