joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c30
Capabilities:
Write file on windows

Disassembly:
push 0x42d000
call sym.slink.exe__string_upcase_4
push 0x42cfa8
call sym.slink.exe__string_upcase_4
push 1
call fcn.0040a3ac
push eax
push 8
push 1
push str.Status__
call fcn.0040a641
mov ax, word [0x42cfaa]
add esp, 0x14
cmp ax, 0x50
jle 0x405c86
cwde
push 0x430811
sub eax, 0x50
push eax
push 0x42d5e4
call fcn.00403a60
mov ax, word [0x42cfaa]
add esp, 0xc
push esi
test ax, ax
jle 0x405c9e
cmp ax, 0x50
jge 0x405c97
movsx esi, ax
jmp 0x405ca0
mov esi, 0x50
jmp 0x405ca0
xor esi, esi
push 1
call fcn.0040a3ac
push eax
push esi
push 1
push 0x42cfac
call fcn.0040a641
push 1
call fcn.0040a3ac
push eax
push 0x10
push 1
push str.__in_subsystem__
call fcn.0040a641
mov ax, word [0x42d002]
mov esi, 0x400
add esp, 0x28
cmp ax, si
jle 0x405cfa
cwde
push 0x430812
sub eax, esi
push eax
push 0x42d5fc
call fcn.00403a60
mov ax, word [0x42d002]
add esp, 0xc
test ax, ax
jle 0x405d09
cmp ax, si
jge 0x405d0b
movsx esi, ax
jmp 0x405d0b
xor esi, esi
push 1
call fcn.0040a3ac
push eax
push esi
push 1
push 0x42d004
call fcn.0040a641
push 1
call fcn.0040a3ac
push eax
push 2
push 1
push 0x42d600
call fcn.0040a641
push 0x42d604
call fcn.00403a60
add esp, 0x2c
mov byte [0x42cffc], 1
pop esi
ret

Function at 0x405d50
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x104
xor eax, eax
push ebx
mov ebx, dword [esp + 0x10c]
push esi
mov esi, dword [esp + 0x114]
mov word [esi + 2], ax
test ebx, ebx
jne 0x405d7d
pop esi
xor al, al
pop ebx
add esp, 0x104
ret 8
push ebp
push edi
cmp word [esi], ax
jle 0x405e83
push 0
push dword [0x430814]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push dword [0x42d658]
push ebx
push 0
push 0x11ff
call sub.KERNEL32.dll_FormatMessageA
test eax, eax
je 0x405dc9
push eax
push dword [esp + 0x14]
push esi
call sym.slink.exe__string_vstring_12
push dword [esp + 0x10]
call sub.KERNEL32.dll_LocalFree
jmp 0x405e7d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x405dd7
push eax
call sub.KERNEL32.dll_LocalFree
push str.RASAPI32.DLL
mov ebp, 1
call sub.KERNEL32.dll_LoadLibraryA
mov edi, eax
test edi, edi
jne 0x405e1c
push ebp
call fcn.0040a3ac
push eax
push 0x1c
push ebp
push str.Could_not_load_RASAIP32.DLL.
call fcn.0040a641
push 0x42d694
call fcn.00403a60
add esp, 0x18
mov al, 1
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x104
ret 8
push str.RasGetErrorStringA
push edi
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
jne 0x405e50
push 1
call fcn.0040a3ac
push eax
push 0x2e
push 1
push str.Could_not_find_RasGetErrorStringA_entry_point.
