joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4095f0
Capabilities:
Write file on windows

Disassembly:
push 0x4332c0
call sym.align_comments.exe__string_upcase_4
push 0x433268
call sym.align_comments.exe__string_upcase_4
push 1
call fcn.0040e20c
push eax
push 8
push 1
push str.Status__
call fcn.0040e4a1
mov ax, word [0x43326a]
add esp, 0x14
cmp ax, 0x50
jle 0x409646
cwde
push 0x437c65
sub eax, 0x50
push eax
push 0x4338a4
call fcn.00404180
mov ax, word [0x43326a]
add esp, 0xc
push esi
test ax, ax
jle 0x40965e
cmp ax, 0x50
jge 0x409657
movsx esi, ax
jmp 0x409660
mov esi, 0x50
jmp 0x409660
xor esi, esi
push 1
call fcn.0040e20c
push eax
push esi
push 1
push 0x43326c
call fcn.0040e4a1
push 1
call fcn.0040e20c
push eax
push 0x10
push 1
push str.__in_subsystem__
call fcn.0040e4a1
mov ax, word [0x4332c2]
mov esi, 0x400
add esp, 0x28
cmp ax, si
jle 0x4096ba
cwde
push 0x437c66
sub eax, esi
push eax
push 0x4338bc
call fcn.00404180
mov ax, word [0x4332c2]
add esp, 0xc
test ax, ax
jle 0x4096c9
cmp ax, si
jge 0x4096cb
movsx esi, ax
jmp 0x4096cb
xor esi, esi
push 1
call fcn.0040e20c
push eax
push esi
push 1
push 0x4332c4
call fcn.0040e4a1
push 1
call fcn.0040e20c
push eax
push 2
push 1
push 0x4338c0
call fcn.0040e4a1
push 0x4338c4
call fcn.00404180
add esp, 0x2c
mov byte [0x4332bc], 1
pop esi
ret

Function at 0x409800
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push esi
call sym.align_comments.exe__sys_error_none_4
push dword [0x4338f4]
push dword [esp + 0xc]
call sub.KERNEL32.dll_TerminateProcess
test al, al
jne 0x409826
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
ret 8
Function at 0x409830
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x480c
call fcn.0040abd0
push esi
mov esi, dword [esp + 0x4818]
mov eax, 0x400
push edi
mov edi, dword [esp + 0x4818]
mov word [esp + 0xc], ax
mov eax, 0x2000
mov word [esp + 0x2810], ax
lea eax, [esp + 0xc]
push esi
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push edi
call sym.align_comments.exe__string_token_16
push esi
call sym.align_comments.exe__sys_error_4
test al, al
jne 0x409979
lea eax, [esp + 0x2810]
push eax
lea eax, [esp + 0x10]
push eax
call sym.align_comments.exe__string_treename_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2814]
push eax
call sym.align_comments.exe__string_token_make_8
push 0x400
lea eax, [esp + 0x414]
push eax
lea eax, [esp + 0x14]
push eax
call sym.align_comments.exe__string_t_c_12
xor eax, eax
mov word [esp + 0x2812], ax
lea eax, [esp + 0xc]
push esi
push eax
lea eax, [esp + 0x10]
push eax
push edi
call sym.align_comments.exe__string_token_16
push esi
call sym.align_comments.exe__string_eos_4
test al, al
jne 0x409923
push esi
call sym.align_comments.exe__sys_error_4
test al, al
jne 0x409979
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2814]
push eax
call sym.align_comments.exe__string_append_token_8
push esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push edi
call sym.align_comments.exe__string_token_16
push esi
call sym.align_comments.exe__string_eos_4
test al, al
je 0x4098e8
push 0x2000
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x2818]
push eax
call sym.align_comments.exe__string_t_c_12
push dword [0x4339f8]
lea eax, [esp + 0x814]
push 0x437c74
push eax
lea eax, [esp + 0x41c]
push eax
push 0x437c74
push dword [0x437c70]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x409979
push esi
add eax, 0x64
push eax
push 0xffffffffffffffff
call sym.align_comments.exe__sys_stat_set_12
pop edi
pop esi
add esp, 0x480c
ret 8
Function at 0x409f40
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x104
xor eax, eax
push ebx
mov ebx, dword [esp + 0x10c]
push esi
mov esi, dword [esp + 0x114]
mov word [esi + 2], ax
test ebx, ebx
jne 0x409f6d
pop esi
xor al, al
pop ebx
add esp, 0x104
ret 8
push ebp
push edi
cmp word [esi], ax
jle 0x40a073
push 0
push dword [0x437c80]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push dword [0x433a50]
push ebx
push 0
push 0x11ff
call sub.KERNEL32.dll_FormatMessageA
test eax, eax
je 0x409fb9
push eax
push dword [esp + 0x14]
push esi
call sym.align_comments.exe__string_vstring_12
push dword [esp + 0x10]
call sub.KERNEL32.dll_LocalFree
jmp 0x40a06d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409fc7
push eax
call sub.KERNEL32.dll_LocalFree
push str.RASAPI32.DLL
mov ebp, 1
call sub.KERNEL32.dll_LoadLibraryA
mov edi, eax
test edi, edi
jne 0x40a00c
push ebp
call fcn.0040e20c
push eax
push 0x1c
push ebp
push str.Could_not_load_RASAIP32.DLL.
