joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d5a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x49f3b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str._sPATH
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x44d5f1
lea eax, [ebp - 0x58]
push eax
push str.from_environment__s
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
xor eax, eax
jmp 0x44d607
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x4c15f0]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044aa30
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046f7be
mov esp, ebp
pop ebp
ret

Function at 0x451910
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x49f3b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
push ecx
push 0x1ff
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00449c10
push 0x2c
lea edx, [ebp - 0x208]
push edx
call fcn.00448e70
add esp, 8
test eax, eax
je 0x4519b1
mov eax, dword [ebp + 0x10]
push eax
push 0x1ff
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00448b30
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x4519b1
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0xffffffd5
jne 0x4519af
push 0x2c
lea eax, [ebp - 0x208]
push eax
call fcn.00448e70
add esp, 8
test eax, eax
jne 0x4519af
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
jmp 0x4519b1
jmp 0x451a12
lea edx, [ebp - 9]
mov dword [ebp - 4], edx
jmp 0x4519c2
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x208]
cmp ecx, edx
jb 0x4519e6
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x4519e6
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
jl 0x4519e6
jmp 0x4519b9
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov byte [edx], 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
test eax, eax
je 0x451a12
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffeb
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046f7be
mov esp, ebp
pop ebp
ret 0xc
Function at 0x452400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x45241b
xor eax, eax
jmp 0x452427
mov eax, dword [ebp - 4]
and eax, 0x10
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x452510
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll__mkdir]
add esp, 4
test eax, eax
je 0x452534
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 0xd
je 0x452534
or eax, 0xffffffff
jmp 0x452536
xor eax, eax
pop ebp
ret
Function at 0x4527c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x49f3b0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0x493268
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4527f2
mov eax, dword [ebp - 4]
jmp 0x452979
push str.WNCHOME_LS
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x45293d
push 0x200
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x452831
xor eax, eax
jmp 0x452979
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x45284e
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x452874
mov edx, dword [ebp - 0x21c]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x452872
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], 0x2f
jmp 0x45283f
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00452990
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x452895
xor eax, eax
jmp 0x452979
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00452990
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4528c5
xor eax, eax
jmp 0x452979
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.00452990
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4528f5
xor eax, eax
jmp 0x452979
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
push 0x49327c
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
jne 0x452930
push 0x493280
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x452934
xor eax, eax
jmp 0x452979
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp + 8]
test edx, edx
je 0x452976
push str.WNCHOME
push 0x4c1620
call sub.MSVCR100.dll_strcpy
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x4c1620
call sub.MSVCR100.dll_strcat
add esp, 8
push 0x4c1620
call dword [sym.imp.MSVCR100.dll__putenv]
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0046f7be
mov esp, ebp
pop ebp
ret

Function at 0x452af0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.WNC_WNCFILES_VERBOSE
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x452b29
push 0x4932a8
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
je 0x452b29
mov eax, 1
jmp 0x452b2b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x467060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0x28]
push edi
xor edi, edi
mov dword [esi + 0x24], edi
cmp ebx, edi
je 0x467084
mov ecx, ebx
call fcn.00463810
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x28], edi
cmp dword [esi + 0x2c], edi
je 0x4670eb
xor edx, edx
cmp dword [esi + 0x14], edi
jle 0x4670d7
push ebp
mov eax, dword [esi + 0x2c]
cmp dword [eax + edx*4], edi
lea ecx, [eax + edx*4]
je 0x4670d0
mov eax, dword [ecx]
mov ebx, dword fs:[0x2c]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0xc], edi
mov dword [eax + 8], edi
mov eax, dword [0x4c1f00]
mov eax, dword [ebx + eax*4]
mov ebx, dword [ecx]
mov ebp, dword [eax + 0xd0]
mov dword [ebx + 0x10], ebp
mov ebx, dword [ecx]
mov dword [eax + 0xd0], ebx
mov dword [ecx], edi
inc edx
cmp edx, dword [esi + 0x14]
jl 0x467091
pop ebp
mov ecx, dword [esi + 0x2c]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x2c], edi
mov dword [esi + 0x14], edi
mov dword [esi], edi
mov ecx, esi
call fcn.00466750
lea ecx, [esi + 0x30]
call fcn.00462280
pop edi
lea ecx, [esi + 0xc8]
pop esi
pop ebx
jmp fcn.00462280

Function at 0x467110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x488459
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x49f3b0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esp + 0x14], 1
call fcn.00467060
call fcn.004661c0
call fcn.00466220
call fcn.00464f80
lea ecx, [esi + 0xc8]
mov byte [esp + 0x14], 0
call fcn.00462280
push 0x425cb0
push 4
push 0x18
add ecx, 0x18
push ecx
call fcn.0046f9a2
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0xffffffff
call fcn.00462280
push 0x425cb0
push 4
push 0x18
add ecx, 0x18
push ecx
call fcn.0046f9a2
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x468e33
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
cmp eax, ebp
je 0x468e4d
inc dword [esp + 0x10]
mov eax, dword [eax]
cmp eax, ebp
jne 0x468e43
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.MSVCR100.dll_fwrite]
push edi
push 1
lea eax, [esi + 8]
push 4
push eax
call ebx
add esp, 0x10
cmp eax, 1
je 0x468e77
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 4
push edi
push 1
lea ecx, [esp + 0x18]
push 4
push ecx
call ebx
add esp, 0x10
cmp eax, 1
jne 0x468e6a
mov esi, dword [esi]
cmp esi, ebp
je 0x468eb9
push edi
push 2
lea edx, [esi + 8]
push 0xc
push edx
call ebx
add esp, 0x10
cmp eax, 2
jne 0x468eb4
mov esi, dword [esi]
test esi, esi
jne 0x468e91
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
mov ebp, 1
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x46f7be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49f3b0]
jne 0x46f7c8
repz ret
jmp fcn.0046fdda

Function at 0x471a80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x49f3b0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00476b00
test eax, eax
je 0x471ab3
call fcn.00476a60
push eax
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x471afc
push 0x494ed4
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x471ae6
push 0x494edc
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x471afc
mov edx, dword [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
push 0x494ee0
push 0x494ee8
push 0x5c
lea ecx, [ebp - 0x210]
push ecx
push 0x494ef0
push 0x4c22a0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov byte [0x4c24a0], 0
push 0x494efc
push 0x4c22a0
call dword [sym.imp.MSVCR100.dll_strcspn]
add esp, 8
mov byte [eax + 0x4c22a0], 0
push 0x201
push 0x4c22a0
call fcn.00471910
add esp, 8
push 0x494f00
push str.zone
push 0x5c
lea edx, [ebp - 0x210]
push edx
push str._s_c_s_s
push 0x4c24a8
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov byte [0x4c26a8], 0
push 0x494f1c
push 0x4c24a8
call dword [sym.imp.MSVCR100.dll_strcspn]
add esp, 8
mov byte [eax + 0x4c24a8], 0
push 0x201
push 0x4c24a8
call fcn.00471910
add esp, 8
cmp dword [0x4c26b4], 0
jne 0x471bce
push 0x471a30
call fcn.0046faa6
add esp, 4
mov dword [0x4c26b4], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046f7be
mov esp, ebp
pop ebp
ret

Function at 0x4764e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x49f3b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4c7b4c], 0
je 0x476546
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s___d__:__d_n
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
mov ecx, dword [0x4c7b48]
push ecx
lea edx, [ebp - 0x408]
push edx
call sub.MSVCR100.dll_strlen
add esp, 4
push eax
push 1
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046f7be
mov esp, ebp
pop ebp
ret

Function at 0x476a60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x495130
cmp dword [0x4c3684], 0
je 0x476a7f
mov eax, 0x4c3688
jmp 0x476aa0
push 0x495134
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x476a9d
mov eax, dword [ebp - 8]
jmp 0x476aa0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x476b10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4c3684], 0
je 0x476b31
push 0x4c3688
push 0x4c7910
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x476b6d
push str.WNCZONE
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x476b5c
push 0x495150
push 0x4c7910
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x476b6d
mov eax, dword [ebp - 4]
push eax
push 0x4c7910
call sub.MSVCR100.dll_strcpy
add esp, 8
push 0x495154
mov ecx, dword [ebp + 8]
push ecx
call fcn.00453480
add esp, 8
push eax
push 0x5c
push 0x4c7910
push str._s_c_s
push 0x4c7708
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
push 0x201
push 0x4c7708
call fcn.00449b40
add esp, 8
cmp dword [0x4c7b1c], 0
jne 0x476bcb
push 0x476a00
call fcn.0046faa6
add esp, 4
mov dword [0x4c7b1c], 1
mov esp, ebp
pop ebp
ret

