joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42542f
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], ecx
xor esi, esi
push eax
push esi
mov dword [ebp - 4], esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x42546d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push dword [ebp + 8]
call fcn.004273ac
add esp, 0x10
xor eax, eax
jmp 0x425512
push ebx
push dword [ebp - 4]
call dword [sym.imp.MSVCR120.dll_malloc]
mov ebx, eax
mov dword [ebp - 0xc], ebx
pop ecx
test ebx, ebx
jne 0x425493
push str.GetMAC_Failed__Because_malloc_failed_
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
jmp 0x425511
push edi
lea eax, [ebp - 4]
mov edi, ebx
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x4254bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push dword [ebp + 8]
call fcn.004273ac
add esp, 0x10
jmp 0x425506
mov ebx, dword [ebp - 8]
mov eax, dword [edi + 0x190]
cmp eax, 6
jb 0x4254fd
cmp eax, 8
ja 0x4254fd
push eax
lea eax, [edi + 0x194]
push eax
push dword [ebp + 8]
call fcn.005501bc
mov esi, dword [edi + 0x190]
lea eax, [edi + 8]
add esp, 0xc
mov ecx, ebx
push eax
call fcn.00425086
shr eax, 2
test al, 1
jne 0x425503
mov edi, dword [edi]
test edi, edi
jne 0x4254c2
mov ebx, dword [ebp - 0xc]
push ebx
call dword [sym.imp.MSVCR120.dll_free]
pop ecx
mov eax, esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42b8b9
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov ebx, 0x690a18
push edi
mov ecx, ebx
call fcn.0042c560
mov ecx, eax
call fcn.00416e18
cmp dword [esi + 0x10], edi
je 0x42b8f3
mov ecx, 0x690c08
call fcn.00424491
push edi
push edi
push 3
mov ecx, ebx
call fcn.004171b9
mov dword [esi + 0x10], edi
jmp 0x42b8fe
push edi
push edi
push 2
mov ecx, ebx
call fcn.004171b9
mov esi, 0x6ab360
mov ecx, esi
call fcn.00429681
cmp dword [eax + 0x98], edi
pop edi
jne 0x42b926
mov ecx, esi
mov dword [eax + 0x98], 1
pop esi
pop ebx
jmp fcn.004c6d99
pop esi
pop ebx
ret

Function at 0x430b07
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [ecx + 0x10], 0
jne fcn.00444c8a
ret
Function at 0x4446df
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi + 0x930], ebx
cmp dword [esi + 0x10], ebx
je 0x44484f
cmp dword [esi + 0x2c], ebx
jne 0x44484f
push edi
mov ecx, 0x6a0b58
call fcn.00421bca
mov edi, dword [ebp + 8]
test eax, eax
jne 0x4447a7
mov ecx, edi
call fcn.0041423c
push eax
mov ecx, edi
call fcn.00422064
push eax
mov ecx, esi
call fcn.00444c14
test eax, eax
je 0x4447a7
mov ecx, 0x6a0b58
call fcn.0052f179
test eax, eax
je 0x44474d
mov ecx, 0x6a0b58
call fcn.00422059
cmp eax, esi
je 0x444786
mov dword [esi + 0x930], 0x100000
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x40], eax
sub eax, dword [esi + 0x44]
cmp eax, 0x78
jbe 0x444786
mov ecx, edi
mov dword [0x6a0ab4], 1
call fcn.00422064
mov ecx, edi
mov dword [esi + 0x50], eax
call fcn.0041423c
mov dword [esi + 0x54], eax
mov ecx, 0x6a0b58
call fcn.0052f179
test eax, eax
jne 0x4447c9
test byte [esi + 0xc], 0x80
je 0x4447c9
push ebx
mov ecx, 0x6941e0
call fcn.0042ccaf
jmp 0x4447c9
mov dword [0x6a0ab4], ebx
cmp dword [0x6a0ab0], ebx
je 0x4447bd
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
jmp 0x4447c9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov ecx, 0x6a0b58
call fcn.0042fb95
test eax, eax
jne 0x444846
mov ecx, edi
call fcn.0041a1d9
push eax
mov ecx, edi
call fcn.0041a1d2
push eax
mov ecx, esi
call fcn.00444c14
test eax, eax
je 0x444846
mov ecx, edi
call fcn.0041424b
test eax, eax
je 0x444807
or dword [esi + 0x930], 0x400
mov ecx, edi
call fcn.004336aa
test eax, eax
je 0x44481c
or dword [esi + 0x930], 0x200
mov ecx, edi
call fcn.0041a435
test eax, eax
je 0x444831
or dword [esi + 0x930], 0x10000
mov ecx, edi
call fcn.00457350
test eax, eax
je 0x444846
or dword [esi + 0x930], 0x20000
mov eax, dword [esi + 0x930]
pop edi
jmp 0x444851
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4

Function at 0x444c8a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
je 0x444cf4
mov ecx, dword [esi + 0x888]
test ecx, ecx
je 0x444cdf
mov eax, dword [esi + 0x894]
xor edx, edx
imul eax, dword [esi + 0x890]
push edi
push 0x64
pop edi
div edi
shl eax, 0x18
or eax, dword [esi + 0x88c]
push eax
lea eax, [esi + 0x898]
push eax
push ecx
and dword [esp], 0
lea eax, [esi + 0x900]
push 0
push eax
call fcn.00434c77
pop edi
mov ecx, esi
pop esi
jmp fcn.00444ea5
mov eax, dword [0x6a0aac]
xor ecx, ecx
cmp dword [0x6a9544], ecx
cmovne eax, ecx
mov dword [0x6a0aac], eax
pop esi
ret
Function at 0x444ea5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x58]
mov ecx, esi
call fcn.0042c560
test eax, eax
jne 0x444ee1
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x6a0ac0]
cmp eax, 0x78
jbe 0x444ffd
call esi
and dword [0x6a0ab0], 0
mov dword [0x6a0ac0], eax
jmp 0x444ffd
mov ecx, esi
call fcn.0042c560
test eax, eax
je 0x444ffd
mov eax, dword [edi + 0x40]
sub eax, dword [edi + 0x44]
cmp eax, 0x78
jbe 0x444ffd
push ebx
push esi
mov ecx, 0x6a0b58
mov dword [0x6a0ab0], 1
call fcn.0042e41a
mov eax, dword [edi + 0x54]
mov ecx, esi
add eax, 0x1c
push eax
mov eax, dword [edi + 0x50]
add eax, 0x22
push eax
call fcn.0042e427
cmp dword [edi + 0x910], 0
mov ebx, 0x6b87b0
je 0x444f90
push 0x1d
mov ecx, ebx
call fcn.004152e3
mov ecx, eax
call fcn.00500dd8
test eax, eax
je 0x444f90
mov esi, dword [edi + 0x910]
mov ecx, esi
call fcn.0042c560
test eax, eax
je 0x444f90
push esi
mov ecx, 0x6a0b58
call fcn.00460b61
mov eax, dword [edi + 0x54]
mov ecx, dword [edi + 0x910]
add eax, 0x1c
push eax
mov eax, dword [edi + 0x50]
sub eax, 0x102
push eax
call fcn.0042e427
mov ecx, dword [edi + 0x910]
push 1
call fcn.00444e5b
cmp dword [edi + 0x914], 0
je 0x444ffc
push 0x1d
mov ecx, ebx
call fcn.004152e3
mov ecx, eax
call fcn.00500dd8
test eax, eax
je 0x444ffc
mov esi, dword [edi + 0x914]
mov ecx, esi
call fcn.0042c560
test eax, eax
je 0x444ffc
push esi
mov ecx, 0x6a0b58
call fcn.0042e391
mov esi, dword [edi + 0x914]
mov ecx, esi
call fcn.0044493a
mov edx, dword [edi + 0x54]
mov ecx, esi
movzx eax, ax
sub edx, eax
mov eax, dword [edi + 0x50]
push edx
sub eax, 0x102
push eax
call fcn.0042e427
mov ecx, dword [edi + 0x914]
push 1
call fcn.00444e5b
pop ebx
pop edi
pop esi
ret

Function at 0x44c685
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0xc]
pop ebp
jmp fcn.0043a0b4
Function at 0x489508
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
push edi
mov edi, ecx
jne 0x489541
mov eax, dword [0x6a83f8]
push esi
add eax, 0x1d4c0
lea esi, [edi + 0x9c0]
mov ecx, esi
mov dword [edi + 0x974], eax
call fcn.00450224
push str.ANRaster.tga
mov ecx, esi
call fcn.0045017d
pop esi
jmp 0x489557
lea ecx, [edi + 0x9c0]
call fcn.00450224
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp + 8]
mov ecx, edi
call fcn.00430b86
pop edi
pop ebp
ret 4

Function at 0x489566
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
push edi
mov edi, ecx
jne 0x4895a2
imul eax, dword [ebp + 0xc], 0x3e8
push esi
lea esi, [edi + 0x9c0]
mov ecx, esi
add eax, dword [0x6a83f8]
mov dword [edi + 0x974], eax
call fcn.00450224
push str.ANRaster.tga
mov ecx, esi
call fcn.0045017d
pop esi
jmp 0x4895b8
lea ecx, [edi + 0x9c0]
call fcn.00450224
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp + 8]
mov ecx, edi
call fcn.00430b86
pop edi
pop ebp
ret 8
Function at 0x4a5500
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp dword [ebx + 0xc8], 0
jne 0x4a552b
mov dword [ebx + 0xc8], eax
sub eax, dword [ebx + 0xc8]
cmp eax, 0x1388
jbe 0x4a5622
push esi
push edi
lea edi, [ebx + 0xa4]
mov ecx, edi
call fcn.0052ef20
mov ecx, edi
mov esi, eax
call fcn.00541526
test esi, esi
jle 0x4a5562
mov ecx, edi
call fcn.0054bd91
dec esi
jne 0x4a5558
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4a557b
mov esi, str.Resource.bin
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x108]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x350], eax
lea eax, [ebp - 0x354]
mov ecx, ebx
push eax
lea eax, [ebp - 0x320]
push eax
call fcn.004a54b5
test eax, eax
je 0x4a55fd
mov esi, str.Resource_
lea edi, [ebp - 0x20c]
lea edx, [ebp - 0x320]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x4a55d7
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4a55e7
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 0x350]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4a55a6
call dword [sym.imp.WINMM.dll_timeGetTime]
pop edi
mov dword [ebx + 0xc8], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005500ac
mov esp, ebp
pop ebp
ret
Function at 0x4c52aa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4c52d7
xor eax, eax
jmp 0x4c5324
push esi
lea eax, [ebp + 8]
push eax
push 0x6c0
lea eax, [ebx + 0x6c4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4c52fc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4c52d3
push esi
lea eax, [ebp + 8]
push eax
push 0x1c0
lea eax, [ebx + 0xf44]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4c531b
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4c6c86
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], ecx
push edi
push 0x80
push 3
push edi
push edi
push 0x80000000
push str.._ini_GameOption.opt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c6cb8
xor eax, eax
jmp 0x4c6d14
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push 4
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4c6cda
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4c6cb4
cmp dword [ebp - 8], 0x71208
jne 0x4c6cd1
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push 0xb0
add eax, 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c6cd1
cmp dword [ebp - 4], 0xb0
ja 0x4c6d0b
xor edi, edi
inc edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c6d99
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push str.._ini_GameOption.opt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4c6dfa
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x71208
push eax
push edi
call esi
push 0
lea eax, [ebp - 8]
push eax
push 0xb0
lea eax, [ebx + 4]
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e9654
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
push edi
push 0x80
push 3
push edi
push edi
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e9750
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x128]
push eax
push 4
lea eax, [ebp - 0x12c]
push eax
push esi
call edi
test eax, eax
jne 0x4e96bc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4e9750
cmp dword [ebp - 0x12c], 0x6111101
jne 0x4e96b0
push 0
lea eax, [ebp - 0x128]
push eax
push 4
lea eax, [ebp - 0x130]
push eax
push esi
call edi
test eax, eax
je 0x4e96b0
mov ecx, 0x6b93e8
call fcn.004e8ee0
movzx eax, al
cmp dword [ebp - 0x130], eax
jne 0x4e96b0
push 0
lea eax, [ebp - 0x128]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x124]
push eax
push esi
call edi
push esi
test eax, eax
je 0x4e96b1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x829
mov ecx, 0x6a0b58
call fcn.0044c748
push dword [ebp - 0x40]
mov esi, eax
push dword [ebp - 0x44]
mov ecx, esi
call fcn.0042ea46
push eax
mov ecx, ebx
call fcn.004e8eee
test eax, eax
je 0x4e9750
push dword [ebp - 0x40]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0x44]
call dword [eax + 0x24]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005500ac
mov esp, ebp
pop ebp
ret 4

Function at 0x4e983a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
push edi
push 0x80
push 3
push edi
push edi
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e9902
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push esi
call edi
test eax, eax
jne 0x4e9896
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4e9902
cmp dword [ebp - 0x18], 0x6060801
jne 0x4e988d
push 0
lea eax, [ebp - 0x14]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push esi
call edi
push esi
test eax, eax
je 0x4e988e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
cmp dword [ebx + 0x1c], esi
je 0x4e9902
mov edi, 0x6a7278
mov ecx, edi
call fcn.004bfa90
test eax, eax
je 0x4e9902
push dword [ebp - 0xc]
mov ecx, eax
call fcn.004962d2
push dword [ebp - 0x10]
mov ecx, edi
call fcn.004bfa90
mov ecx, eax
call fcn.004962af
movss xmm0, dword [ebp - 8]
push esi
push ecx
movss dword [esp], xmm0
mov ecx, 0x6d6c20
push esi
call fcn.00524725
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005500ac
mov esp, ebp
pop ebp
ret 4
Function at 0x4ea00a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, 0x6a0b58
push 0x829
call fcn.0044c748
mov esi, eax
test esi, esi
je 0x4ea068
mov ecx, esi
call fcn.00413d2e
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0x44], eax
call fcn.00413d35
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov dword [ebp - 0x40], eax
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4ea0f0
mov ecx, 0x6b93e8
mov dword [ebp - 0x130], 0x6111101
call fcn.004e8ee0
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
movzx ecx, al
lea eax, [ebp - 0x12c]
push ebx
push eax
push 4
lea eax, [ebp - 0x130]
mov dword [ebp - 0x134], ecx
push eax
push edi
call esi
push ebx
lea eax, [ebp - 0x12c]
push eax
push 4
lea eax, [ebp - 0x134]
push eax
push edi
call esi
push ebx
lea eax, [ebp - 0x12c]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x124]
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005500ac
mov esp, ebp
pop ebp
ret 4

Function at 0x4ea103
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
test ebx, ebx
je 0x4ea237
push esi
push 0
mov ecx, 0x6d7510
call fcn.0052db8b
push eax
lea eax, [ebp - 0x108]
push str._sData
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x108]
add esp, 0xc
push 0
push eax
call esi
push dword [edi + 0x18]
mov ecx, 0x6d7510
push 0
call fcn.0052db8b
push eax
lea eax, [ebp - 0x108]
push str._sData_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x108]
push 0
push eax
call esi
mov esi, 0x6d7510
test bl, 1
je 0x4ea1c6
push dword [edi + 0x18]
mov ecx, esi
push dword [edi + 0x18]
push 0
call fcn.0052db8b
push eax
lea eax, [ebp - 0x108]
push str._sData_d_d.UII
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x108]
mov ecx, edi
push eax
call fcn.004e9915
test bl, 2
je 0x4ea1fe
push dword [edi + 0x18]
mov ecx, esi
push dword [edi + 0x18]
push 0
call fcn.0052db8b
push eax
lea eax, [ebp - 0x108]
push str._sData_d_d.UIS
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x108]
mov ecx, edi
push eax
call fcn.004ea249
test bl, 4
je 0x4ea236
push dword [edi + 0x18]
mov ecx, esi
push dword [edi + 0x18]
push 0
call fcn.0052db8b
push eax
lea eax, [ebp - 0x108]
push str._sData_d_d.UIR
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x108]
mov ecx, edi
push eax
call fcn.004ea00a
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.005500ac
mov esp, ebp
pop ebp
ret 4
Function at 0x4ea249
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x6a7278
mov ecx, edi
call fcn.004bfa90
test eax, eax
je 0x4ea2e9
push ebx
mov ecx, eax
call fcn.004946fc
mov ecx, edi
mov dword [ebp - 0xc], eax
call fcn.004bfa90
mov ecx, eax
call fcn.004946f4
xor ebx, ebx
mov word [ebp - 0x10], ax
push ebx
mov ecx, 0x6d6c20
call fcn.004e8eca
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push esi
fstp dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4ea2e8
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x14]
push ebx
push eax
push 4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x6060801
push eax
push edi
call esi
push ebx
lea eax, [ebp - 0x14]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005500ac
mov esp, ebp
pop ebp
ret 4

Function at 0x4fd988
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push esi
jne 0x4fd9d0
push 0x571344
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_fopen]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4fda05
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4fd9ae
push esi
sub ecx, edx
push 1
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR120.dll_fwrite]
push esi
call dword [sym.imp.MSVCR120.dll_fclose]
add esp, 0x14
jmp 0x4fda05
cmp dword [ebp + 0x10], 1
jne 0x4fda05
push 0x571348
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_fopen]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4fda05
push dword [ebp + 0xc]
push 0x57134c
push esi
call dword [sym.imp.MSVCR120.dll_fprintf]
push esi
call dword [sym.imp.MSVCR120.dll_fclose]
add esp, 0x10
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x4fec99
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x4fed6d
push 0x55cf54
push ebx
call dword [sym.imp.MSVCR120.dll_fopen]
pop ecx
pop ecx
lea edx, [edi + 0x30]
mov dword [edi + 4], eax
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x4fecd4
cmp dword [edi + 4], 0
je 0x4fed6d
mov esi, dword [sym.imp.MSVCR120.dll_fseek]
push 2
push 0
push dword [edi + 4]
call esi
push dword [edi + 4]
call dword [sym.imp.MSVCR120.dll_ftell]
push 0
push 0
push dword [edi + 4]
mov dword [ebp - 0x208], eax
call esi
add esp, 0x1c
mov ecx, edi
call fcn.004fe4cc
push dword [edi + 4]
lea esi, [edi + 0x18]
push 1
push 0xc
push esi
call dword [sym.imp.MSVCR120.dll_fread]
mov eax, dword [esi]
lea ecx, [edi + 0x134]
sub eax, dword [edi + 0x1c]
add esp, 0x10
sub eax, dword [edi + 0x20]
push eax
call fcn.004059cf
test eax, eax
jne 0x4fed82
push ebx
lea eax, [ebp - 0x104]
push str.Bin_File_Version_Error_____s
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
lea eax, [ebp - 0x104]
add esp, 0xc
xor ecx, ecx
push ecx
push ecx
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005500ac
mov esp, ebp
pop ebp
ret 4
lea ecx, [edi + 0x134]
call fcn.004059b8
test eax, eax
je 0x4fedfe
mov esi, dword [ebp - 0x208]
add esi, 0xfffffff2
push esi
call fcn.0054ff8e
mov dword [edi + 0x28], eax
pop ecx
test eax, eax
je 0x4fed6d
push esi
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea ecx, [edi + 0x134]
push dword [edi + 0x1c]
push esi
push dword [edi + 0x28]
push dword [edi + 4]
call fcn.00405874
test eax, eax
jne 0x4fedeb
push ebx
lea eax, [ebp - 0x204]
push str.File_Open_Error_:__s
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
lea eax, [ebp - 0x204]
jmp 0x4fed5e
push dword [edi + 4]
call dword [sym.imp.MSVCR120.dll_fclose]
and dword [edi + 4], 0
xor ebx, ebx
pop ecx
inc ebx
jmp 0x4fee6c
push dword [edi + 4]
mov esi, dword [sym.imp.MSVCR120.dll_fread]
lea eax, [edi + 0x24]
xor ebx, ebx
inc ebx
push ebx
push ebx
push eax
call esi
add esp, 0x10
cmp dword [edi + 0x20], 0
je 0x4fee33
push dword [edi + 0x20]
call fcn.0054ff8e
push dword [edi + 4]
mov dword [edi + 0x28], eax
push dword [edi + 0x20]
push ebx
push eax
call esi
add esp, 0x14
push dword [edi + 4]
lea eax, [edi + 0x25]
push ebx
push ebx
push eax
call esi
push dword [edi + 4]
call dword [sym.imp.MSVCR120.dll_fclose]
and dword [edi + 4], 0
add esp, 0x14
mov ecx, edi
call fcn.004fe482
test eax, eax
je 0x4fed6d
mov ecx, edi
call fcn.004fe40c
test eax, eax
je 0x4fed6d
mov dword [edi + 0x2c], ebx
mov eax, ebx
jmp 0x4fed6f