call fcn.0040e4a1
push 0x433a8c
call fcn.00404180
add esp, 0x18
mov al, 1
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x104
ret 8
push str.RasGetErrorStringA
push edi
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
jne 0x40a040
push 1
call fcn.0040e20c
push eax
push 0x2e
push 1
push str.Could_not_find_RasGetErrorStringA_entry_point.
call fcn.0040e4a1
push 0x433ac0
call fcn.00404180
add esp, 0x18
jmp 0x40a050
push dword [0x433a64]
lea ecx, [esp + 0x18]
push ecx
push ebx
call eax
mov ebp, eax
push edi
call sub.KERNEL32.dll_FreeLibrary
test ebp, ebp
jne 0x40a073
movzx eax, word [0x433a68]
push eax
lea eax, [esp + 0x18]
push eax
push esi
call sym.align_comments.exe__string_vstring_12
push esi
call sym.align_comments.exe__string_unpad_4
pop edi
pop ebp
pop esi
mov al, 1
pop ebx
add esp, 0x104
ret 8
Function at 0x40a440
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 0x14]
push esi
call sym.align_comments.exe__sys_error_none_4
cmp byte [0x437ca1], 0
jne 0x40a465
push 0x43af70
call sub.KERNEL32.dll_InitializeCriticalSection
mov byte [0x437ca1], 1
lea eax, [esp + 0x14]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [0x437c8c]
push dword [0x437c88]
call sub.KERNEL32.dll_CreateThread
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
test eax, eax
jne 0x40a497
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
ret 0x10

Function at 0x41d870
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2008
call fcn.0040abd0
push esi
mov esi, dword [esp + 0x2018]
mov eax, 0x2000
push edi
push esi
mov word [esp + 0x10], ax
call sym.align_comments.exe__sys_error_none_4
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x2018]
call sym.align_comments.exe__string_copy_8
movzx eax, word [0x434684]
push eax
push 0x434680
lea eax, [esp + 0x14]
push eax
call sym.align_comments.exe__string_appendn_12
lea eax, [esp + 0xc]
push eax
call sym.align_comments.exe__string_terminate_null_4
push dword [0x438730]
lea eax, [esp + 0x14]
push 0x8000080
push 3
push dword [0x43872c]
push 1
push accept
push eax
call sub.KERNEL32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x41d903
call sub.KERNEL32.dll_GetLastError
pop edi
mov dword [esi + 0xc], eax
pop esi
add esp, 0x2008
ret 0xc
push dword [0x438734]
movsx eax, word [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push eax
lea eax, [esp + 0x1c]
push eax
push edi
call sub.KERNEL32.dll_ReadFile
test al, al
jne 0x41d93c
call sub.KERNEL32.dll_GetLastError
push edi
mov dword [esi + 0xc], eax
call fcn.0040b734
pop edi
pop esi
add esp, 0x2008
ret 0xc
movsx edx, word [esp + 0xc]
mov ecx, dword [esp + 8]
cmp edx, ecx
movzx eax, word [esp + 0xc]
movzx esi, cx
cmovb esi, eax
push edi
mov word [esp + 0x12], si
call fcn.0040b734
mov edx, dword [esp + 0x2018]
mov cx, word [esp + 0xe]
movzx eax, word [edx]
cmp ax, cx
cwde
jl 0x41d975
movsx eax, cx
movzx eax, ax
mov ecx, 1
movsx esi, ax
mov word [edx + 2], ax
cmp esi, ecx
jl 0x41d9af
mov al, byte [esp + ecx + 0xf]
cmp al, 0x1f
jbe 0x41d9a8
cmp al, 0x7f
je 0x41d9a8
mov byte [ecx + edx + 3], al
inc ecx
cmp ecx, esi
jle 0x41d988
pop edi
pop esi
add esp, 0x2008
ret 0xc
lea eax, [ecx - 1]
mov word [edx + 2], ax
pop edi
pop esi
add esp, 0x2008
ret 0xc
Function at 0x41d9c0
Capabilities:
Clear file content
Delete file
Write file on windows

Disassembly:
mov eax, 0x2510
call fcn.0040abd0
mov eax, 0x400
mov word [esp + 0x108], ax
mov eax, 0x100
push esi
push edi
mov edi, dword [esp + 0x2528]
mov word [esp + 0xc], ax
mov eax, 0x2000
push edi
mov word [esp + 0x518], ax
call sym.align_comments.exe__sys_error_none_4
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x114]
push eax
push dword [esp + 0x2524]
call sym.align_comments.exe__string_pathname_split_12
lea eax, [esp + 0x110]
push eax
push eax
call sym.align_comments.exe__string_treename_8
lea eax, [esp + 0x514]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x118]
push eax
call sym.align_comments.exe__string_pathname_join_12
test byte [esp + 0x2524], 1
mov esi, 1
je 0x41da86
lea eax, [esp + 0x514]
mov esi, 2
push eax
call sym.align_comments.exe__string_terminate_null_4
lea eax, [esp + 0x518]
push eax
call sub.KERNEL32.dll_DeleteFileA
test al, al
jne 0x41da86
call sub.KERNEL32.dll_GetLastError
push edi
mov dword [edi + 0xc], eax
call sym.align_comments.exe__file_not_found_4
test al, al
je 0x41db1b
movzx eax, word [0x434674]
push eax
push 0x434670
lea eax, [esp + 0x51c]
push eax
call sym.align_comments.exe__string_appendn_12
lea eax, [esp + 0x514]
push eax
call sym.align_comments.exe__string_terminate_null_4
push dword [0x438724]
lea eax, [esp + 0x51c]
push 0x8000080
push esi
push dword [0x438720]
push 1
push 0x40000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x41db13
push dword [0x438728]
mov eax, dword [esp + 0x2524]
lea edx, [esp + 0xc]
push edx
movsx ecx, word [eax + 2]
add eax, 4
push ecx
push eax
push esi
call sub.KERNEL32.dll_WriteFile
test al, al
je 0x41db26
push esi
call sub.KERNEL32.dll_SetEndOfFile
test al, al
je 0x41db26
push esi
call fcn.0040b734
test al, al
jne 0x41db1b
call sub.KERNEL32.dll_GetLastError
mov dword [edi + 0xc], eax
pop edi
pop esi
add esp, 0x2510
ret 0x10
call sub.KERNEL32.dll_GetLastError
push esi
mov dword [edi + 0xc], eax
call fcn.0040b734
lea eax, [esp + 0x518]
push eax
call sub.KERNEL32.dll_DeleteFileA
pop edi
pop esi
add esp, 0x2510
ret 0x10
Function at 0x41db50
Capabilities:
Delete file

Disassembly:
mov eax, 0x250c
call fcn.0040abd0
mov eax, 0x400
mov word [esp + 0x104], ax
mov eax, 0x100
push esi
mov esi, dword [esp + 0x2518]
mov word [esp + 4], ax
mov eax, 0x2000
push esi
mov word [esp + 0x510], ax
call sym.align_comments.exe__sys_error_none_4
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x10c]
push eax
push dword [esp + 0x251c]
call sym.align_comments.exe__string_pathname_split_12
lea eax, [esp + 0x108]
push eax
push eax
call sym.align_comments.exe__string_treename_8
lea eax, [esp + 0x50c]
push eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x110]
push eax
call sym.align_comments.exe__string_pathname_join_12
movzx eax, word [0x43467c]
push eax
push 0x434678
lea eax, [esp + 0x514]
push eax
call sym.align_comments.exe__string_appendn_12
lea eax, [esp + 0x50c]
push eax
call sym.align_comments.exe__string_terminate_null_4
lea eax, [esp + 0x510]
push eax
call sub.KERNEL32.dll_DeleteFileA
test al, al
jne 0x41dc0d
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x250c
ret 8

Function at 0x41dc20
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x208c
call fcn.0040abd0
push esi
push edi
mov eax, 0x2000
mov edi, 0x84
mov word [esp + 0x90], ax
lea eax, [esp + 8]
push str.Syntax_error_occurred_on_line
push eax
mov dword [esp + 0x10], edi
call sym.align_comments.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.align_comments.exe__string_append1_8
mov esi, dword [esp + 0x2098]
mov eax, dword [esi]
push dword [eax + 0x970]
