joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006000
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x18
movzx ecx, word [eax]
mov edi, dword [eax + 0x4804]
shr cx, 4
mov dword [esp + 4], edi
movzx ebx, cx
xor ecx, 0x7f
mov dword [eax + edx*4 + 0x4808], edi
movzx ebx, byte [ebx + 0x10119a60]
movzx ecx, cx
mov dword [esp + 0x10], ebx
movzx ebx, byte [ecx + 0x10119a60]
movzx ecx, word [eax + 2]
shr cx, 4
movzx esi, cx
xor ecx, 0x7f
movzx ecx, cx
movzx esi, byte [esi + 0x10119a60]
movzx ecx, byte [ecx + 0x10119a60]
add esi, ebx
add ebx, ecx
imul ecx, edx, 0x440
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebx
lea ebx, [eax + ecx + 0x404]
mov dword [esp], ebx
test edi, edi
je 0x10006190
shl edx, 4
xor edi, edi
mov dword [esp + 0x14], edx
lea ebp, [edx + 4]
lea esi, [esi]
lea ebx, [edi + 8]
xor esi, esi
mov ecx, ebx
shr ebx, 1
and ecx, 1
lea edx, [eax + ebx*2]
movzx edx, word [edx + ebp]
neg ecx
and ecx, 0x7ff
xor edx, ecx
shr edx, 4
movzx edx, byte [edx + 0x10119a60]
add esi, edx
cmp ebx, 1
jne 0x10006095
mov ebx, dword [esp]
add esi, dword [esp + 0x10]
mov dword [ebx + edi*4], esi
add edi, 1
cmp dword [esp + 4], edi
jbe 0x100060d6
cmp edi, 7
jbe 0x10006090
cmp dword [esp + 4], edi
jbe 0x10006190
mov ebx, dword [esp + 0x14]
add ebx, 0x104
lea esi, [esi]
mov esi, edi
xor ebp, ebp
mov ecx, esi
shr esi, 1
and ecx, 1
lea edx, [eax + esi*2]
movzx edx, word [edx + ebx]
neg ecx
and ecx, 0x7ff
xor edx, ecx
shr edx, 4
movzx edx, byte [edx + 0x10119a60]
add ebp, edx
cmp esi, 1
jne 0x100060f4
mov esi, dword [esp]
add ebp, dword [esp + 8]
mov dword [esi + edi*4], ebp
add edi, 1
cmp dword [esp + 4], edi
jbe 0x10006135
cmp edi, 0xf
jbe 0x100060f0
mov esi, dword [esp + 4]
cmp esi, edi
jbe 0x10006190
add esi, 0xf0
lea ebx, [eax + 0x204]
add edi, 0xf0
mov ebp, esi
mov ecx, edi
xor esi, esi
mov edx, ecx
shr ecx, 1
and edx, 1
movzx eax, word [ebx + ecx*2]
neg edx
and edx, 0x7ff
xor eax, edx
shr eax, 4
movzx eax, byte [eax + 0x10119a60]
add esi, eax
cmp ecx, 1
jne 0x10006155
mov eax, dword [esp]
add esi, dword [esp + 0xc]
mov dword [eax + edi*4 - 0x3c0], esi
add edi, 1
cmp ebp, edi
jne 0x10006151
add esp, 0x18
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1000e1b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, 0x1011bd40
not eax
mov esi, esi
lea edi, [edi]
cmp edi, 0x10
jb 0x1000e2c5
test esi, 7
je 0x1000e1f4
movzx ebp, byte [esi]
inc esi
movzx ecx, al
xor ebp, ecx
shr eax, 8
xor eax, dword [ebx + ebp*4]
dec edi
jmp 0x1000e1d0
mov dword [esp + 0x18], edi
and edi, 0xfffffff8
sub dword [esp + 0x18], edi
add edi, esi
sub edi, 8
xor eax, dword [esi]
mov ecx, dword [esi + 4]
movzx ebp, cl
mov edx, dword [ebx + ebp*4 + 0xc00]
movzx ebp, ch
xor edx, dword [ebx + ebp*4 + 0x800]
shr ecx, 0x10
xor edx, dword [esi + 8]
movzx ebp, cl
xor edx, dword [ebx + ebp*4 + 0x400]
movzx ebp, ch
xor edx, dword [ebx + ebp*4]
movzx ebp, al
mov ecx, dword [esi + 0xc]
xor edx, dword [ebx + ebp*4 + 0x1c00]
movzx ebp, ah
shr eax, 0x10
xor edx, dword [ebx + ebp*4 + 0x1800]
movzx ebp, ah
movzx eax, al
mov eax, dword [ebx + eax*4 + 0x1400]
add esi, 8
xor eax, edx
xor eax, dword [ebx + ebp*4 + 0x1000]
cmp esi, edi
movzx ebp, cl
jne 0x1000e20c
mov edx, dword [ebx + ebp*4 + 0xc00]
movzx ebp, ch
xor edx, dword [ebx + ebp*4 + 0x800]
shr ecx, 0x10
movzx ebp, cl
xor edx, dword [ebx + ebp*4 + 0x400]
movzx ebp, ch
xor edx, dword [ebx + ebp*4]
movzx ebp, al
xor edx, dword [ebx + ebp*4 + 0x1c00]
movzx ebp, ah
shr eax, 0x10
xor edx, dword [ebx + ebp*4 + 0x1800]
movzx ebp, ah
movzx eax, al
mov eax, dword [ebx + eax*4 + 0x1400]
add esi, 8
xor eax, edx
xor eax, dword [ebx + ebp*4 + 0x1000]
mov edi, dword [esp + 0x18]
test edi, edi
je 0x1000e2db
movzx ebp, byte [esi]
inc esi
movzx ecx, al
xor ebp, ecx
shr eax, 8
xor eax, dword [ebx + ebp*4]
dec edi
jmp 0x1000e2c5
not eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1000ebf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, 8
push esi
mov esi, ecx
push ebx
mov ecx, dword [eax + 0xaa4]
and edx, dword [eax + 0xaa8]
mov ebx, dword [esp + 0x18]
sub edi, ecx
shl edx, cl
mov ecx, edi
shr esi, cl
lea ecx, [edx + esi]
lea edx, [ecx + ecx*2]
shl edx, 9
cmp byte [esp + 0x14], 0
lea edi, [eax + edx + 0xaac]
mov eax, dword [esp + 0x1c]
lea edx, [eax + 0x100]
jne 0x1000ec70
xor eax, eax
lea esi, [esi]
lea edi, [edi]
mov ebx, edx
shr edx, 1
and ebx, 1
movzx ecx, word [edi + edx*2]
neg ebx
and ebx, 0x7ff
xor ecx, ebx
shr ecx, 4
movzx ecx, byte [ecx + 0x10119a60]
add eax, ecx
cmp edx, 1
jne 0x1000ec40
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0x100
xor eax, eax
mov esi, esi
lea edi, [edi]
mov ecx, edx
add ebx, ebx
mov ebp, esi
shr ecx, 8
and ebp, ebx
add ecx, esi
add ecx, ebp
mov ebp, edx
add edx, edx
shl ebp, 0x18
movzx ecx, word [edi + ecx*2]
sar ebp, 0x1f
and ebp, 0x7ff
xor ecx, ebp
shr ecx, 4
movzx ecx, byte [ecx + 0x10119a60]
add eax, ecx
mov ecx, ebx
xor ecx, edx
not ecx
and esi, ecx
cmp edx, 0xffff
jbe 0x1000ec80
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10013c80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ebx, 0x1011dd60
not eax
not edx
cmp edi, 8
jb 0x10013d72
test esi, 3
je 0x10013cc8
movzx ebp, byte [esi]
inc esi
movzx ecx, al
xor ebp, ecx
shrd eax, edx, 8
xor eax, dword [ebx + ebp*8]
shr edx, 8
xor edx, dword [ebx + ebp*8 + 4]
dec edi
jmp 0x10013c9d
mov dword [esp + 0x18], edi
and edi, 0xfffffffc
sub dword [esp + 0x18], edi
add edi, esi
sub edi, 4
mov ecx, dword [esi]
xor ecx, eax
movzx ebp, cl
mov eax, dword [ebx + ebp*8 + 0x1800]
xor eax, edx
mov edx, dword [ebx + ebp*8 + 0x1804]
movzx ebp, ch
xor eax, dword [ebx + ebp*8 + 0x1000]
xor edx, dword [ebx + ebp*8 + 0x1004]
shr ecx, 0x10
movzx ebp, cl
xor eax, dword [ebx + ebp*8 + 0x800]
xor edx, dword [ebx + ebp*8 + 0x804]
movzx ebp, ch
add esi, 4
xor eax, dword [ebx + ebp*8]
xor edx, dword [ebx + ebp*8 + 4]
cmp esi, edi
mov ecx, dword [esi]
jb 0x10013cda
xor ecx, eax
movzx ebp, cl
mov eax, dword [ebx + ebp*8 + 0x1800]
xor eax, edx
mov edx, dword [ebx + ebp*8 + 0x1804]
movzx ebp, ch
xor eax, dword [ebx + ebp*8 + 0x1000]
xor edx, dword [ebx + ebp*8 + 0x1004]
shr ecx, 0x10
movzx ebp, cl
xor eax, dword [ebx + ebp*8 + 0x800]
xor edx, dword [ebx + ebp*8 + 0x804]
movzx ebp, ch
add esi, 4
xor eax, dword [ebx + ebp*8]
xor edx, dword [ebx + ebp*8 + 4]
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10013d90
movzx ebp, byte [esi]
inc esi
movzx ecx, al
xor ebp, ecx
shrd eax, edx, 8
xor eax, dword [ebx + ebp*8]
shr edx, 8
xor edx, dword [ebx + ebp*8 + 4]
dec edi
jmp 0x10013d72
not eax
not edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10016040
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x10125a94]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
mov ebx, dword [esp + 0x1a4]
push ebp
mov ebp, dword [esp + 0x1b0]
push esi
mov esi, dword [esp + 0x1b8]
push edi
mov edi, dword [esp + 0x1b4]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], ebp
mov ecx, dword [edi]
mov eax, ecx
not eax
test al, 1
je 0x100160e0
lea eax, [esp + 0x18]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100160b3
push eax
push esi
push ebp
lea eax, [edi + 0x80a4]
push str._s:_s_failed_to_setup_winsock2__wsa:__d_
push eax
call fcn.10018fa0
add esp, 0x14
jmp 0x10016205
test byte [esp + 0x18], 1
je 0x100160db
push esi
push ebp
lea eax, [edi + 0x80a4]
push str._s:_s_bad_winsock_version__2_is_required_
push eax
call fcn.10018fa0
add esp, 0x10
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x10016205
or dword [edi], 1
mov ecx, dword [edi]
cmp dword [esp + 0x1c0], 0
je 0x10016137
lea eax, [edi + 0x84a4]
lea ecx, [edi + 0x1808954]
cmp eax, ecx
jae 0x1001610f
nop word [eax + eax]
cmp dword [eax + 8], 0xffffffff
je 0x10016119
add eax, 0x200064
cmp eax, ecx
jb 0x10016100
mov eax, str._s:_s_server_limit_reached
jmp 0x100161f3
push 1
push esi
push ebp
push eax
push ebx
call fcn.10016220
add esp, 0x14
test eax, eax
je 0x10016207
or dword [eax], 0x20
jmp 0x10016207
not ecx
test cl, 0x20
je 0x100161ee
or dword [ebx + 0x154], 0x20
lea eax, [edi + 0x84a4]
lea ebp, [edi + 0x1808954]
mov esi, eax
cmp esi, ebp
jae 0x10016182
nop dword [eax + eax]
cmp dword [esi + 8], 0xffffffff
je 0x10016172
push 1
push esi
push ebx
call fcn.10017170
add esp, 0xc
add esi, 0x200064
cmp esi, ebp
jb 0x10016160
lea eax, [edi + 0x84a4]
push 0
push dword [esp + 0x14]
push dword [esp + 0x1c]
push eax
push ebx
call fcn.10016220
mov ebp, eax
add esp, 0x14
test ebp, ebp
je 0x100161ea
lea esi, [ebp + 0x10]
push esi
push dword [ebx + 4]
call fcn.10037f20
push 1
push str.ServerConnecting
push 0
push dword [ebx + 4]
push dword [ebx + 0x14]
call fcn.1002c5e0
push 0xfffffffffffffffe
push dword [ebx + 4]
call fcn.100383d0
test byte [ebp], 4
mov ecx, str._s_connected_to_server_immediately
mov eax, str._s_connecting_to_server
cmovne eax, ecx
push esi
push eax
mov eax, dword [ebx + 0x18]
push 0
push eax
call fcn.100198a0
add esp, 0x34
or dword [edi], 0x20
mov eax, ebp
jmp 0x10016207
mov eax, str._s:_s_already_connected_to_another_server
push esi
push ebp
push eax
lea eax, [edi + 0x80a4]
push eax
call fcn.10018fa0
add esp, 0x10
xor eax, eax
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100aebeb
add esp, 0x19c
ret
Function at 0x1001d750
Capabilities:
Log keystrokes

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push 1
push esi
call fcn.10038740
add esp, 8
cmp eax, 3
jne 0x1001d77e
push 1
push esi
call fcn.10038510
add esp, 8
fstp dword [esp + 4]
cvttss2si eax, dword [esp + 4]
pop esi
pop ecx
ret
cmp eax, 4
je 0x1001d793
push str.number_or_string
push 1
push esi
call fcn.10047990
add esp, 0xc
push 1
push esi
call fcn.10038630
mov esi, eax
push esi
call fcn.1001d6d0
add esp, 0xc
test eax, eax
jne 0x1001d7c5
push esi
call fcn.1001d7d0
add esp, 4
test eax, eax
je 0x1001d7c3
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x1001eb50
Capabilities:
Log keystrokes
Log keystrokes via polling
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x104
mov eax, dword [0x10125a94]
xor eax, esp
mov dword [esp + 0x100], eax
push esi
mov esi, dword [esp + 0x10c]
push edi
push 1
push dword [esp + 0x118]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edi, eax
test edi, edi
je 0x1001ed23
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x1001ed23
cmp edi, 0xd
jne 0x1001ebbb
pop edi
mov dword [esi], 2
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.100aebeb
add esp, 0x104
ret
cmp edi, 0x1b
jne 0x1001ebdd
pop edi
mov dword [esi], 1
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.100aebeb
add esp, 0x104
ret
cmp edi, 8
jne 0x1001ec08
mov eax, dword [esi + 4]
test eax, eax
je 0x1001ed23
dec eax
pop edi
mov dword [esi + 4], eax
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.100aebeb
add esp, 0x104
ret
cmp edi, 0x56
jne 0x1001ecde
test byte [esp + 0x19], 0x80
je 0x1001ecde
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1001ed23
push esi
call fcn.1001d240
add esp, 4
test eax, eax
je 0x1001ecc1
push ebx
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
xor edi, edi
movsx ecx, byte [ebx]
push ecx
call fcn.100b8b90
add esp, 4
test eax, eax
je 0x1001ec73
nop word [eax + eax]
movsx eax, byte [edi + ebx + 1]
inc edi
push eax
call fcn.100b8b90
add esp, 4
test eax, eax
jne 0x1001ec60
mov edx, dword [esi + 8]
mov ecx, dword [esi + 0xc]
sub edx, dword [esi + 4]
add ecx, dword [esi + 4]
cmp edi, edx
jae 0x1001ecaf
push edi
push ebx
push ecx
call fcn.100aff00
add dword [esi + 4], edi
add esp, 0xc
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.100aebeb
add esp, 0x104
ret
push edx
push ebx
push ecx
call fcn.100aff00
mov eax, dword [esi + 8]
add esp, 0xc
mov dword [esi + 4], eax
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.100aebeb
add esp, 0x104
ret
push 0
lea eax, [esp + 0xc]
push eax
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_ToAscii]
cmp eax, 1
jne 0x1001ed23
movsx eax, byte [esp + 8]
push eax
call fcn.100b8b90
add esp, 4
test eax, eax
je 0x1001ed23
push esi
call fcn.1001d240
add esp, 4
test eax, eax
je 0x1001ed23
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov al, byte [esp + 8]
mov byte [edx + ecx], al
inc dword [esi + 4]
mov ecx, dword [esp + 0x108]
pop edi
pop esi
xor ecx, esp
call fcn.100aebeb
add esp, 0x104
ret
Function at 0x10025e80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10125a94]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esi
push 0x40
push fcn.100b05da
push ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
call fcn.10052940
push 0
push eax
call fcn.100b05f0
add esp, 0x14
test eax, eax
jne 0x10025f0e
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push esi
push 1
push 8
push eax
call fcn.100ba32e
add esp, 0x10
test eax, eax
je 0x10025f0e
push 8
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.10051080
add esp, 0xc
test eax, eax
jne 0x10025f0e
push esi
mov esi, dword [ebp - 0x14]
push esi
call fcn.10050e80
push 8
push esi
call fcn.10051050
add esp, 0x10
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100aebeb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100aebeb
mov esp, ebp
pop ebp
ret
Function at 0x10029e70
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push 0x18
call fcn.100b8158
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10029e95
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10029e90
mov dword [eax], 2
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
test eax, eax
je 0x10029f1e
lea ecx, [esp + 0x10]
push ecx
push 0x100f2f0c
push dword [esp + 0x28]
push dword [esp + 0x28]
push eax
call fcn.10032da0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x1002a004
mov ecx, dword [esp + 0x10]
inc ecx
push ecx
call fcn.100b8158
mov esi, eax
add esp, 4
test esi, esi
jne 0x10029ee4
push edi
call fcn.10032090
jmp 0x1002a001
push dword [esp + 0x10]
push esi
push edi
call fcn.10033140
add esp, 0xc
push edi
cmp eax, dword [esp + 0x14]
je 0x10029f0c
call fcn.10032090
push esi
call fcn.100b813d
add esp, 8
jmp 0x1002a004
call fcn.10032090
mov eax, dword [esp + 0x14]
mov byte [esi + eax], 0
jmp 0x10029fb4
push 0x100f2f0c
push dword [esp + 0x24]
call fcn.100b3a27
mov edi, eax
add esp, 8
test edi, edi
je 0x1002a004
push 2
push 0
push edi
call fcn.100bac63
add esp, 0xc
test eax, eax
jne 0x10029ffb
push edi
call fcn.100bb2b6
mov ebp, eax
add esp, 4
cmp ebp, 0xffffffff
je 0x10029ffb
push 0
push 0
push edi
call fcn.100bac63
add esp, 0xc
test eax, eax
jne 0x10029ffb
lea eax, [ebp + 1]
push eax
call fcn.100b8158
add esp, 4
mov esi, eax
push edi
test esi, esi
je 0x10029ffc
push 1
push ebp
push esi
call fcn.100ba32e
add esp, 0x10
push edi
test eax, eax
jne 0x10029fab
call fcn.100b3940
push esi
call fcn.100b813d
add esp, 8
jmp 0x1002a004
call fcn.100b3940
mov byte [esi + ebp], 0
add esp, 4
lea eax, [ebx + 8]
push dword [esp + 0x24]
push eax
lea eax, [ebx + 4]
push eax
push esi
call fcn.100299d0
add esp, 0x10
mov dword [ebx], eax
test eax, eax
jne 0x10029fe9
push esi
call fcn.100b813d
push ebx
call fcn.100b813d
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
mov dword [ebx + 0xc], esi
mov eax, ebx
pop esi
pop ebp
mov dword [ebx + 0x10], 0
pop ebx
pop ecx
ret
push edi
call fcn.100b3940
add esp, 4
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1002a012
mov dword [eax], 1
push ebx
call fcn.100b813d
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1002b9b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push dword [edi + 0x164]
mov esi, dword [edi + 4]
push 0xffffd8f0
push esi
call fcn.100380f0
push 0xffffffffffffffff
push esi
call fcn.10038740
add esp, 0x14
cmp eax, 5
je 0x1002b9fb
push str.extra_save_data_was_corrupted
push 1
push dword [edi + 0x18]
call fcn.10019920
push 0xfffffffffffffffe
push esi
call fcn.100383d0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ecx
ret
push esi
call fcn.10037ee0
push 0xfffffffffffffffe
push esi
call fcn.10037cf0
add esp, 0xc
test eax, eax
jne 0x1002ba24
push 0xfffffffffffffffe
push esi
call fcn.100383d0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ecx
ret
push ebx
push 0xfffffffffffffffd
push esi
call fcn.100383d0
push 0
lea eax, [esp + 0x20]
push eax
push esi
call fcn.10036070
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x1002ba83
push str.failed_to_save_extra_save_data:
push esi
call fcn.10037f20
push 0xfffffffffffffffe
push esi
call fcn.100379c0
push 2
push esi
call fcn.10037740
push 0xffffffffffffffff
push esi
call fcn.10038630
push eax
push 1
push dword [edi + 0x18]
call fcn.10019920
push 0xfffffffffffffffe
push esi
call fcn.100383d0
add esp, 0x34
xor eax, eax
pop ebx
pop edi
pop esi
pop ecx
ret
push 0
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x1c]
push ebx
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1002baba
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x14]
jne 0x1002baba
push ebx
call fcn.100b813d
add esp, 4
mov eax, 1
pop ebx
pop edi
pop esi
pop ecx
ret
push ebx
call fcn.100b813d
push str.failed_to_write_extra_save_data
push 1
push dword [edi + 0x18]
call fcn.10019920
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
pop ecx
ret

Function at 0x10033140
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax], 0
mov ecx, dword [eax + 4]
je 0x10033166
push dword [esp + 0xc]
push dword [esp + 0xc]
push ecx
call fcn.1005d7a0
xor ecx, ecx
add esp, 0xc
cmp eax, 0xffffffff
cmove eax, ecx
ret
push ecx
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.100ba32e
add esp, 0x10
ret
Function at 0x100368b0
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x10125a94]
xor eax, esp
mov dword [esp + 0x104], eax
mov ecx, dword [esp + 0x10c]
mov edx, ecx
push ebx
push esi
push edi
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x100368d3
sub edx, esi
cmp edx, 0x104
jae 0x10036997
lea edx, [esp + 0xc]
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x100368f0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esp + 0xc], al
je 0x1003695a
lea esi, [esp + 0xc]
cmp byte [esp + 0xd], al
je 0x1003694d
nop dword [eax]
mov al, byte [esi]
cmp al, 0x2f
je 0x1003692a
cmp al, 0x5c
jne 0x10036946
push 0
lea eax, [esp + 0x10]
mov byte [esi], 0
push eax
call ebx
test eax, eax
jne 0x10036943
call edi
cmp eax, 0xb7
jne 0x10036997
mov byte [esi], 0x5c
inc esi
cmp byte [esi + 1], 0
jne 0x10036920
mov al, byte [esi]
cmp al, 0x2f
je 0x10036957
cmp al, 0x5c
jne 0x1003695a
mov byte [esi], 0
cmp dword [esp + 0x11c], 0
jne 0x1003697a
push 0
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
jne 0x1003697a
call edi
cmp eax, 0xb7
jne 0x10036997
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100aebeb
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100aebeb
add esp, 0x108
ret
Function at 0x1003fe10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x10125a94]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x7c]
push edi
test byte [esi + 0x30], 2
je 0x1003ff0b
mov edi, dword [esp + 0x88]
sub edi, dword [esi + 0x1c]
push 0xffffffffffffffff
push 1
push esi
mov dword [esp + 0x20], edi
call fcn.1003fc60
mov eax, dword [esi + 0x14]
add esp, 0xc
test byte [eax + 8], 1
jne 0x1003ff04
cmp dword [eax + 0x14], 0
je 0x1003ff01
dec dword [eax + 0x14]
mov edi, dword [esi + 0x3c]
test edi, edi
je 0x1003fef0
cmp byte [esi + 0x31], 0
je 0x1003fef0
mov eax, dword [esi + 0x14]
mov ebp, dword [esi + 8]
sub ebp, dword [esi + 0x1c]
mov eax, dword [eax + 4]
sub eax, dword [esi + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
sub eax, dword [esi + 8]
mov dword [esp + 0x18], 4
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x74], 0
cmp eax, 0xa0
jg 0x1003feb9
push 0x14
push esi
call fcn.1003fd40
add esp, 8
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 8]
add ecx, 0xa0
mov dword [eax + 4], ecx
lea eax, [esp + 0x18]
push eax
push esi
mov byte [esi + 0x31], 0
call edi
mov eax, dword [esi + 0x14]
add esp, 8
mov ecx, dword [esi + 0x1c]
add ecx, dword [esp + 0x10]
mov byte [esi + 0x31], 1
mov dword [eax + 4], ecx
mov eax, dword [esi + 0x1c]
add eax, ebp
mov dword [esi + 8], eax
mov eax, dword [esi + 0x14]
cmp dword [eax + 0x14], 0
jne 0x1003fe62
mov edi, dword [esp + 0x14]
dec dword [eax + 0x14]
mov ebp, dword [esi + 0x1c]
add ebp, edi
jmp 0x1003ff12
mov ebp, dword [esp + 0x88]
add dword [esi + 0x14], 0xffffffe8
mov eax, dword [esi + 0x14]
mov edi, dword [esi + 0xc]
mov ebx, dword [esp + 0x84]
sub edi, 8
mov eax, dword [eax]
mov dword [esi + 0xc], eax
test ebx, ebx
je 0x1003ff60
nop
cmp ebp, dword [esi + 8]
jae 0x1003ff4e
mov ecx, ebp
mov edx, edi
add edi, 8
add ebp, 8
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
sub ebx, 1
jne 0x1003ff30
test ebx, ebx
jle 0x1003ff60
dec ebx
mov dword [edi], 0
add edi, 8
test ebx, ebx
jg 0x1003ff52
mov ecx, dword [esp + 0x78]
mov dword [esi + 8], edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100aebeb
add esp, 0x6c
ret