joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001c1ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov r12b, r9b
mov r13d, r8d
mov rbp, rdx
mov rbx, rcx
xor edi, edi
mov dword [rcx + 0x10], edi
mov dword [rcx + 8], 1
mov dword [rcx + 0xc], edi
mov dword [rcx + 0x28], edi
mov qword [rcx + 0x20], rdi
mov byte [rcx + 0x14], dil
mov dword [rcx + 0x18], 3
lea rax, [0x10007ae90]
mov qword [rcx], rax
lea eax, [rdi + 2]
mul r13
lea r14, [rdi - 1]
cmovo rax, r14
mov rcx, rax
call fcn.100002be0
mov qword [rbx + 0x68], rax
cmp rax, rdi
je 0x10001c234
mov r8, rbp
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_wcscpy_s
mov dword [rbx + 0x70], r13d
mov qword [rbx + 0x60], rdi
mov qword [rbx + 0x88], rdi
mov qword [rbx + 0x80], rdi
mov qword [rbx + 0x98], rdi
mov byte [rbx + 0x34], r12b
mov qword [rbx + 0x78], rdi
mov byte [rbx + 0x90], dil
mov qword [rbx + 0x50], rdi
mov dword [rbx + 0x3c], edi
mov dword [rbx + 0x38], edi
mov dword [rbx + 0x40], edi
movzx ecx, r12b
mov eax, 4
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.100002be0
mov qword [rbx + 0x48], rax
cmp rax, rdi
je 0x10001c2b0
cmp byte [rbx + 0x34], dil
jbe 0x10001c2b0
mov rcx, rdi
mov rax, qword [rbx + 0x48]
mov dword [rcx + rax], 0x64
inc edi
add rcx, 4
movzx eax, byte [rbx + 0x34]
cmp edi, eax
jb 0x10001c297
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x10001c730
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x20
mov rbx, rcx
mov r13d, 0x40
mov rcx, r13
call fcn.100002580
xor edi, edi
lea r12, [0x10007bbb0]
cmp rax, rdi
je 0x10003396e
mov dword [rax + 8], edi
mov dword [rax + 0xc], edi
mov dword [rax + 0x10], 0x10
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], edi
mov qword [rax], r12
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdi
mov dword [rax + 0x38], 0x3e8
jmp 0x10001c790
mov rcx, r13
mov qword [rbx + 0x60], rax
call fcn.100002580
cmp rax, rdi
je 0x100033976
mov dword [rax + 8], edi
mov dword [rax + 0xc], edi
mov dword [rax + 0x10], 0x10
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], edi
mov qword [rax], r12
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdi
mov dword [rax + 0x38], 0x3e8
jmp 0x10001c7cd
mov rcx, rax
mov qword [rbx + 0x68], rax
call fcn.10000a0c0
mov rcx, r13
call fcn.100002580
cmp rax, rdi
je 0x10003397e
mov dword [rax + 8], edi
mov dword [rax + 0xc], edi
mov dword [rax + 0x10], 0x10
mov qword [rax + 0x18], rdi
lea rcx, [0x10007bbd8]
mov dword [rax + 0x20], edi
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdi
mov dword [rax + 0x38], 0x3e8
mov qword [rax], rcx
jmp 0x10001c819
mov rcx, rax
mov qword [rbx + 0x70], rax
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
add rsp, 0x20
pop r13
jmp fcn.10000a0c0
mov rax, rdi
jmp 0x10001c790
mov rax, rdi
jmp 0x10001c7cd
mov rax, rdi
jmp 0x10001c819
Function at 0x10001efe0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x10009e270]
test rcx, rcx
jne 0x10001f00a
call fcn.10001f084
test eax, eax
je 0x10003ac4c
mov rcx, qword [0x10009e270]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x10001f073
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x10003ac4c
mov eax, dword [rax]
mov rcx, qword [0x10009e270]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
jne 0x10003ac53
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x10009e270]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x10001f057
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
jmp 0x10001f073
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x10001f073
Function at 0x100020394
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
mov r12, rcx
mov ecx, 0x2028
call fcn.100002580
mov rbx, rax
jmp 0x1000203c4
xor edi, edi
cmp rbx, rdi
je 0x100031e4b
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x58]
mov r8d, 0x2028
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x100031ec8
cmp dword [rsp + 0x58], 0x2028
jne 0x100031ec8
cmp dword [rbx], 0x484d4752
jne 0x100031eb9
cmp dword [rbx + 4], 1
jne 0x100031e52
cmp dword [rbx + 8], 0x2028
jne 0x100031e52
mov edx, dword [rbx + 0x14]
cmp edx, edi
je 0x10002044a
mov r9d, 1
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x100031eaa
mov rcx, rbx
call sub.msvcrt.dll_free
mov eax, 1
jmp 0x100020459
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
xor eax, eax
jmp 0x100020459
cmp dword [rbx + 8], 0x2030
jne 0x100031eb9
lea rdx, [rbx + 0x10]
lea rcx, [rbx + 0xc]
mov r8d, 0x2018
call sub.msvcrt.dll_memmove
mov dword [rbx + 8], 0x2028
mov word [rbx + 0x2024], di
mov r9d, 1
xor r8d, r8d
lea edx, [r9 + 7]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x100020428
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100020459
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100020459
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100020459
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100020459
Function at 0x1000206ec
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
call fcn.100003370
test al, al
jne 0x10002b313
xor edx, edx
xor ecx, ecx
call fcn.100021cd0
test al, al
jne 0x10002b313
mov dl, 1
mov rcx, rbx
call fcn.100021da0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [rsp + 0x58], 0
lea rdx, [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r8d, 1
cmp dword [rsp + 0x58], r8d
jle 0x10002b363
lea rdx, [rax + 8]
mov rsi, qword [rdx]
lea rdi, str._newgame
mov ecx, 9
repe cmpsw word [rsi], word [rdi]
je 0x10002b3fc
inc r8d
add rdx, 8
cmp r8d, dword [rsp + 0x58]
jl 0x10002b33d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rbx + 0x88]
cmp byte [rdx + 0x11], 0
jne 0x10002b39f
xor edx, edx
xor ecx, ecx
call fcn.100021cd0
test al, al
jne 0x10002b39f
mov rcx, qword [0x10009e168]
call fcn.1000413a4
cmp byte [0x1000a19d8], 0
je 0x10002071c
mov rax, qword [rbx]
mov edx, dword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x10]
mov eax, dword [rbx + 8]
mov edx, 9
mov dword [rbx + 0xc], eax
mov rax, qword [rbx]
mov rcx, rbx
mov dword [rbx + 8], 9
call qword [rax + 8]
mov rcx, qword [0x10009e150]
call fcn.1000441b8
mov rcx, rbx
mov dil, al
test al, al
jne 0x10002b40b
mov rax, qword [rbx]
mov edx, dword [rbx + 8]
call qword [rax + 0x10]
mov edx, dword [rbx + 8]
mov rax, qword [rbx]
and dword [rbx + 8], 0
mov dword [rbx + 0xc], edx
mov rcx, rbx
xor edx, edx
call qword [rax + 8]
jmp 0x10002b442
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
jmp 0x10002071c
mov dl, 1
call fcn.100007ae0
mov rdx, qword [0x10009e150]
mov byte [rdx + 0x43], 1
cmp byte [rbx + 0x10c], 0
jne 0x10002b442
lea rdx, str.HowToPlay
lea rcx, [rsp + 0x20]
call fcn.100002c10
mov rcx, rbx
mov rdx, rax
call fcn.100022854
test dil, dil
je 0x10002071c
mov rax, qword [0x10009e1c8]
cmp byte [rax + 0x12c], 0
je 0x100020726
cmp dword [rbx + 8], 4
jne 0x10002b471
mov rcx, rbx
call fcn.100043b0c
mov edx, eax
jmp 0x10002b47d
cmp dword [rbx + 8], 2
jne 0x100020726
xor edx, edx
mov rcx, rbx
call fcn.100009b28
jmp 0x100020726

Function at 0x100021cd0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r8d, 1
cmp dword [rsp + 0x40], r8d
mov rbx, rax
jg 0x100037a93
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rdx, [rax + 8]
mov rcx, qword [rdx]
cmp word [rcx], 0x2f
je 0x100037aa6
cmp word [rcx], 0x2d
jne 0x100037aba
inc r8d
add rdx, 8
cmp r8d, dword [rsp + 0x40]
jge 0x100021d12
jmp 0x100037a97
test rdi, rdi
je 0x100037ad1
movsxd r8, r8d
mov rdx, rsi
mov rcx, rdi
mov r8, qword [rax + r8*8]
call sub.msvcrt.dll_wcscpy_s
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
jmp 0x100021d14
Function at 0x100024290
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x10009e100]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
mov esi, edx
repne scasw ax, word [rdi]
xor edi, edi
not rcx
mov edx, edi
dec rcx
cmp ecx, edi
jbe 0x1000242ea
mov rax, rbx
cmp word [rax], 0x3a
je 0x10002c88f
inc edx
add rax, 2
cmp edx, ecx
jb 0x1000242d6
cmp word [rbx], 0x2e
je 0x10002c8bf
cmp word [rbx], 0x2f
je 0x10002c8bf
cmp word [rbx], 0x5c
je 0x10002c8bf
lea rcx, [rsp + 0x240]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x240]
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
mov qword [rsp + 0x20], r11
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
and esi, 0x28
cmp sil, 0x28
je 0x10002c875
lea rcx, str.Microsoft_Games
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp eax, edi
je 0x10002439d
mov rcx, qword [0x10009e158]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp eax, edi
jne 0x10002c898
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x1000243aa
mov r11d, edi
cmp r11d, 1
sete al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1000024e0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rcx, str.Saved_Games
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp eax, edi
je 0x10002439d
jmp 0x100024377
lea rdx, str.FileNames_cannot_have_colons_in_them:__s
jmp 0x10002c8c6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x30]
cmp eax, edi
je 0x1000243a2
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r11d, 1
jmp 0x1000243ad
lea rdx, str.FileNames_cannot_start_with_a_slash_or_a_period:__s
mov r8, rbx
mov ecx, 0x80
call fcn.100002470
nop
jmp 0x1000243aa
Function at 0x100024f20
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov eax, dword [rcx + 0x20]
xor ebp, ebp
mov r13, r9
mov esi, r8d
mov r12, rdx
mov rdi, rcx
test eax, eax
je 0x100024ffc
sub eax, 1
je 0x10003afdb
cmp eax, 1
jne 0x10003b03e
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov ecx, dword [rdi + 0x3c]
lea edx, [rsi + rcx]
cmp edx, eax
jbe 0x100024fd8
mov rcx, qword [rdi + 0x28]
mov ebx, dword [rdi + 0x3c]
mov rax, qword [rcx]
add ebx, esi
call qword [rax + 0x20]
add eax, eax
cmp ebx, eax
jbe 0x10003afbe
mov rbp, qword [rdi + 0x28]
cmp ebx, dword [rbp + 0xc]
jbe 0x100024fd8
lea rdx, [0x10007b2b0]
mov ecx, ebx
call fcn.10000291c
mov r14, rax
test rax, rax
je 0x10003afd1
mov r8d, dword [rbp + 0xc]
mov rdx, qword [rbp + 0x10]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_free
mov qword [rbp + 0x10], r14
mov dword [rbp + 0xc], ebx
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov ecx, dword [rdi + 0x3c]
mov r8, rsi
add rcx, rax
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov dword [r13], esi
add dword [rdi + 0x3c], esi
jmp 0x100024ffc
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov ebx, eax
add ebx, ebx
jmp 0x100024f95
mov eax, 0x8007000e
jmp 0x100024ffe
mov ecx, dword [rcx + 0x38]
mov ebx, 0x10000
lea eax, [rcx + rsi]
cmp eax, ebx
ja 0x10003affe
add rcx, qword [rdi + 0x30]
mov r8, rsi
call sub.msvcrt.dll_memcpy
add dword [rdi + 0x38], esi
jmp 0x10003b0a4
cmp ecx, ebx
je 0x10003b01e
test ecx, ecx
je 0x10003b054
mov r8d, ebx
sub r8d, ecx
add rcx, qword [rdi + 0x30]
call sub.msvcrt.dll_memcpy
mov ecx, dword [rdi + 0x38]
sub r12, rcx
add r12, rbx
test ecx, ecx
je 0x10003b054
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi]
and qword [rsp + 0x20], rbp
mov r9, r13
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10003b048
mov eax, 0x80004005
jmp 0x100024ffe
add dword [rdi + 0x3c], ebx
mov ebp, ebx
sub ebp, dword [rdi + 0x38]
and dword [rdi + 0x38], 0
mov ebx, esi
sub ebx, ebp
shr ebx, 0x10
test ebx, ebx
je 0x10003b088
mov rcx, qword [rdi]
and qword [rsp + 0x20], 0
shl ebx, 0x10
mov r8d, ebx
mov r9, r13
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10003b03e
add dword [rdi + 0x3c], ebx
mov eax, ebx
add ebp, ebx
add r12, rax
cmp ebp, esi
jae 0x10003b0a4
mov rcx, qword [rdi + 0x30]
mov eax, esi
mov rdx, r12
sub eax, ebp
mov r8d, eax
mov ebx, eax
call sub.msvcrt.dll_memcpy
mov dword [rdi + 0x38], ebx
mov dword [r13], esi
jmp 0x100024ffc
Function at 0x100025f30
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rcx + 0x20]
mov rbx, rcx
test eax, eax
je 0x100025f52
sub eax, 1
je 0x10003b0af
cmp eax, 1
jne 0x10003b0ad
xor eax, eax
add rsp, 0x30
pop rbx
ret
jmp 0x10003b0d8
mov r8d, dword [rcx + 0x38]
test r8d, r8d
je 0x100025f52
mov rdx, qword [rcx + 0x30]
mov rcx, qword [rcx]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10003b0e2
mov eax, 0x80004005
jmp 0x100025f54
mov eax, dword [rbx + 0x38]
add dword [rbx + 0x3c], eax
and dword [rbx + 0x38], 0
jmp 0x100025f52
Function at 0x100026f0c
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r12, qword [rsp + 0xa0]
mov r13, rcx
mov r14d, 0x2028
mov rcx, r14
mov rbp, r9
mov rsi, r8
mov rbx, rdx
call fcn.100002580
mov r8, r14
mov rcx, rax
xor edx, edx
mov rdi, rax
call sub.msvcrt.dll_memset
mov dword [rdi], 0x484d4752
mov dword [rdi + 4], 1
mov dword [rdi + 8], r14d
movdqu xmm0, xmmword [rbx]
xor ebx, ebx
movdqu xmmword [rdi + 0x18], xmm0
cmp rsi, rbx
je 0x100026f77
mov qword [rdi + 0xc], rbx
mov eax, dword [rsi]
mov dword [rdi + 0x14], eax
mov r14d, 0x3ff
cmp rbp, rbx
je 0x100026f91
lea rcx, [rdi + 0x28]
mov r8, rbp
mov rdx, r14
call sub.msvcrt.dll_wcscpy_s
cmp r12, rbx
je 0x100026fa8
lea rcx, [rdi + 0x828]
mov r8, r12
mov rdx, r14
call sub.msvcrt.dll_wcscpy_s
lea r9, [rsp + 0x30]
mov r8d, 0x2028
mov rdx, rdi
mov rcx, r13
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
je 0x100031e2d
cmp rsi, rbx
je 0x100026ff7
mov r8d, dword [rsi]
mov rdx, qword [rsi + 0x10]
lea r9, [rsp + 0x30]
mov rcx, r13
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
je 0x100026ffc
mov ebx, 1
mov rcx, rdi
call sub.msvcrt.dll_free
mov eax, ebx
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, rdi
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100027006

Function at 0x100027a90
Capabilities:
Check if file exists
Create process on windows
Query environment variable

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x10009e100]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor ebx, ebx
cmp byte [0x10009e052], bl
jne 0x1000379fb
xor al, al
jmp 0x100027abd
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1000024e0
add rsp, 0x290
pop rbx
ret
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], bx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x30]
lea rdx, str._SystemRoot_ehomeehshell.exe
mov r8d, 0x3e
call sub.msvcrt.dll_memcpy
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
je 0x100027ab9
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebx
je 0x100027ab9
lea r8, [rsp + 0x70]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
setg al
jmp 0x100027abd
Function at 0x100042230
Capabilities:
Get common file path
Set current directory
Write file on windows

Disassembly:
lea rdx, str.HeartsAIPlayer::Cleanup__
mov ecx, 0x80000
jmp fcn.100002470

Function at 0x100046634
Capabilities:
Get common file path
Set current directory
Write file on windows

Disassembly:
lea rdx, str.HumanPlayer::Cleanup__
mov ecx, 0x40000
jmp fcn.100002470

Function at 0x100047b28
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x58
cmp byte [0x10009fb74], 0
je 0x100047bf2
lea r9, str.Dropping_to_low_DPI
lea r8, str.Engine.cpp
mov edx, 0x244
mov ecx, 0x10
call fcn.100002c98
cmp byte [0x10009e052], 0
jne 0x100047bd2
mov edx, 0x373
mov byte [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea ecx, [rdx + 0x12]
mov r9d, 0xfffe
mov r8d, 1
call fcn.100051f7c
mov rcx, qword [0x10009e168]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [0x10009e07c]
mov r9d, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
mov rcx, qword [0x10009e168]
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], eax
mov eax, dword [0x10009e078]
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x100047be0
mov rcx, qword [0x10009e1b8]
mov byte [rcx + 0xa5], 0
xor ecx, ecx
call fcn.1000131f4
test al, al
je 0x100047bf2
mov al, 1
add rsp, 0x58
ret
lea r9, str.Insufficient_video_memory_to_load_the_game
lea r8, str.Engine.cpp
mov edx, 0x25d
mov ecx, 0x10
call fcn.100002c98
mov edx, 0x37d
mov byte [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea ecx, [rdx + 8]
mov r9d, 0xfffe
mov r8d, 1
call fcn.100051f7c
mov cl, byte [0x10009e052]
call fcn.100027a90
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100050894
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x10009e100]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov bpl, r8b
mov edi, edx
mov rsi, rcx
lea rbx, [rsp + 0x60]
cmp edx, 0x40
ja 0x100050941
je 0x100050935
mov eax, edx
sub eax, 1
je 0x100050929
sub eax, 1
je 0x10005091d
sub eax, 2
je 0x100050911
sub eax, 4
je 0x100050905
sub eax, 8
je 0x1000508f9
cmp eax, 0x10
jne 0x10005096d
lea rbx, str.PackedResource:
jmp 0x1000509d4
lea rbx, str.Core:
jmp 0x1000509d4
lea rbx, str.Timekeeping:
jmp 0x1000509d4
lea rbx, str.Resources:
jmp 0x1000509d4
lea rbx, str.Rendering:
jmp 0x1000509d4
lea rbx, str.ERROR:
jmp 0x1000509d4
lea rbx, str.Event:
jmp 0x1000509d4
cmp edx, 0x80
je 0x1000509cd
cmp edx, 0x100
je 0x1000509c4
cmp edx, 0x200
je 0x1000509bb
cmp edx, 0x400
je 0x1000509b2
cmp edx, 0x800
je 0x1000509a9
mov rax, qword [0x10009e128]
test rax, rax
je 0x10005098a
mov ecx, edx
call rax
mov rbx, rax
test rax, rax
jne 0x1000509d4
lea rbx, [rsp + 0x60]
or r8, 0xffffffffffffffff
lea r9, str.0x_08x:
lea rcx, [rsp + 0x60]
lea edx, [r8 + 0x11]
mov dword [rsp + 0x20], edi
call sub.msvcrt.dll__snwprintf_s
jmp 0x1000509d4
lea rbx, str.UI:
jmp 0x1000509d4
lea rbx, str.Xml:
jmp 0x1000509d4
lea rbx, str.Animation:
jmp 0x1000509d4
lea rbx, str.Nodes:
jmp 0x1000509d4
lea rbx, str.SaveFS:
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
test bpl, bpl
je 0x100050a90
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x100050a74
and qword [rsp + 0x30], 0
and qword [rsp + 0x50], 0
lea r9, [rsp + 0x48]
lea rcx, str.CONOUT_
mov edx, 0xc0000000
mov r8d, 2
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x48], 0x18
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
test rax, rax
je 0x100050aab
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100050aab
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x100050aab
and qword [rsp + 0x20], rax
lea r8d, [rcx + rcx - 2]
lea r9, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1000024e0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x100071028
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
imul r9d, dword [rsp + 0x50]
mov rbx, rdx
mov rbp, rcx
mov edi, r9d
add rdi, rdx
cmp rdx, rdi
jae 0x100071159
mov r13d, dword [rsp + 0x50]
mov r14d, dword [rsp + 0x58]
mov eax, r8d
lea rsi, [rdx + rax*4]
mov edx, 0xffc03fc0
lea r12, [r13 + r13]
mov r15, rbx
cmp rbx, rsi
jae 0x100071147
mov r14, rbp
mov r11d, dword [r15 + 4]
mov r9d, dword [r15]
mov r10d, dword [r13 + r15]
mov r8d, dword [r13 + r15 + 4]
mov ecx, r9d
mov eax, r11d
shr eax, 2
shr ecx, 2
add r15, 8
and eax, edx
and ecx, edx
add ecx, eax
mov eax, r10d
shr eax, 2
and eax, edx
add ecx, eax
mov eax, r8d
shr eax, 2
and eax, edx
lea edx, [rcx + rax - 0x7fff80]
mov ecx, r10d
shr r10d, 2
and ecx, 0xff00ff
mov eax, r8d
shr r8d, 2
and eax, 0xff00ff
add ecx, eax
mov eax, r9d
shr r9d, 2
and eax, 0xff00ff
add ecx, eax
mov eax, r11d
shr r11d, 2
and eax, 0xff00ff
lea ecx, [rcx + rax + 0x20002]
shr ecx, 2
xor edx, ecx
mov ecx, 0x3fc03fc0
and r10d, ecx
and edx, 0xff00ff
and r8d, ecx
add r10d, r8d
and r9d, ecx
and r11d, ecx
add r10d, r9d
lea eax, [r10 + r11 + 0x800080]
xor edx, eax
mov dword [r14], edx
add r14, 4
mov edx, 0xffc03fc0
cmp r15, rsi
jb 0x100071085
mov r14d, dword [rsp + 0x58]
add rbx, r12
add rbp, r14
add rsi, r12
cmp rbx, rdi
jb 0x100071076
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
pop r15
pop r14
pop r13
pop r12
pop rdi
ret