joyce8/EMBER2024-capa huggingface dataset:
Function at 0x549bf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 3]
test ecx, ecx
je 0x549dd1
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 2]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 9
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x1a
ja case.0x549c2c.1
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + 0x549de4]
jmp dword [eax*4 + 0x549dd8]
mov byte [ebp - 1], 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.006ccb90
add esp, 4
mov edx, dword [ebp + 8]
push edx
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.006cf670
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
call fcn.006ccb90
add esp, 4
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + eax + 0xe], 0
jne 0x549c9e
mov dword [ebp - 8], 0
mov edx, dword [ebp + 8]
push edx
push 1
push 4
lea eax, [ebp - 8]
push eax
call fcn.006cf670
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
call fcn.006ccb90
add esp, 4
jmp 0x549d07
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax + 0xe]
push edx
call fcn.006b6c40
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
push 1
push 4
lea ecx, [ebp - 8]
push ecx
call fcn.006cf670
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
call fcn.006ccb90
add esp, 4
mov eax, dword [ebp + 8]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax + 0xe]
push edx
call fcn.006cf670
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call fcn.006ccb90
add esp, 4
jmp case.0x549c2c.1
mov byte [ebp - 1], 2
mov ecx, dword [ebp + 8]
push ecx
push 1
push 1
lea edx, [ebp - 1]
push edx
call fcn.006cf670
add esp, 0x10
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx + 0xe]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00537040
add esp, 8
mov edx, dword [ebp + 0xc]
mov al, byte [edx + 4]
mov byte [ebp - 0x10], al
cmp byte [ebp - 0x10], 0xc
je 0x549d54
cmp byte [ebp - 0x10], 0x12
je 0x549d54
jmp 0x549dd1
mov byte [ebp - 1], 1
mov ecx, dword [ebp + 8]
push ecx
push 1
push 1
lea edx, [ebp - 1]
push edx
call fcn.006cf670
add esp, 0x10
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x36], 0
jne 0x549d92
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 8]
push ecx
push 1
push 4
lea edx, [ebp - 8]
push edx
call fcn.006cf670
add esp, 0x10
jmp 0x549dd1
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x36]
push ecx
call fcn.006b6c40
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
push edx
push 1
push 4
lea eax, [ebp - 8]
push eax
call fcn.006cf670
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x36]
push ecx
call fcn.006cf670
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x54fc00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
mov eax, dword [ebp - 4]
add eax, 0x1c
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.USER32.dll_FillRect]
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
push 0x189
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x114]
push ecx
call fcn.006b6c40
add esp, 4
push eax
lea edx, [ebp - 0x114]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
add ecx, 2
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
add eax, 0x14
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
push 0x7ff7
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x14], eax
push 0xcc0020
push 0
mov ecx, dword [ebp - 4]
imul edx, dword [ecx + 0x2c], 0xd
push edx
mov eax, dword [ebp - 8]
push eax
push 0xc
push 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
add edx, 2
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
add ecx, 2
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
and eax, 0x10
je 0x54fd44
mov ecx, dword [ebp - 4]
add ecx, 0x1c
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x5520d0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x1b3176c], 0
je 0x552225
cmp dword [ebp + 8], 0
je 0x552225
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00551f70
add esp, 8
test eax, eax
je 0x552225
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 0xc], al
cmp byte [ebp - 0xc], 2
je 0x552122
jmp 0x552225
mov ecx, dword [0x1b3187c]
push ecx
push 2
push 0x1102
mov edx, dword [0x1b3176c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x15da91c]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push str.c:Fallen
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [0x199df0c]
add ecx, 4
push ecx
call fcn.00555020
add esp, 4
mov dword [0x15da968], eax
cmp dword [0x15da968], 0
je 0x5521d6
mov dword [0x15da984], 0x4000
mov dword [0x15da98c], 0x4000
mov dword [0x15da990], 0xe00
mov dword [0x15da980], 0x640
mov dword [0x15da97c], 0
call fcn.0053d490
push 0
mov edx, dword [0x15da980]
push edx
mov eax, dword [0x15da97c]
push eax
mov ecx, dword [0x15da978]
push ecx
mov edx, dword [0x15da974]
push edx
mov eax, dword [0x15da970]
push eax
call fcn.00555090
add esp, 0x18
mov ecx, dword [0x15da814]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
mov edx, dword [0x1b3187c]
push edx
push 4
push 0x110a
mov eax, dword [0x1b3176c]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x55221e
mov ecx, dword [ebp - 4]
push ecx
push 9
push 0x110b
mov edx, dword [0x1b3176c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
jmp 0x552227
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x552fd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x15da91c]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0x717e54
push 0x1b31da8
call fcn.00690360
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x553162
mov byte [ebp - 1], 8
mov ecx, dword [ebp - 8]
push ecx
push 1
push 1
lea edx, [ebp - 1]
push edx
call fcn.006cf670
add esp, 0x10
mov dword [ebp - 0xc], 0x14
mov eax, dword [ebp - 8]
push eax
push 1
push 4
lea ecx, [ebp - 0xc]
push ecx
call fcn.006cf670
add esp, 0x10
mov dword [ebp - 0xc], 0x1d0
mov edx, dword [ebp - 8]
push edx
push 1
push 4
lea eax, [ebp - 0xc]
push eax
call fcn.006cf670
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
push 0x14
push 0x1d0
push 0x1b2df10
call fcn.006cf670
add esp, 0x10
mov dword [ebp - 0xc], 0x64
mov edx, dword [ebp - 8]
push edx
push 1
push 4
lea eax, [ebp - 0xc]
push eax
call fcn.006cf670
add esp, 0x10
mov dword [ebp - 0xc], 0x200
mov ecx, dword [ebp - 8]
push ecx
push 1
push 4
lea edx, [ebp - 0xc]
push edx
call fcn.006cf670
add esp, 0x10
mov dword [ebp - 0xc], 0x9a21
mov eax, dword [ebp - 8]
push eax
push 1
push 4
lea ecx, [ebp - 0xc]
push ecx
call fcn.006cf670
add esp, 0x10
mov dword [ebp - 0x10], 0
jmp 0x5530ca
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x64
jae 0x553156
mov eax, dword [ebp - 8]
push eax
push 1
push 0x9a21
imul ecx, dword [ebp - 0x10], 0x9a21
add ecx, 0x15daa28
push ecx
call fcn.006cf670
add esp, 0x10
mov dword [ebp - 0x14], 0
jmp 0x553107
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x200
jae 0x553131
imul eax, dword [ebp - 0x10], 0x9a21
imul ecx, dword [ebp - 0x14], 0x4a
lea edx, [eax + ecx + 0x15daf48]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00549bf0
add esp, 8
jmp 0x5530fe
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x4000
mov edx, dword [ebp - 0x10]
shl edx, 0xe
add edx, 0x199df10
push edx
call fcn.006cf670
add esp, 0x10
jmp 0x5530c1
mov eax, dword [ebp - 8]
push eax
call fcn.0068fac0
add esp, 4
mov ecx, dword [0x15da814]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x1b31768], 0
call fcn.0053f450
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x5549a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 1
push 0x717e54
mov eax, dword [ebp + 8]
push eax
call fcn.00690360
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x554aab
push 0x1b83cc8
call fcn.00554b10
add esp, 4
mov dword [ebp - 4], 0
jmp 0x5549ea
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x100
jge 0x554a0d
imul edx, dword [ebp - 4], 0x14
movsx eax, byte [edx + 0x1b83ccb]
and eax, 0xfffffffe
imul ecx, dword [ebp - 4], 0x14
mov byte [ecx + 0x1b83ccb], al
jmp 0x5549e1
mov edx, dword [ebp - 0xc]
shl edx, 0x10
or edx, 0x14
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0x100
mov dword [ebp - 0x10], 3
mov eax, dword [ebp - 8]
push eax
push 1
push 0xc
lea ecx, [ebp - 0x18]
push ecx
call fcn.006cf670
add esp, 0x10
cmp eax, 1
je 0x554a44
jmp 0x554a9b
mov edx, dword [ebp - 8]
push edx
push 1
push 0x1428
push 0x1b83cc8
call fcn.006cf670
add esp, 0x10
cmp eax, 1
je 0x554a65
jmp 0x554a9b
mov eax, dword [ebp - 8]
push eax
call fcn.0068fac0
add esp, 4
mov dword [0x1b83cc0], 0
mov dword [0x1b332bc], 0
mov dword [0x1b83cc4], 0xffffffff
call fcn.00554e20
mov eax, 1
jmp 0x554aad
mov ecx, dword [ebp - 8]
push ecx
call fcn.0068fac0
add esp, 4
xor eax, eax
jmp 0x554aad
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x557600
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.00554f10
test eax, eax
je 0x557665
push 0x33
push str.Load_a_new_map
push str.Save_changes_to_current_map_
mov eax, dword [0x1b851bc]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x557640
cmp dword [ebp - 4], 6
je 0x55763c
cmp dword [ebp - 4], 7
je 0x55763e
jmp 0x557645
jmp 0x557665
jmp 0x557665
jmp 0x55775a
mov ecx, 1
test ecx, ecx
je 0x557665
push 0x495
push str.C:devworkspaces_repo_clonesClean_UrbanChaosMuckyFoot_UrbanChaos_fallenLeditSourceledit.cpp
push str.ASSERT_TRIGGERED
call fcn.0049b8f0
add esp, 0xc
mov edx, dword [0x1b85208]
push edx
call dword [sym.imp.USER32.dll_SetCursor]
push 0x1b85330
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [ebp + 8]
push eax
call fcn.00555020
add esp, 4
mov dword [0x1b8532c], eax
mov dword [0x1b85438], 1
mov dword [0x1b85454], 0
cmp dword [0x1b8532c], 0
je 0x5576be
mov ecx, dword [ebp + 8]
push ecx
push 0x1b85228
call fcn.006b6b40
add esp, 8
jmp 0x5576d0
push str.No_map_loaded
push 0x1b85228
call fcn.006b6b40
add esp, 8
call fcn.00554410
call fcn.00557f30
mov dword [0x1b85944], 0x4000
mov dword [0x1b85948], 0x4000
mov dword [0x1b8594c], 0xa00
mov dword [0x1b85940], 0x640
mov dword [0x1b8593c], 0
call fcn.00555200
push 0
mov edx, dword [0x1b85940]
push edx
mov eax, dword [0x1b8593c]
push eax
mov ecx, dword [0x1b85834]
push ecx
mov edx, dword [0x1b8572c]
push edx
mov eax, dword [0x1b85624]
push eax
call fcn.00555090
add esp, 0x18
push 0
push 0
mov ecx, dword [0x1b851c0]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [0x1b85204]
push edx
call dword [sym.imp.USER32.dll_SetCursor]
mov esp, ebp
pop ebp
ret
Function at 0x562210
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x210]
push ecx
call fcn.00401830
mov edx, dword [eax]
or edx, 1
mov eax, dword [eax + 4]
push eax
push edx
call fcn.006b69c0
add esp, 0x1c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x562261
mov dword [ebp - 0x10], 0xffffffff
jmp 0x562267
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esp, ebp
pop ebp
ret
Function at 0x567710
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x716764
mov eax, dword [ebp + 8]
push eax
call fcn.00690360
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x567737
xor eax, eax
jmp 0x5677eb
mov ecx, dword [ebp - 4]
push ecx
push 1
push 8
lea edx, [ebp - 0xc]
push edx
call fcn.006b7750
add esp, 0x10
cmp eax, 1
je 0x56775a
jmp 0x5677dd
cmp dword [ebp - 0xc], 2
jne 0x567769
cmp dword [ebp - 8], 0x17400
je 0x567779
mov eax, dword [ebp - 4]
push eax
call fcn.0068fac0
add esp, 4
xor eax, eax
jmp 0x5677eb
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x17400
push 0x223e8a8
call fcn.006b7750
add esp, 0x10
cmp eax, 1
je 0x56779a
jmp 0x5677dd
mov edx, dword [ebp - 4]
push edx
call fcn.0068fac0
add esp, 4
push 0x223e8a8
call fcn.00567fb0
add esp, 4
mov dword [0x223e89c], 0
mov dword [0x223e898], 0
mov dword [0x223e8a0], 0xffffffff
call fcn.00568040
mov eax, 1
jmp 0x5677eb
mov eax, dword [ebp - 4]
push eax
call fcn.0068fac0
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x567aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x717e54
mov eax, dword [ebp + 8]
push eax
call fcn.00690360
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x567ac7
xor eax, eax
jmp 0x567b64
mov dword [ebp - 0xc], 2
mov dword [ebp - 8], 0x17400
push 0x223e8a8
call fcn.00567e70
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
push 1
push 8
lea edx, [ebp - 0xc]
push edx
call fcn.006cf670
add esp, 0x10
cmp eax, 1
je 0x567aff
jmp 0x567b56
mov eax, dword [ebp - 4]
push eax
push 1
push 0x17400
push 0x223e8a8
call fcn.006cf670
add esp, 0x10
cmp eax, 1
je 0x567b20
jmp 0x567b56
mov ecx, dword [ebp - 4]
push ecx
call fcn.0068fac0
add esp, 4
mov dword [0x223e89c], 0
mov dword [0x223e898], 0
mov dword [0x223e8a0], 0xffffffff
call fcn.00568040
mov eax, 1
jmp 0x567b64
mov edx, dword [ebp - 4]
push edx
call fcn.0068fac0
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x569730
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x226d120]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0x226d240
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp + 8]
push ecx
call fcn.00555020
add esp, 4
mov dword [0x226d134], eax
cmp dword [0x226d134], 0
je 0x56977a
mov edx, dword [ebp + 8]
push edx
push 0x226d138
call fcn.006b6b40
add esp, 8
jmp 0x56978c
push str.No_map_loaded
push 0x226d138
call fcn.006b6b40
add esp, 8
mov dword [0x226d820], 3
mov dword [0x226d81c], 0
mov dword [0x226d824], 1
mov dword [0x226d830], 0
mov dword [0x226d828], 0
mov dword [0x226d850], 0x4000
mov dword [0x226d854], 0x800
mov dword [0x226d858], 0x4000
mov dword [0x226d85c], 0xa00
mov dword [0x226d84c], 0x640
mov dword [0x226d848], 0
call fcn.00568160
push 0
mov eax, dword [0x226d84c]
push eax
mov ecx, dword [0x226d848]
push ecx
mov edx, dword [0x226d844]
push edx
mov eax, dword [0x226d840]
push eax
mov ecx, dword [0x226d83c]
push ecx
call fcn.00555090
add esp, 0x18
push 0
push 0
mov edx, dword [0x226d110]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [0x226d11c]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
call fcn.0056a0f0
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jmp 0x56985d
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x569869
jmp 0x569854
mov edx, 1
test edx, edx
je 0x56989d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jne 0x56987c
jmp 0x56989d
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x569892
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x56989d
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x569869
mov dword [ebp - 8], 0x226d710
mov edx, 1
test edx, edx
je 0x5698e2
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dl, byte [ecx]
mov byte [eax], dl
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0x2e
je 0x5698de
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
test edx, edx
jne 0x5698e0
jmp 0x5698e2
jmp 0x5698a4
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5b4320
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x254da60
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push str.__s___s___d_n
call fcn.004017c0
add esp, 0x10
push str.Secret
mov eax, dword [ebp + 0x10]
push eax
call fcn.006e37b0
add esp, 8
test eax, eax
je 0x5b4380
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.005b44b0
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x5b4390
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x254da60
push 0x104
push 0x254db68
push 0x717b43
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x254db68
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
push str.__s___s____s__n
call fcn.004017c0
add esp, 0x10
mov ecx, 1
imul edx, ecx, 0
movsx eax, byte [edx + 0x254db68]
test eax, eax
je 0x5b43ec
mov dword [ebp - 4], 0x254db68
jmp 0x5b43f3
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x5b4400
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x254da60
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x254da60
call fcn.006b6c40
add esp, 4
movsx eax, byte [eax + 0x254da5f]
cmp eax, 0x5c
je 0x5b443f
push 0x71faf8
push 0x254da60
call fcn.006b6b50
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
push 0x254da60
call fcn.006b6b50
add esp, 8
push 0x254da60
push str.Full_INI_file_pathname___s_n
call fcn.004017c0
add esp, 8
push 0x254da60
push 0
push str.local
push str.MuckyFoot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5b44a6
push str.c:_fallen.ini
push 0x254da60
call fcn.006b6b40
add esp, 8
push 0x254da60
push str.Using_local_INI_file__s_n
call fcn.004017c0
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x5c4cc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x727608
mov eax, dword [ebp + 8]
push eax
call fcn.00401720
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5c4cf7
push 0x11d
push str.C:devworkspaces_repo_clonesClean_UrbanChaosMuckyFoot_UrbanChaos_fallenSource_frontend.cpp
push str.ASSERT_TRIGGERED
call fcn.0049b8f0
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x5c4d4e
mov ecx, dword [ebp - 4]
push ecx
push 0x5000
push 1
push 0x25590d8
call fcn.006b7750
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x5000
jb 0x5c4d38
push 0x122
push str.C:devworkspaces_repo_clonesClean_UrbanChaosMuckyFoot_UrbanChaos_fallenSource_frontend.cpp
push str.ASSERT_TRIGGERED
call fcn.0049b8f0
add esp, 0xc
mov edx, dword [ebp - 8]
mov byte [edx + 0x25590d8], 0
mov eax, dword [ebp - 4]
push eax
call fcn.00401700
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x5c4f20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp dword [0x255ee38], 0
je 0x5c4f5f
movzx eax, byte [0x255e5d9]
imul ecx, eax, 0x14
add ecx, 0x255e1f0
cmp ecx, dword [ebp + 8]
jne 0x5c4f5f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0x7ff
cmp eax, 0x3ff
jae 0x5c4f5f
mov dword [ebp - 8], 1
jmp 0x5c4f66
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [0x256384c]
push eax
call fcn.005c8720
add esp, 8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x12]
movsx eax, word [0x255e62e]
add edx, eax
movsx ecx, word [0x255e5da]
sub edx, ecx
mov dword [ebp - 0x10], edx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0x80
je 0x5c4fd0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
and eax, 0xffffff7f
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0x10
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, 0x1000000
mov dword [ebp - 4], edx
jmp 0x5c4fd9
mov eax, dword [ebp - 4]
shl eax, 0x10
mov dword [ebp - 4], eax
push 0x19
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
movzx eax, byte [0x255ee44]
test eax, eax
je 0x5c5038
push 0xc0
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.00458370
add esp, 0x14
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x34]
push edx
push 0xc0
movzx eax, word [ebp - 0x10]
push eax
mov ecx, 0x26c
sub ecx, dword [ebp - 0x14]
push ecx
call fcn.004584d0
add esp, 0x1c
jmp 0x5c505f
push 0
push 0
push 0x5c8
push 0x100
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0x26c
lea ecx, [ebp - 0x34]
push ecx
call fcn.00455540
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x5cd470
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov byte [ebp - 5], 3
push 0
push str.saves
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movzx eax, byte [ebp + 0xc]
push eax
push str.saves_slot_d.wag
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0041e320
add esp, 0xc
push 1
lea edx, [ebp - 0x10c]
push edx
call fcn.00401390
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.005c6580
add esp, 8
push 1
push 0x25590d5
mov edx, dword [ebp - 4]
push edx
call fcn.004016d0
add esp, 0xc
push 1
lea eax, [ebp - 5]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004016d0
add esp, 0xc
push 1
push 0x11d762c
mov edx, dword [ebp - 4]
push edx
call fcn.004016d0
add esp, 0xc
push 1
push 0x11d762d
mov eax, dword [ebp - 4]
push eax
call fcn.004016d0
add esp, 0xc
push 1
push 0x11d762e
mov ecx, dword [ebp - 4]
push ecx
call fcn.004016d0
add esp, 0xc
push 1
push 0x11d762f
mov edx, dword [ebp - 4]
push edx
call fcn.004016d0
add esp, 0xc
push 1
push 0x11d7630
mov eax, dword [ebp - 4]
push eax
call fcn.004016d0
add esp, 0xc
push 1
push 0x11d7631
mov ecx, dword [ebp - 4]
push ecx
call fcn.004016d0
add esp, 0xc
push 1
push 0x11d7632
mov edx, dword [ebp - 4]
push edx
call fcn.004016d0
add esp, 0xc
push 1
push 0x11d7633
mov eax, dword [ebp - 4]
push eax
call fcn.004016d0
add esp, 0xc
push 1
push 0x11d7634
mov ecx, dword [ebp - 4]
push ecx
call fcn.004016d0
add esp, 0xc
push 0x3c
push 0x256397c
mov edx, dword [ebp - 4]
push edx
call fcn.004016d0
add esp, 0xc
push 0xc8
mov eax, 4
imul ecx, eax, 0
mov edx, 1
imul eax, edx, 0
lea ecx, [ecx + eax + 0x2567738]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004016d0
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call fcn.00401380
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret