joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447ab4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x103
xor ebx, ebx
push edi
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x29b]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x29c], bl
call fcn.004a8c80
add esp, 0xc
push edi
lea eax, [ebp - 0x193]
push ebx
push eax
mov byte [ebp - 0x194], bl
call fcn.004a8c80
add esp, 0xc
push 0x7f
lea eax, [ebp - 0x8b]
push ebx
push eax
mov byte [ebp - 0x8c], bl
call fcn.004a8c80
xor eax, eax
mov word [ebp - 0x334], bx
lea edi, [ebp - 0x332]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x344], bx
lea edi, [ebp - 0x342]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp esi, ebx
stosw word es:[edi], ax
jne 0x447b60
push str.StoreId.dat
lea edi, [ebp - 0x29c]
call fcn.00442cbc
jmp 0x447b71
push esi
mov ecx, 0x104
lea eax, [ebp - 0x29c]
call fcn.00477a48
pop ecx
lea edx, [ebp - 0x29c]
call fcn.00477a16
test eax, eax
je 0x447b92
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8565
leave
ret
call fcn.004a913c
push eax
push str.StoreId.dat
push ebx
push ebx
call fcn.0045bc06
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x194]
push str._stempGet_s_d
push eax
call fcn.004a8bfe
add esp, 0x14
lea eax, [ebp - 0x194]
call fcn.004199a1
lea edx, [ebp - 0x194]
lea ecx, [ebp - 0x29c]
call fcn.00419a4c
test eax, eax
je 0x447b81
push 0x10
lea eax, [ebp - 0x334]
push ebx
push eax
mov byte [ebp - 0x8c], bl
call fcn.004a8c80
add esp, 0xc
push 0x10
lea eax, [ebp - 0x344]
push ebx
push eax
call fcn.004a8c80
add esp, 0xc
push 0x2a5b
push str..Network.c
mov edx, 0x4c722c
lea ecx, [ebp - 0x194]
call fcn.0041bb64
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x320], eax
je 0x447b81
push 0x7f
lea eax, [ebp - 0x31b]
push ebx
push eax
mov byte [ebp - 0x31c], bl
call fcn.004a8c80
add esp, 0xc
push dword [ebp - 0x320]
mov edi, 0x80
lea eax, [ebp - 0x8c]
push edi
push eax
call fcn.004aa00d
add esp, 0xc
push ebx
push 0xa
lea esi, [ebp - 0x8c]
call fcn.00478581
push dword [ebp - 0x320]
lea eax, [ebp - 0x31c]
push edi
push eax
call fcn.004aa00d
add esp, 0x14
push dword [ebp - 0x320]
lea eax, [ebp - 0x334]
push 1
push 0x10
push eax
call fcn.004a8fc5
mov ecx, dword [ebp - 0x320]
add esp, 0x10
call fcn.0041bf91
mov edi, dword [ebp - 0x324]
cmp edi, ebx
je 0x447cbe
lea esi, [ebp - 0x334]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
sub esp, 0x10
lea esi, [ebp - 0x334]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00499a8c
add esp, 0x14
test eax, eax
jne 0x447d06
cmp dword [ebp - 0x324], ebx
je 0x447cf4
push 0x10
push ebx
push dword [ebp - 0x324]
call fcn.004a8c80
add esp, 0xc
lea eax, [ebp - 0x194]
call fcn.004199a1
mov eax, ebx
jmp 0x447b83
xor ebx, ebx
inc ebx
jmp 0x447cf4
Function at 0x4493b3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.004a8c80
add esp, 0xc
push str.lnd.reg
push ebx
push ebx
call fcn.0045bc06
pop ecx
pop ecx
push eax
push 0x4c8500
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00478fcf
push 0x2e97
push str..Network.c
mov edx, 0x4c722c
lea ecx, [ebp - 0x110]
call fcn.0041bb64
mov edi, eax
add esp, 0x1c
cmp edi, ebx
jne 0x449432
xor eax, eax
jmp 0x44945d
call fcn.00449369
mov esi, eax
cmp esi, ebx
je 0x44942e
push edi
push 0x1a
push 0x27c
push esi
call fcn.004a8fc5
mov ecx, edi
call fcn.0041bf91
push ebx
mov eax, esi
call fcn.00449380
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8565
leave
ret

Function at 0x44946c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
xor edi, edi
lea eax, [ebp - 0x10f]
mov esi, ecx
push edi
push eax
mov dword [ebp - 0x114], esi
mov byte [ebp - 0x110], 0
call fcn.004a8c80
add esp, 0xc
cmp esi, edi
jne 0x4494b3
xor eax, eax
jmp 0x44957c
push str.lnd.reg
push edi
push edi
call fcn.0045bc06
pop ecx
pop ecx
push eax
push 0x4c8500
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00478fcf
add esp, 0x14
movsx eax, byte [esi]
call fcn.004778a5
cmp eax, 0x61
jl 0x4494ed
cmp eax, 0x7a
jle 0x449506
inc edi
add esi, 0x27c
cmp edi, 0x1a
jl 0x4494db
lea eax, [ebp - 0x110]
call fcn.004199a1
jmp 0x44957c
push 0x2eca
mov edi, str..Network.c
mov esi, 0x4c7368
push edi
mov edx, esi
lea ecx, [ebp - 0x110]
call fcn.0041bb64
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x449555
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x2ecd
push edi
mov edx, esi
lea ecx, [ebp - 0x110]
call fcn.0041bb64
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x4494ac
push ebx
push 0x1a
push 0x27c
push dword [ebp - 0x114]
call fcn.004a7ca6
add esp, 0x10
mov ecx, ebx
mov esi, eax
call fcn.0041bf91
xor eax, eax
cmp esi, 0x1a
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8565
leave
ret
Function at 0x44a1ba
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x120], edi
mov byte [ebp - 0x110], bl
call fcn.004a8c80
add esp, 0xc
push 0x8c
lea eax, [ebp - 0x1ac]
push ebx
push eax
mov dword [ebp - 0x1b0], ebx
call fcn.004a8c80
add esp, 0xc
cmp edi, ebx
mov dword [ebp - 0x118], ebx
jne 0x44a22b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8565
leave
ret
mov esi, 0x90
push esi
push ebx
push edi
mov dword [ebp - 0x114], 1
call fcn.004a8c80
add esp, 0xc
push 0x32ab
push str..Network.c
push 0x280
call fcn.0044337f
add esp, 0xc
push str.fTender.cfg
lea edi, [ebp - 0x110]
call fcn.00442baf
pop ecx
push ebx
push 0x20
push 3
push 0x80000000
mov eax, edi
call fcn.00418959
add esp, 0x10
cmp eax, 0xffffffff
mov dword [ebp - 0x11c], eax
jne 0x44a294
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x44a21a
push ebx
lea ecx, [ebp - 0x118]
push ecx
push esi
lea ecx, [ebp - 0x1b0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44a2c1
mov esi, dword [ebp - 0x11c]
call fcn.0041c426
mov eax, ebx
jmp 0x44a21c
cmp dword [ebp - 0x118], esi
jae 0x44a2e0
push esi
lea eax, [ebp - 0x1b0]
push ebx
push eax
call fcn.004a8c80
add esp, 0xc
mov dword [ebp - 0x114], ebx
cmp dword [ebp - 0x1b0], ebx
jl 0x44a2f1
cmp dword [ebp - 0x1b0], 7
jle 0x44a308
push esi
lea eax, [ebp - 0x1b0]
push ebx
push eax
call fcn.004a8c80
add esp, 0xc
mov dword [ebp - 0x114], ebx
mov edi, dword [ebp - 0x120]
mov ebx, dword [ebp - 0x114]
push 0x24
pop ecx
lea esi, [ebp - 0x1b0]
rep movsd dword es:[edi], dword [esi]
jmp 0x44a2af
Function at 0x44eff6
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
mov ebx, eax
jne 0x44f009
mov edi, 0x5fdcc8
mov eax, dword [ebp + 0x14]
dec eax
dec eax
je 0x44f177
dec eax
je 0x44f094
push dword [ebp + 8]
mov eax, dword [ebp + 0x14]
call fcn.0044f2dc
push eax
push str.DRIVER_s_SERVER_s_OPTION3_
mov esi, 0x200
push esi
push edi
call fcn.00478fcf
add esp, 0x14
mov edx, ebx
call fcn.00477a16
test eax, eax
jne 0x44f051
push ebx
push str.DATABASE_s_
mov eax, esi
call fcn.00478f8d
pop ecx
pop ecx
mov edx, dword [ebp + 0xc]
call fcn.00477a16
test eax, eax
jne 0x44f06e
push dword [ebp + 0xc]
mov eax, esi
push str.USER_s_
call fcn.00478f8d
pop ecx
pop ecx
mov edx, dword [ebp + 0x10]
call fcn.00477a16
test eax, eax
jne 0x44f200
push dword [ebp + 0x10]
mov eax, esi
push str.PASSWORD_s_
call fcn.00478f8d
pop ecx
pop ecx
jmp 0x44f200
push 3
pop eax
call fcn.0044f2dc
push eax
push str.DRIVER_s_
mov esi, 0x200
push esi
push edi
call fcn.00478fcf
push dword [ebp + 8]
mov eax, esi
push str.HOST_s_
call fcn.00478f8d
push dword [ebp + 8]
mov eax, esi
push str.SERVERtms_server_
call fcn.00478f8d
push str.SERVICE1525_
mov eax, esi
call fcn.00478f8d
push str.PROTOCOLontlitcp_
mov eax, esi
call fcn.00478f8d
add esp, 0x28
mov edx, ebx
call fcn.00477a16
test eax, eax
jne 0x44f101
push ebx
push str.DATABASE_s_
mov eax, esi
call fcn.00478f8d
pop ecx
pop ecx
mov edx, dword [ebp + 0xc]
call fcn.00477a16
test eax, eax
jne 0x44f11e
push dword [ebp + 0xc]
mov eax, esi
push str.UID_s_
call fcn.00478f8d
pop ecx
pop ecx
cmp dword [ebp + 0x10], 0
je 0x44f135
push dword [ebp + 0x10]
mov eax, esi
push str.PWD_s_
call fcn.00478f8d
pop ecx
pop ecx
mov ebx, str.informix_
push ebx
push 0
call fcn.0045ba18
push eax
push str.TDLL_sbinigo4n304.dll_
mov eax, esi
call fcn.00478f8d
push str.TRANSLATIONOPTION0_
mov eax, esi
call fcn.00478f8d
push ebx
push 0
call fcn.0045ba18
add esp, 0x1c
push eax
push str.INFORMIXDIR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x44f200
push 2
pop eax
call fcn.0044f2dc
push eax
push str.Driver_s_
mov esi, 0x200
push esi
push edi
call fcn.00478fcf
mov edx, dword [ebp + 0xc]
add esp, 0x10
call fcn.00477a16
test eax, eax
jne 0x44f1b1
push dword [ebp + 0xc]
mov eax, esi
push str.UID_s_
call fcn.00478f8d
pop ecx
pop ecx
cmp dword [ebp + 0x10], 0
je 0x44f1c8
push dword [ebp + 0x10]
mov eax, esi
push str.PWD_s_
call fcn.00478f8d
pop ecx
pop ecx
mov edx, ebx
call fcn.00477a16
test eax, eax
jne 0x44f1e2
push ebx
push str.DBN_s_
mov eax, esi
call fcn.00478f8d
pop ecx
pop ecx
push str.ENGdefault_
mov eax, esi
call fcn.00478f8d
push dword [ebp + 8]
mov eax, esi
push str.Linkstcpip_HOST_s_PORT2638_verifyno_dobroadcastnone__
call fcn.00478f8d
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4509e3
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov esi, 0xff
push esi
xor ebx, ebx
lea eax, [ebp - 0x10b]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x114], edi
mov byte [ebp - 0x10c], 0
call fcn.004a8c80
add esp, 0xc
cmp edi, ebx
je 0x450a2b
mov eax, edi
call fcn.00477999
push ebx
call fcn.004506b0
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x450a3f
xor eax, eax
jmp 0x450b27
push str.SELECT_STORE_PROFILE.STORE_NUM__COMPANY.NAME_FROM_STORE_PROFILE__COMPANY_WHERE_STORE_PROFILE.COMPANY_IDCOMPANY.ID
push edi
mov dword [ebp - 0x110], ebx
call fcn.0044f89d
test eax, eax
pop ecx
pop ecx
je 0x450b14
push 2
push 9
push esi
lea eax, [ebp - 0x10c]
push eax
push edi
mov dword [ebp - 0x118], ebx
call fcn.0044f988
add esp, 0x14
test eax, eax
je 0x450b1a
mov ebx, 0x4c9ffc
cmp dword [ebp - 0x118], 0xde
jge 0x450b1a
cmp dword [ebp - 0x110], 0
jne 0x450aef
lea eax, [ebp - 0x10c]
push eax
call fcn.004a9d63
cmp dword [ebp - 0x114], 0
pop ecx
mov dword [ebp - 0x110], eax
je 0x450aef
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.004a7fc0
test eax, eax
pop ecx
pop ecx
je 0x450aef
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.004a7fc0
mov ecx, dword [ebp + 8]
inc eax
push eax
mov eax, dword [ebp - 0x114]
call fcn.00477a48
add esp, 0xc
call fcn.00478422
inc dword [ebp - 0x118]
push 2
push 9
push esi
lea eax, [ebp - 0x10c]
push eax
push edi
call fcn.0044f988
add esp, 0x14
test eax, eax
jne 0x450a82
jmp 0x450b1a
mov dword [ebp - 0x110], ebx
push edi
call fcn.0044f658
mov eax, dword [ebp - 0x110]
pop ecx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8565
leave
ret
Function at 0x450c86
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3f
xor ebx, ebx
lea eax, [ebp - 0x47]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x50], esi
mov byte [ebp - 0x48], 0
call fcn.004a8c80
add esp, 0xc
call fcn.0049a965
cmp esi, ebx
je 0x450cbe
mov dword [esi], ebx
push ebx
call fcn.004506b0
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x450cdb
call fcn.0040fb59
neg eax
sbb eax, eax
neg eax
jmp 0x450d73
mov ecx, edi
mov dword [ebp - 0x4c], ebx
call fcn.00450937
push eax
push str.SELECT_TENDER_TYPE_ACCEPTED_FROM_TENDER_TYPE_PROFILE_WHERE_LOC_d
push edi
call fcn.0044f89d
add esp, 0xc
test eax, eax
je 0x450d46
push 1
push 9
push 0x3f
lea eax, [ebp - 0x48]
push eax
push edi
call fcn.0044f988
jmp 0x450d3c
cmp ebx, 0xde
jge 0x450d43
lea esi, [ebp - 0x48]
call fcn.0047a457
test eax, eax
je 0x450d28
xor eax, eax
inc eax
mov ecx, ebx
shl eax, cl
or dword [ebp - 0x4c], eax
push 1
push 9
push 0x3f
lea eax, [ebp - 0x48]
push eax
push edi
inc ebx
call fcn.0044f988
mov esi, dword [ebp - 0x50]
add esp, 0x14
test eax, eax
jne 0x450d0a
mov ebx, dword [ebp - 0x4c]
push edi
call fcn.0044f658
test esi, esi
pop ecx
je 0x450d53
mov dword [esi], ebx
test bl, 1
je 0x450d70
test bl, 2
je 0x450d70
test bl, 8
je 0x450d6c
test bl, 0x10
je 0x450d6c
test bl, 4
jne 0x450d70
xor eax, eax
jmp 0x450d73
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8565
leave
ret
Function at 0x455c6d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x455d42
cmp dword [esi + 4], ebx
jle 0x455d42
push edi
call fcn.0046a3c9
cmp dword [esi + 4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
jle 0x455cef
lea eax, [esi + 0x40]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movsx ebx, word [eax]
mov edi, dword [ebp - 8]
call fcn.0046a752
test eax, eax
mov edi, dword [ebp - 0xc]
jne 0x455cc3
movsx eax, word [edi]
mov ebx, dword [ebp - 8]
push eax
call fcn.0046a47b
pop ecx
cmp word [edi + 6], 0
jle 0x455cd9
movsx ebx, word [edi]
push 1
push dword [ebp - 8]
call fcn.0046a7c4
pop ecx
pop ecx
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, 0x90
cmp eax, dword [esi + 4]
mov dword [ebp - 0xc], edi
jl 0x455ca1
xor ebx, ebx
cmp dword [esi + 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
jle 0x455d34
lea eax, [esi + 0x63]
mov dword [ebp - 0xc], eax
jmp 0x455d07
mov eax, dword [ebp - 0xc]
xor ebx, ebx
mov edi, dword [ebp - 8]
mov byte [eax], bl
movsx ebx, word [eax - 0x23]
call fcn.0046a8ea
test eax, eax
je 0x455d22
mov eax, dword [ebp - 0xc]
inc dword [ebp - 0x10]
mov byte [eax], 1
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add dword [ebp - 0xc], 0x90
cmp eax, dword [esi + 4]
jl 0x455d02
mov esi, dword [ebp - 8]
call fcn.0046a43e
mov eax, dword [ebp - 0x10]
pop edi
jmp 0x455d45
or eax, 0xffffffff
pop esi
pop ebx
leave
ret
Function at 0x45b786
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
push esi
push edi
jne 0x45b7a3
cmp dword [esp + 0x10], eax
je 0x45b7a3
cmp dword [esp + 0x10], 0xffffffff
je 0x45b7a3
call fcn.0045bea5
mov ebx, eax
mov esi, 0x5fead0
mov edx, esi
call fcn.00477a16
test eax, eax
mov edi, 0x104
je 0x45b7f2
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push edi
push esi
push str.APPDATA
call ebp
test eax, eax
jne 0x45b7ea
push edi
push esi
push str.SystemDrive
call ebp
test eax, eax
jne 0x45b7f1
push 0x4e52cc
mov ecx, edi
mov eax, esi
call fcn.00477a48
pop ecx
jmp 0x45b7f1
mov byte [0x5fead2], 0
pop ebp
push esi
mov esi, 0x5febd8
mov ecx, edi
mov eax, esi
call fcn.00477a48
test ebx, ebx
pop ecx
je 0x45b844
push esi
push ebx
call fcn.004a8050
push esi
call fcn.004a7f30
mov ecx, dword [esp + 0x1c]
add esp, 0xc
test ecx, ecx
je 0x45b842
cmp ecx, 0xffffffff
je 0x45b842
lea edx, [esp + 0x14]
push edx
push ecx
sub edi, eax
add eax, ebx
push edi
push eax
call fcn.004a9b76
add esp, 0x10
test eax, eax
jge 0x45b842
mov byte [ebx + 0x103], 0
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x45ba18
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp + 0x88], eax
mov eax, dword [ebp + 0x94]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov dword [ebp - 0x80], eax
jne 0x45ba5e
cmp dword [ebp + 0x98], ebx
je 0x45ba5e
cmp dword [ebp + 0x98], 0xffffffff
je 0x45ba5e
call fcn.0045bea5
mov dword [ebp - 0x80], eax
mov eax, fcn.0045b919
cmp eax, fcn.0045ba18
mov esi, 0x5ff208
mov edi, 0x104
mov edx, esi
je 0x45babb
call fcn.00477a16
test eax, eax
jne 0x45ba8b
cmp dword [0x5feac4], ebx
je 0x45bb53
push edi
push ebx
push esi
call fcn.004a8c80
push ebx
push ebx
mov dword [0x5feac4], ebx
call fcn.0045b919
push eax
push str._sPAULA_
push edi
push esi
call fcn.00478fcf
push esi
call fcn.004a7f30
add esp, 0x28
jmp 0x45bb4e
call fcn.00477a16
test eax, eax
jne 0x45bad0
cmp dword [0x5feac4], ebx
je 0x45bb53
push edi
push ebx
push esi
call fcn.004a8c80
add esp, 0xc
push edi
lea eax, [ebp - 0x7c]
push eax
mov dword [0x5feac4], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.APPDATA
call ebx
test eax, eax
jne 0x45bb27
push edi
lea eax, [ebp - 0x7c]
push eax
push str.USERPROFILE
call ebx
test eax, eax
jne 0x45bb27
push edi
lea eax, [ebp - 0x7c]
push eax
push str.ProgramData
call ebx
test eax, eax
jne 0x45bb27
push str.C:ProgramData
mov ecx, edi
lea eax, [ebp - 0x7c]
call fcn.00477a48
pop ecx
lea eax, [ebp - 0x7c]
push 0x4cc7ec
push eax
call fcn.004a8060
lea eax, [ebp - 0x7c]
push eax
push str._sPAULA_
push edi
push esi
call fcn.00478fcf
push esi
call fcn.004a7f30
add esp, 0x1c
mov dword [0x5febd4], eax
mov ebx, 0x5ff310
push esi
mov ecx, edi
mov eax, ebx
call fcn.00477a48
mov ecx, dword [0x5febd4]
push esi
mov esi, 0x5ff418
mov eax, esi
call fcn.00477a48
cmp dword [ebp - 0x80], 0
pop ecx
pop ecx
jne 0x45bb8a
cmp dword [ebp + 0x98], 0xffffffff
je 0x45bbee
mov eax, ebx
jmp 0x45bbee
cmp dword [ebp + 0x98], 0xffffffff
jne 0x45bba7
push esi
push dword [ebp - 0x80]
call fcn.004a8050
push esi
call fcn.004a7f30
add esp, 0xc
jmp 0x45bbeb
push ebx
push dword [ebp - 0x80]
call fcn.004a8050
push ebx
call fcn.004a7f30
add esp, 0xc
cmp dword [ebp + 0x98], 0
je 0x45bbeb
mov esi, dword [ebp - 0x80]
lea ecx, [ebp + 0x9c]
push ecx
push dword [ebp + 0x98]
sub edi, eax
add eax, esi
push edi
push eax
call fcn.004a9b76
add esp, 0x10
test eax, eax
jge 0x45bbeb
mov byte [esi + 0x103], 0
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp + 0x88]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8565
add ebp, 0x8c
leave
ret
Function at 0x465433
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push edi
xor edi, edi
push 0x3e
lea eax, [ebp - 0x54]
push edi
push eax
mov dword [ebp - 0x58], edi
call fcn.004a8c80
mov edx, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 4], edi
call fcn.00477a16
test eax, eax
jne 0x465595
mov ecx, dword [ebp + 8]
push 0x15b4
push str..Printer.c
mov edx, 0x4c7368
call fcn.0041bb64
mov ebx, eax
cmp ebx, edi
pop ecx
pop ecx
mov dword [ebp - 8], ebx
je 0x465595
mov eax, esi
call fcn.004672bf
test eax, eax
je 0x46558e
mov edx, esi
call fcn.004672d0
test eax, eax
je 0x46558e
push 0x42
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004a8580
push ebx
push 0x42
lea eax, [ebp - 0x58]
push 1
push eax
call fcn.004a7ca6
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalSize]
add esp, 0x1c
cmp dword [ebp - 0x50], edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
je 0x465527
push dword [esi + 0xc]
call edi
test eax, eax
mov dword [ebp - 0xc], eax
je 0x465523
push dword [esi + 0xc]
call ebx
test eax, eax
mov dword [ebp - 4], eax
jle 0x465514
push dword [ebp - 8]
lea eax, [ebp - 4]
push 4
push 1
push eax
call fcn.004a7ca6
push dword [ebp - 8]
push dword [ebp - 4]
push 1
push dword [ebp - 0xc]
call fcn.004a7ca6
add esp, 0x20
jmp 0x465518
and dword [ebp - 0x50], 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x465527
and dword [ebp - 0x50], 0
cmp dword [ebp - 0x4c], 0
je 0x46557a
push dword [esi + 0x10]
call edi
mov edi, eax
test edi, edi
je 0x465576
push dword [esi + 0x10]
call ebx
test eax, eax
mov dword [ebp - 4], eax
jle 0x465567
push dword [ebp - 8]
lea eax, [ebp - 4]
push 4
push 1
push eax
call fcn.004a7ca6
push dword [ebp - 8]
push dword [ebp - 4]
push 1
push edi
call fcn.004a7ca6
add esp, 0x20
jmp 0x46556b
and dword [ebp - 0x4c], 0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x46557a
and dword [ebp - 0x4c], 0
mov eax, esi
call fcn.00467303
mov ecx, dword [ebp - 8]
call fcn.0041bf91
xor eax, eax
inc eax
jmp 0x465597
mov ecx, ebx
call fcn.0041bf91
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x46adc7
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
test esi, esi
push edi
mov ebx, eax
jge 0x46add9
call fcn.0040d05f
mov esi, eax
test ebx, ebx
jge 0x46ade4
call fcn.0040cfdd
mov ebx, eax
test esi, esi
jle 0x46ae2b
test ebx, ebx
jle 0x46ae2b
push 1
push 0x1f8
call fcn.004a7b08
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x46ae2b
mov dword [edi], esi
imul esi, ebx
mov eax, esi
cdq
sub eax, edx
sar eax, 1
lea eax, [eax + esi + 0x14]
push eax
push 4
mov dword [edi + 4], ebx
call fcn.004a7b08
test eax, eax
pop ecx
pop ecx
mov dword [edi + 0x14], eax
jne 0x46ae31
push edi
call fcn.004a795c
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
ret
xor eax, eax
test esi, esi
push 7
pop ebx
jle 0x46ae4e
mov ecx, dword [edi + 0x14]
mov byte [ecx + eax*4], 0x20
mov ecx, dword [edi + 0x14]
mov word [ecx + eax*4 + 2], bx
inc eax
cmp eax, esi
jl 0x46ae3a
mov eax, dword [0x6036ac]
test eax, eax
jne 0x46ae76
call fcn.0046a3c9
test eax, eax
mov dword [0x6036ac], eax
jne 0x46ae76
push dword [edi + 0x14]
call fcn.004a795c
push edi
call fcn.004a795c
pop ecx
jmp 0x46ae2a
mov ecx, dword [edi + 0x14]
lea ecx, [ecx + esi*4 + 4]
push 5
mov dword [edi + 0x24], ecx
lea ecx, [esi + 2]
pop edx
cmp ecx, edx
mov dword [edi + 0x20], ecx
jge 0x46ae90
mov dword [edi + 0x20], edx
mov dword [edi + 0x10], ebx
mov byte [edi + 0x1d], bl
push edi
mov ebx, eax
mov byte [edi + 0x1c], 9
call fcn.0046a47b
lea ebx, [edi + 0x38]
mov dword [esp], str..ScreenBuffer.c
push ebx
call fcn.0041c68c
pop ecx
pop ecx
mov esi, str.A_ScreenBuffer_handle_had_to_be_forced_to_unlock___
mov eax, ebx
call fcn.0041c887
mov eax, 0x7d0
mov ecx, ebx
call fcn.0041c8b0
mov eax, edi
call fcn.0046d2e2
mov eax, edi
jmp 0x46ae2d