joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4528f0
Capabilities:
Read file on windows
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72c
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
mov ebx, edx
mov dword [ebp - 0x724], eax
push esi
push edi
test eax, eax
js 0x4529b8
cmp eax, 0x2711
je 0x4529b8
cmp eax, 0x2710
jge 0x452931
mov ecx, str.save_cnmajiro__04d.sav
jmp 0x4529a0
call fcn.00456860
mov edi, eax
call fcn.00456810
push 0
mov esi, eax
lea eax, [ebp - 0x520]
push 0x4c3c38
push eax
call fcn.00493964
push 0x200
lea eax, [ebp - 0x720]
mov edx, edi
push eax
lea eax, [ebp - 0x520]
mov ecx, esi
push eax
push str.QuickNum
call fcn.0047e280
lea eax, [ebp - 0x720]
push eax
call fcn.00494176
mov ecx, 0x271b
add esp, 0x20
sub ecx, dword [ebp - 0x724]
add eax, ecx
and eax, 0x80000007
jns 0x45299b
dec eax
or eax, 0xfffffff8
inc eax
mov ecx, str.save_cnmajiro_quick_d.sav
push eax
call fcn.0045e940
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00493964
add esp, 0xc
jmp 0x4529dd
mov ecx, str.save_cnmajiro_last.sav
call fcn.0045e940
lea edx, [ebp - 0x120]
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x4529d0
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x120]
mov edi, 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x452a23
lea eax, [ebp - 0x72c]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push 0x200
lea eax, [ebp - 0x320]
push 0
push eax
call fcn.0049cbc0
lea ecx, [ebp - 0x320]
add esp, 0xc
sub ecx, ebx
mov al, byte [ebx]
lea ebx, [ebx + 1]
mov byte [ecx + ebx - 1], al
test al, al
jne 0x452a41
lea eax, [ebp - 0x120]
push 2
push eax
call fcn.00495ab8
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x452ac7
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.00495cdf
add esp, 0xc
lea eax, [ebp - 0x14]
mov ecx, str.MajiroSavV1.105
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x452aa0
test dl, dl
je 0x452a9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x452aa0
add eax, 2
add ecx, 2
test dl, dl
jne 0x452a80
xor eax, eax
jmp 0x452aa5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x452abe
push 0x200
lea eax, [ebp - 0x320]
push eax
push esi
call fcn.00496584
add esp, 0xc
push esi
call fcn.00496ed8
add esp, 4
test edi, edi
jne 0x452b05
push edi
push 0x80
push 3
push edi
push edi
push 0x40000000
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x452b05
lea eax, [ebp - 0x72c]
push eax
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00493955
mov esp, ebp
pop ebp
ret
Function at 0x452ba0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x544
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
js 0x452c5f
cmp ebx, 0x2711
je 0x452c5f
cmp ebx, 0x2710
jge 0x452bdc
push ebx
mov ecx, str.save_cnmajiro__04d.sav
jmp 0x452c48
call fcn.00456860
mov edi, eax
call fcn.00456810
push 0
mov esi, eax
lea eax, [ebp - 0x520]
push 0x4c3c38
push eax
call fcn.00493964
push 0x200
lea eax, [ebp - 0x320]
mov edx, edi
push eax
lea eax, [ebp - 0x520]
mov ecx, esi
push eax
push str.QuickNum
call fcn.0047e280
lea eax, [ebp - 0x320]
push eax
call fcn.00494176
mov ecx, 0x271b
add esp, 0x20
sub ecx, ebx
add eax, ecx
and eax, 0x80000007
jns 0x452c42
dec eax
or eax, 0xfffffff8
inc eax
push eax
mov ecx, str.save_cnmajiro_quick_d.sav
call fcn.0045e940
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00493964
add esp, 0xc
jmp 0x452c7e
mov ecx, str.save_cnmajiro_last.sav
call fcn.0045e940
lea edx, [ebp - 0x120]
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x452c71
push 0x100
push 0
push 0x5619d0
call fcn.0049cbc0
lea eax, [ebp - 0x120]
push 0x4c3d40
push eax
call fcn.00494396
mov esi, eax
add esp, 0x14
test esi, esi
je 0x452dc1
push esi
push 1
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.00495739
add esp, 0x10
push esi
cmp eax, 1
jne 0x452db9
call fcn.00494b54
add esp, 4
lea eax, [ebp - 0x14]
mov ecx, str.MajiroSavV1.105
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x452cf8
test dl, dl
je 0x452cf4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x452cf8
add eax, 2
add ecx, 2
test dl, dl
jne 0x452cd8
xor eax, eax
jmp 0x452cfd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x452dc1
push eax
push 0x80
push 3
push eax
push eax
push 0x80000000
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x452dc1
lea eax, [ebp - 0x538]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x538]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x540]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [ebp - 0x524]
mov ecx, 0x64
push eax
movzx eax, word [ebp - 0x526]
push eax
movzx eax, word [ebp - 0x528]
push eax
movzx eax, word [ebp - 0x52a]
push eax
movzx eax, word [ebp - 0x52e]
push eax
movzx eax, word [ebp - 0x530]
cdq
idiv ecx
push edx
push str._02d__02d__02d__02d:_02d:_02d
push 0x5619d0
call fcn.00493964
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x452dc1
call fcn.00494b54
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 0x5619d0
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00493955
mov esp, ebp
pop ebp
ret
Function at 0x454020
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x518
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53a358], 0
jne 0x454075
mov ecx, str.REG_LOCAL
call fcn.00487da0
mov byte [0x53a358], 0
test eax, eax
je 0x454056
mov eax, dword [eax + 4]
jmp 0x45405b
mov eax, str.MAJIRO_RUNTIME
push 0x800
push eax
push 0x53a358
call fcn.00495450
add esp, 0xc
mov byte [0x53ab57], 0
cmp byte [0x53ab68], 0
jne 0x4540b7
mov ecx, str.REG_GLOBAL
call fcn.00487da0
mov byte [0x53ab68], 0
test eax, eax
je 0x454098
mov eax, dword [eax + 4]
jmp 0x45409d
mov eax, str.MAJIRO_SYSTEM
push 0x800
push eax
push 0x53ab68
call fcn.00495450
add esp, 0xc
mov byte [0x53b367], 0
push 0
lea eax, [ebp - 0x318]
push 0x4c3c38
push eax
call fcn.00493964
push 0x200
lea eax, [ebp - 0x518]
mov edx, 0x53a358
push eax
lea eax, [ebp - 0x318]
mov ecx, 0x53ab68
push eax
push str.QuickNum
call fcn.0047e280
lea eax, [ebp - 0x518]
push eax
call fcn.00494176
push eax
lea eax, [ebp - 0x118]
push str.save_cnmajiro_quick_d.sav
push eax
call fcn.00493964
add esp, 0x2c
lea ecx, [ebp - 0x118]
call fcn.0045e940
mov edx, 0x561ad0
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x454124
call fcn.00470220
test eax, eax
je 0x454159
push 0x4c68d8
call fcn.00485da0
add esp, 4
test eax, eax
jne 0x454159
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493955
mov esp, ebp
pop ebp
ret
push esi
push 0x4c3d40
push 0x561ad0
call fcn.00494396
mov esi, eax
add esp, 8
test esi, esi
je 0x4541e7
push esi
push 1
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.00495739
push esi
call fcn.00494b54
add esp, 0x14
lea eax, [ebp - 0x14]
mov ecx, str.MajiroSavV1.105
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4541b1
test dl, dl
je 0x4541ad
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4541b1
add eax, 2
add ecx, 2
test dl, dl
jne 0x454191
xor eax, eax
jmp 0x4541b6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4541e0
mov dword [0x53c88c], 2
or eax, 0xffffffff
mov dword [0x5379f4], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493955
mov esp, ebp
pop ebp
ret
push 0x4c6900
jmp 0x4541ec
push 0x4c6918
call fcn.00485d10
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00493955
mov esp, ebp
pop ebp
ret
Function at 0x455bb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x56eb6c], 0
jne 0x455c20
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call esi
test eax, eax
je 0x455c14
mov edi, edi
cmp dword [ebp - 0x18], 0x12
je 0x455c24
lea eax, [ebp - 0x1c]
push eax
call edi
lea eax, [ebp - 0x1c]
push eax
call ebx
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call esi
test eax, eax
jne 0x455bf0
cmp dword [0x56eb6c], 0
je 0x455bd4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x14]
call fcn.0049501f
int3

Function at 0x4568b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa04
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x538b40], 0
jne 0x456a00
mov ecx, str.TITLEBAR
call fcn.00487da0
mov byte [ebp - 0xa04], 0
test eax, eax
je 0x4568ea
mov eax, dword [eax + 4]
jmp 0x4568ef
mov eax, 0x4c6c0c
push 0x800
push eax
lea eax, [ebp - 0xa04]
push eax
call fcn.00495450
lea eax, [ebp - 0xa04]
mov byte [ebp - 0x205], 0
push 0x4c6c3c
push eax
call fcn.004972b3
lea ecx, [ebp - 0xa04]
add esp, 0x14
cmp eax, ecx
je 0x456949
mov eax, ecx
push eax
push 0x538b40
call fcn.0049f3e0
add esp, 8
mov eax, 0x538b40
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493955
mov esp, ebp
pop ebp
ret
push esi
push edi
lea eax, [ebp - 0xa01]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4569ab
call fcn.00456860
mov edi, eax
call fcn.00456810
push 1
mov esi, eax
lea eax, [ebp - 0x204]
push 0x4c3c38
push eax
call fcn.00493964
push 0
lea eax, [ebp - 0x204]
mov edx, edi
push eax
push str.MULTIPLE_EXEC
mov ecx, esi
call fcn.0047e3b0
lea eax, [ebp - 0xa04]
jmp 0x4569f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00456860
mov edi, eax
call fcn.00456810
push 0
mov esi, eax
lea eax, [ebp - 0x204]
push 0x4c3c38
push eax
call fcn.00493964
push 0
lea eax, [ebp - 0x204]
mov edx, edi
push eax
push str.MULTIPLE_EXEC
mov ecx, esi
call fcn.0047e3b0
lea eax, [ebp - 0xa01]
push eax
push 0x538b40
call fcn.0049f3e0
add esp, 0x20
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, 0x538b40
xor ecx, ebp
call fcn.00493955
mov esp, ebp
pop ebp
ret

Function at 0x45a8f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x53bb48]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], str.open
call fcn.00457320
movdqa xmm0, xmmword [0x4c9ee0]
push str.none
push eax
mov dword [ebp - 0x2c], eax
movdqu xmmword [ebp - 0x28], xmm0
call fcn.004959dc
add esp, 8
test eax, eax
jne 0x45a93e
mov esp, ebp
pop ebp
ret
mov eax, dword [0x53c0fc]
test eax, eax
je 0x45a949
call eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov esp, ebp
pop ebp
ret
Function at 0x45b7a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x67c
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0
push 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x56d248
call fcn.00494895
push 0x56d248
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x620]
push str._s_sMajiroCompile.exe__f__t__d__txt__s_s
push eax
call fcn.00493964
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x218]
push str._s_s
push eax
call fcn.00493964
lea ecx, [ebp - 0x218]
add esp, 0x38
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45b816
sub ecx, edx
cmp byte [ebp + ecx - 0x219], 0x5c
jne 0x45b83d
dec ecx
cmp ecx, 0x208
jae 0x45b927
mov byte [ebp + ecx - 0x218], al
lea eax, [ebp - 0x678]
mov dword [ebp - 0x668], 0x44
push eax
lea eax, [ebp - 0x668]
mov dword [ebp - 0x664], 0
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x660], 0
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x620]
mov dword [ebp - 0x65c], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x658], 0
push 0
mov dword [ebp - 0x654], 0
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x640], 0
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x638], 0xa
movdqu xmmword [ebp - 0x634], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
test edi, edi
je 0x45b916
push dword [ebp - 0x678]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x674]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.00493955
mov esp, ebp
pop ebp
ret
call fcn.004946f4
int3
Function at 0x45b930
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0
lea eax, [ebp - 0x418]
mov esi, ecx
push eax
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.00494895
push esi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x620]
push str._s_sMajiroCompile.exe__f__t__d__txt__s_s
push eax
call fcn.00493964
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x218]
push str._s_s
push eax
call fcn.00493964
lea ecx, [ebp - 0x218]
add esp, 0x38
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45b9a1
sub ecx, edx
je 0x45b9ca
cmp byte [ebp + ecx - 0x219], 0x5c
jne 0x45b9ca
dec ecx
cmp ecx, 0x208
jae 0x45baca
mov byte [ebp + ecx - 0x218], al
lea eax, [ebp - 0x678]
mov dword [ebp - 0x668], 0x44
push eax
lea eax, [ebp - 0x668]
mov dword [ebp - 0x664], 0
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x660], 0
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x620]
mov dword [ebp - 0x65c], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x658], 0
push 0
mov dword [ebp - 0x654], 0
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x640], 0
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x638], 0xa
movdqu xmmword [ebp - 0x634], xmm0
mov dword [0x56eb6c], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
test edi, edi
je 0x45baab
push dword [ebp - 0x678]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x674]
call esi
call fcn.00455bb0
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00493955
mov esp, ebp
pop ebp
ret
call fcn.004946f4
int3
Function at 0x45cda0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1b1c
call fcn.0049f010
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4e4e18], 1
push ebx
push esi
push edi
mov dword [ebp - 0x1b1c], edx
je 0x45cfd6
cmp byte [0x56d550], 0
je 0x45cfd6
push 0
lea eax, [ebp - 0x318]
push eax
push 0
push 0
push ecx
call fcn.00494895
mov eax, dword [0x53c0fc]
add esp, 0x14
test eax, eax
je 0x45cdfb
call eax
push str._fn_
push 0x56d550
call fcn.00497050
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x45cf28
push 0x4c3dbc
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x218]
push str._s.mjo
push eax
call fcn.00493964
lea edx, [ebp - 0x218]
mov ecx, edx
call fcn.00482070
push 0x4c3dbc
lea edx, [ebp - 0x218]
lea ecx, [ebp - 0x110]
call fcn.0045cb50
add esp, 0x14
lea eax, [ebp - 0x110]
push 0x4c3d40
push eax
call fcn.00494396
add esp, 8
test eax, eax
jne 0x45ce8e
lea eax, [ebp - 0x318]
push 0x4c7738
push eax
lea ecx, [ebp - 0x110]
call fcn.0045cc70
add esp, 8
jmp 0x45ce97
push eax
call fcn.00494b54
add esp, 4
mov esi, ebx
lea eax, [ebp - 0xb18]
sub esi, 0x56d550
push esi
push 0x56d550
push eax
call fcn.0049c4f0
add esp, 0xc
cmp esi, 0x800
jae 0x45cfe7
lea edx, [ebp - 0x110]
mov byte [ebp + esi - 0xb18], 0
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x45ced0
lea edi, [ebp - 0xb18]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x45cee0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebx + 4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
jmp 0x45cf00
mov al, byte [edx]
inc edx
test al, al
jne 0x45cf00
lea edi, [ebp - 0xb18]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x45cf10
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x45cf44
xor ecx, ecx
lea ebx, [ebx]
mov al, byte [ecx + 0x56d550]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0xb19], al
test al, al
jne 0x45cf30
lea eax, [ebp - 0xb18]
push str._line_
push eax
call fcn.00497050
mov edi, eax
add esp, 8
test edi, edi
je 0x45cfb0
lea eax, [ebp - 0xb18]
mov esi, edi
sub esi, eax
push esi
push eax
lea eax, [ebp - 0x1b18]
push eax
call fcn.0049c4f0
add esp, 0xc
cmp esi, 0x800
jae 0x45cfe7
lea eax, [edi + 6]
mov byte [ebp + esi - 0x1b18], 0
push eax
push dword [ebp - 0x1b1c]
lea eax, [ebp - 0x1b18]
push eax
lea eax, [ebp - 0x1318]
push str._s_d_s
push eax
call fcn.00493964
add esp, 0x14
jmp 0x45cfc7
xor ecx, ecx
mov al, byte [ebp + ecx - 0xb18]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x1319], al
test al, al
jne 0x45cfb2
push 0xa
lea eax, [ebp - 0x1318]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00493955
mov esp, ebp
pop ebp
ret
call fcn.004946f4
int3
Function at 0x45d550
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
cmp dword [0x4e4e18], 1
je 0x45d5a8
cmp dword [0x53ab58], 0
jne 0x45d593
push esi
push 0x2020
call fcn.00497cab
mov esi, eax
add esp, 4
test esi, esi
jne 0x45d589
push 0x10
push str.malloc
push 0x4c9a90
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x53ab58], esi
mov byte [esi], 0
pop esi
mov ecx, str._r_n_r_n
call fcn.0045d4d0
mov ecx, dword [0x53ab58]
jmp fcn.00482b20
ret

Function at 0x45e050
Capabilities:
Create directory
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edi, 1
jmp 0x45e090
xor ecx, ecx
mov al, byte [ecx + 0x56de60]
mov byte [ebp + ecx - 0x108], al
inc ecx
test al, al
jne 0x45e092
xor esi, esi
lea eax, [ebp - 0x108]
test edi, edi
jle 0x45e10b
mov cl, byte [eax]
test cl, cl
je 0x45e0d6
cmp byte [eax + 1], 0
lea edx, [eax + 1]
jne 0x45e0c3
mov eax, edx
jmp 0x45e0d6
movzx ecx, cl
test byte [ecx + 0x4c5029], 1
jne 0x45e0d3
mov eax, edx
jmp 0x45e0d6
add eax, 2
cmp byte [eax], 0
je 0x45e112
jmp 0x45e0e0
mov dl, byte [eax]
movzx ecx, dl
test byte [ecx + 0x4c5029], 1
jne 0x45e0f6
cmp dl, 0x5c
je 0x45e106
inc eax
jmp 0x45e0ff
cmp byte [eax + 1], 0
je 0x45e112
add eax, 2
cmp byte [eax], 0
jne 0x45e0e0
jmp 0x45e112
inc esi
cmp esi, edi
jl 0x45e0b0
test eax, eax
je 0x45e112
mov byte [eax], 0
lea eax, [ebp - 0x108]
push eax
call ebx
test eax, eax
jne 0x45e131
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x45e197
lea eax, [ebp - 0x20c]
push eax
call ebx
lea ecx, [ebp - 0x108]
mov eax, 0x56de60
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x45e165
test dl, dl
je 0x45e161
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x45e165
add eax, 2
add ecx, 2
test dl, dl
jne 0x45e145
xor eax, eax
jmp 0x45e16a
sbb eax, eax
or eax, 1
test eax, eax
je 0x45e184
inc edi
cmp edi, 0x3e7
jl 0x45e090
lea eax, [ebp - 0x20c]
push eax
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493955
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00493955
mov esp, ebp
pop ebp
ret
Function at 0x45e9c0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x10b]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x10b], 0
lea esi, [ebp - 0x10b]
je 0x45ea83
jmp 0x45ea00
mov cl, byte [esi]
movzx eax, cl
test byte [eax + 0x4c5029], 1
jne 0x45ea16
cmp cl, 0x5c
je 0x45ea33
inc esi
jmp 0x45ea1f
cmp byte [esi + 1], 0
je 0x45ea83
add esi, 2
cmp byte [esi], 0
jne 0x45ea00
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493955
mov esp, ebp
pop ebp
ret
mov dl, byte [esi + 1]
lea eax, [esi + 1]
test dl, dl
je 0x45ea63
lea ecx, [ecx]
movzx ecx, dl
test byte [ecx + 0x4c5029], 1
jne 0x45ea54
cmp dl, 0x5c
je 0x45ea6e
inc eax
jmp 0x45ea5d
cmp byte [eax + 1], 0
je 0x45ea63
add eax, 2
mov dl, byte [eax]
test dl, dl
jne 0x45ea40
cmp byte [esi - 1], 0x3a
je 0x45ea72
mov byte [esi], 0
jmp 0x45ea76
mov esi, eax
jmp 0x45ea33
mov byte [esi + 1], 0
lea eax, [ebp - 0x10b]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00493955
mov esp, ebp
pop ebp
ret
Function at 0x4620e0
Capabilities:
Create directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
lea edi, [ebp - 0x108]
xor esi, esi
sub edi, ebx
mov ecx, ebx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x462104
cmp byte [ebp - 0x108], al
je 0x462168
mov eax, 1
xor ecx, ecx
cmp ecx, esi
jg 0x462168
mov dl, byte [ebp + eax - 0x108]
test dl, dl
je 0x462168
cmp dl, 0x5c
jne 0x462142
cmp byte [ebp + eax - 0x109], dl
je 0x462142
inc ecx
cmp ecx, esi
jg 0x46214c
inc eax
cmp eax, 0x104
jl 0x462120
jmp 0x462168
cmp byte [ebp + eax - 0x109], 0x3a
jne 0x462160
mov byte [ebp + eax - 0x107], 0
jmp 0x462168
mov byte [ebp + eax - 0x108], 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x46218b
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4621dc
lea ecx, [ebp - 0x108]
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4621b3
test dl, dl
je 0x4621af
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4621b3
add eax, 2
add ecx, 2
test dl, dl
jne 0x462193
xor eax, eax
jmp 0x4621b8
sbb eax, eax
or eax, 1
test eax, eax
je 0x4621c9
inc esi
cmp esi, 0x3e7
jl 0x462102
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493955
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00493955
mov esp, ebp
pop ebp
ret

Function at 0x462200
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
lea edx, [ebp - 0x108]
sub edx, ecx
jmp 0x462220
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x462220
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x462236
sub ecx, edx
cmp ecx, 1
jae 0x462257
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493955
mov esp, ebp
pop ebp
ret
cmp byte [ebp + ecx - 0x109], 0x5c
jne 0x46227c
cmp byte [ebp + ecx - 0x10a], 0x3a
je 0x46227c
dec ecx
cmp ecx, 0x104
jae 0x4622ba
mov byte [ebp + ecx - 0x108], 0
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x108]
call fcn.004620e0
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00493955
mov esp, ebp
pop ebp
ret
call fcn.004946f4
int3