Function at 0x4801e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x4c7c60]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR100.dll_strlen
add esp, 4
push eax
push 1
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100.dll_strlen
add esp, 4
cmp esi, eax
je 0x48023a
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffe6
jmp 0x480270
mov dx, word [0x495a20]
mov word [ebp - 8], dx
mov al, byte [0x495a22]
mov byte [ebp - 6], al
mov ecx, dword [ebp - 4]
push ecx
push 2
push 1
lea edx, [ebp - 8]
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 2
je 0x480270
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xffffffe6
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x480360
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x4c7c60]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
push eax
push 1
push 1
lea ecx, [ebp - 5]
push ecx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x4803b5
mov edx, dword [ebp + 0x14]
mov dword [edx], 0xffffffe7
mov byte [ebp - 5], 0
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
jmp 0x4803c9
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
mov dl, byte [ebp - 5]
mov byte [ecx], dl
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 1
cmp dword [ebp - 4], ecx
jge 0x4803e5
movsx edx, byte [ebp - 5]
cmp edx, 0xa
je 0x4803e5
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
je 0x480383
mov ecx, dword [ebp + 0x10]
sub ecx, 1
cmp dword [ebp - 4], ecx
jne 0x480460
movsx edx, byte [ebp - 5]
cmp edx, 0xa
je 0x480460
mov eax, dword [ebp + 0x14]
mov dword [eax], 0xffffffd6
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 1]
cmp edx, 0xa
je 0x48041c
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0xa
jmp 0x480425
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0xd
je 0x480441
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0xa
jne 0x48045b
cmp dword [ebp - 4], 0
jl 0x48045b
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x480425
jmp 0x4804f7
mov edx, dword [ebp + 0x14]
cmp dword [edx], 0xffffffe7
je 0x480471
movsx eax, byte [ebp - 5]
cmp eax, 0xa
jne 0x480482
cmp dword [ebp - 4], 0
jne 0x480482
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0xffffffe9
jmp 0x4804f7
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0xd
je 0x4804ae
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0xa
jne 0x4804f7
cmp dword [ebp - 4], 0
jl 0x4804f7
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0xa
jne 0x4804e3
cmp dword [ebp - 0x10], 0
jne 0x4804e1
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x4804f5
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x480492
mov esp, ebp
pop ebp
ret

Function at 0x481670
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
pop ebp
ret
Function at 0x4836b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffd
mov edx, dword [ebp + 8]
mov dword [edx + 0x320], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [str.WKNC_Id:_fbseek.cpp_7003_2011_05_16_16:32:53Z_jsturton___WORKNC]
mov dword [eax + 0x210], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x214], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x21c], 0xa0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x218], 0xa0
mov edx, dword [ebp + 8]
mov dword [edx + 0x220], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x224], 0
call fcn.00446bc0
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x228
push ecx
call sub.MSVCR100.dll_strcpy
add esp, 8
mov edx, dword [ebp + 8]
mov byte [edx + 0x2a8], 1
mov eax, dword [ebp + 8]
mov byte [eax + 0x2a9], 1
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2aa], 1
mov edx, dword [ebp + 8]
mov byte [edx + 0x2ac], 0
call fcn.00446b10
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2ab], al
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
push 0xa0
push 1
mov ecx, dword [ebp + 8]
add ecx, 0x210
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 0xa0
je 0x48379b
mov eax, 0xffffffe6
jmp 0x48379d
xor eax, eax
pop ebp
ret

Function at 0x4850b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x49f3b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004851e0
add esp, 8
cmp eax, 0xffffffff
je 0x4851af
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
je 0x48518e
push 0x101
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR100.dll__read]
add esp, 0xc
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x485164
lea edx, [ebp - 0x148]
push edx
call dword [sym.imp.MSVCR100.dll_atol]
add esp, 4
cmp dword [ebp + 0xc], eax
jne 0x485140
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x485162
cmp dword [0x4c7df8], 0
je 0x485162
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x495a60
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
jmp 0x48517f
cmp dword [0x4c7df8], 0
je 0x48517f
mov eax, dword [ebp - 0x40]
push eax
push str._nread_error_:_nblu___d_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
jmp 0x4851ad
cmp dword [0x4c7df8], 0
je 0x4851ad
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x3c]
push eax
push str._nopen_error_:_handle___d___nomfic___s_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
jmp 0x4851ca
cmp dword [0x4c7df8], 0
je 0x4851ca
mov ecx, dword [ebp + 8]
push ecx
push str._nstat_error_:_nomfic___s_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046f7be
mov esp, ebp
pop ebp
ret
Function at 0x485200
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49f3b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
push 0x180
push 0x502
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x485282
mov ecx, dword [ebp - 4]
push ecx
push 0x495af4
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call sub.MSVCR100.dll_strlen
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.MSVCR100.dll__write]
add esp, 0xc
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
jmp 0x485318
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 0x11
jne 0x485311
push pe_nt_image_headers32
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x48530f
push 0x14
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x13
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.MSVCR100.dll__read]
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4852ec
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR100.dll_atol]
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x4852f3
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
je 0x48530f
mov dword [ebp - 0x28], 0xffffffff
jmp 0x485318
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046f7be
mov esp, ebp
pop ebp
ret