joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408cd0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.0040d33c
push eax
push 0xe
push 1
push str.Error_reading
call fcn.0040d5d1
mov edi, dword [esp + 0x43c]
add esp, 0x14
movzx ecx, word [edi + 2]
mov eax, ecx
cmp cx, 0x20
jle 0x408d36
movsx eax, cx
push 0x493ad2
sub eax, 0x20
push eax
push 0x42ed80
call fcn.004015f0
movzx eax, word [edi + 2]
add esp, 0xc
test ax, ax
jle 0x408d4d
cmp ax, 0x20
jge 0x408d46
movsx esi, ax
jmp 0x408d4f
mov esi, 0x20
jmp 0x408d4f
xor esi, esi
push 1
call fcn.0040d33c
push eax
push esi
lea eax, [edi + 4]
push 1
push eax
call fcn.0040d5d1
push 1
call fcn.0040d33c
push eax
push 0x22
push 1
push str..lan_language_descriptor_file_set.
call fcn.0040d5d1
push 0x42eda8
call fcn.004015f0
add esp, 0x2c
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push 0x42ecd0
push eax
call sym.afont_font.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.afont_font.exe__string_append1_8
mov edi, dword [esp + 0x42c]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.afont_font.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.afont_font.exe__string_append_8
push 0x42ed20
lea eax, [esp + 0x24]
push eax
call sym.afont_font.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x408e05
cwde
push 0x493ad3
sub eax, 0x400
push eax
push 0x42edac
call fcn.004015f0
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x408e18
cmp ax, bx
jge 0x408e14
movsx esi, ax
jmp 0x408e1a
mov esi, ebx
jmp 0x408e1a
xor esi, esi
push 1
call fcn.0040d33c
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.0040d5d1
push 0x42edb0
call fcn.004015f0
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x408e6c
movsx eax, cx
push 0x493ad4
sub eax, 0x400
push eax
push 0x42edb4
call fcn.004015f0
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x408e7f
cmp ax, bx
jge 0x408e7b
movsx esi, ax
jmp 0x408e81
mov esi, ebx
jmp 0x408e81
xor esi, esi
push 1
call fcn.0040d33c
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.0040d5d1
push 0x42edb8
call fcn.004015f0
add esp, 0x18
call sym.afont_font.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 8
Function at 0x41c7f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x24]
push esi
call sym.afont_font.exe__sys_error_none_4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x10
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x20]
push dword [eax + 0x920]
call sub.WS2_32.dll_getsockname
test eax, eax
je 0x41c832
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x10
ret 0x10
push 4
lea eax, [esp + 0xc]
push eax
call sym.afont_font.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xa]
push eax
call sym.afont_font.exe__sys_order_flip_8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 8]
pop esi
mov dword [ecx], eax
mov ecx, dword [esp + 0x1c]
mov ax, word [esp + 2]
mov word [ecx], ax
add esp, 0x10
ret 0x10

Function at 0x41c8c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x24]
push edi
push esi
call sym.afont_font.exe__sys_error_none_4
call sym.afont_font.exe__sys_sys_netstart_0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x41c8f6
call sub.WS2_32.dll_WSAGetLastError
pop edi
mov dword [esi + 0xc], eax
pop esi
add esp, 0x10
ret 0x10
lea eax, [esp + 8]
push eax
call sym.afont_font.exe__file_inet_sockaddr_init_4
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov ax, word [esp + 0x20]
mov word [esp + 0xa], ax
lea eax, [esp + 0xc]
push 4
push eax
call sym.afont_font.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xe]
push eax
call sym.afont_font.exe__sys_order_flip_8
push dword [0x42f868]
lea eax, [esp + 0xc]
push eax
push edi
call sub.WS2_32.dll_connect
test eax, eax
jne 0x41c8e6
mov esi, dword [esp + 0x24]
push esi
call fcn.0041ce60
mov dword [esi + 0x920], edi
pop edi
pop esi
add esp, 0x10
ret 0x10
Function at 0x41cb90
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, dword [esp + 0x28]
push edi
call sym.afont_font.exe__sys_error_none_4
call sym.afont_font.exe__sys_sys_netstart_0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, dword [esp + 0x24]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x41cbcb
call sub.WS2_32.dll_WSAGetLastError
mov dword [edi + 0xc], eax
pop edi
pop esi
add esp, 0x10
ret 0x10
lea eax, [esp + 8]
push eax
call sym.afont_font.exe__file_inet_sockaddr_init_4
mov ax, word [esp + 0x20]
mov word [esp + 0xa], ax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push 4
push eax
call sym.afont_font.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xe]
push eax
call sym.afont_font.exe__sys_order_flip_8
push dword [0x42f864]
lea eax, [esp + 0xc]
push eax
push dword [esi + 4]
call sub.WS2_32.dll_bind
test eax, eax
jne 0x41cc62
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x10
push eax
lea eax, [esp + 0xc]
push eax
push dword [esi + 4]
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x41cc62
push 4
lea eax, [esp + 0x10]
push eax
call sym.afont_font.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xe]
push eax
call sym.afont_font.exe__sys_order_flip_8
mov ax, word [esp + 0xa]
push 8
push dword [esi + 4]
mov word [esi], ax
call sub.WS2_32.dll_listen
test eax, eax
je 0x41cc72
call sub.WS2_32.dll_WSAGetLastError
mov dword [edi + 0xc], eax
push dword [esi + 4]
call sub.WS2_32.dll_closesocket
pop edi
pop esi
add esp, 0x10
ret 0x10

Function at 0x41cc80
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 0x18]
push esi
call sym.afont_font.exe__sys_error_none_4
mov eax, dword [esp + 0xc]
push 0x10
push dword [eax + 0x918]
push 0
push dword [esp + 0x1c]
push dword [esp + 0x18]
push dword [eax + 0x920]
call sub.WS2_32.dll_sendto
mov ecx, eax
mov eax, dword [esp + 0x14]
test ecx, ecx
jns 0x41ccc8
mov dword [eax], 0
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 0xc], eax
pop esi
ret 0x14
mov dword [eax], ecx
cmp ecx, dword [esp + 0x10]
je 0x41ccda
push esi
push 0x1c
push 0xfffffffffffffffd
call sym.afont_font.exe__sys_stat_set_12
pop esi
ret 0x14
Function at 0x41cce0
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
call sym.afont_font.exe__sys_error_none_4
call sym.afont_font.exe__sys_sys_netstart_0
push 0
push 2
push 2
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x41cd10
call sub.WS2_32.dll_WSAGetLastError
pop edi
mov dword [esi + 0xc], eax
pop esi
ret 0x10
lea eax, [esp + 0x18]
push eax
push 0x10
call sym.afont_font.exe__sys_mem_alloc_8
mov eax, dword [esp + 0x18]
mov ecx, 2
push 4
mov word [eax], cx
mov ecx, dword [esp + 0x1c]
mov ax, word [esp + 0x14]
mov word [ecx + 2], ax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
add eax, 4
push eax
call sym.afont_font.exe__sys_order_flip_8
mov eax, dword [esp + 0x18]
push 2
add eax, 2
push eax
call sym.afont_font.exe__sys_order_flip_8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x920], edi
pop edi
mov word [ecx], 0xa03
mov byte [ecx + 2], 0
mov dword [ecx + 4], 0x400
mov dword [ecx + 0x408], 0x100
mov dword [ecx + 0x50c], 0x400
mov dword [ecx + 0x910], 0
mov dword [ecx + 0x914], 0xfffffffe
mov dword [ecx + 0x918], eax
mov dword [ecx + 0x91c], 0x41c890
pop esi
ret 0x10
Function at 0x41cee0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x30]
push edi
push esi
call sym.afont_font.exe__sys_error_none_4
mov edi, dword [esp + 0x30]
test edi, edi
je 0x41d081
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [ebx + 0x918]
test ebp, ebp
jne 0x41cf33
push 1
call fcn.0040d33c
push eax
push 0x36
push 1
push str.INTERNAL_ERROR:_Data_pointer_NIL_in_FILE_READ_INETSTR.
call fcn.0040d5d1
push 0x42f8e4
call fcn.004015f0
add esp, 0x18
call sym.afont_font.exe__sys_bomb_0
push 0x494564
push 0
push 1
push dword [0x494560]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call sub.KERNEL32.dll_CreateEventA
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x40]
push eax
push edi
push dword [esp + 0x3c]
push dword [ebx + 0x920]
call sub.KERNEL32.dll_WriteFile
test al, al
jne 0x41d048
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3e5
jne 0x41d015
movss xmm0, dword [ebp + 4]
or eax, 0xffffffff
comiss xmm0, dword [0x427598]
jbe 0x41cfdf
movsd xmm1, qword [0x422220]
sub esp, 8
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x4275a0]
maxsd xmm1, xmm0
addsd xmm1, qword [0x4273f0]
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp qword [esp]
call fcn.00420f40
fstp qword [esp + 0x18]
cvttsd2si eax, qword [esp + 0x18]
add esp, 8
push eax
push dword [esp + 0x2c]
call sub.KERNEL32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x41d02b
cmp eax, 0xffffffff
je 0x41d010
push 1
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x20]
push eax
push dword [ebx + 0x920]
call sub.KERNEL32.dll_GetOverlappedResult
test al, al
jne 0x41d048
call sub.KERNEL32.dll_GetLastError
push dword [esp + 0x28]
mov dword [esi + 0xc], eax
call fcn.0040a874
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x1c
ret 0x10
push esi
push 0x20
push 0xfffffffffffffffd
call sym.afont_font.exe__sys_stat_set_12
push dword [esp + 0x28]
call fcn.0040a874
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x1c
ret 0x10
cmp dword [esp + 0x3c], edi
je 0x41d076
push esi
push 9
push 0xfffffffffffffffd
call sym.afont_font.exe__sys_stat_set_12
push esi
lea eax, [ebx + 0x50c]
push eax
call sym.afont_font.exe__sys_stat_parm_vstr_8
push esi
push edi
call sym.afont_font.exe__sys_stat_parm_int_8
push esi
push dword [esp + 0x40]
call sym.afont_font.exe__sys_stat_parm_int_8
push dword [esp + 0x28]
call fcn.0040a874
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x1c
ret 0x10
Function at 0x41d0f0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x400
push ebx
mov ebx, dword [esp + 0x40c]
push esi
mov esi, dword [esp + 0x414]
push edi
mov edi, dword [esp + 0x410]
push esi
push ebx
push edi
call sym.afont_font.exe__string_t_inetadr_12
push esi
call sym.afont_font.exe__sys_error_4
test al, al
je 0x41d18c
push ebp
push esi
call sym.afont_font.exe__sys_error_none_4
call sym.afont_font.exe__sys_sys_netstart_0
movsx ebp, word [edi + 2]
cmp dword [0x42f860], ebp
cmovl ebp, dword [0x42f860]
cmp ebp, 1
jl 0x41d154
lea eax, [edi + 4]
push ebp
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0040a960
add esp, 0xc
mov al, byte [0x494554]
mov byte [esp + ebp + 0x10], al
lea eax, [esp + 0x10]
push eax
call sub.WS2_32.dll_gethostbyname
pop ebp
test eax, eax
jne 0x41d198
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 0xc], eax
cmp eax, 0x2af9
jne 0x41d18c
push esi
push 0xf
push 0xfffffffffffffffd
call sym.afont_font.exe__sys_stat_set_12
push esi
push edi
call sym.afont_font.exe__sys_stat_parm_vstr_8
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0xc
mov eax, dword [eax + 0xc]
test eax, eax
je 0x41d17b
mov eax, dword [eax]
test eax, eax
je 0x41d17b
mov eax, dword [eax]
push 4
push ebx
mov dword [ebx], eax
call sym.afont_font.exe__sys_order_flip_8
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0xc

Function at 0x41d520
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2008
call fcn.00409f50
push esi
mov esi, dword [esp + 0x2018]
mov eax, 0x2000
push edi
push esi
mov word [esp + 0x10], ax
call sym.afont_font.exe__sys_error_none_4
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x2018]
call sym.afont_font.exe__string_copy_8
movzx eax, word [0x42f914]
push eax
push 0x42f910
lea eax, [esp + 0x14]
push eax
call sym.afont_font.exe__string_appendn_12
lea eax, [esp + 0xc]
push eax
call sym.afont_font.exe__string_terminate_null_4
push dword [0x494578]
lea eax, [esp + 0x14]
push 0x8000080
push 3
push dword [0x494574]
push 1
push connect
push eax
call sub.KERNEL32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x41d5b3
call sub.KERNEL32.dll_GetLastError
pop edi
mov dword [esi + 0xc], eax
pop esi
add esp, 0x2008
ret 0xc
push dword [0x49457c]
movsx eax, word [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push eax
lea eax, [esp + 0x1c]
push eax
push edi
call sub.KERNEL32.dll_ReadFile
test al, al
jne 0x41d5ec
call sub.KERNEL32.dll_GetLastError
push edi
mov dword [esi + 0xc], eax
call fcn.0040a874
pop edi
pop esi
add esp, 0x2008
ret 0xc
movsx edx, word [esp + 0xc]
mov ecx, dword [esp + 8]
cmp edx, ecx
movzx eax, word [esp + 0xc]
movzx esi, cx
cmovb esi, eax
push edi
mov word [esp + 0x12], si
call fcn.0040a874
mov edx, dword [esp + 0x2018]
mov cx, word [esp + 0xe]
movzx eax, word [edx]
cmp ax, cx
cwde
jl 0x41d625
movsx eax, cx
movzx eax, ax
mov ecx, 1
movsx esi, ax
mov word [edx + 2], ax
cmp esi, ecx
jl 0x41d65f
mov al, byte [esp + ecx + 0xf]
cmp al, 0x1f
jbe 0x41d658
cmp al, 0x7f
je 0x41d658
mov byte [ecx + edx + 3], al
inc ecx
cmp ecx, esi
jle 0x41d638
pop edi
pop esi
add esp, 0x2008
ret 0xc
lea eax, [ecx - 1]
mov word [edx + 2], ax
pop edi
pop esi
add esp, 0x2008
ret 0xc
Function at 0x41d670
Capabilities:
Clear file content
Delete file
Write file on windows

Disassembly:
mov eax, 0x2510
call fcn.00409f50
mov eax, 0x400
mov word [esp + 0x108], ax
mov eax, 0x100
push esi
push edi
mov edi, dword [esp + 0x2528]
mov word [esp + 0xc], ax
mov eax, 0x2000
push edi
mov word [esp + 0x518], ax
call sym.afont_font.exe__sys_error_none_4
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x114]
push eax
push dword [esp + 0x2524]
call sym.afont_font.exe__string_pathname_split_12
lea eax, [esp + 0x110]
push eax
push eax
call sym.afont_font.exe__string_treename_8
lea eax, [esp + 0x514]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x118]
push eax
call sym.afont_font.exe__string_pathname_join_12
test byte [esp + 0x2524], 1
mov esi, 1
je 0x41d736
lea eax, [esp + 0x514]
mov esi, 2
push eax
call sym.afont_font.exe__string_terminate_null_4
lea eax, [esp + 0x518]
push eax
call sub.KERNEL32.dll_DeleteFileA
test al, al
jne 0x41d736
call sub.KERNEL32.dll_GetLastError
push edi
mov dword [edi + 0xc], eax
call sym.afont_font.exe__file_not_found_4
test al, al
je 0x41d7cb
movzx eax, word [0x42f904]
push eax
push 0x42f900
lea eax, [esp + 0x51c]
push eax
call sym.afont_font.exe__string_appendn_12
lea eax, [esp + 0x514]
push eax
call sym.afont_font.exe__string_terminate_null_4
push dword [0x49456c]
lea eax, [esp + 0x51c]
push 0x8000080
push esi
push dword [0x494568]
push 1
push 0x40000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x41d7c3
push dword [0x494570]
mov eax, dword [esp + 0x2524]
lea edx, [esp + 0xc]
push edx
movsx ecx, word [eax + 2]
add eax, 4
push ecx
push eax
push esi
call sub.KERNEL32.dll_WriteFile
test al, al
je 0x41d7d6
push esi
call sub.KERNEL32.dll_SetEndOfFile
test al, al
je 0x41d7d6
push esi
call fcn.0040a874
test al, al
jne 0x41d7cb
call sub.KERNEL32.dll_GetLastError
mov dword [edi + 0xc], eax
pop edi
pop esi
add esp, 0x2510
ret 0x10
call sub.KERNEL32.dll_GetLastError
push esi
mov dword [edi + 0xc], eax
call fcn.0040a874
lea eax, [esp + 0x518]
push eax
call sub.KERNEL32.dll_DeleteFileA
pop edi
pop esi
add esp, 0x2510
ret 0x10

Function at 0x41d800
Capabilities:
Delete file

Disassembly:
mov eax, 0x250c
call fcn.00409f50
mov eax, 0x400
mov word [esp + 0x104], ax
mov eax, 0x100
push esi
mov esi, dword [esp + 0x2518]
mov word [esp + 4], ax
mov eax, 0x2000
push esi
mov word [esp + 0x510], ax
call sym.afont_font.exe__sys_error_none_4
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x10c]
push eax
push dword [esp + 0x251c]
call sym.afont_font.exe__string_pathname_split_12
lea eax, [esp + 0x108]
push eax
push eax
call sym.afont_font.exe__string_treename_8
lea eax, [esp + 0x50c]
push eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x110]
push eax
call sym.afont_font.exe__string_pathname_join_12
movzx eax, word [0x42f90c]
push eax
push 0x42f908
lea eax, [esp + 0x514]
push eax
call sym.afont_font.exe__string_appendn_12
lea eax, [esp + 0x50c]
push eax
call sym.afont_font.exe__string_terminate_null_4
lea eax, [esp + 0x510]
push eax
call sub.KERNEL32.dll_DeleteFileA
test al, al
jne 0x41d8bd
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x250c
ret 8
Function at 0x41d8d0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x208c
call fcn.00409f50
push esi
push edi
mov eax, 0x2000
mov edi, 0x84
mov word [esp + 0x90], ax
lea eax, [esp + 8]
push str.Syntax_error_occurred_on_line
push eax
mov dword [esp + 0x10], edi
call sym.afont_font.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.afont_font.exe__string_append1_8
mov esi, dword [esp + 0x2098]
mov eax, dword [esi]
push dword [eax + 0x970]
lea eax, [esp + 0x94]
push eax
call sym.afont_font.exe__string_f_int_8
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0xc]
push eax
call sym.afont_font.exe__string_append_8
push 0x42fb28
lea eax, [esp + 0xc]
push eax
call sym.afont_font.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.afont_font.exe__string_append1_8
mov eax, dword [esi]
add eax, 0x568
push eax
lea eax, [esp + 0xc]
push eax
call sym.afont_font.exe__string_append_8
mov ax, word [esp + 0xa]
cmp ax, di
jle 0x41d98d
cwde
push 0x4945d6
sub eax, edi
push eax
push 0x42fad4
call fcn.004015f0
mov ax, word [esp + 0x16]
add esp, 0xc
test ax, ax
jle 0x41d9a0
cmp ax, di
jge 0x41d99c
movsx esi, ax
jmp 0x41d9a2
mov esi, edi
jmp 0x41d9a2
xor esi, esi
push 1
call fcn.0040d33c
push eax
push esi
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0040d5d1
push 0x42fb78
call fcn.004015f0
add esp, 0x18
call sym.afont_font.exe__sys_bomb_0
pop edi
pop esi
add esp, 0x208c
ret 4
Function at 0x41e290
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x428
push ebx
push esi
push edi
mov eax, 0x20
mov ebx, 0x400
mov word [esp + 0xc], ax
lea eax, [esp + 0x30]
push str.Error_on_line
push eax
mov dword [esp + 0x38], ebx
call sym.afont_font.exe__string_appends_8
push 0x20
lea eax, [esp + 0x34]
push eax
call sym.afont_font.exe__string_append1_8
mov edi, dword [esp + 0x438]
mov eax, dword [edi]
push dword [eax + 0x970]
lea eax, [esp + 0x10]
push eax
call sym.afont_font.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x34]
push eax
call sym.afont_font.exe__string_append_8
push str._of_file
lea eax, [esp + 0x34]
push eax
call sym.afont_font.exe__string_appends_8
mov ax, word [esp + 0x32]
cmp ax, bx
jle 0x41e323
cwde
push 0x4945df
sub eax, ebx
push eax
push 0x42fd64
call fcn.004015f0
mov ax, word [esp + 0x3e]
add esp, 0xc
test ax, ax
jle 0x41e336
cmp ax, bx
jge 0x41e332
movsx esi, ax
jmp 0x41e338
mov esi, ebx
jmp 0x41e338
xor esi, esi
push 1
call fcn.0040d33c
push eax
push esi
lea eax, [esp + 0x40]
push 1
push eax
call fcn.0040d5d1
push 0x42fe08
call fcn.004015f0
mov eax, dword [edi]
add esp, 0x18
movzx ecx, word [eax + 0x56a]
cmp cx, bx
jle 0x41e385
movsx eax, cx
push 0x4945e0
sub eax, 0x400
push eax
push 0x42fe0c
call fcn.004015f0
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 0x56a]
test ax, ax
jle 0x41e39f
cmp ax, bx
jge 0x41e39b
movsx esi, ax
jmp 0x41e3a1
mov esi, ebx
jmp 0x41e3a1
xor esi, esi
push 1
call fcn.0040d33c
push eax
mov eax, dword [edi]
push esi
add eax, 0x56c
push 1
push eax
call fcn.0040d5d1
push 0x42fe10
call fcn.004015f0
add esp, 0x18
pop edi
pop esi
pop ebx
add esp, 0x428
ret 4

Function at 0x41e3e0
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.0041e290
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
movzx ecx, word [eax + 2]
cmp cx, 0x50
jle 0x41e416
movsx eax, cx
push 0x4945db
sub eax, 0x50
push eax
push 0x42fd50
call fcn.004015f0
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 2]
test ax, ax
jle 0x41e431
cmp ax, 0x50
jge 0x41e42a
movsx esi, ax
jmp 0x41e433
mov esi, 0x50
jmp 0x41e433
xor esi, esi
push 1
call fcn.0040d33c
push eax
mov eax, dword [edi]
push esi
add eax, 4
push 1
push eax
call fcn.0040d5d1
push 0x42fd54
call fcn.004015f0
mov eax, dword [esp + 0x2c]
add esp, 0x18
movsx eax, word [eax]
pop edi
pop esi
cmp eax, 2
jle 0x41e47a
push 0x4945de
add eax, 0xfffffffe
push eax
push 0x42fd58
call fcn.004015f0
add esp, 0xc
push 0x20
push 0x42fd5c
call fcn.004015f0
push 0x5e
push 0x42fd60
call fcn.004015f0
add esp, 0x10
ret 0xc
Function at 0x41e540
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x3c]
mov dword [esp + 0xc], 0x20
mov ax, word [edi]
mov word [ebx], ax
movzx eax, word [edi]
cmp ax, word [esi + 2]
jg 0x41e59b
nop dword [eax]
cwde
mov cl, byte [eax + esi + 3]
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x41e59b
push ecx
lea eax, [esp + 0x10]
push eax
call sym.afont_font.exe__string_append1_8
mov ax, word [edi]
inc ax
movzx ecx, ax
mov word [edi], ax
mov eax, ecx
cmp cx, word [esi + 2]
jle 0x41e570
mov esi, dword [esp + 0x44]
lea eax, [esp + 0xc]
push esi
push dword [esp + 0x44]
push eax
call sym.afont_font.exe__string_t_int_12
push esi
call sym.afont_font.exe__sys_error_4
test al, al
je 0x41e675
cmp byte [esp + 0x34], 0
je 0x41e66f
push 1
call fcn.0040d33c
push eax
push 0xd
push 1
push str.Bad_integer__
call fcn.0040d5d1
mov ax, word [esp + 0x22]
add esp, 0x14
cmp ax, 0x20
jle 0x41e607
cwde
push 0x4945da
sub eax, 0x20
push eax
push 0x42fd44
call fcn.004015f0
mov ax, word [esp + 0x1a]
add esp, 0xc
test ax, ax
jle 0x41e61e
cmp ax, 0x20
jge 0x41e617
movsx esi, ax
jmp 0x41e620
mov esi, 0x20
jmp 0x41e620
xor esi, esi
push 1
call fcn.0040d33c
push eax
push esi
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0040d5d1
push 1
call fcn.0040d33c
push eax
push 2
push 1
push 0x42fd48
call fcn.0040d5d1
push 0x42fd4c
call fcn.004015f0
add esp, 0x2c
push ebx
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.0041e3e0
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
mov ax, word [ebx]
mov word [edi], ax
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
Function at 0x41f480
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x918]
cmp byte [eax], 0
jne 0x41f49b
add eax, 8
mov dword [esp + 4], eax
jmp sym.afont_font.exe__file_close_4
ret 4
Function at 0xb6a370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xb6a38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xb93074
push ecx
mov edi, eax
call fcn.00b7e198
mov esi, eax
add esp, 8
test esi, esi
jne 0xb6a3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00b7e02e
push esi
call fcn.00b7dfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret