joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417280
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x7287f4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.004288a0
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
push fcn.0040a880
push 0x40b080
push 3
push 4
lea edi, [esi + 0xd0]
push edi
mov byte [esp + 0x30], 0xd
call fcn.007276b0
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf8], ebx
mov dword [esi + 0xfc], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebx
push ebx
mov byte [esp + 0x20], 0x12
mov dword [esi], 0x74665c
call dword [sym.imp.ole32.dll_CoInitialize]
push str.Begin_loading_of_archive_header_and_invalidation_of_archived_files
call fcn.00477fa0
add esp, 4
call fcn.0047a600
push str.Finished_with_header_loading_and_invalidation
call fcn.00477fa0
mov ecx, dword [esi + 0xc4]
add esp, 4
cmp ecx, ebx
je 0x417393
dec dword [ecx + 4]
jne 0x41738d
cmp ecx, ebx
je 0x41738d
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0xc4], ebx
mov ecx, dword [esi + 0xc8]
cmp ecx, ebx
je 0x4173b2
dec dword [ecx + 4]
jne 0x4173ac
cmp ecx, ebx
je 0x4173ac
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0x108], ebx
mov byte [esi + 0x10c], bl
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
push 0x374
mov dword [edi + 8], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, ebx
mov byte [esp + 0x1c], 0x13
je 0x4173fd
mov ecx, eax
call fcn.0040dac0
jmp 0x4173ff
xor eax, eax
push str..Morrowind.ini
push 0xf0
push str.Max_FPS
push str.General
mov byte [esp + 0x2c], 0x12
mov dword [0x7c67dc], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
mov eax, dword [0x7c67dc]
mov dword [eax + 0xc], 0x40a00000
fstp dword [eax + 0x10]
push 0x14
mov dword [0x7c952c], 0x776e9c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, ebx
mov byte [esp + 0x1c], 0x14
je 0x417464
mov ecx, eax
call fcn.0047e1e0
jmp 0x417466
xor eax, eax
push ebx
mov dword [esi + 0x98], eax
mov dword [esi + 0x94], ebx
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
mov ecx, dword [esp + 0x1c]
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x41da30
Capabilities:
Access peb ldr_data
Get ntdll base address
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x728d8f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov byte [esi], al
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
push str..Morrowind.ini
push ebx
push str.DisableFOW
push str.General
mov byte [esp + 0x2c], 5
mov word [esi + 0x10], bx
mov word [esi + 0x12], bx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x41daab
mov byte [0x77773c], bl
mov ecx, 0x7cb478
call fcn.004d51b0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str..Morrowind.ini
push 0x104
mov edi, eax
push edi
push 0x777770
push str.Map_Alpha
push str.Water
call ebx
push edi
call dword [sym.imp.MSVCRT.dll_atof]
fstp dword [0x777740]
add esp, 4
push str..Morrowind.ini
push 0x104
push edi
push 0x777760
push str.World_Alpha
push str.Water
call ebx
push edi
call dword [sym.imp.MSVCRT.dll_atof]
fstp dword [0x777744]
mov ecx, dword [esp + 0x18]
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x420400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
mov ax, word [0x7d45f2]
push eax
call fcn.00595370
add esp, 4
test eax, eax
je 0x42041a
jmp fcn.005e99c0
ret

Function at 0x420db0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xc
mov eax, dword [0x7c67e0]
push ebx
push ebp
push esi
mov esi, dword [eax + 0xac]
test esi, esi
mov ebp, ecx
push edi
mov dword [esp + 0x18], ebp
jne 0x420e08
mov edi, 4
mov ebx, 3
mov ecx, dword [0x7c67e0]
mov edx, dword [edi + ecx]
mov esi, dword [edx + 4]
test esi, esi
jne 0x420df3
push str.MapTextureManager_:_RepairMapRender_:_entry_in_tes_grid_does_not_have_a_cell
call fcn.00477400
add esp, 4
push esi
mov ecx, ebp
call fcn.00420fb0
add edi, 4
dec ebx
jne 0x420dd6
cmp edi, 0x28
jl 0x420dd1
jmp 0x420e10
push esi
mov ecx, ebp
call fcn.00420fb0
test byte [esi + 0x18], 2
je 0x420f9e
mov eax, dword [0x7c67e0]
mov ecx, dword [eax + 0xb4ec]
mov ebx, dword [ecx + 0xb4]
push 2
lea edx, [esp + 0x14]
push edx
mov ecx, ebx
call fcn.006ead20
mov esi, dword [eax]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x420e5e
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x420e5e
test ecx, ecx
je 0x420e5e
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x7c67e0]
mov al, byte [ecx + 0xb4dd]
test al, al
je 0x420f75
push str..Morrowind.ini
push 0
push str.Create_Maps_Enable
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 2
jne 0x420f75
mov eax, dword [ebx + 0x9c]
xor ebp, ebp
test eax, eax
jbe 0x420f68
cmp eax, ebp
jbe 0x420f59
mov edx, dword [ebx + 0x94]
mov esi, dword [edx + ebp*4]
test esi, esi
je 0x420f59
mov eax, dword [0x7c6f58]
test eax, eax
jne 0x420f28
push 4
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.006ead20
mov edi, dword [eax]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x420ef5
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
test edx, edx
mov dword [eax], edx
jne 0x420ef5
test ecx, ecx
je 0x420ef5
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [0x7c6f58]
cmp eax, edi
je 0x420f28
test eax, eax
je 0x420f1b
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
test edx, edx
mov dword [eax], edx
jne 0x420f1b
test ecx, ecx
je 0x420f1b
mov eax, dword [ecx]
push 1
call dword [eax]
test edi, edi
mov dword [0x7c6f58], edi
je 0x420f28
inc dword [edi + 4]
push 4
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.006eae20
mov eax, dword [esp + 0x14]
test eax, eax
je 0x420f59
mov esi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec esi
mov edx, esi
test edx, edx
mov dword [eax], esi
jne 0x420f59
test ecx, ecx
je 0x420f59
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [ebx + 0x9c]
inc ebp
cmp eax, ebp
ja 0x420eaa
mov ecx, ebx
call fcn.006eb0e0
mov ebp, dword [esp + 0x18]
jmp 0x420f82
fld dword [0x777740]
or byte [esi + 0x14], 1
fstp dword [esi + 0x50]
mov ecx, dword [ebp + 0x2c]
mov eax, dword [ecx]
push 1
push ebx
call dword [eax + 0x94]
mov ecx, dword [ebp + 0x2c]
push 1
push 0
push 0
call fcn.006eb000
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x427800
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 0
push 0x8000080
push 3
push 0
push 1
push DirectSoundCreate
push ebx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x42783f
push ebx
push str.Invalid_File_Handle:__s
call fcn.00477400
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
ret 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [esi + 0xc], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esi + 0xc]
add esp, 4
push 0
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
push edi
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x427876
pop edi
pop esi
xor al, al
pop ebx
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0xc]
lea edx, [ecx - 1]
xor eax, eax
test edx, edx
mov dword [esi], 0
jbe 0x4278a7
mov ecx, dword [esi + 8]
mov bl, 0xfb
cmp byte [ecx + eax], 0xff
jne 0x4278a2
cmp byte [ecx + eax + 1], bl
jne 0x4278a2
inc dword [esi]
inc eax
cmp eax, edx
jb 0x427894
pop edi
mov dword [esi + 0x10], 0
pop esi
mov al, 1
pop ebx
ret 4
Function at 0x430cf0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x7cb478
call fcn.004d51b0
mov edi, dword [esp + 0x60]
test edi, edi
mov ebx, eax
mov eax, dword [esi + 0x30]
mov esi, dword [eax + 0x34]
je 0x430ede
mov ecx, edi
call fcn.004e22f0
test al, al
jne 0x430ede
mov ecx, dword [0x7c67e0]
mov al, byte [ecx + 0xb4dd]
test al, al
je 0x430ede
push str..Morrowind.ini
push 0
push str.Create_Maps_Enable
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 2
jne 0x430ede
mov ecx, edi
call fcn.004db9f0
push eax
mov ecx, edi
call fcn.004db9d0
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x20]
push eax
push str.Maps_s___d__d_.bmp
push ebx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0x180
push 0x8301
push ebx
call dword [sym.imp.MSVCRT.dll__open]
add esp, 0xc
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
je 0x430ede
mov eax, dword [esi + 0x30]
mov edi, dword [eax]
mov edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x40]
mov ebx, dword [edx]
mov eax, edi
imul eax, edi
push ebp
mov ebp, dword [esi + 0x2c]
lea eax, [eax + eax*2]
push eax
mov dword [esp + 0x68], ecx
add ebx, ebp
call dword [sym.imp.MSVCRT.dll_malloc]
lea ebp, [edi - 1]
xor edx, edx
add esp, 4
xor ecx, ecx
cmp ebp, edx
mov esi, eax
jl 0x430e55
mov edx, dword [esp + 0x64]
mov eax, ebp
imul eax, edx
imul edx, edi
imul eax, edi
neg edx
inc ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], ebp
test edi, edi
jbe 0x430e42
lea edx, [ebx + 1]
mov ebp, ebx
sub ebp, edx
add ebp, 2
mov dword [esp + 0x1c], ebp
mov ebp, ebx
add eax, edx
sub ebp, edx
mov dword [esp + 0x10], edi
mov edx, dword [esp + 0x1c]
mov dl, byte [edx + eax]
mov byte [esi + ecx], dl
mov dl, byte [eax]
mov byte [esi + ecx + 1], dl
mov dl, byte [eax + ebp]
mov byte [esi + ecx + 2], dl
add eax, dword [esp + 0x64]
mov edx, dword [esp + 0x10]
add ecx, 3
dec edx
mov dword [esp + 0x10], edx
jne 0x430e11
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
add eax, edx
dec ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebp
jne 0x430df5
xor edx, edx
mov ebp, dword [sym.imp.MSVCRT.dll__write]
mov eax, edi
imul eax, edi
lea ebx, [eax + eax*2]
push 0x36
lea ecx, [esp + 0x2c]
mov dword [esp + 0x3e], edi
mov dword [esp + 0x42], edi
mov edi, dword [esp + 0x28]
push ecx
lea eax, [ebx + 0x36]
push edi
mov word [esp + 0x34], 0x4d42
mov dword [esp + 0x36], eax
mov word [esp + 0x3a], dx
mov word [esp + 0x3c], dx
mov dword [esp + 0x3e], 0x36
mov dword [esp + 0x42], 0x28
mov word [esp + 0x4e], 1
mov word [esp + 0x50], 0x18
mov dword [esp + 0x52], edx
mov dword [esp + 0x56], ebx
mov dword [esp + 0x5a], edx
mov dword [esp + 0x5e], edx
mov dword [esp + 0x62], edx
mov dword [esp + 0x66], edx
call ebp
push ebx
push esi
push edi
call ebp
push edi
call dword [sym.imp.MSVCRT.dll__close]
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x50
ret 4
Function at 0x432f10
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x72980a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x746a08
mov eax, dword [esi + 8]
test eax, eax
lea edi, [esi + 8]
mov dword [esp + 0x11c], 2
je 0x432fc2
mov ebp, dword [eax + 0xa0]
push ecx
mov ecx, esp
mov dword [ecx], eax
mov ecx, dword [eax + 4]
inc ecx
mov dword [esp + 0x10], esp
mov dword [eax + 4], ecx
call fcn.004334c0
mov ecx, dword [edi]
mov eax, dword [ecx + 0xa0]
add esp, 4
test eax, eax
je 0x432f9f
push eax
push ebp
call fcn.006ea1b0
push eax
lea eax, [esp + 0x20]
push str._s_Error:_Not_all_objects_removed._Before:__d_After:__d_n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x432fb2
call fcn.00404630
mov dword [esi + 0xc], 0
push 0
mov ecx, edi
call fcn.00471b00
mov dword [esi + 4], 0
lea ecx, [esi + 0x10]
mov byte [esp + 0x11c], 1
call fcn.00404570
mov ecx, dword [esi + 0xc]
test ecx, ecx
mov byte [esp + 0x11c], 0
je 0x432ff0
dec dword [ecx + 4]
jne 0x432ff0
test ecx, ecx
je 0x432ff0
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [edi]
test ecx, ecx
mov dword [esp + 0x11c], 0xffffffff
je 0x433010
dec dword [ecx + 4]
jne 0x433010
test ecx, ecx
je 0x433010
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x114]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x114
ret
Function at 0x4587e0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x72a928
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
call fcn.004596c0
mov ecx, dword [0x7c67dc]
lea eax, [esp + 4]
push eax
add ecx, 0x108
call fcn.00430f70
mov eax, dword [eax]
push 7
mov ecx, eax
mov dword [esp + 0x14], 0
call fcn.006cc780
mov eax, dword [esp + 4]
test eax, eax
mov dword [esp + 0x10], 0xffffffff
je 0x458850
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
test edx, edx
mov dword [eax], edx
jne 0x458850
test ecx, ecx
je 0x458850
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esi + 4]
test ecx, ecx
mov byte [esi + 0x28], 0
je 0x458879
mov edx, dword [esp + 0x30]
mov eax, dword [ecx]
push edx
mov edx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push edx
call dword [eax + 0xc]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4588f5
call fcn.006b6e20
cmp eax, 2
je 0x458897
mov ecx, dword [esi + 4]
call fcn.006b6e20
cmp eax, 3
jne 0x4588f5
mov al, byte [esp + 0x28]
mov byte [esi + 0x28], al
mov al, byte [esp + 0x24]
test al, al
mov dword [esi], 1
je 0x4588fb
mov al, byte [esi + 8]
test al, al
jne 0x4588fb
lea ecx, [esp + 0x28]
push ecx
push 0
mov byte [esi + 8], 1
mov esi, dword [esi + 4]
push esi
push 0x4244a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
mov dword [esi], 0
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x467850
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
mov ecx, 0x7cb478
call fcn.004d51b0
push str..Morrowind.ini
push 0x200
mov esi, eax
push esi
push 0x7c6180
push str.Language
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4678dc
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
push str.French
push esi
call edi
add esp, 8
test eax, eax
jne 0x4678a4
mov eax, 1
pop edi
mov dword [0x7c8420], eax
pop esi
ret
push str.German
push esi
call edi
add esp, 8
test eax, eax
jne 0x4678c0
mov eax, 2
pop edi
mov dword [0x7c8420], eax
pop esi
ret
push str.Russian
push esi
call edi
add esp, 8
test eax, eax
jne 0x4678dc
mov eax, 3
pop edi
mov dword [0x7c8420], eax
pop esi
ret
mov eax, dword [0x7c8420]
pop edi
pop esi
ret
Function at 0x46c710
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
mov ecx, 0x7cb478
call fcn.004d51b0
push str..Morrowind.ini
push 0x104
mov esi, eax
push esi
push str.1.0f
push str.PC_Footstep_Volume
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
call dword [sym.imp.MSVCRT.dll_atof]
fstp dword [0x788a20]
mov eax, dword [0x7c67e0]
mov ecx, dword [eax]
add esp, 4
push 0
push 0
call fcn.004c7e60
mov ecx, dword [0x7c67e0]
push 1
mov dword [0x7c86d8], eax
mov ecx, dword [ecx]
push 0
call fcn.004c7e60
mov dword [0x7c86dc], eax
mov eax, dword [0x7c86d8]
test eax, eax
jne 0x46c78f
push str.Need_to_add_a_generic_sound_for_the_default_left_foot._r_n
call fcn.00477400
add esp, 4
mov eax, dword [0x7c86dc]
test eax, eax
jne 0x46c7a5
push str.Need_to_add_a_generic_sound_for_the_default_right_foot._r_n
call fcn.00477400
add esp, 4
xor esi, esi
mov edx, dword [esi + 0x7889f8]
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x46c7e6
mov eax, dword [0x7c67e0]
mov ecx, dword [eax]
push edx
call fcn.004ba7a0
test eax, eax
mov dword [esi + 0x7c86e0], eax
jne 0x46c7e6
mov ecx, dword [esi + 0x7889f8]
push ecx
push str.Need_to_add_a_foot_sound_called___s_._r_n
call fcn.00477400
add esp, 8
add esi, 4
cmp esi, 0x28
jl 0x46c7a7
mov edx, dword [0x7c67e0]
mov ecx, dword [edx]
push 4
push 0
call fcn.004c7e60
mov dword [0x7c86c8], eax
mov eax, dword [0x7c67e0]
mov ecx, dword [eax]
push 5
push 0
call fcn.004c7e60
mov ecx, dword [0x7c67e0]
push 6
mov dword [0x7c873c], eax
mov ecx, dword [ecx]
push 0
call fcn.004c7e60
mov edx, dword [0x7c67e0]
push 7
mov dword [0x7c85f8], eax
mov ecx, dword [edx]
push 0
call fcn.004c7e60
pop edi
mov dword [0x7c8668], eax
pop esi
ret
Function at 0x4745c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x72aeb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004ee8d0
lea ecx, [esi + 0x3c]
mov dword [esp + 0x14], 0
call fcn.004ac610
xor eax, eax
mov dword [esi], 0x747644
mov ecx, 8
lea edi, [esi + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esi + 0x30]
push 0
lea edi, [esi + 0x34]
push eax
mov byte [esp + 0x1c], 1
mov dword [eax], 0
mov dword [edi], 0
call fcn.0047b410
push 0
push edi
call fcn.0047b410
add esp, 0x10
push 1
mov ecx, esi
mov dword [esi + 0x38], 0
mov dword [esi + 4], 0x4e475342
call fcn.004eed40
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x54], 0
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x474680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x72aed3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x747644
mov eax, dword [esi + 0x38]
test eax, eax
mov dword [esp + 0x14], 1
je 0x4746bd
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
lea edi, [esi + 0x3c]
mov ecx, edi
mov dword [esi + 0x38], 0
call fcn.004ac6e0
lea eax, [esi + 0x30]
push 0
push eax
call fcn.0047b410
lea ecx, [esi + 0x34]
push 0
push ecx
call fcn.0047b410
add esp, 0x10
mov ecx, edi
mov byte [esp + 0x14], 0
call fcn.004ac640
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004ee910
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x475640
Capabilities:
Write file on windows

Disassembly:
mov dword [ecx], 0x74766c
jmp fcn.00694090

Function at 0x476c70
Capabilities:
Delete file
Read .ini file

Disassembly:
push esi
push edi
push 0x476c40
call fcn.00694450
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 4
push str.Warnings.txt
call esi
push str.ProgramFlow.txt
call esi
push str.ProgrammerOutput.txt
call esi
push str..Morrowind.ini
push 0
push str.SkipProgramFlows
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
setne al
mov byte [0x7c8f73], al
xor eax, eax
mov ecx, 0x41
mov edi, 0x7c8b7c
rep stosd dword es:[edi], eax
mov ecx, 0x41
mov edi, 0x7c8e58
rep stosd dword es:[edi], eax
mov ecx, 0x41
mov edi, 0x7c8d14
rep stosd dword es:[edi], eax
pop edi
pop esi
ret
Function at 0x476cf0
Capabilities:
Read .ini file

Disassembly:
mov al, byte [0x7c8b7c]
test al, al
push esi
jne 0x476dcd
call fcn.004678f0
test eax, eax
jne 0x476d67
mov ecx, dword [0x7c67dc]
test ecx, ecx
je 0x476d67
mov eax, dword [0x7c67e0]
test eax, eax
je 0x476d67
push 0x104
push 0x44
call fcn.0040f930
mov esi, dword [sym.imp.MSVCRT.dll_strncpy]
push eax
push 0x7c8b7c
call esi
mov ecx, dword [0x7c67dc]
add esp, 0xc
push 0x104
push 0x45
call fcn.0040f930
push eax
push 0x7c8e58
call esi
push 0x104
push str.Continue_running_executable_
push 0x7c8d14
call esi
add esp, 0x18
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str..Morrowind.ini
push 0x104
push 0x7c8b7c
push 0x789a3c
push 0x789a3c
push str.GeneralWarnings
call esi
push str..Morrowind.ini
push 0x104
push 0x7c8e58
push 0x789a28
push 0x789a28
push str.GeneralWarnings
call esi
push str..Morrowind.ini
push 0x104
push 0x7c8d14
push str.Continue_running_executable_
push str.Continue
push str.GeneralWarnings
call esi
pop esi
ret

Function at 0x476dd0
Capabilities:
Delete file
Get file size

Disassembly:
push esi
push 0
push 0x80
push 3
push 0
push 1
push DirectSoundCreate
push str.Warnings.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x476e18
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0x46
pop edi
jne 0x476e18
push str.Warnings.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret
Function at 0x477fa0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x518
push ebx
push esi
push edi
call dword [sym.imp.MSVCRT.dll_clock]
mov esi, eax
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ecx, edx
mov eax, 0x10624dd3
imul esi
mov eax, edx
sar eax, 5
mov edx, eax
shr edx, 0x1f
add eax, edx
cdq
mov esi, 0x64
idiv esi
mov eax, ecx
mov esi, 0x3c
push edx
cdq
idiv esi
mov eax, 0x88888889
push edx
imul ecx
mov eax, edx
add eax, ecx
sar eax, 5
mov ecx, eax
shr ecx, 0x1f
add eax, ecx
cdq
mov ecx, esi
idiv ecx
push edx
lea edx, [esp + 0x1c]
push str._02d_02d_02d:
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [esp + 0x53c]
lea ecx, [esp + 0x540]
push ecx
push edx
lea eax, [esp + eax + 0x2c]
push eax
call dword [sym.imp.MSVCRT.dll_vsprintf]
or ecx, 0xffffffff
add esp, 0x20
xor eax, eax
mov edi, 0x776ca0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, ecx
or ecx, 0xffffffff
mov esi, edi
lea edx, [esp + 0x10]
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
shr ecx, 2
push eax
dec edi
rep movsd dword es:[edi], dword [esi]
push 0x80
push 4
push eax
push eax
mov ecx, ebx
push 0xc0000000
and ecx, 3
push str.ProgramFlow.txt
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4780c0
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x10]
push eax
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x518
ret