call fcn.0040a641
push 0x42d6c8
call fcn.00403a60
add esp, 0x18
jmp 0x405e60
push dword [0x42d66c]
lea ecx, [esp + 0x18]
push ecx
push ebx
call eax
mov ebp, eax
push edi
call sub.KERNEL32.dll_FreeLibrary
test ebp, ebp
jne 0x405e83
movzx eax, word [0x42d670]
push eax
lea eax, [esp + 0x18]
push eax
push esi
call sym.slink.exe__string_vstring_12
push esi
call sym.slink.exe__string_unpad_4
pop edi
pop ebp
pop esi
mov al, 1
pop ebx
add esp, 0x104
ret 8
Function at 0x406250
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 0x14]
push esi
call sym.slink.exe__sys_error_none_4
cmp byte [0x430849], 0
jne 0x406275
push 0x433bf0
call sub.KERNEL32.dll_InitializeCriticalSection
mov byte [0x430849], 1
lea eax, [esp + 0x14]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [0x430820]
push dword [0x43081c]
call sub.KERNEL32.dll_CreateThread
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
test eax, eax
jne 0x4062a7
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
ret 0x10

Function at 0x406390
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push esi
call sym.slink.exe__sys_error_none_4
push dword [0x42d724]
push dword [esp + 0xc]
call sub.KERNEL32.dll_TerminateProcess
test al, al
jne 0x4063b6
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
ret 8

Function at 0x4063c0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x480c
call fcn.00406fb0
push esi
mov esi, dword [esp + 0x4818]
mov eax, 0x400
push edi
mov edi, dword [esp + 0x4818]
mov word [esp + 0xc], ax
mov eax, 0x2000
mov word [esp + 0x2810], ax
lea eax, [esp + 0xc]
push esi
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push edi
call sym.slink.exe__string_token_16
push esi
call sym.slink.exe__sys_error_4
test al, al
jne 0x406509
lea eax, [esp + 0x2810]
push eax
lea eax, [esp + 0x10]
push eax
call sym.slink.exe__string_treename_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2814]
push eax
call sym.slink.exe__string_token_make_8
push 0x400
lea eax, [esp + 0x414]
push eax
lea eax, [esp + 0x14]
push eax
call sym.slink.exe__string_t_c_12
xor eax, eax
mov word [esp + 0x2812], ax
lea eax, [esp + 0xc]
push esi
push eax
lea eax, [esp + 0x10]
push eax
push edi
call sym.slink.exe__string_token_16
push esi
call sym.slink.exe__string_eos_4
test al, al
jne 0x4064b3
push esi
call sym.slink.exe__sys_error_4
test al, al
jne 0x406509
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2814]
push eax
call sym.slink.exe__string_append_token_8
push esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push edi
call sym.slink.exe__string_token_16
push esi
call sym.slink.exe__string_eos_4
test al, al
je 0x406478
push 0x2000
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x2818]
push eax
call sym.slink.exe__string_t_c_12
push dword [0x42d828]
lea eax, [esp + 0x814]
push 0x430838
push eax
lea eax, [esp + 0x41c]
push eax
push 0x430838
push dword [0x430834]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x406509
push esi
add eax, 0x64
push eax
push 0xffffffffffffffff
call sym.slink.exe__sys_stat_set_12
pop edi
pop esi
add esp, 0x480c
ret 8
Function at 0x419840
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x91c]
test eax, eax
jne 0x4198ab
test byte [esi], 2
je 0x41987e
cmp byte [esi + 1], al
jne 0x41987e
push dword [esi + 0x920]
call sub.KERNEL32.dll_SetEndOfFile
test al, al
jne 0x41987e
push 0
push 0x431334
push str.truncate
push 0x42e180
call sym.slink.exe__sys_sys_error_bomb_16
cmp byte [esi + 1], 6
je 0x4198b8
push dword [esi + 0x920]
call fcn.004078f8
test al, al
jne 0x4198b8
push 0
push 0x431334
push str.close
push 0x42e180
call sym.slink.exe__sys_sys_error_bomb_16
jmp 0x4198b8
push esi
call eax
mov dword [esi + 0x91c], 0
add esi, 0x918
cmp dword [esi], 0
je 0x4198c9
push esi
call sym.slink.exe__sys_mem_dealloc_4
pop esi
ret 4

Function at 0x4198e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x24]
push esi
call sym.slink.exe__sys_error_none_4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x10
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x20]
push dword [eax + 0x920]
call sub.WS2_32.dll_getsockname
test eax, eax
je 0x419922
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x10
ret 0x10
push 4
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xa]
push eax
call sym.slink.exe__sys_order_flip_8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 8]
pop esi
mov dword [ecx], eax
mov ecx, dword [esp + 0x1c]
mov ax, word [esp + 2]
mov word [ecx], ax
add esp, 0x10
ret 0x10

Function at 0x4199b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x24]
push edi
push esi
call sym.slink.exe__sys_error_none_4
call sym.slink.exe__sys_sys_netstart_0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x4199e6
call sub.WS2_32.dll_WSAGetLastError
pop edi
mov dword [esi + 0xc], eax
pop esi
add esp, 0x10
ret 0x10
lea eax, [esp + 8]
push eax
call sym.slink.exe__file_inet_sockaddr_init_4
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov ax, word [esp + 0x20]
mov word [esp + 0xa], ax
lea eax, [esp + 0xc]
push 4
push eax
call sym.slink.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xe]
push eax
call sym.slink.exe__sys_order_flip_8
push dword [0x42e278]
lea eax, [esp + 0xc]
push eax
push edi
call sub.WS2_32.dll_connect
test eax, eax
jne 0x4199d6
mov esi, dword [esp + 0x24]
push esi
call fcn.00419f50
mov dword [esi + 0x920], edi
pop edi
pop esi
add esp, 0x10
ret 0x10
Function at 0x419c80
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, dword [esp + 0x28]
push edi
call sym.slink.exe__sys_error_none_4
call sym.slink.exe__sys_sys_netstart_0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, dword [esp + 0x24]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x419cbb
call sub.WS2_32.dll_WSAGetLastError
mov dword [edi + 0xc], eax
pop edi
pop esi
add esp, 0x10
ret 0x10
lea eax, [esp + 8]
push eax
call sym.slink.exe__file_inet_sockaddr_init_4
mov ax, word [esp + 0x20]
mov word [esp + 0xa], ax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push 4
push eax
call sym.slink.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xe]
push eax
call sym.slink.exe__sys_order_flip_8
push dword [0x42e274]
lea eax, [esp + 0xc]
push eax
push dword [esi + 4]
call sub.WS2_32.dll_bind
test eax, eax
jne 0x419d52
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x10
push eax
lea eax, [esp + 0xc]
push eax
push dword [esi + 4]
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x419d52
push 4
lea eax, [esp + 0x10]
push eax
call sym.slink.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xe]
push eax
call sym.slink.exe__sys_order_flip_8
mov ax, word [esp + 0xa]
push 8
push dword [esi + 4]
mov word [esi], ax
call sub.WS2_32.dll_listen
test eax, eax
je 0x419d62
call sub.WS2_32.dll_WSAGetLastError
mov dword [edi + 0xc], eax
push dword [esi + 4]
call sub.WS2_32.dll_closesocket
pop edi
pop esi
add esp, 0x10
ret 0x10

Function at 0x419d70
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 0x18]
push esi
call sym.slink.exe__sys_error_none_4
mov eax, dword [esp + 0xc]
push 0x10
push dword [eax + 0x918]
push 0
push dword [esp + 0x1c]
push dword [esp + 0x18]
push dword [eax + 0x920]
call sub.WS2_32.dll_sendto
mov ecx, eax
mov eax, dword [esp + 0x14]
test ecx, ecx
jns 0x419db8
mov dword [eax], 0
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 0xc], eax
pop esi
ret 0x14
mov dword [eax], ecx
cmp ecx, dword [esp + 0x10]
je 0x419dca
push esi
push 0x1c
push 0xfffffffffffffffd
call sym.slink.exe__sys_stat_set_12
pop esi
ret 0x14
Function at 0x419dd0
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
call sym.slink.exe__sys_error_none_4
call sym.slink.exe__sys_sys_netstart_0
push 0
push 2
push 2
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x419e00
call sub.WS2_32.dll_WSAGetLastError
pop edi
mov dword [esi + 0xc], eax
pop esi
ret 0x10
lea eax, [esp + 0x18]
push eax
push 0x10
call sym.slink.exe__sys_mem_alloc_8
mov eax, dword [esp + 0x18]
mov ecx, 2
push 4
mov word [eax], cx
mov ecx, dword [esp + 0x1c]
mov ax, word [esp + 0x14]
mov word [ecx + 2], ax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
add eax, 4
push eax
call sym.slink.exe__sys_order_flip_8
mov eax, dword [esp + 0x18]
push 2
add eax, 2
push eax
call sym.slink.exe__sys_order_flip_8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x920], edi
pop edi
mov word [ecx], 0xa03
mov byte [ecx + 2], 0
mov dword [ecx + 4], 0x400
mov dword [ecx + 0x408], 0x100
mov dword [ecx + 0x50c], 0x400
mov dword [ecx + 0x910], 0
mov dword [ecx + 0x914], 0xfffffffe
mov dword [ecx + 0x918], eax
mov dword [ecx + 0x91c], 0x419980
pop esi
ret 0x10
Function at 0x419fd0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x30]
push edi
push esi
call sym.slink.exe__sys_error_none_4
mov edi, dword [esp + 0x30]
test edi, edi
je 0x41a171
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [ebx + 0x918]
test ebp, ebp
jne 0x41a023
push 1
call fcn.0040a3ac
push eax
push 0x36
push 1
push str.INTERNAL_ERROR:_Data_pointer_NIL_in_FILE_READ_INETSTR.
call fcn.0040a641
push 0x42e2f4
call fcn.00403a60
add esp, 0x18
call sym.slink.exe__sys_bomb_0
push 0x431348
push 0
push 1
push dword [0x431344]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call sub.KERNEL32.dll_CreateEventA
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x40]
push eax
push edi
push dword [esp + 0x3c]
push dword [ebx + 0x920]
call sub.KERNEL32.dll_WriteFile
test al, al
jne 0x41a138
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3e5
jne 0x41a105
movss xmm0, dword [ebp + 4]
or eax, 0xffffffff
comiss xmm0, dword [0x426598]
jbe 0x41a0cf
movsd xmm1, qword [0x425bc0]
sub esp, 8
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x4265a0]
maxsd xmm1, xmm0
addsd xmm1, qword [0x4263f0]
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp qword [esp]
call fcn.00420330
fstp qword [esp + 0x18]
cvttsd2si eax, qword [esp + 0x18]
add esp, 8
push eax
push dword [esp + 0x2c]
call sub.KERNEL32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x41a11b
cmp eax, 0xffffffff
je 0x41a100
push 1
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x20]
push eax
push dword [ebx + 0x920]
call sub.KERNEL32.dll_GetOverlappedResult
test al, al
jne 0x41a138
call sub.KERNEL32.dll_GetLastError
push dword [esp + 0x28]
mov dword [esi + 0xc], eax
call fcn.004078f8
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x1c
ret 0x10
push esi
push 0x20
push 0xfffffffffffffffd
call sym.slink.exe__sys_stat_set_12
push dword [esp + 0x28]
call fcn.004078f8
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x1c
ret 0x10
cmp dword [esp + 0x3c], edi
je 0x41a166
push esi
push 9
push 0xfffffffffffffffd
call sym.slink.exe__sys_stat_set_12
push esi
lea eax, [ebx + 0x50c]
push eax
call sym.slink.exe__sys_stat_parm_vstr_8
push esi
push edi
call sym.slink.exe__sys_stat_parm_int_8
push esi
push dword [esp + 0x40]
call sym.slink.exe__sys_stat_parm_int_8
push dword [esp + 0x28]
call fcn.004078f8
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x1c
ret 0x10
Function at 0x41a1e0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x400
push ebx
mov ebx, dword [esp + 0x40c]
push esi
mov esi, dword [esp + 0x414]
push edi
mov edi, dword [esp + 0x410]
push esi
push ebx
push edi
call sym.slink.exe__string_t_inetadr_12
push esi
call sym.slink.exe__sys_error_4
test al, al
je 0x41a27c
push ebp
push esi
call sym.slink.exe__sys_error_none_4
call sym.slink.exe__sys_sys_netstart_0
movsx ebp, word [edi + 2]
cmp dword [0x42e270], ebp
cmovl ebp, dword [0x42e270]
cmp ebp, 1
jl 0x41a244
lea eax, [edi + 4]
push ebp
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004079d0
add esp, 0xc
mov al, byte [0x431338]
mov byte [esp + ebp + 0x10], al
lea eax, [esp + 0x10]
push eax
call sub.WS2_32.dll_gethostbyname
pop ebp
test eax, eax
jne 0x41a288
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 0xc], eax
cmp eax, 0x2af9
jne 0x41a27c
push esi
push 0xf
push 0xfffffffffffffffd
call sym.slink.exe__sys_stat_set_12
push esi
push edi
call sym.slink.exe__sys_stat_parm_vstr_8
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0xc
mov eax, dword [eax + 0xc]
test eax, eax
je 0x41a26b
mov eax, dword [eax]
test eax, eax
je 0x41a26b
mov eax, dword [eax]
push 4
push ebx
mov dword [ebx], eax
call sym.slink.exe__sys_order_flip_8
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0xc

Function at 0x41a610
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x208c
call fcn.00406fb0
push esi
push edi
mov eax, 0x2000
mov edi, 0x84
mov word [esp + 0x90], ax
lea eax, [esp + 8]
push str.Syntax_error_occurred_on_line
push eax
mov dword [esp + 0x10], edi
call sym.slink.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__string_append1_8
mov esi, dword [esp + 0x2098]
mov eax, dword [esi]
push dword [eax + 0x970]
lea eax, [esp + 0x94]
push eax
call sym.slink.exe__string_f_int_8
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__string_append_8
push 0x42e520
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__string_append1_8
mov eax, dword [esi]
add eax, 0x568
push eax
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__string_append_8
mov ax, word [esp + 0xa]
cmp ax, di
jle 0x41a6cd
cwde
push 0x4313a6
sub eax, edi
push eax
push 0x42e4cc
call fcn.00403a60
mov ax, word [esp + 0x16]
add esp, 0xc
test ax, ax
jle 0x41a6e0
cmp ax, di
jge 0x41a6dc
movsx esi, ax
jmp 0x41a6e2
mov esi, edi
jmp 0x41a6e2
xor esi, esi
push 1
call fcn.0040a3ac
push eax
push esi
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0040a641
push 0x42e570
call fcn.00403a60
add esp, 0x18
call sym.slink.exe__sys_bomb_0
pop edi
pop esi
add esp, 0x208c
ret 4
Function at 0x41b000
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x428
push ebx
push esi
push edi
mov eax, 0x20
mov ebx, 0x400
mov word [esp + 0xc], ax
lea eax, [esp + 0x30]
push 0x42e760
push eax
mov dword [esp + 0x38], ebx
call sym.slink.exe__string_appends_8
push 0x20
lea eax, [esp + 0x34]
push eax
call sym.slink.exe__string_append1_8
mov edi, dword [esp + 0x438]
mov eax, dword [edi]
push dword [eax + 0x970]
lea eax, [esp + 0x10]
push eax
call sym.slink.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x34]
push eax
call sym.slink.exe__string_append_8
push 0x42e7b0
lea eax, [esp + 0x34]
push eax
call sym.slink.exe__string_appends_8
mov ax, word [esp + 0x32]
cmp ax, bx
jle 0x41b093
cwde
push 0x4313af
sub eax, ebx
push eax
push 0x42e75c
call fcn.00403a60
mov ax, word [esp + 0x3e]
add esp, 0xc
test ax, ax
jle 0x41b0a6
cmp ax, bx
jge 0x41b0a2
movsx esi, ax
jmp 0x41b0a8
mov esi, ebx
jmp 0x41b0a8
xor esi, esi
push 1
call fcn.0040a3ac
push eax
push esi
lea eax, [esp + 0x40]
push 1
push eax
call fcn.0040a641
push 0x42e800
call fcn.00403a60
mov eax, dword [edi]
add esp, 0x18
movzx ecx, word [eax + 0x56a]
cmp cx, bx
jle 0x41b0f5
movsx eax, cx
push 0x4313b0
sub eax, 0x400
push eax
push 0x42e804
call fcn.00403a60
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 0x56a]
test ax, ax
jle 0x41b10f
cmp ax, bx
jge 0x41b10b
movsx esi, ax
jmp 0x41b111
mov esi, ebx
jmp 0x41b111
xor esi, esi
push 1
call fcn.0040a3ac
push eax
mov eax, dword [edi]
push esi
add eax, 0x56c
push 1
push eax
call fcn.0040a641
push 0x42e808
call fcn.00403a60
add esp, 0x18
pop edi
pop esi
pop ebx
add esp, 0x428
ret 4

Function at 0x41b150
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.0041b000
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
movzx ecx, word [eax + 2]
cmp cx, 0x50
jle 0x41b186
movsx eax, cx
push 0x4313ab
sub eax, 0x50
push eax
push 0x42e748
call fcn.00403a60
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 2]
test ax, ax
jle 0x41b1a1
cmp ax, 0x50
jge 0x41b19a
movsx esi, ax
jmp 0x41b1a3
mov esi, 0x50
jmp 0x41b1a3
xor esi, esi
push 1
call fcn.0040a3ac
push eax
mov eax, dword [edi]
push esi
add eax, 4
push 1
push eax
call fcn.0040a641
push 0x42e74c
call fcn.00403a60
mov eax, dword [esp + 0x2c]
add esp, 0x18
movsx eax, word [eax]
pop edi
pop esi
cmp eax, 2
jle 0x41b1ea
push 0x4313ae
add eax, 0xfffffffe
push eax
push 0x42e750
call fcn.00403a60
add esp, 0xc
push 0x20
push 0x42e754
call fcn.00403a60
push 0x5e
push 0x42e758
call fcn.00403a60
add esp, 0x10
ret 0xc
Function at 0x41b2b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x3c]
mov dword [esp + 0xc], 0x20
mov ax, word [edi]
mov word [ebx], ax
movzx eax, word [edi]
cmp ax, word [esi + 2]
jg 0x41b30b
nop dword [eax]
cwde
mov cl, byte [eax + esi + 3]
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x41b30b
push ecx
lea eax, [esp + 0x10]
push eax
call sym.slink.exe__string_append1_8
mov ax, word [edi]
inc ax
movzx ecx, ax
mov word [edi], ax
mov eax, ecx
cmp cx, word [esi + 2]
jle 0x41b2e0
mov esi, dword [esp + 0x44]
lea eax, [esp + 0xc]
push esi
push dword [esp + 0x44]
push eax
call sym.slink.exe__string_t_int_12
push esi
call sym.slink.exe__sys_error_4
test al, al
je 0x41b3e5
cmp byte [esp + 0x34], 0
je 0x41b3df
push 1
call fcn.0040a3ac
push eax
push 0xd
push 1
push str.Bad_integer__
call fcn.0040a641
mov ax, word [esp + 0x22]
add esp, 0x14
cmp ax, 0x20
jle 0x41b377
cwde
push 0x4313aa
sub eax, 0x20
push eax
push 0x42e73c
call fcn.00403a60
mov ax, word [esp + 0x1a]
add esp, 0xc
test ax, ax
jle 0x41b38e
cmp ax, 0x20
jge 0x41b387
movsx esi, ax
jmp 0x41b390
mov esi, 0x20
jmp 0x41b390
xor esi, esi
push 1
call fcn.0040a3ac
push eax
push esi
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0040a641
push 1
call fcn.0040a3ac
push eax
push 2
push 1
push 0x42e740
call fcn.0040a641
push 0x42e744
call fcn.00403a60
add esp, 0x2c
push ebx
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.0041b150
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
mov ax, word [ebx]
mov word [edi], ax
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
Function at 0x41c210
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x918]
cmp byte [eax], 0
jne 0x41c22b
add eax, 8
mov dword [esp + 4], eax
jmp sym.slink.exe__file_close_4
ret 4

Function at 0x41c5a0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
call sym.slink.exe__sys_error_none_4
mov edi, dword [esp + 0x10]
test edi, edi
je 0x41c639
push ebx
push dword [0x43145c]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
push edi
push dword [esp + 0x24]
push dword [eax + 0x920]
call sub.KERNEL32.dll_ReadFile
mov ebx, dword [esp + 0x1c]
test al, al
jne 0x41c5fb
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x6d
je 0x41c605
mov dword [esi + 0xc], eax
mov eax, ebx
pop ebx
pop edi
pop esi
mov dword [eax], 0
ret 0x14
mov eax, dword [esp + 0x20]
mov dword [ebx], eax
test eax, eax
jne 0x41c61b
push esi
push 1
push 0xfffffffffffffffd
mov dword [ebx], 0
call sym.slink.exe__sys_stat_set_12
pop ebx
pop edi
pop esi
ret 0x14
cmp eax, edi
jae 0x41c638
push esi
push 0xa
push 0xfffffffffffffffd
call sym.slink.exe__sys_stat_set_12
push esi
push edi
call sym.slink.exe__sys_stat_parm_int_8
push esi
push dword [ebx]
call sym.slink.exe__sys_stat_parm_int_8
pop ebx
pop edi
pop esi
ret 0x14
Function at 0x41de00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
cmp byte [0x430848], 0
mov eax, 0x20
mov word [esp + 4], ax
jne 0x41de1b
call sym.slink.exe__sys_read_env_global_0
push esi
lea eax, [esp + 8]
push eax
push dword [esp + 0x34]
call sym.slink.exe__string_copy_8
lea eax, [esp + 8]
push eax
call sym.slink.exe__string_upcase_4
mov eax, dword [0x433bec]
mov esi, 0x433bec
mov dword [esp + 4], eax
test eax, eax
je 0x41de66
add eax, 4
push eax
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__string_equal_8
test al, al
jne 0x41dec7
mov esi, dword [esp + 4]
mov eax, dword [esi]
mov dword [esp + 4], eax
test eax, eax
jne 0x41de46
lea eax, [esp + 4]
push eax
push 0x108
call sym.slink.exe__sys_mem_alloc_8
mov eax, dword [esp + 4]
test eax, eax
jne 0x41dea9
push 1
call fcn.0040a3ac
push eax
push 0x3a
push 1
push str.Unable_to_allocate_more_virtual_memory.__The_disk_is_full.
call fcn.0040a641
push 0x42ebe4
call fcn.00403a60
add esp, 0x18
call sym.slink.exe__sys_bomb_0
mov eax, dword [esp + 4]
add eax, 4
push eax
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__sys_read_env_lang_8
mov eax, dword [esp + 4]
mov dword [eax], 0
mov eax, dword [esp + 4]
mov dword [esi], eax
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x34]
add ecx, 4
pop esi
mov dword [eax], ecx
add esp, 0x28
ret 8