lea eax, [esp + 0x94]
push eax
call sym.align_comments.exe__string_f_int_8
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0xc]
push eax
call sym.align_comments.exe__string_append_8
push 0x434898
lea eax, [esp + 0xc]
push eax
call sym.align_comments.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.align_comments.exe__string_append1_8
mov eax, dword [esi]
add eax, 0x568
push eax
lea eax, [esp + 0xc]
push eax
call sym.align_comments.exe__string_append_8
mov ax, word [esp + 0xa]
cmp ax, di
jle 0x41dcdd
cwde
push 0x43878e
sub eax, edi
push eax
push 0x434844
call fcn.00404180
mov ax, word [esp + 0x16]
add esp, 0xc
test ax, ax
jle 0x41dcf0
cmp ax, di
jge 0x41dcec
movsx esi, ax
jmp 0x41dcf2
mov esi, edi
jmp 0x41dcf2
xor esi, esi
push 1
call fcn.0040e20c
push eax
push esi
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0040e4a1
push 0x4348e8
call fcn.00404180
add esp, 0x18
call sym.align_comments.exe__sys_bomb_0
pop edi
pop esi
add esp, 0x208c
ret 4
Function at 0x41e5e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x428
push ebx
push esi
push edi
mov eax, 0x20
mov ebx, 0x400
mov word [esp + 0xc], ax
lea eax, [esp + 0x30]
push 0x434ad8
push eax
mov dword [esp + 0x38], ebx
call sym.align_comments.exe__string_appends_8
push 0x20
lea eax, [esp + 0x34]
push eax
call sym.align_comments.exe__string_append1_8
mov edi, dword [esp + 0x438]
mov eax, dword [edi]
push dword [eax + 0x970]
lea eax, [esp + 0x10]
push eax
call sym.align_comments.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x34]
push eax
call sym.align_comments.exe__string_append_8
push 0x434b28
lea eax, [esp + 0x34]
push eax
call sym.align_comments.exe__string_appends_8
mov ax, word [esp + 0x32]
cmp ax, bx
jle 0x41e673
cwde
push 0x438797
sub eax, ebx
push eax
push 0x434ad4
call fcn.00404180
mov ax, word [esp + 0x3e]
add esp, 0xc
test ax, ax
jle 0x41e686
cmp ax, bx
jge 0x41e682
movsx esi, ax
jmp 0x41e688
mov esi, ebx
jmp 0x41e688
xor esi, esi
push 1
call fcn.0040e20c
push eax
push esi
lea eax, [esp + 0x40]
push 1
push eax
call fcn.0040e4a1
push 0x434b78
call fcn.00404180
mov eax, dword [edi]
add esp, 0x18
movzx ecx, word [eax + 0x56a]
cmp cx, bx
jle 0x41e6d5
movsx eax, cx
push 0x438798
sub eax, 0x400
push eax
push 0x434b7c
call fcn.00404180
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 0x56a]
test ax, ax
jle 0x41e6ef
cmp ax, bx
jge 0x41e6eb
movsx esi, ax
jmp 0x41e6f1
mov esi, ebx
jmp 0x41e6f1
xor esi, esi
push 1
call fcn.0040e20c
push eax
mov eax, dword [edi]
push esi
add eax, 0x56c
push 1
push eax
call fcn.0040e4a1
push 0x434b80
call fcn.00404180
add esp, 0x18
pop edi
pop esi
pop ebx
add esp, 0x428
ret 4

Function at 0x41e730
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.0041e5e0
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
movzx ecx, word [eax + 2]
cmp cx, 0x50
jle 0x41e766
movsx eax, cx
push 0x438793
sub eax, 0x50
push eax
push 0x434ac0
call fcn.00404180
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 2]
test ax, ax
jle 0x41e781
cmp ax, 0x50
jge 0x41e77a
movsx esi, ax
jmp 0x41e783
mov esi, 0x50
jmp 0x41e783
xor esi, esi
push 1
call fcn.0040e20c
push eax
mov eax, dword [edi]
push esi
add eax, 4
push 1
push eax
call fcn.0040e4a1
push 0x434ac4
call fcn.00404180
mov eax, dword [esp + 0x2c]
add esp, 0x18
movsx eax, word [eax]
pop edi
pop esi
cmp eax, 2
jle 0x41e7ca
push 0x438796
add eax, 0xfffffffe
push eax
push 0x434ac8
call fcn.00404180
add esp, 0xc
push 0x20
push 0x434acc
call fcn.00404180
push 0x5e
push 0x434ad0
call fcn.00404180
add esp, 0x10
ret 0xc
Function at 0x41e890
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x3c]
mov dword [esp + 0xc], 0x20
mov ax, word [edi]
mov word [ebx], ax
movzx eax, word [edi]
cmp ax, word [esi + 2]
jg 0x41e8eb
nop dword [eax]
cwde
mov cl, byte [eax + esi + 3]
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x41e8eb
push ecx
lea eax, [esp + 0x10]
push eax
call sym.align_comments.exe__string_append1_8
mov ax, word [edi]
inc ax
movzx ecx, ax
mov word [edi], ax
mov eax, ecx
cmp cx, word [esi + 2]
jle 0x41e8c0
mov esi, dword [esp + 0x44]
lea eax, [esp + 0xc]
push esi
push dword [esp + 0x44]
push eax
call sym.align_comments.exe__string_t_int_12
push esi
call sym.align_comments.exe__sys_error_4
test al, al
je 0x41e9c5
cmp byte [esp + 0x34], 0
je 0x41e9bf
push 1
call fcn.0040e20c
push eax
push 0xd
push 1
push str.Bad_integer__
call fcn.0040e4a1
mov ax, word [esp + 0x22]
add esp, 0x14
cmp ax, 0x20
jle 0x41e957
cwde
push 0x438792
sub eax, 0x20
push eax
push 0x434ab4
call fcn.00404180
mov ax, word [esp + 0x1a]
add esp, 0xc
test ax, ax
jle 0x41e96e
cmp ax, 0x20
jge 0x41e967
movsx esi, ax
jmp 0x41e970
mov esi, 0x20
jmp 0x41e970
xor esi, esi
push 1
call fcn.0040e20c
push eax
push esi
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0040e4a1
push 1
call fcn.0040e20c
push eax
push 2
push 1
push 0x434ab8
call fcn.0040e4a1
push 0x434abc
call fcn.00404180
add esp, 0x2c
push ebx
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.0041e730
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
mov ax, word [ebx]
mov word [edi], ax
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
Function at 0x41f6b0
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x918]
cmp byte [eax], 0
jne 0x41f6cb
add eax, 8
mov dword [esp + 4], eax
jmp sym.align_comments.exe__file_close_4
ret 4

Function at 0x4203e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
cmp byte [0x437ca0], 0
mov eax, 0x20
mov word [esp + 4], ax
jne 0x4203fb
call sym.align_comments.exe__sys_read_env_global_0
push esi
lea eax, [esp + 8]
push eax
push dword [esp + 0x34]
call sym.align_comments.exe__string_copy_8
lea eax, [esp + 8]
push eax
call sym.align_comments.exe__string_upcase_4
mov eax, dword [0x43af6c]
mov esi, 0x43af6c
mov dword [esp + 4], eax
test eax, eax
je 0x420446
add eax, 4
push eax
lea eax, [esp + 0xc]
push eax
call sym.align_comments.exe__string_equal_8
test al, al
jne 0x4204a7
mov esi, dword [esp + 4]
mov eax, dword [esi]
mov dword [esp + 4], eax
test eax, eax
jne 0x420426
lea eax, [esp + 4]
push eax
push 0x108
call sym.align_comments.exe__sys_mem_alloc_8
mov eax, dword [esp + 4]
test eax, eax
jne 0x420489
push 1
call fcn.0040e20c
push eax
push 0x3a
push 1
push str.Unable_to_allocate_more_virtual_memory.__The_disk_is_full.
call fcn.0040e4a1
push 0x434eac
call fcn.00404180
add esp, 0x18
call sym.align_comments.exe__sys_bomb_0
mov eax, dword [esp + 4]
add eax, 4
push eax
lea eax, [esp + 0xc]
push eax
call sym.align_comments.exe__sys_read_env_lang_8
mov eax, dword [esp + 4]
mov dword [eax], 0
mov eax, dword [esp + 4]
mov dword [esi], eax
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x34]
add ecx, 4
pop esi
mov dword [eax], ecx
add esp, 0x28
ret 8
Function at 0x4208a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.0040e20c
push eax
push 0x2e
push 1
push str.Error_reading_global.env_environment_file_set.
call fcn.0040e4a1
push 0x435140
call fcn.00404180
add esp, 0x18
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push 0x435070
push eax
call sym.align_comments.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.align_comments.exe__string_append1_8
mov edi, dword [esp + 0x428]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.align_comments.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.align_comments.exe__string_append_8
push 0x4350c0
lea eax, [esp + 0x24]
push eax
call sym.align_comments.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x42095c
cwde
push 0x43898a
sub eax, ebx
push eax
push 0x435144
call fcn.00404180
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x42096f
cmp ax, bx
jge 0x42096b
movsx esi, ax
jmp 0x420971
mov esi, ebx
jmp 0x420971
xor esi, esi
push 1
call fcn.0040e20c
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.0040e4a1
push 0x435148
call fcn.00404180
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x4209c3
movsx eax, cx
push 0x43898b
sub eax, 0x400
push eax
push 0x43514c
call fcn.00404180
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x4209d6
cmp ax, bx
jge 0x4209d2
movsx esi, ax
jmp 0x4209d8
mov esi, ebx
jmp 0x4209d8
xor esi, esi
push 1
call fcn.0040e20c
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.0040e4a1
push 0x435150
call fcn.00404180
add esp, 0x18
call sym.align_comments.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 4
Function at 0x421020
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.0040e20c
push eax
push 0xe
push 1
push str.Error_reading
call fcn.0040e4a1
mov edi, dword [esp + 0x43c]
add esp, 0x14
movzx ecx, word [edi + 2]
mov eax, ecx
cmp cx, 0x20
jle 0x421086
movsx eax, cx
push 0x4389ea
sub eax, 0x20
push eax
push 0x435388
call fcn.00404180
movzx eax, word [edi + 2]
add esp, 0xc
test ax, ax
jle 0x42109d
cmp ax, 0x20
jge 0x421096
movsx esi, ax
jmp 0x42109f
mov esi, 0x20
jmp 0x42109f
xor esi, esi
push 1
call fcn.0040e20c
push eax
push esi
lea eax, [edi + 4]
push 1
push eax
call fcn.0040e4a1
push 1
call fcn.0040e20c
push eax
push 0x22
push 1
push str..lan_language_descriptor_file_set.
call fcn.0040e4a1
push 0x4353b0
call fcn.00404180
add esp, 0x2c
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push str.Error_on_line
push eax
call sym.align_comments.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.align_comments.exe__string_append1_8
mov edi, dword [esp + 0x42c]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.align_comments.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.align_comments.exe__string_append_8
push str._of_file
lea eax, [esp + 0x24]
push eax
call sym.align_comments.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x421155
cwde
push 0x4389eb
sub eax, 0x400
push eax
push 0x4353b4
call fcn.00404180
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x421168
cmp ax, bx
jge 0x421164
movsx esi, ax
jmp 0x42116a
mov esi, ebx
jmp 0x42116a
xor esi, esi
push 1
call fcn.0040e20c
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.0040e4a1
push 0x4353b8
call fcn.00404180
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x4211bc
movsx eax, cx
push 0x4389ec
sub eax, 0x400
push eax
push 0x4353bc
call fcn.00404180
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x4211cf
cmp ax, bx
jge 0x4211cb
movsx esi, ax
jmp 0x4211d1
mov esi, ebx
jmp 0x4211d1
xor esi, esi
push 1
call fcn.0040e20c
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.0040e4a1
push 0x4353c0
call fcn.00404180
add esp, 0x18
call sym.align_comments.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 8
Function at 0xf685f4
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf685fe
pushal
call 0xf68604
pop ebp
sub ebp, 0x10
sub ebp, 0xb685f4
jmp 0xf6861a
mov eax, 0xb685f4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c5
mov edx, 0x65725b4b
xor byte [eax], dl
inc eax
dec ecx
jne 0xf68631
jmp 0xf68644
rol byte [esi + 0x4b77c2c0], 0x4b
dec ebx
retf 0xb38a

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x100018a0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x100018de
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x100018d6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x100018e0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x100018c6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100019b0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x100019c6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x100019e1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret