joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476090
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e60
call fcn.004915d0
mov eax, dword [esp + 0x8e68]
push ebx
push ebp
mov ebp, dword [esp + 0x8e6c]
push esi
mov esi, ecx
mov cl, byte [edx]
xor ebx, ebx
cmp cl, 0x41
je 0x4760bb
cmp cl, 0x61
jne 0x47610c
cmp byte [edx + 1], bl
jne 0x47610c
cmp byte [edi], bl
jne 0x47610c
cmp byte [eax], bl
jne 0x47610c
cmp byte [esi], bl
jne 0x47610c
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x4760ed
cmp byte [ebp + 0xc6], bl
jne 0x4760ed
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4760ed
xor esi, esi
cmp byte [esp + 0x8e7c], bl
je 0x476100
cmp esi, ebx
je 0x476100
mov dword [ebp + 0xa0], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
cmp cl, bl
jne 0x47612d
cmp byte [edi], bl
jne 0x47612d
cmp byte [eax], bl
jne 0x47612d
cmp byte [esi], bl
jne 0x47612d
mov eax, ebp
call fcn.00476280
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x828], 0x4987f9
mov byte [esp + 0xc45], bl
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc50], ebx
mov dword [esp + 0xc54], ebx
mov dword [esp + 0xc58], ebx
mov dword [esp + 0xc5c], ebx
mov dword [esp + 0xc68], ebx
mov dword [esp + 0xc6c], ebx
call fcn.00476cf0
test eax, eax
je 0x47623e
test byte [esp + 0xc], 2
mov al, byte [esp + 0x8e78]
mov ecx, dword [esp + 0x8e80]
mov edx, dword [esp + 0x8e84]
mov byte [esp + 0xc35], al
mov dword [esp + 0xc44], ecx
mov dword [esp + 0xc48], edx
je 0x47624a
mov eax, dword [esp + 0x828]
cmp eax, 0xffff
je 0x476216
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47623e
cmp byte [ebp + 0xc6], bl
jne 0x47620f
mov eax, dword [esp + 0x828]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x47620f
mov ecx, dword [esp + 0x828]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
je 0x47623e
mov eax, dword [esp + 0x828]
cmp dword [esp + 0xc5c], eax
je 0x47622f
lea esi, [esp + 0xc]
mov dword [esp + 0xc5c], eax
call fcn.00477130
push ebx
lea edx, [esp + 0x10]
push edx
call fcn.004771f0
test eax, eax
jne 0x47625a
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
lea eax, [esp + 0xc]
push eax
push 0x4762f0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0xc3c]
cmp byte [esp + 0x8e7c], bl
je 0x476274
cmp eax, ebx
je 0x476274
mov dword [ebp + 0xa0], eax
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
Function at 0x476460
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x8018
call fcn.004915d0
push ebx
push ebp
mov ebp, dword [esp + 0x8028]
push esi
push edi
mov edi, dword [esp + 0x802c]
mov esi, ecx
test edi, edi
je 0x476489
mov ecx, edi
call fcn.00412b30
cmp dword [esp + 0x8038], 0
jne 0x47649e
mov dword [esp + 0x8038], 0x1f4
cmp dword [esp + 0x803c], 1
jge 0x4764b3
mov dword [esp + 0x803c], 0x32
cmp ebp, 1
jge 0x4764bd
mov ebp, 1
test esi, esi
je 0x47668a
mov ebx, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
lea eax, [esp + 0x20]
push eax
push 0x7d0
push 2
push 0
push 0
push 0x406
push esi
call ebx
test eax, eax
je 0x47668a
cmp ebp, dword [esp + 0x20]
jg 0x47668a
push 0x8000
xor eax, eax
mov ecx, esi
lea edi, [esp + 0x1c]
call fcn.004735e0
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
test edi, edi
je 0x476683
dec ebp
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x24], eax
jmp 0x476530
lea ecx, [esp + 0x14]
push ecx
push 0x7d0
push 2
push 0
push ebp
push 0x403
push esi
call ebx
test eax, eax
je 0x4765a7
mov edx, 0x7fff
cmp word [esp + 0x14], dx
ja 0x4765fe
lea eax, [esp + 0x14]
push eax
push 0x7d0
push 2
push edi
push ebp
push 0x402
push esi
call ebx
test eax, eax
je 0x4765a7
movzx ecx, word [esp + 0x14]
mov eax, dword [esp + 0x18]
push 0
inc ecx
push ecx
lea edx, [esp + 0x30]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4765f9
mov edx, dword [esp + 0x8034]
lea eax, [esp + 0x28]
call fcn.004759e0
test al, al
jne 0x476624
cmp dword [esp + 0x802c], 0
jne 0x476608
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x476657
mov edi, dword [esp + 0x8038]
test edi, edi
js 0x4765de
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x24]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x47663c
mov edx, dword [esp + 0x803c]
push 1
push edx
call fcn.00401330
mov edi, dword [esp + 0x24]
add esp, 8
jmp 0x476530
mov byte [esp + 0x28], 0
cmp dword [esp + 0x802c], 0
je 0x476657
mov eax, dword [esp + 0x802c]
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x34]
push edx
push eax
call fcn.00474ce0
mov esi, eax
jmp 0x47665c
mov eax, dword [0x4aa51c]
push 1
push 0
push 0xffffffffffffffff
push 0x498884
push eax
call fcn.00474ce0
jmp 0x4765fe
mov ecx, dword [0x4aa51c]
push 1
push 0
push 0xffffffffffffffff
push 0x499ee8
push ecx
call fcn.00474ce0
mov edi, dword [esp + 0x1c]
mov esi, 1
push 0x8000
push 0
push edi
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov edi, dword [esp + 0x802c]
mov eax, 0x499ee8
test edi, edi
jne 0x476698
mov eax, 0x49a030
mov ecx, dword [0x4a6440]
cmp byte [ecx + 0xe4], 0
jne 0x4766c5
mov edx, dword [0x4aa51c]
push 1
push 0
push 0xffffffffffffffff
push eax
push edx
call fcn.00474ce0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov ecx, dword [0x4ac0f0]
push 0x4987f9
push 0
push eax
call fcn.0042e170
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
Function at 0x477130
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0xc50]
test ecx, ecx
je 0x4771e7
mov eax, dword [esi]
test eax, eax
je 0x4771e7
push edi
test al, 1
jne 0x477159
mov eax, dword [esi + 0x80c]
cmp byte [eax], 0
je 0x477172
push 0x7fff
lea edi, [esi + 0xc58]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jne 0x477172
mov byte [edi], al
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x47718d
mov edx, dword [esi + 0xc50]
lea ecx, [esi + 0xc54]
push ecx
push edx
call edi
test byte [esi], 0x20
je 0x4771c8
mov ecx, dword [esi + 0xc50]
lea eax, [esp + 4]
push eax
push ecx
call edi
test eax, eax
je 0x4771c8
movzx edx, byte [esi + 0xc28]
mov ecx, dword [esp + 4]
push edx
lea eax, [esi + 0x8d58]
call fcn.0044eba0
add esp, 4
test eax, eax
jne 0x4771c8
mov byte [esi + 0x8d58], al
test byte [esi], 8
pop edi
je 0x4771e7
mov ecx, dword [esi + 0xc50]
push 0x101
lea eax, [esi + 0x8c57]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
pop ecx
ret

Function at 0x477910
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e5c
call fcn.004915d0
mov eax, dword [esp + 0x8e60]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x4779bd
mov dword [esp + 0xc44], eax
lea eax, [esp + 4]
push eax
push 0x478050
mov dword [esp + 0xc], ebx
mov dword [esp + 0x818], 0x4987f9
mov byte [esp + 0xc35], bl
mov dword [esp + 0xc38], ebx
mov dword [esp + 0xc3c], ebx
mov dword [esp + 0xc40], ebx
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc58], ebx
mov dword [esp + 0xc5c], ebx
mov byte [esp + 0xc50], cl
mov dword [esp + 0xc54], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0xc34], ebx
je 0x4779bd
mov ecx, dword [0x4a6440]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x4779bd
push 1
push eax
call fcn.00401330
add esp, 8
mov eax, 1
pop ebx
add esp, 0x8e5c
ret 4
Function at 0x4779d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x4779ec
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4a6440]
push eax
push esi
mov ecx, edi
call fcn.00477e90
cmp byte [edi], 0
mov dword [esp + 0x10], eax
je 0x477a23
test eax, eax
jne 0x477a27
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edi
call fcn.00477ae0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x477aa6
test esi, esi
je 0x477aa6
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.00401330
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x477a85
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x477a85
push 1
push 0x8000012f
call fcn.00401330
add esp, 8
push esi
call edi
test eax, eax
jne 0x477a60
mov edx, dword [0x4a6440]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x477a9e
push 1
push eax
call fcn.00401330
add esp, 8
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x477ac0
mov ecx, dword [esp + 0x1c]
push 0
push ecx
push edi
call fcn.00477ae0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
push edx
mov ecx, edi
call fcn.00477c60
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x477c60
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e68
call fcn.004915d0
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x477de0
xor cl, cl
mov eax, edi
call fcn.00477e00
test eax, eax
jne 0x477c95
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4a6440]
push eax
push ebp
mov ecx, edi
call fcn.00477e90
test eax, eax
je 0x477cb8
xor eax, eax
mov dword [0x4abd20], eax
jmp 0x477cbd
mov eax, dword [0x4abd20]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x824], 0x4987f9
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc64], ebx
mov dword [esp + 0xc68], ebx
cmp byte [esp + 0x8e7c], bl
je 0x477d03
mov byte [esp + 0xc41], bl
cmp eax, ebx
je 0x477d0b
mov byte [esp + 0xc41], 1
mov ecx, dword [0x4abd1c]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0xc54], eax
lea eax, [esp + 0x18]
push eax
push 0x477f60
mov dword [esp + 0xc58], ecx
mov dword [esp + 0xc60], edx
call esi
mov eax, dword [esp + 0xc48]
cmp eax, ebx
je 0x477db8
lea ecx, [esp + 0x10]
push ecx
push 0x476b00
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x477d75
mov edx, dword [esp + 0xc48]
call fcn.00477620
mov dword [esp + 0xc48], esi
mov eax, dword [esp + 0xc48]
call fcn.00475b80
mov edx, dword [esp + 0xc48]
call fcn.00477620
mov edx, dword [0x4a6440]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x477de0
push 1
push eax
call fcn.00401330
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
mov eax, dword [0x4abd20]
cmp eax, ebx
je 0x477de0
cmp eax, 1
setg al
mov dword [0x4abd20], ebx
cmp al, bl
je 0x477de0
mov edx, ebp
call fcn.00477620
push ebx
mov ecx, edi
call fcn.00477c60
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x8e68
ret 4
Function at 0x48bee4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a5d90]
jne 0x48beee
repz ret
jmp fcn.00490817

Function at 0x48e864
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a5d90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00488ed2
and dword [ebp - 0x14], 0
cmp dword [0x4a8554], 0
mov dword [ebp - 0x18], eax
jne 0x48e917
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x48e9bf
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x48e9bf
mov esi, dword [fcn.00484a40]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4a8554], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4a8558], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4a855c], eax
call edi
push eax
call esi
mov dword [0x4a8564], eax
test eax, eax
je 0x48e917
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4a8560], eax
mov eax, dword [0x4a8560]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00484a44]
cmp eax, ecx
je 0x48e970
cmp dword [0x4a8564], ecx
je 0x48e970
push eax
call esi
push dword [0x4a8564]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x48e970
test ebx, ebx
je 0x48e970
call edi
test eax, eax
je 0x48e967
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x48e967
test byte [ebp - 8], 1
jne 0x48e970
or dword [ebp + 0x10], 0x200000
jmp 0x48e9a3
mov eax, dword [0x4a8558]
cmp eax, dword [ebp - 0x18]
je 0x48e9a3
push eax
call esi
test eax, eax
je 0x48e9a3
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x48e9a3
mov eax, dword [0x4a855c]
cmp eax, dword [ebp - 0x18]
je 0x48e9a3
push eax
call esi
test eax, eax
je 0x48e9a3
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4a8554]
call esi
test eax, eax
je 0x48e9bf
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x48e9c1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048bee4
leave
ret

Function at 0x43b63c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
sub ebx, 0xc1ba52e5
or ecx, ecx
call fcn.0043b686
push 0xccf3296b
pop ecx
add ebx, 1
xor dword [edx], eax
and ecx, ebx
add edx, 1
add ecx, 0x87096c84
dec ebx
cmp edx, esi
jne fcn.0043b63c
push ebx
mov ebx, dword [esp]
add esp, 4
mov ecx, ebx
add ecx, 0xf7055896
ret
Function at 0x40200b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp + 0xc]
push edi
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [ebp + 0x10]
mov esi, eax
and byte [edi], 0
test esi, esi
jne 0x40206f
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov esi, eax
test esi, esi
jne 0x40206f
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret 0xc

Function at 0x402077
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 0xc]
mov edi, ecx
push ebx
push ebx
push dword [ebp + 8]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov dword [ebp + 0xc], eax
ja 0x402155
lea eax, [ebp - 0x208]
mov esi, 0x80000000
push eax
push str..htm
push esi
mov ecx, edi
call fcn.0040200b
test eax, eax
jne 0x402155
lea eax, [ebp - 0x208]
push str._shellopencommand
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x208]
mov ecx, edi
push eax
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.0040200b
test eax, eax
jne 0x402155
lea eax, [ebp - 0x208]
push str.__1_
push eax
call fcn.0041a682
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
jne 0x40213c
lea eax, [ebp - 0x208]
push 0x43c1a8
push eax
call fcn.0041a682
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
jne 0x40213c
lea eax, [ebp - 0x208]
push eax
call fcn.0041a460
pop ecx
lea esi, [ebp + eax - 0x209]
jmp 0x40213e
mov byte [esi], bl
push 0x43c1a4
push esi
call fcn.0041a380
push dword [ebp + 8]
push esi
call fcn.0041a380
add esp, 0x10
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x403ad4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, 0x208
mov dword [esi + 0x624], eax
push edi
lea eax, [esi + 0x20c]
push 0
push eax
mov dword [esi], 0x435a88
call fcn.0041a310
push edi
lea eax, [esi + 0x414]
push 0
push eax
call fcn.0041a310
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
mov dword [esi + 0x628], eax
mov eax, dword [esi + 0x624]
lea eax, [eax + eax + 0x800]
push eax
call fcn.0042f00a
mov dword [esi + 0x61c], eax
mov eax, dword [esi + 0x624]
add eax, 0x400
push eax
call fcn.0042f00a
pop ecx
mov dword [esi + 0x620], eax
pop ecx
mov eax, esi
pop edi
pop esi
leave
ret 4
Function at 0x403f82
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x18]
xor edx, edx
cmp eax, edx
push edi
mov dword [ebp - 4], ecx
je 0x403f9f
cmp dword [ecx + 0x62c], eax
jg 0x4040af
cmp dword [ebp + 8], 0xffffffff
je 0x4040af
cmp dword [ebp + 8], edx
je 0x4040af
cmp dword [ebp + 0xc], edx
je 0x4040af
mov edi, dword [ebp + 0x10]
cmp edi, edx
je 0x4040af
sub edi, dword [ebp + 0xc]
inc edi
js 0x403fe4
cmp edi, edx
jle 0x403fda
mov dword [ecx + 0x630], 1
jne 0x403fec
cmp dword [ecx + 0x630], edx
jne 0x403fec
push 1
pop eax
jmp 0x4040b1
push ebx
push esi
push dword [ebp + 0x14]
call fcn.0041a460
lea ebx, [eax + edi + 0x64]
push ebx
call fcn.0042f00a
push ebx
xor ebx, ebx
mov esi, eax
push ebx
push esi
call fcn.0041a310
add esp, 0x14
xor eax, eax
cmp edi, ebx
jle 0x404029
mov edx, dword [ebp + 0xc]
mov ecx, esi
sub edx, esi
mov eax, edi
mov bl, byte [edx + ecx]
mov byte [ecx], bl
inc ecx
dec edi
jne 0x40401e
xor ebx, ebx
push dword [ebp + 0x14]
and byte [eax + esi], 0
push esi
call fcn.0041a380
pop ecx
lea eax, [ebp + 0x10]
pop ecx
mov dword [ebp + 0x10], ebx
push ebx
push eax
push esi
call fcn.0041a460
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
pop ecx
push eax
push esi
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 4]
add eax, 0x62c
inc dword [eax]
cmp dword [ebp + 0x18], ebx
mov eax, dword [eax]
je 0x4040a1
cmp eax, dword [ebp + 0x18]
jle 0x4040a1
push 0x43c258
push dword [ebp + 0x14]
call fcn.0041b403
pop ecx
test eax, eax
pop ecx
jne 0x4040a1
push dword [ebp + 0x18]
push str._r_n_lines_skipped___output_limited_to__d_lines__r_n
push esi
call fcn.0041b502
add esp, 0xc
lea eax, [ebp + 0x10]
push ebx
push eax
push esi
call fcn.0041a460
pop ecx
push eax
push esi
push dword [ebp + 8]
call edi
push esi
call fcn.0042f033
pop ecx
push 1
pop eax
pop esi
pop ebx
jmp 0x4040b1
xor eax, eax
pop edi
leave
ret 0x14
Function at 0x41908c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, dword [ebp + 0x10]
xor eax, eax
push ebx
push esi
cmp ecx, eax
push edi
je 0x419103
mov dword [ecx], eax
mov ecx, dword [ebp + 8]
cmp ecx, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
je 0x419103
cmp byte [ecx], al
je 0x419103
mov edx, dword [ebp + 0xc]
cmp edx, eax
je 0x419103
cmp byte [edx], al
je 0x419103
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, 0x80
push eax
push ebx
push 3
push eax
mov edi, 0x80000000
push 3
push edi
push ecx
call esi
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x419103
push 0
push ebx
push 3
push 0
push 3
push edi
push dword [ebp + 0xc]
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x41910c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ebx, ebx
push ebx
push dword [ebp + 8]
call esi
push ebx
mov dword [ebp + 0xc], eax
push dword [ebp - 0xc]
call esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4191ef
cmp eax, 0xffffffff
je 0x4191ef
mov esi, 0x10000
push esi
call fcn.0042f00a
push esi
mov dword [ebp - 8], eax
call fcn.0042f00a
cmp dword [ebp - 8], ebx
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
je 0x4191ef
cmp eax, ebx
je 0x4191ef
cmp dword [ebp + 0xc], ebx
je 0x4191d4
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x18]
push ebx
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 0x18], ebx
push dword [ebp + 8]
call edi
test eax, eax
je 0x4191c3
lea eax, [ebp - 0x14]
push ebx
push eax
push esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x14], ebx
push dword [ebp - 0xc]
call edi
test eax, eax
je 0x4191c3
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
jne 0x4191cf
cmp eax, ebx
je 0x4191c8
cmp dword [ebp - 0x14], ebx
je 0x4191c8
push eax
push dword [ebp - 0x1c]
push dword [ebp - 8]
call fcn.0041b730
add esp, 0xc
test eax, eax
jne 0x4191cf
mov eax, dword [ebp - 0x18]
sub dword [ebp + 0xc], eax
jne 0x41916b
jmp 0x4191d4
mov dword [ebp - 4], ebx
jmp 0x4191cf
mov dword [ebp - 0x10], 1
cmp dword [ebp + 0xc], ebx
jne 0x4191db
mov dword [ebp - 0x10], 1
push dword [ebp - 8]
call fcn.0042f033
push dword [ebp - 0x1c]
call fcn.0042f033
pop ecx
pop ecx
jmp 0x4191f2
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x419202
push dword [ebp + 8]
call esi
cmp dword [ebp - 0xc], ebx
je 0x41920c
push dword [ebp - 0xc]
call esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
jmp 0x419105
Function at 0x41921c
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
push dword [ebp + 0xc]
xor esi, esi
lea eax, [ebx + 0x5c]
push dword [ebp + 8]
mov dword [ebp - 4], eax
push str.____Creating_text_file__s_with__d_lines
push esi
push 1
push esi
push eax
call fcn.00403689
add esp, 0x1c
push esi
push 0x80
push 2
push esi
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x41930e
push esi
call fcn.0041b80b
push eax
call fcn.0041b7dc
pop ecx
xor edi, edi
cmp dword [ebp + 0xc], esi
pop ecx
mov dword [ebp + 8], esi
jle 0x4192be
push dword [ebp + 0x10]
inc edi
mov ecx, ebx
mov dword [ebp - 0xc], esi
push edi
call fcn.00419315
push eax
mov dword [ebp - 0x10], eax
call fcn.0041a460
pop ecx
lea ecx, [ebp - 0xc]
push esi
push ecx
push eax
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4192d9
mov eax, dword [ebp - 0xc]
add dword [ebp + 8], eax
cmp edi, dword [ebp + 0xc]
jl 0x419284
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [ebp + 8]
jne 0x4192f0
push str.____File_size_matches_size_written___file_write_OK
push esi
push 1
push 3
jmp 0x4192fa
push str.____ERROR:_file_write_failed
push esi
push 1
push 0xa
push dword [ebp - 4]
call fcn.00403689
add esp, 0x14
jmp 0x41930e
push str.____File_size_does_not_match_size_written___file_write_failed
push esi
push 1
push 0xa
push dword [ebp - 4]
call fcn.00403689
add esp, 0x14
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x41b554
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41b574
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041c578
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x41b597
test byte [esp + 8], 2
je 0x41b597
call fcn.0041c5eb
mov dword [eax], 0xd
call fcn.0041c5f4
mov dword [eax], 5
jmp 0x41b570
xor eax, eax
ret