joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
je 0x41a7bc
push 0x46e280
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0043644b
add esp, 0xc
test eax, eax
je 0x41a748
push 0
push str.ERROR_
push str.Could_not_open_save_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebx]
cmp esi, dword [ebx + 4]
je 0x41a798
lea ebx, [esi + 0x3a]
push edi
movzx edi, word [ebx - 2]
push 0x3a
push esi
call fcn.00423470
push edi
push ebx
call fcn.00423470
push dword [ebp - 4]
push 0x3a
push 1
push esi
call fcn.00436dba
push dword [ebp - 4]
push edi
push 1
push ebx
call fcn.00436dba
mov eax, dword [ebp + 0xc]
add esi, 0x43a
add esp, 0x30
add ebx, 0x43a
cmp esi, dword [eax + 4]
jne 0x41a754
pop edi
push dword [ebp - 4]
call fcn.00436555
add esp, 4
push 0
push str.NOTICE_
push str.File_saved_successfully_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ae10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d987
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [0x48c7e8]
mov ecx, 0x48c7e8
mov dword [ebp - 4], 0
push dword [eax + 4]
call fcn.0041bb00
mov eax, dword [0x48c7e8]
push edi
push 1
push 6
mov dword [eax + 4], eax
mov eax, dword [0x48c7e8]
mov dword [ebp - 4], 0xffffffff
mov dword [eax], eax
mov eax, dword [0x48c7e8]
mov dword [eax + 8], eax
lea eax, [ebp - 0x238]
push eax
mov dword [0x48c7ec], 0
call fcn.004369a9
add esp, 0x10
test eax, eax
je 0x41afe2
nop dword [eax]
lea eax, [ebp - 0x238]
push 6
push eax
call fcn.00423470
movzx eax, word [ebp - 0x234]
push eax
call fcn.00423c35
movzx ecx, word [ebp - 0x234]
mov esi, eax
push edi
push 1
push ecx
push esi
call fcn.004369a9
movzx ecx, word [ebp - 0x234]
push ecx
push esi
call fcn.00423470
mov eax, dword [ebp - 0x238]
add esp, 0x24
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x218], 0xf
mov dword [ebp - 0x21c], 0
mov byte [ebp - 0x22c], 0
cmp byte [esi], 0
jne 0x41af0f
xor eax, eax
jmp 0x41af1d
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41af14
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x22c]
call fcn.0041be00
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 1
push eax
mov ecx, 0x48c7e8
call fcn.0041a9c0
push eax
add eax, 0x10
mov ecx, 0x48c7e8
push eax
push 0
lea eax, [ebp - 0x240]
push eax
call fcn.0041abe0
mov eax, dword [ebp - 0x218]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0x10
jb 0x41afa5
mov ecx, dword [ebp - 0x22c]
inc eax
cmp eax, 0x1000
jb 0x41af9c
test cl, 0x1f
jne 0x41b012
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x41b012
sub ecx, eax
cmp ecx, 4
jb 0x41b012
cmp ecx, 0x23
ja 0x41b012
mov ecx, eax
push ecx
call fcn.00423c22
add esp, 4
push esi
mov dword [ebp - 0x218], 0xf
mov dword [ebp - 0x21c], 0
mov byte [ebp - 0x22c], 0
call fcn.004243b7
push edi
push 1
lea eax, [ebp - 0x238]
push 6
push eax
call fcn.004369a9
add esp, 0x14
test eax, eax
jne 0x41aea0
lea eax, [ebp - 0x214]
mov byte [ebp - 0x14], 0
push eax
call fcn.00404e40
add esp, 4
test eax, eax
jne 0x41b017
push eax
push str.ERROR_
push str.Failed_to_save_the_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41b065
call fcn.0042e588
lea eax, [ebp - 0x214]
push 0x48c7e8
push eax
call fcn.0041b610
add esp, 8
mov eax, dword [0x48c7e8]
mov ecx, 0x48c7e8
mov dword [ebp - 4], 2
push dword [eax + 4]
call fcn.0041bb00
mov eax, dword [0x48c7e8]
mov dword [eax + 4], eax
mov eax, dword [0x48c7e8]
mov dword [eax], eax
mov eax, dword [0x48c7e8]
mov dword [eax + 8], eax
mov dword [0x48c7ec], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424024
mov esp, ebp
pop ebp
ret
Function at 0x41b700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
cmp dword [ebx + 4], 0
je 0x41b822
push 0x46e280
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0043644b
add esp, 0xc
test eax, eax
je 0x41b749
push 0
push str.ERROR_
push str.Could_not_open_save_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
push esi
mov esi, dword [eax]
cmp esi, eax
je 0x41b7fe
push edi
cmp dword [esi + 0x28], 0x10
lea ebx, [esi + 0x14]
jb 0x41b762
mov ebx, dword [ebx]
mov edi, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x41b767
mov eax, dword [esi + 0x10]
sub edi, ecx
mov dword [ebp - 0xc], eax
inc edi
lea eax, [ebp - 0xc]
mov word [ebp - 8], di
push 6
push eax
call fcn.00423470
push edi
push ebx
call fcn.00423470
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push 6
push 1
push eax
call fcn.00436dba
push dword [ebp - 4]
push edi
push 1
push ebx
call fcn.00436dba
add esp, 0x30
cmp byte [esi + 0xd], 0
jne 0x41b7f2
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x41b7d1
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x41b7f2
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x41b7c5
jmp 0x41b7f2
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x41b7f0
nop word [eax + eax]
cmp esi, dword [eax + 8]
jne 0x41b7f0
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x41b7e0
mov esi, eax
mov eax, dword [ebp + 0xc]
cmp esi, dword [eax]
jne 0x41b757
pop edi
push dword [ebp - 4]
call fcn.00436555
add esp, 4
push 0
push str.NOTICE_
push str.File_saved_successfully_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41c3e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x48cc00]
push esi
mov esi, dword [ebp + 8]
push esi
push 1
mov dword [0x48cc04], eax
lea eax, [ebp - 0x234]
push 0x29
push eax
call fcn.004369a9
add esp, 0x10
test eax, eax
je 0x41c45a
nop dword [eax]
lea eax, [ebp - 0x234]
push 0x29
push eax
call fcn.00423470
add esp, 8
lea eax, [ebp - 0x234]
mov ecx, 0x48cc00
push eax
call fcn.0041cce0
push esi
push 1
lea eax, [ebp - 0x234]
push 0x29
push eax
call fcn.004369a9
add esp, 0x10
test eax, eax
jne 0x41c420
lea eax, [ebp - 0x208]
mov byte [ebp - 8], 0
push eax
call fcn.00404e40
add esp, 4
pop esi
test eax, eax
jne 0x41c497
push eax
push str.ERROR_
push str.Failed_to_save_the_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424024
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x208]
push 0x48cc00
push eax
call fcn.0041c940
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [0x48cc00]
xor ecx, ebp
mov dword [0x48cc04], eax
call fcn.00424024
mov esp, ebp
pop ebp
ret
Function at 0x41ca30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
cmp eax, dword [edi + 4]
je 0x41cac4
push 0x46e280
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.0043644b
add esp, 0xc
test eax, eax
je 0x41ca75
push 0
push str.ERROR_
push str.Could_not_open_save_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop ebp
ret
push esi
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je 0x41caa0
nop dword [eax]
push 0x29
push esi
call fcn.00423470
push dword [ebp + 0xc]
push 0x29
push 1
push esi
call fcn.00436dba
add esi, 0x29
add esp, 0x18
cmp esi, dword [edi + 4]
jne 0x41ca80
push dword [ebp + 0xc]
call fcn.00436555
add esp, 4
push 0
push str.NOTICE_
push str.File_saved_successfully_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop edi
pop ebp
ret

Function at 0x41cd90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20208
call fcn.004243c0
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x20208]
push 0x20000
push eax
call fcn.004369a9
lea eax, [ebp - 0x20208]
push 0x20000
push eax
call fcn.00423470
lea eax, [ebp - 0x208]
mov byte [ebp - 8], 0
push eax
call fcn.00404e40
add esp, 0x1c
test eax, eax
jne 0x41ce0b
push eax
push str.ERROR_
push str.Failed_to_save_the_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424024
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20208]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.0041d320
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
call fcn.00424024
mov esp, ebp
pop ebp
ret

Function at 0x41d3f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
je 0x41d463
push 0x46e280
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0043644b
add esp, 0xc
test eax, eax
je 0x41d42e
push 0
push str.ERROR_
push str.Could_not_open_save_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
push 0x20000
push 1
push dword [ebp + 0xc]
call fcn.00436dba
push dword [ebp - 4]
call fcn.00436555
add esp, 0x14
push 0
push str.NOTICE_
push str.File_saved_successfully_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esp, ebp
pop ebp
ret
Function at 0x41d470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x3300
call fcn.00423c35
push 0x3300
mov esi, eax
push 0
push esi
mov dword [ebp - 0x20c], esi
call fcn.004255e0
add esp, 0x10
mov edi, 0x80
push ebx
push 0x66
push 1
push esi
call fcn.004369a9
push 0x66
push esi
call fcn.00423470
add esp, 0x18
add esi, 0x66
sub edi, 1
jne 0x41d4b0
lea eax, [ebp - 0x208]
mov byte [ebp - 8], 0
push eax
call fcn.00404e40
add esp, 4
test eax, eax
jne 0x41d50d
push eax
push str.ERROR_
push str.Failed_to_save_the_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424024
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x20c]
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0041da00
push esi
call fcn.004243b7
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00424024
mov esp, ebp
pop ebp
ret

Function at 0x41dba0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x41dc5a
push 0x46e280
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.0043644b
add esp, 0xc
test eax, eax
je 0x41dbe5
push 0
push str.ERROR_
push str.Could_not_open_save_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov esi, ebx
mov edi, 0x80
nop
push 0x66
push esi
call fcn.00423470
add esp, 8
add esi, 0x66
sub edi, 1
jne 0x41dbf0
push 0xe2f1
push 0x3300
push ebx
call fcn.00422b60
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 1
push 0x3300
push ebx
call fcn.00436dba
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push 1
push 4
push eax
call fcn.00436dba
push dword [ebp + 0xc]
call fcn.00436555
add esp, 0x30
push edi
push str.NOTICE_
push str.File_saved_successfully_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41dc60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x41000
call fcn.00423c35
push 0x41000
mov esi, eax
push 0
push esi
mov dword [ebp - 0x20c], esi
call fcn.004255e0
add esp, 0x10
mov edi, 0x400
push ebx
push 0x104
push 1
push esi
call fcn.004369a9
push 0x104
push esi
call fcn.00423470
add esp, 0x18
add esi, 0x104
sub edi, 1
jne 0x41dca0
lea eax, [ebp - 0x208]
mov byte [ebp - 8], 0
push eax
call fcn.00404e40
add esp, 4
test eax, eax
jne 0x41dd06
push eax
push str.ERROR_
push str.Failed_to_save_the_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424024
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x20c]
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0041e1d0
push esi
call fcn.004243b7
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00424024
mov esp, ebp
pop ebp
ret

Function at 0x41e290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x41e32b
push 0x46e280
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.0043644b
add esp, 0xc
test eax, eax
je 0x41e2d5
push 0
push str.ERROR_
push str.Could_not_open_save_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov esp, ebp
pop ebp
ret
push 0xe2f1
push 0x41000
push esi
call fcn.00422b60
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 1
push 0x41000
push esi
call fcn.00436dba
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push 1
push 4
push eax
call fcn.00436dba
push dword [ebp + 0xc]
call fcn.00436555
add esp, 0x30
push 0
push str.NOTICE_
push str.File_saved_successfully_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41e330
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0xf8000
call fcn.00423c35
push 0xf8000
mov esi, eax
push 0
push esi
mov dword [ebp - 0x20c], esi
call fcn.004255e0
add esp, 0x10
mov edi, 0x2000
push ebx
push 0x7c
push 1
push esi
call fcn.004369a9
push 0x7c
push esi
call fcn.00423470
add esp, 0x18
add esi, 0x7c
sub edi, 1
jne 0x41e370
lea eax, [ebp - 0x208]
mov byte [ebp - 8], 0
push eax
call fcn.00404e40
add esp, 4
test eax, eax
jne 0x41e3cd
push eax
push str.ERROR_
push str.Failed_to_save_the_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424024
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x20c]
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0041e8f0
push esi
call fcn.004243b7
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00424024
mov esp, ebp
pop ebp
ret
Function at 0x41eac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x41eb5b
push 0x46e280
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.0043644b
add esp, 0xc
test eax, eax
je 0x41eb05
push 0
push str.ERROR_
push str.Could_not_open_save_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov esp, ebp
pop ebp
ret
push 0xe2f1
push 0xf8000
push esi
call fcn.00422b60
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 1
push 0xf8000
push esi
call fcn.00436dba
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push 1
push 4
push eax
call fcn.00436dba
push dword [ebp + 0xc]
call fcn.00436555
add esp, 0x30
push 0
push str.NOTICE_
push str.File_saved_successfully_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41eb60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push 1
push 4
push eax
mov dword [ebp - 0x20c], 0
call fcn.004369a9
mov eax, dword [ebp - 0x20c]
add esp, 0x10
test eax, eax
js 0x41ec54
xor ecx, ecx
mov edx, 0x174
mul edx
push ebx
push edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00423c35
imul ecx, dword [ebp - 0x20c], 0x174
mov ebx, eax
push esi
push 1
push ecx
push ebx
call fcn.004369a9
xor edi, edi
add esp, 0x14
cmp dword [ebp - 0x20c], edi
jle 0x41ebfd
mov esi, ebx
push 0x174
push esi
call fcn.00423470
inc edi
add esp, 8
add esi, 0x174
cmp edi, dword [ebp - 0x20c]
jl 0x41ebe0
lea eax, [ebp - 0x208]
mov byte [ebp - 8], 0
push eax
call fcn.00404e40
add esp, 4
test eax, eax
jne 0x41ec3c
push eax
push str.ERROR_
push str.Failed_to_save_the_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424024
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x20c]
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.0041ec70
add esp, 0xc
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00424024
mov esp, ebp
pop ebp
ret
Function at 0x41f930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x48e058]
push ebx
mov ebx, dword [ebp + 8]
push 0x104
mov dword [0x48e05c], eax
lea eax, [ebp - 0x30c]
push 0
push eax
mov dword [ebp - 0x310], ebx
call fcn.004255e0
push ebx
push 1
lea eax, [ebp - 0x30c]
push 0x104
push eax
call fcn.004369a9
add esp, 0x1c
test eax, eax
je 0x41fa78
push esi
push edi
nop dword [eax + eax]
lea eax, [ebp - 0x30c]
push 0x104
push eax
call fcn.00423470
mov edi, dword [0x48e05c]
lea eax, [ebp - 0x30c]
add esp, 8
cmp eax, edi
jae 0x41fa1a
mov ebx, dword [0x48e058]
cmp ebx, eax
ja 0x41fa14
mov ecx, eax
mov eax, 0x7e07e07f
sub ecx, ebx
imul ecx
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x48e060]
jne 0x41f9f3
push 1
mov ecx, 0x48e058
call fcn.004201f0
mov edi, dword [0x48e05c]
mov ebx, dword [0x48e058]
test edi, edi
je 0x41fa0c
imul esi, esi, 0x104
mov ecx, 0x41
add esi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x48e05c]
mov ebx, dword [ebp - 0x310]
jmp 0x41fa4b
mov ebx, dword [ebp - 0x310]
cmp edi, dword [0x48e060]
jne 0x41fa34
push 1
mov ecx, 0x48e058
call fcn.004201f0
mov edi, dword [0x48e05c]
test edi, edi
je 0x41fa4b
mov ecx, 0x41
lea esi, [ebp - 0x30c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x48e05c]
push ebx
push 1
lea eax, [ebp - 0x30c]
add edi, 0x104
push 0x104
push eax
mov dword [0x48e05c], edi
call fcn.004369a9
add esp, 0x10
test eax, eax
jne 0x41f990
pop edi
pop esi
lea eax, [ebp - 0x208]
mov byte [ebp - 8], 0
push eax
call fcn.00404e40
add esp, 4
pop ebx
test eax, eax
jne 0x41fab5
push eax
push str.ERROR_
push str.Failed_to_save_the_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424024
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x208]
push 0x48e058
push eax
call fcn.00420000
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
call fcn.00424024
mov esp, ebp
pop ebp
ret

Function at 0x4200b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
cmp eax, dword [edi + 4]
je 0x420142
push 0x46e280
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.0043644b
add esp, 0xc
test eax, eax
je 0x4200f5
push 0
push str.ERROR_
push str.Could_not_open_save_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop ebp
ret
push esi
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je 0x42011e
nop dword [eax]
push dword [ebp + 0xc]
push 0x104
push 1
push esi
call fcn.00436dba
add esi, 0x104
add esp, 0x10
cmp esi, dword [edi + 4]
jne 0x420100
push dword [ebp + 0xc]
call fcn.00436555
add esp, 4
push 0
push str.NOTICE_
push str.File_saved_successfully_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop edi
pop ebp
ret
Function at 0x4208d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46dacb
mov eax, dword fs:[0]
push eax
sub esp, 0x32c
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
xor edi, edi
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x32c], 0
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x328], esi
mov dword [ebp - 0x31c], esi
push eax
push 4
lea eax, [ebp - 0x32c]
mov dword [ebp - 4], esi
push 1
xor ebx, ebx
push eax
mov dword [ebp - 0x320], ebx
call fcn.004369a9
add esp, 0x10
mov dword [ebp - 0x330], ebx
cmp dword [ebp - 0x32c], ebx
jle 0x420a6f
nop dword [eax + eax]
push 0x102
lea eax, [ebp - 0x318]
push 0
push eax
call fcn.004255e0
push dword [ebp - 0x334]
lea eax, [ebp - 0x318]
push 0x102
push 1
push eax
call fcn.004369a9
lea eax, [ebp - 0x318]
push 0x102
push eax
call fcn.00423470
lea eax, [ebp - 0x318]
add esp, 0x24
cmp eax, ebx
jae 0x420a06
cmp edi, eax
ja 0x420a06
mov ecx, eax
mov eax, 0xfe03f81
sub ecx, edi
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x338], eax
cmp ebx, esi
jne 0x4209f8
push 1
lea ecx, [ebp - 0x324]
call fcn.00421340
mov eax, dword [ebp - 0x31c]
mov ebx, dword [ebp - 0x320]
mov edi, dword [ebp - 0x324]
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x338]
test ebx, ebx
je 0x420a3e
imul esi, eax, 0x102
add esi, edi
jmp 0x420a33
cmp ebx, esi
jne 0x420a29
push 1
lea ecx, [ebp - 0x324]
call fcn.00421340
mov eax, dword [ebp - 0x31c]
mov ebx, dword [ebp - 0x320]
mov dword [ebp - 0x328], eax
test ebx, ebx
je 0x420a3e
lea esi, [ebp - 0x318]
mov ecx, 0x40
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp - 0x330]
add ebx, 0x102
mov edi, dword [ebp - 0x324]
inc eax
mov esi, dword [ebp - 0x328]
mov dword [ebp - 0x320], ebx
mov dword [ebp - 0x330], eax
cmp eax, dword [ebp - 0x32c]
jl 0x420960
lea eax, [ebp - 0x214]
mov byte [ebp - 0x14], 0
push eax
call fcn.00404e40
add esp, 4
test eax, eax
jne 0x420ab8
push eax
push str.ERROR_
push str.Failed_to_save_the_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
test edi, edi
je 0x420afe
sub esi, edi
mov eax, 0xfe03f81
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push edi
jmp 0x420af3
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.004210c0
mov esi, dword [ebp - 0x324]
add esp, 8
test esi, esi
je 0x420afe
mov ecx, dword [ebp - 0x31c]
mov eax, 0xfe03f81
sub ecx, esi
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
lea ecx, [ebp - 0x324]
call fcn.00421450
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424024
mov esp, ebp
pop ebp
ret