joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053f88
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x100849b8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10053fce
cmp word [ebx], dx
jne 0x10053fce
or byte [eax + edi + 0x28], 4
jmp 0x10053fd3
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10054136
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10054116
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10054014
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1005404a
cmp eax, edx
jae 0x10054058
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10053fef
jmp 0x10054136
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10054111
cmp dword [ebp - 0x18], 0
je 0x10054111
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x100849b8]
test byte [eax + edi + 0x28], 0x48
je 0x100540e7
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x100540ab
mov word [esi], cx
jmp 0x100540e2
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x100849b8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x100849b8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x100849b8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10054136
pop eax
cmp word [ebp - 4], ax
jne 0x100540f7
cmp esi, ebx
jne 0x100540f7
mov word [esi], ax
jmp 0x10054133
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100549c1
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10054136
push 0xd
pop eax
jmp 0x100540f2
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x100849b8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10054130
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10054136
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1005813c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100581d9
push ebx
push esi
call fcn.10058105
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10056f21
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10058186
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100581d8
push edi
push eax
call fcn.1004ef27
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100581a6
call fcn.1004eeed
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100581d7
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10056f21
add esp, 0x20
test eax, eax
jne 0x100581c5
push edi
call fcn.1004eeed
jmp 0x100581cd
push ebx
call fcn.1004eeed
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1005a8a0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1004d474
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1005a90f
cmp esi, dword [ebp - 4]
je 0x1005a90a
cmp dword [ebp + 0xc], 0
je 0x1005a90a
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1005a8e7
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1005a3f2
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1005a911
xor eax, eax
inc eax
jmp 0x1005a911
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1005a976
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1007f054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1004d474
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1004d474
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1005a9ed
cmp word [ecx], dx
je 0x1005a9ed
mov eax, dword [0x1006c054]
push edi
dec eax
push eax
push 0x1006bf40
call fcn.1005a915
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1005aa60
cmp word [eax], dx
je 0x1005aa60
mov eax, dword [edi]
test eax, eax
je 0x1005aa11
cmp word [eax], dx
je 0x1005aa11
lea eax, [ebp - 0x10]
push eax
call fcn.1005a2f8
jmp 0x1005aa1a
lea eax, [ebp - 0x10]
push eax
call fcn.1005a393
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1005aa8a
mov eax, dword [0x1006bf3c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1006bc30
call fcn.1005a915
add esp, 0xc
test al, al
je 0x1005aa8a
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1005aa55
cmp word [eax], di
je 0x1005aa55
lea eax, [ebp - 0x10]
push eax
call fcn.1005a2f8
pop ecx
jmp 0x1005aa8c
lea eax, [ebp - 0x10]
push eax
call fcn.1005a393
jmp 0x1005aa52
mov eax, dword [edi]
test eax, eax
je 0x1005aa77
cmp word [eax], dx
je 0x1005aa77
lea eax, [ebp - 0x10]
push eax
call fcn.1005a2ad
pop ecx
jmp 0x1005aa8a
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1005ab55
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1005a79a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1005ab55
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1005ab55
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1005ab55
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1005aae2
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10053421
test ebx, ebx
je 0x1005ab50
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10053421
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1005ab55
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1005ab55
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10050e3c
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1005ab57
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003b02a
leave
ret
Function at 0x1005e9f1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1005e96d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1005eb60
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1005eb60
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1005eb15
jg 0x1005ea4d
test eax, eax
je 0x1005eb0b
push 1
push 0x1000
call fcn.1004cf79
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1005ea70
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1005eb02
push 0x8000
push ebx
call fcn.1005e89e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1005ea99
jg 0x1005ea94
cmp ecx, 0x1000
jb 0x1005ea99
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10052633
add esp, 0x10
cmp eax, 0xffffffff
je 0x1005eade
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1005ea94
jl 0x1005eac5
test ecx, ecx
jne 0x1005ea86
push dword [ebp - 0xc]
push ebx
call fcn.1005e89e
push esi
call fcn.1004eeed
add esp, 0xc
xor ebx, ebx
jmp 0x1005eb6e
cmp byte [edi + 0x24], 0
je 0x1005eaf5
cmp dword [edi + 0x20], 5
jne 0x1005eaf5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1005eb00
mov ebx, dword [edi + 0x18]
jmp 0x1005eb02
xor ebx, ebx
push esi
call fcn.1004eeed
pop ecx
jmp 0x1005eb6e
test ecx, ecx
jg 0x1005ead7
jl 0x1005eb15
test eax, eax
jae 0x1005ead7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100549c1
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1005eb35
cmp byte [edi + 0x1c], 0
je 0x1005ead7
jmp 0x1005eb66
push ebx
call fcn.1005c940
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1005ead7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1005eb6e
cmp byte [edi + 0x1c], 0
je 0x1005eb6b
mov ebx, dword [edi + 0x18]
jmp 0x1005eb6e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100549c1
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404c00
Capabilities:
Create directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x52382c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
push 0x525258
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0
push str.GuildTemp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
push 0x525258
lea edx, [ebp - 0x204]
push 0x4e4468
push edx
call fcn.004cce8a
add esp, 0x14
push 0
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
cmp eax, 0xffffffff
jne 0x404c75
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
push 0x480
push esi
push eax
call dword [sym.imp.KERNEL32.dll__lwrite]
xor ecx, ecx
cmp eax, 0x480
sete cl
pop esi
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
Function at 0x40cf00
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [0x6a4154]
mov eax, dword [0x41ebcf4]
inc ecx
mov dword [0x6a4154], ecx
cmp eax, 1
jne 0x40cf53
cmp ecx, 0xe10
jle 0x40cf24
jmp fcn.0047b5c0
cmp ecx, 0x12c
jle 0x40cf64
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
shl edx, 4
sub edx, eax
add edx, edx
add edx, edx
sub ecx, edx
jne 0x40cf64
jmp fcn.0047c0a0
test eax, eax
jne 0x40cf64
cmp ecx, 0x12c
jle 0x40cf64
jmp fcn.0047c0a0
ret
Function at 0x40dee0
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x52382c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x40c]
push esi
push eax
call fcn.004cd339
lea ecx, [ebp - 0x40c]
push ecx
call fcn.004cd312
push 0x525258
lea edx, [ebp - 0x204]
push str._sChatLog
push edx
mov esi, eax
call fcn.004cce8a
add esp, 0x14
push 0
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, 0x41ec34c
cmp ecx, 0x64424c
je 0x40e117
push edi
mov edi, 1
lea ecx, [ecx]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edi
push edx
inc eax
push eax
add ecx, 0x76c
push ecx
push 0x525258
lea edx, [ebp - 0x404]
push str._sChatLogChat_4d_02d_02d__d.txt
push edx
call fcn.004cce8a
lea eax, [ebp - 0x404]
push 0x4e45b0
push eax
call fcn.004cdd4a
add esp, 0x24
test eax, eax
je 0x40df95
inc edi
jmp 0x40df50
push ebx
lea ecx, [ebp - 0x404]
push 0x4e45ac
push ecx
call fcn.004cdd4a
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40e0e4
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
push edx
mov edx, dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + 0x14]
push edx
inc eax
push eax
mov eax, dword [0x5ec194]
add eax, dword [0x1a3ba10]
add ecx, 0x76c
push ecx
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.004cce8a
lea eax, [ebp - 0x204]
add esp, 0x20
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40dff6
push ebx
sub eax, edx
push 1
push eax
lea edx, [ebp - 0x204]
push edx
call fcn.004cdc14
lea eax, [ebp - 0x204]
push 0x4e45a8
push eax
call fcn.004cce8a
lea eax, [ebp - 0x204]
add esp, 0x18
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e030
push ebx
sub eax, edx
push 1
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.004cdc14
mov esi, dword [0x41ec34c]
add esp, 0x10
cmp esi, dword [0x64424c]
je 0x40e09c
lea ebx, [ebx]
mov edx, esi
imul edx, edx, 0x104
lea ecx, [edx + 0x1a3c828]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40e073
push ebx
sub eax, edi
push 1
push eax
push ecx
call fcn.004cdc14
inc esi
add esp, 0x10
cmp esi, 0x100
jl 0x40e094
xor esi, esi
cmp esi, dword [0x64424c]
jne 0x40e060
push ebx
call fcn.004cda49
mov edx, dword [0x5ec198]
add edx, dword [0x1a3ba10]
lea eax, [ebp - 0x404]
push eax
push edx
lea eax, [ebp - 0x204]
push eax
call fcn.004cce8a
lea ecx, [ebp - 0x204]
push 5
push ecx
call fcn.0040d780
add esp, 0x18
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x5ec19c]
add ecx, dword [0x1a3ba10]
lea edx, [ebp - 0x404]
push edx
push ecx
lea edx, [ebp - 0x204]
push edx
call fcn.004cce8a
lea eax, [ebp - 0x204]
push 5
push eax
call fcn.0040d780
add esp, 0x14
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
Function at 0x433920
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
push 0x4e4714
push eax
call fcn.004cdd4a
mov esi, eax
add esp, 8
test esi, esi
jne 0x433941
pop esi
mov esp, ebp
pop ebp
ret
push esi
push 4
lea ecx, [ebp - 4]
push 1
push ecx
call fcn.004cdfab
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 2]
push esi
mov byte [0x525372], al
mov byte [0x525370], ah
mov byte [0x525373], dl
call fcn.004cda49
add esp, 0x14
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x434bc0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x52382c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x525258
lea eax, [ebp - 0x204]
push str._sDataSkill.dat
push eax
call fcn.004cce8a
add esp, 0xc
push 0
push 0
push 3
push 0
push 1
push connect
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x434c2e
push str.Skill.dat_Not_Found__
call fcn.0040b000
add esp, 4
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
push edi
lea edx, [ebp - 0x20c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x434c73
cmp dword [ebp - 0x20c], 0
jne 0x434c9e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Skill.dat_GetFileSize_Size_Error__
call fcn.0040b000
add esp, 4
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x434c9e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Skill.dat_No_Data__
call fcn.0040b000
add esp, 4
lea eax, [edi + 1]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
push esi
push 0
push 0
push 0
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
mov dword [ebp - 0x208], esi
test esi, esi
jne 0x434ce3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Skill.dat_CreateFileMapping_Failed__
call fcn.0040b000
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x434d21
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
push str.Skill.dat_MapViewOfFile_Failed__
call fcn.0040b000
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
xor edx, edx
mov ecx, dword [0x5f3440]
lea edi, [edx + ecx]
lea esi, [edx + eax]
add edx, 0xd8
mov ecx, 0x36
rep movsd dword es:[edi], dword [esi]
cmp edx, 0xd800
jl 0x434d23
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0x208]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
push ebx
call esi
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
Function at 0x435100
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x52382c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x525258
lea eax, [ebp - 0x204]
push str._sDataItemAction.dat
push eax
call fcn.004cce8a
add esp, 0xc
push 0
push 0
push 3
push 0
push 1
push connect
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43516e
push str.ItemAction.dat_Not_Found__
call fcn.0040b000
add esp, 4
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
push edi
lea edx, [ebp - 0x210]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4351b3
cmp dword [ebp - 0x210], 0
jne 0x4351dd
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ItemAction.dat_GetFileSize_Size_Error__
call fcn.0040b000
add esp, 4
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x4351dd
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ItemAction.dat_No_Data__
call fcn.0040b000
add esp, 4
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
push esi
push 0
push 0
push 0
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
mov dword [ebp - 0x20c], esi
test esi, esi
jne 0x435222
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ItemAction.dat_CreateFileMapping_Failed__
call fcn.0040b000
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x208], eax
test eax, eax
jne 0x435266
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
push str.ItemAction.dat_MapViewOfFile_Failed__
call fcn.0040b000
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
mov esi, 0x1a83a48
mov edi, eax
sub edi, esi
nop
push 0x1024
lea eax, [edi + esi]
push eax
push esi
call fcn.004cd640
add esi, 0x1024
add esp, 0xc
cmp esi, 0x41eb888
jl 0x435270
mov ecx, dword [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0x20c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
push ebx
call esi
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
Function at 0x438b90
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [0x52382c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea ecx, [ebp - 0x84]
push ecx
lea edx, [ebp - 0x184]
push str.SystemCurrentControlSetControlKeyboard_Layouts_s
push edx
call fcn.004cce8a
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x184]
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp - 0x188]
lea edx, [ebp - 0x18c]
push edx
push 0x526b48
lea eax, [ebp - 0x190]
push eax
push 0
push 0x4e5d68
push ecx
mov dword [ebp - 0x18c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x18c], 0
jle 0x438c3c
mov eax, 0x526b48
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x438c32
mov edx, dword [ebp - 0x188]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004ccd49
mov esp, ebp
pop ebp
ret

Function at 0x438e50
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x52382c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5269ec]
push ebx
mov ebx, dword [ebp + 8]
push edi
push eax
call sub.IMM32.dll_ImmIsIME
test eax, eax
je 0x438e90
mov eax, dword [0x526ac0]
test eax, 0x20000
jne 0x438e90
test eax, 0x10000
je 0x438e90
push ebx
call fcn.00439310
add esp, 4
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
push eax
mov dword [0x5269ec], eax
call sub.IMM32.dll_ImmGetProperty
push ebx
mov dword [0x526ac0], eax
call sub.IMM32.dll_ImmGetContext
mov edi, eax
test edi, edi
je 0x438f5b
push esi
xor esi, esi
lea ecx, [ecx]
test dword [0x526ac0], 0x10000
je 0x438ef9
lea ecx, [ebp - 0x34]
push ecx
push ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0x40
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
add edx, 0x64
add eax, 0xffffffce
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
push ecx
jmp 0x438f19
lea edx, [ebp - 0x24]
push edx
push esi
push edi
call sub.IMM32.dll_ImmGetCandidateWindow
test eax, eax
je 0x438f1f
cmp dword [ebp - 0x20], 0
je 0x438f1f
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0
push eax
push edi
call sub.IMM32.dll_ImmSetCandidateWindow
inc esi
cmp esi, 4
jb 0x438ec0
push ebx
call sub.IMM32.dll_ImmGetContext
mov esi, eax
test esi, esi
je 0x438f5a
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x3c]
push edx
push esi
call sub.IMM32.dll_ImmGetConversionStatus
mov eax, dword [ebp - 0x38]
and eax, 0xfffffff7
push eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x3c]
push eax
push esi
call sub.IMM32.dll_ImmSetConversionStatus
push esi
push ebx
call sub.IMM32.dll_ImmReleaseContext
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004ccd49
mov esp, ebp
pop ebp
ret