joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f5d0
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b5948
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4e706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 1
push str.MBSetup
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edi, eax
test edi, edi
jne 0x45f6c4
lea ecx, [ebp - 0x30]
call fcn.0045f3e0
mov dword [ebp - 4], edi
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x45f62d
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.d:jenkinsworkspace_n_sucommon_src_sucommon_setuputilities.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x231
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Error_on_WinHttpOpen:
mov ecx, eax
call fcn.0040f7a0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.00418700
push eax
call fcn.0040fb10
mov edx, dword [ebp - 0x1c]
add esp, 4
cmp edx, 8
jb 0x45f6c0
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45f6b6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f746
push edx
push ecx
call fcn.0046f0d0
add esp, 8
xor eax, eax
jmp 0x45f72b
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
lea eax, [ebp - 0x14]
push 4
push eax
push 0x54
push edi
mov dword [ebp - 0x18], 0x2a0
mov dword [ebp - 0x14], 0xaa0
call esi
test eax, eax
jne 0x45f729
push 4
lea eax, [ebp - 0x18]
push eax
push 0x54
push edi
call esi
test eax, eax
jne 0x45f729
mov edx, str.Error_on_WinHttpSetOption_SECURE_PROTOCOLS_:
mov ecx, 0x4eb558
call fcn.0040f7a0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.00418700
push eax
call fcn.0040fb10
add esp, 4
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor eax, eax
jmp 0x45f72b
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ebaf
mov esp, ebp
pop ebp
ret
call fcn.0048a05c
int3
Function at 0x471d26
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4a093b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a05e2

Function at 0x4a0946
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a076c
Function at 0x10006731
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
or ebx, 0xffffffff
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
cmp dword [ebp + 8], ebx
jne 0x10006752
xor eax, eax
jmp 0x100068d3
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x10006780
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x10006780
mov eax, dword [ebp + 8]
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x100068d3
cmp dword [esi + 0x50], 0
je 0x100068d1
mov ecx, esi
call fcn.1000795c
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [esi + 0x40], ecx
jne 0x100067b4
push dword [esi + 0x50]
movsx eax, al
push eax
call fcn.10013114
cmp eax, ebx
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
jmp 0x100068d1
push ecx
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
push 8
mov byte [esp + 0x1b], al
mov dword [esp + 0x44], 0xf
call fcn.100098ca
lea eax, [esi + 0x48]
mov dword [esp + 0x18], eax
mov edi, dword [esp + 0x3c]
mov esi, dword [esi + 0x40]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x2c]
cmp edi, 0x10
lea edx, [esp + 0x2c]
mov edi, dword [esi]
cmovae ecx, dword [esp + 0x2c]
cmovae edx, dword [esp + 0x2c]
add eax, ecx
push eax
push edx
lea eax, [esp + 0x30]
mov ecx, esi
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x27]
push eax
push dword [esp + 0x30]
call dword [edi + 0x1c]
test eax, eax
js 0x100068c4
cmp eax, 1
jg 0x100068a5
mov edi, dword [esp + 0x3c]
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x28]
cmp edi, 0x10
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
cmovae eax, ecx
sub edx, eax
mov dword [esp + 0x20], edx
je 0x10006872
push dword [esi + 0x50]
cmp edi, 0x10
lea eax, [esp + 0x2c]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.100102d1
mov edx, dword [esp + 0x30]
add esp, 0x10
cmp edx, eax
jne 0x100068c4
mov edi, dword [esp + 0x3c]
lea eax, [esp + 0x13]
mov byte [esi + 0x45], 1
cmp dword [esp + 0x24], eax
jne 0x100068a0
test edx, edx
jne 0x100067df
cmp dword [esp + 0x38], 0x20
jae 0x100068c4
push edx
push 8
lea ecx, [esp + 0x30]
call fcn.1000308d
jmp 0x100067db
mov ebx, dword [ebp + 8]
jmp 0x100068c4
cmp eax, 3
jne 0x100068c4
mov eax, dword [esp + 0x14]
push dword [eax + 0x50]
movsx eax, byte [esp + 0x17]
push eax
call fcn.10013114
cmp eax, ebx
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.100022c0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100077e4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x40], 0
je 0x100078ee
cmp byte [ebx + 0x45], 0
je 0x100078ee
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x10007819
xor al, al
jmp 0x100078f0
xor eax, eax
mov dword [esp + 0x24], 0xf
push eax
push 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
mov byte [esp + 0x18], al
call fcn.100098ca
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
cmp ecx, 0x10
lea eax, [esp + 0xc]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x10]
push eax
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x14]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10007879
dec eax
je 0x1000787d
dec eax
dec eax
je 0x100078db
xor bl, bl
jmp 0x100078dd
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
mov edx, dword [esp + 0x10]
cmp ecx, 0x10
mov esi, dword [esp + 0xc]
cmovae eax, edx
sub esi, eax
je 0x100078bc
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x14]
push esi
cmovae eax, edx
push 1
push eax
call fcn.100102d1
add esp, 0x10
cmp esi, eax
jne 0x10007875
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
cmp byte [ebx + 0x45], 0
je 0x100078db
test esi, esi
jne 0x1000783f
push esi
push 8
lea ecx, [esp + 0x18]
call fcn.1000308d
jmp 0x10007837
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.100022c0
mov al, bl
jmp 0x100078f0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000ca57
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10054c0b

Function at 0x1000ca91
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10054980

Function at 0x1000ce7b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10052e26

Function at 0x1000d3d5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10051981
Function at 0x100447a3
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx], 0
and dword [ecx + 4], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
ret
Function at 0x10045346
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
and dword [ecx], 0
and dword [ecx + 4], 0
test edx, edx
jne 0x1004538b
mov dword [ecx + 8], 0x6a09e667
mov dword [ecx + 0xc], 0xbb67ae85
mov dword [ecx + 0x10], 0x3c6ef372
mov dword [ecx + 0x14], 0xa54ff53a
mov dword [ecx + 0x18], 0x510e527f
mov dword [ecx + 0x1c], 0x9b05688c
mov dword [ecx + 0x20], 0x1f83d9ab
mov dword [ecx + 0x24], 0x5be0cd19
jmp 0x100453c3
mov dword [ecx + 8], 0xc1059ed8
mov dword [ecx + 0xc], 0x367cd507
mov dword [ecx + 0x10], 0x3070dd17
mov dword [ecx + 0x14], 0xf70e5939
mov dword [ecx + 0x18], 0xffc00b31
mov dword [ecx + 0x1c], 0x68581511
mov dword [ecx + 0x20], 0x64f98fa7
mov dword [ecx + 0x24], 0xbefa4fa4
mov dword [ecx + 0x68], edx
ret
Function at 0x100463e5
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
add eax, 0xc
mov dword [ebp - 0xc], eax
mov ecx, dword [eax]
cmp ecx, eax
je 0x100464fe
lea edi, [ecx]
mov ecx, dword [ecx]
push dword [edi + 0x30]
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0x58]
push dword [edi + 0x2c]
call fcn.100477bd
cmp dword [ebp - 0x44], 0x10
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
cmovae ecx, dword [ebp - 0x58]
call fcn.10047813
cmp eax, 0x922264df
jne 0x100464e6
cmp edx, 0x7c1c4fd9
jne 0x100464e6
mov edi, dword [edi + 0x18]
mov ecx, 0x14c
mov eax, dword [edi + 0x3c]
lea esi, [edi + 0x80]
cmp word [eax + edi + 4], cx
je 0x10046463
lea esi, [edi + 0x90]
add esi, eax
mov esi, dword [esi]
add esi, edi
jmp 0x100464df
cmp byte [eax + edi], 0
lea ecx, [eax + edi]
mov dword [ebp - 0x10], ecx
je 0x100464dc
mov eax, dword [esi]
test eax, eax
je 0x10046486
mov ebx, dword [esi + 0x10]
add eax, edi
add ebx, edi
jmp 0x1004648d
mov eax, dword [esi + 0x10]
add eax, edi
mov ebx, eax
cmp dword [eax], 0
je 0x100464dc
sub eax, ebx
mov dword [ebp - 4], eax
mov ecx, dword [eax + ebx]
test ecx, ecx
js 0x100464d3
add ecx, 2
add ecx, edi
call fcn.10047813
mov ecx, eax
mov eax, edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
cmp ecx, 0xbf132508
jne 0x100464c1
cmp eax, 0x425796db
je 0x10046507
cmp ecx, 0x4ddfee2b
jne 0x100464d0
cmp eax, 0xb402ea38
je 0x10046507
mov eax, dword [ebp - 4]
add ebx, 4
cmp dword [eax + ebx], 0
jne 0x10046497
add esi, 0x14
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x1004646b
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.100022c0
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jne 0x10046407
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x70]
mov edx, esi
mov dword [ebp - 0x28], 0x4c454853
mov dword [ebp - 0x24], 0x2e32334c
mov dword [ebp - 0x20], 0x6c6c64
call fcn.100478b4
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.100478b4
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
push eax
push dword [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x70]
call fcn.10001e66
test eax, eax
je 0x100465b8
push esi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov ecx, esi
call fcn.10049187
test al, al
je 0x100465b4
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov edi, eax
mov edx, esi
lea eax, [ebp - 0x28]
mov ecx, edi
push 0xc
push eax
call fcn.10047904
pop ecx
pop ecx
test al, al
je 0x100465b4
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push dword [ebp - 0x14]
mov dl, 1
mov ecx, eax
push dword [ebp - 0x18]
call fcn.100492fa
mov dword [ebp - 0x1c], eax
mov edx, ebx
lea eax, [ebp - 0x1c]
mov ecx, edi
push 4
push eax
call fcn.10047904
add esp, 0x10
test al, al
jne 0x100465b8
xor bl, bl
jmp 0x100465ba
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.100022c0
push 0
push 1
lea ecx, [ebp - 0x70]
call fcn.100022c0
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.100022c0
mov al, bl
jmp 0x10046500
Function at 0x10046830
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push 3
xor esi, esi
push esi
push str.SoftwareValveSteamActiveProcess
push 0x80000001
call edi
test eax, eax
jne 0x10046902
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp byte [0x100a05c0], al
je 0x1004688f
mov ecx, 0x100a05c0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10046870
sub ecx, edx
lea eax, [ecx + 1]
push eax
push 0x100a05c0
push 1
push esi
push str.SteamClientDll
push dword [ebp - 4]
call ebx
cmp dword [0x100a02b4], esi
je 0x100468ab
push 4
push 0x100a02b4
push 4
push esi
push 0x10060310
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 4]
push eax
push 3
push 0
push str.SoftwareValveSteam
push 0x80000001
call edi
test eax, eax
jne 0x10046901
cmp byte [0x100a02b8], al
je 0x100468fc
mov edi, 0x100a02b8
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100468e0
sub ecx, edx
lea eax, [ecx + 1]
push eax
push edi
push 1
push 0
push str.SteamPath
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
call esi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10046908
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
and dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
push eax
push 3
push 0
push 0x1006022c
mov edi, 0x80000001
mov dword [ebp - 0x10], ecx
push edi
mov esi, edx
call ebx
test eax, eax
je 0x10046963
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push 3
push eax
push eax
push eax
push 0x10060250
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x10046963
xor al, al
jmp 0x10046af2
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
push 0x100a05c0
xor ecx, ecx
mov dword [ebp - 8], 0x208
push ecx
push ecx
push 0x10060274
push dword [ebp - 4]
mov byte [0x100a05c0], cl
call edi
movzx ecx, byte [0x100a05c0]
xor edx, edx
test eax, eax
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
cmovne ecx, edx
push 0x100a02b4
mov byte [0x100a05c0], cl
xor ecx, ecx
push ecx
push ecx
push 0x10060284
push dword [ebp - 4]
mov dword [0x100a02b4], ecx
call edi
mov ecx, dword [0x100a02b4]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [0x100a02b4], ecx
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100469dd
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push 0x10060288
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1004695c
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x10060298
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1004695c
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 4]
push eax
push 3
push 0
push 0x1006029c
push 0x80000001
call ebx
test eax, eax
jne 0x1004695c
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
push 0x100a02b8
xor ebx, ebx
push ebx
push ebx
push 0x100602b4
push dword [ebp - 4]
mov byte [0x100a02b8], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movzx ecx, byte [0x100a02b8]
xor edx, edx
test eax, eax
lea eax, [ebp - 0x218]
push 0x104
cmovne ecx, edx
push eax
mov byte [0x100a02b8], cl
call fcn.10011ba8
push str.Steam
push 0x5c
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x114]
push 0x100602c8
push eax
call fcn.10011765
lea ecx, [ebp - 0x114]
add esp, 0x1c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10046ac2
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x114]
push eax
push 1
push ebx
push 0x100602d0
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1004695c
push dword [ebp - 4]
call esi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10046af9
Capabilities:
Get common file path
Get program files directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push eax
xor eax, eax
push eax
push eax
push 0x26
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x108]
dec ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x10046b2b
mov eax, dword [0x10060188]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0x1006018c]
mov dword [ecx + 4], eax
mov al, byte [ebx]
inc ebx
test al, al
jne 0x10046b44
lea edi, [ebp - 0x108]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10046b54
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
xor ebx, ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
movzx eax, word [ecx + 0x100a1a20]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x416], ax
test ax, ax
jne 0x10046b6e
lea edi, [ebp - 0x414]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x10046b8e
push 8
pop ecx
sub esp, 0x18
lea eax, [ebp + 8]
mov esi, str.steamclient.dll
rep movsd dword es:[edi], dword [esi]
mov ecx, esp
push eax
call fcn.1000285d
sub esp, 0x18
lea eax, [ebp - 0x414]
mov ecx, esp
push eax
call fcn.10002d0c
call fcn.10049022
add esp, 0x30
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
lea edx, [ebp - 0x61c]
cmovae ecx, dword [ebp + 8]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10046bdc
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor ecx, ecx
lea edi, [ebp - 0x61c]
sub edi, 2
mov word [eax], cx
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x10046c08
push 0xc
pop ecx
mov esi, 0x100601b0
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
movzx eax, word [ecx + 0x100a1a20]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x416], ax
test ax, ax
jne 0x10046c20
lea edi, [ebp - 0x414]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x10046c40
push 0xc
pop ecx
sub esp, 0x18
lea eax, [ebp - 0x61c]
mov esi, str.GameOverlayRenderer.dll
rep movsd dword es:[edi], dword [esi]
mov ecx, esp
push eax
call fcn.10002d0c
sub esp, 0x18
lea eax, [ebp - 0x414]
mov ecx, esp
push eax
call fcn.10002d0c
call fcn.10049022
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x108]
add esp, 0x30
call fcn.10046908
test al, al
je 0x10046ce2
call fcn.100465e5
test al, al
je 0x10046ce2
push dword [0x100a16f0]
lea eax, [ebp - 0x20c]
push 0x10060210
push eax
call fcn.10011765
mov esi, dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
lea eax, [ebp - 0x20c]
add esp, 0xc
push eax
push str.SteamAppID
call esi
lea eax, [ebp - 0x20c]
push eax
push str.SteamGameId
call esi
call fcn.100466ad
test al, al
je 0x10046ce2
mov bl, 1
xor eax, eax
lea ecx, [ebp + 8]
push eax
push 1
call fcn.10002b9c
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100470c7
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
mov esi, ecx
push edi
test esi, esi
je 0x1004711d
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100470d8
sub ecx, edx
cmp ecx, 1
jne 0x100470eb
cmp byte [esi], 0x2f
je 0x1004711d
push esi
call fcn.100122bb
pop ecx
mov ecx, eax
call fcn.1004774a
mov edi, eax
test edi, edi
je 0x10047116
lea eax, [ebp - 0x30]
push eax
push edi
call fcn.1001230b
pop ecx
pop ecx
test eax, eax
je 0x10047116
mov ecx, edi
call fcn.100470c7
push esi
call fcn.10012351
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10047123
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push edx
push ecx
push str.Internal_error_0x_02X:__s_
push eax
call fcn.10011765
add esp, 0x10
lea eax, [ebp - 0x104]
push 0x10
push str.Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.100122a7
int3
Function at 0x10047160
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
xor eax, eax
push esi
push edi
push edx
push eax
push eax
push 0x2e
push eax
mov edi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x1004738d
push 0x104
mov esi, 0x100a01b0
push esi
call fcn.10011ba8
push 0x1005fffc
push 0x5c
push esi
lea eax, [ebp - 0x108]
push 0x1006000c
push eax
call fcn.10011765
add esp, 0x1c
push 0x24
call fcn.10011057
mov esi, eax
pop ecx
test esi, esi
je 0x100471d7
sub esp, 0x18
lea eax, [ebp - 0x108]
mov ecx, esp
push eax
call fcn.10001fad
mov ecx, esi
call fcn.1004bf51
jmp 0x100471d9
xor eax, eax
cmp byte [eax], 0
mov dword [0x100a07e8], eax
jne 0x10047336
push 0x104
mov esi, 0x100a01b0
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x10060014
push 0x5c
push esi
lea eax, [ebp - 0x108]
push 0x10060024
push eax
call fcn.10011765
mov esi, dword [0x100a07e8]
add esp, 0x14
test esi, esi
je 0x10047242
lea ecx, [esi + 0x1c]
call fcn.10002885
push 0
push 1
lea ecx, [esi + 4]
call fcn.100022c0
push esi
call fcn.1001102c
pop ecx
push 0x24
call fcn.10011057
mov esi, eax
pop ecx
test esi, esi
je 0x1004726a
sub esp, 0x18
lea eax, [ebp - 0x108]
mov ecx, esp
push eax
call fcn.10001fad
mov ecx, esi
call fcn.1004bf51
jmp 0x1004726c
xor eax, eax
cmp byte [eax], 0
mov dword [0x100a07e8], eax
jne 0x10047336
test edi, edi
je 0x10047310
push 0x104
mov esi, 0x100a01b0
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.steam_emu.ini
push 0x5c
push esi
lea eax, [ebp - 0x108]
push 0x1006003c
push eax
call fcn.10011765
mov esi, dword [0x100a07e8]
add esp, 0x14
test esi, esi
je 0x100472dc
lea ecx, [esi + 0x1c]
call fcn.10002885
push 0
push 1
lea ecx, [esi + 4]
call fcn.100022c0
push esi
call fcn.1001102c
pop ecx
push 0x24
call fcn.10011057
mov esi, eax
pop ecx
test esi, esi
je 0x10047304
sub esp, 0x18
lea eax, [ebp - 0x108]
mov ecx, esp
push eax
call fcn.10001fad
mov ecx, esi
call fcn.1004bf51
jmp 0x10047306
xor eax, eax
cmp byte [eax], 0
mov dword [0x100a07e8], eax
jne 0x10047336
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x210]
push str.Ini_file_not_found_at__s
push eax
call fcn.10011765
xor ecx, ecx
lea edx, [ebp - 0x210]
add esp, 0xc
inc ecx
jmp 0x10047395
push 0x1230
push 0
push 0x100a07f0
call fcn.100171c0
add esp, 0xc
push 0
sub esp, 0x18
mov ecx, esp
push str.AppId
call fcn.10001fad
sub esp, 0x18
mov ecx, esp
push 0x10060068
call fcn.10001fad
mov ecx, dword [0x100a07e8]
call fcn.1004c37d
mov dword [0x100a16f0], eax
test eax, eax
jne 0x10047387
mov edx, str.Config_error_
push 5
jmp 0x10047394
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, str.System_error
push 6
pop ecx
call fcn.10047123
int3
Function at 0x10047ca9
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
sub esp, 0x22c
push ebx
push esi
mov esi, dword [eax + 0xc]
add esi, 0xc
push edi
mov edi, dword [esi]
jmp 0x10047d02
mov ebx, edi
lea ecx, [ebp - 0x20]
mov edi, dword [edi]
mov dword [ebp - 4], ebx
push dword [ebx + 0x30]
push dword [ebx + 0x2c]
call fcn.100477bd
cmp dword [ebp - 0xc], 0x10
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
cmovae ecx, dword [ebp - 0x20]
call fcn.10047813
cmp eax, dword [ebp + 8]
jne 0x10047cf6
cmp edx, dword [ebp + 0xc]
je 0x10047d0b
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.100022c0
cmp edi, esi
jne 0x10047cc5
jmp 0x10047d9f
mov esi, 0x208
lea eax, [ebp - 0x228]
push esi
push eax
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push esi
mov ebx, eax
call fcn.100127a5
mov edi, eax
mov edx, 0x100a1a20
mov esi, edi
mov dword [ebp - 8], edi
pop ecx
sub esi, edx
movzx ecx, word [edx]
mov word [esi + edx], cx
lea edx, [edx + 2]
test cx, cx
jne 0x10047d45
mov esi, ebx
xor ecx, ecx
mov ax, word [ebx]
add ebx, 2
cmp ax, cx
jne 0x10047d58
sub ebx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x10047d68
push dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, ebx
shr ecx, 2
add eax, 0x24
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor eax, eax
lea ecx, [ebp - 0x20]
push eax
push 1
call fcn.100022c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret