joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4289a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x482b56
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x49b470]
xor eax, esp
mov dword [esp + 0x1b8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49b470]
xor eax, esp
push eax
lea eax, [esp + 0x1d0]
mov dword fs:[0], eax
xor ebp, ebp
mov ebx, ecx
mov dword [esp + 0x18], ebp
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x1dc], ebp
call fcn.00403eb0
mov byte [esp + 0x1d8], 1
mov ecx, dword [0x4b5acc]
push ebx
add ecx, 0x58cc
call fcn.004040f0
push eax
lea ecx, [esp + 0xcc]
push str._sgrp_s
push ecx
call fcn.0045f116
lea eax, [esp + 0xd4]
add esp, 0x10
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x428a30
sub eax, edx
push eax
lea edx, [esp + 0xc8]
push edx
lea ecx, [esp + 0x24]
call fcn.00402b90
lea esi, [esp + 0x1c]
call fcn.00404430
mov ecx, str..dat
mov edx, esi
call fcn.00409e20
push ebp
push 0x80
push 3
push ebp
push 1
push DirectSoundCreate
lea eax, [esp + 0xdc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x428b52
mov ecx, dword [0x4b3cf8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
xor edi, edi
push ebx
mov dword [esp + 0x1c], edi
call eax
cmp eax, 0xffffffff
je 0x428ad4
push eax
call fcn.0045fd36
mov ecx, dword [0x4b3cf8]
mov edx, dword [ecx]
add esp, 4
mov ebp, eax
mov eax, dword [edx + 0x1c]
push ebp
push ebx
call eax
test eax, eax
jne 0x428bab
lea esi, [esp + 0x1c]
call fcn.00403f80
xor eax, eax
jmp 0x428bc1
mov ecx, dword [0x4b3cf8]
mov esi, dword [ecx]
lea ecx, [esp + 0x1c]
call fcn.004041a0
mov ecx, dword [0x4b3cf8]
mov edx, dword [esi + 0x18]
push eax
call edx
cmp eax, 0xffffffff
je 0x428ac4
push eax
call fcn.0045fd36
mov esi, eax
mov eax, dword [0x4b3cf8]
mov ebx, dword [eax]
add esp, 4
push esi
lea ecx, [esp + 0x20]
call fcn.004041a0
mov ecx, dword [0x4b3cf8]
mov edx, dword [ebx + 0x1c]
push eax
call edx
test eax, eax
je 0x428ac4
mov eax, dword [0x4b3d20]
push eax
mov edx, esi
call fcn.00443070
push esi
mov ebx, eax
call fcn.0045fc59
push ebx
call fcn.0045fd36
mov ecx, dword [0x4b3d20]
push ebx
mov ebp, eax
push ecx
push ebp
call fcn.00463fd0
add esp, 0x18
jmp 0x428bab
lea edx, [esp + 0x18]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
call fcn.0045fd36
add esp, 4
push 0
mov ebp, eax
lea eax, [esp + 0x1c]
push eax
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x428b86
cmp dword [esp + 0x18], 0
jne 0x428b9e
lea esi, [esp + 0x1c]
call fcn.00403f80
test edi, edi
je 0x428b9a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x428bc1
test edi, edi
je 0x428bab
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
lea esi, [esp + 0x1c]
call fcn.00403f80
test edi, edi
je 0x428bbf
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov ecx, dword [esp + 0x1d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
call fcn.0045f0aa
add esp, 0x1c8
ret
Function at 0x428cb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x28
push ebp
push esi
push edi
push 1
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x428ce3
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov esi, dword [ebx + 4]
lea eax, [esp + 0x10]
push eax
lea edi, [esp + 0x18]
call fcn.004309b0
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 4
cmp dword [0x4b5a90], 1
jne 0x428d10
call ebp
jmp 0x428d12
call edi
mov esi, eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
test eax, eax
je 0x428d2e
sub esi, dword [ebx + 0x64]
cmp esi, 0x21
jbe 0x428d2a
push 0
jmp 0x428d30
push 1
jmp 0x428d30
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4b5a90], 1
jne 0x428d4e
call ebp
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 8]
pop edi
pop esi
pop ebp
add esp, 0x28
ret
call edi
pop edi
pop esi
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 8]
pop ebp
add esp, 0x28
ret
Function at 0x42b720
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x114
mov eax, dword [0x49b470]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
push edi
mov edi, ecx
xor esi, esi
lea ebx, [ebx]
push 0
push esi
mov ecx, edi
call fcn.0042b480
inc esi
cmp esi, 0x15
jl 0x42b740
mov eax, dword [edi + 0x414]
sub eax, 1
jne 0x42b921
mov eax, dword [0x4a45fc]
mov ecx, dword [0x4a45f8]
push ebx
mov ebx, dword [0x4a4604]
push eax
push ecx
push ebx
mov ebx, dword [0x4a4600]
push ebx
push eax
lea edx, [edi + 0x220]
lea esi, [edi + 0x100]
push ecx
mov eax, edx
mov ecx, esi
call fcn.00408dc0
cmp dword [edi + 0x408], 0x17
lea edx, [edi + 0x280]
je 0x42b7d4
mov eax, dword [0x4a460c]
mov ecx, dword [0x4a4608]
push eax
mov eax, dword [0x4a4604]
push ecx
mov ecx, dword [0x4a4600]
push edx
mov edx, dword [0x4a45fc]
push eax
mov eax, dword [0x4a45f8]
push ecx
push edx
mov ecx, esi
call fcn.0040a1b0
jmp 0x42b919
mov eax, dword [0x4a4614]
mov ecx, dword [0x4a4610]
push ebp
push eax
mov eax, dword [0x4a4604]
push ecx
mov ecx, dword [0x4a4600]
push edx
mov edx, dword [0x4a45fc]
push eax
mov eax, dword [0x4a45f8]
push ecx
push edx
mov ecx, esi
call fcn.0040a1b0
push 0x65
push 0x4b3848
lea eax, [esp + 0x20]
push str._s_save_file_02dc.dat
push eax
xor ebp, ebp
call fcn.0045f116
add esp, 0x10
push ebp
push 0x80
push 3
push ebp
push 1
push DirectSoundCreate
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42b8b5
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [edi + 0x3b0]
push ebp
lea edx, [esp + 0x14]
push edx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42b8a6
cmp dword [esp + 0x10], ebp
je 0x42b8a6
mov eax, dword [0x4a45d4]
mov ecx, dword [0x4a45d0]
mov edx, dword [0x4a45cc]
push eax
push ecx
mov ecx, dword [0x4a45c8]
push edx
mov edx, dword [0x4a45c4]
push ecx
mov ecx, dword [0x4a45c0]
push edx
push ecx
lea eax, [edi + 0x3a0]
mov ecx, esi
call fcn.00408dc0
mov ebp, 1
test ebx, ebx
je 0x42b8b1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
jne 0x42b918
mov edx, dword [0x4a45c4]
mov eax, dword [0x4a45c0]
mov ecx, dword [0x4a45cc]
push edx
mov edx, dword [0x4a45c8]
push eax
push ecx
push edx
push 0
lea ebx, [edi + 0x3a0]
push 0
lea eax, [edi + 0x220]
mov ecx, ebx
call fcn.00408dc0
mov eax, dword [0x4a45d4]
mov ecx, dword [0x4a45d0]
mov edx, dword [0x4a45cc]
push eax
mov eax, dword [0x4a45c8]
push ecx
mov ecx, dword [0x4a45c4]
push edx
mov edx, dword [0x4a45c0]
push eax
push ecx
push edx
mov eax, ebx
mov ecx, esi
call fcn.00408dc0
pop ebp
push 0x17
call fcn.0042b340
pop ebx
mov ecx, dword [esp + 0x118]
pop edi
pop esi
xor ecx, esp
call fcn.0045f0aa
add esp, 0x114
ret
Function at 0x42b940
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x114
mov eax, dword [0x49b470]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x118]
push ebx
push ebp
mov ebp, dword [esp + 0x124]
xor ebx, ebx
push edi
cmp eax, 0xff
je 0x42ba4c
cmp eax, 0x63
jne 0x42b990
push 0x4b3848
lea eax, [esp + 0x18]
push str._s_save_file00c.dat
push eax
call fcn.0045f116
add esp, 0xc
jmp 0x42b9a9
inc eax
push eax
push 0x4b3848
lea ecx, [esp + 0x1c]
push str._s_save_file_02dc.dat
push ecx
call fcn.0045f116
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 1
push DirectSoundCreate
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x42ba4c
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 0x3b0]
push 0
lea edx, [esp + 0x10]
push edx
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42ba3d
cmp dword [esp + 0xc], ebx
je 0x42ba3d
cmp ebp, 1
jne 0x42ba38
mov eax, dword [0x4a45d4]
mov ecx, dword [0x4a45d0]
mov edx, dword [0x4a45cc]
push eax
push ecx
mov ecx, dword [0x4a45c8]
push edx
mov edx, dword [0x4a45c4]
push ecx
mov ecx, dword [0x4a45c0]
push edx
push ecx
lea eax, [esi + 0x3a0]
lea ecx, [esi + 0x100]
call fcn.00408dc0
mov ebx, 1
test edi, edi
je 0x42ba48
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x42bab8
mov edx, dword [0x4a45c4]
mov eax, dword [0x4a45c0]
mov ecx, dword [0x4a45cc]
push edx
mov edx, dword [0x4a45c8]
push eax
push ecx
push edx
push 0
lea edi, [esi + 0x3a0]
lea eax, [esi + 0x220]
push 0
mov ecx, edi
call fcn.00408dc0
cmp ebp, 1
jne 0x42bab8
mov eax, dword [0x4a45d4]
mov ecx, dword [0x4a45d0]
mov edx, dword [0x4a45cc]
push eax
mov eax, dword [0x4a45c8]
push ecx
mov ecx, dword [0x4a45c4]
push edx
mov edx, dword [0x4a45c0]
push eax
push ecx
push edx
lea ecx, [esi + 0x100]
mov eax, edi
call fcn.00408dc0
mov ecx, dword [esp + 0x11c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045f0aa
add esp, 0x114
ret 8
Function at 0x42e7d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov ecx, dword [0x4b5acc]
mov eax, dword [ecx + 0x5c7c]
sub eax, 1
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
mov esi, 0
je 0x42e802
sub eax, 2
je 0x42e7fb
lea ebp, [esi + 1]
jmp 0x42e80e
mov ebp, 2
jmp 0x42e80e
xor ebp, ebp
mov dword [ecx + 0x5c7c], 2
mov edi, dword [edx + 8]
mov ebx, dword [edx + 4]
xor eax, eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov ecx, 1
mov word [esp + 0x48], cx
mov cx, word [edx + 0xe]
mov eax, edi
neg eax
mov dword [esp + 0x44], eax
mov edx, dword [edx + 0x4d0]
movzx eax, cx
shr eax, 3
imul eax, ebx
mov dword [esp + 0x40], ebx
mov ebx, eax
add eax, 3
imul ebx, edi
and eax, 0xfffffffc
mov word [esp + 0x4a], cx
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x7c]
shr cx, 3
push eax
mov word [esp + 0x6c], cx
push ebp
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], vtable.CBuffer.0
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], 0x20
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], esi
mov dword [esp + 0x48], 0x28
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x34], edx
mov dword [esp + 0x78], 0x4b5adc
call fcn.00414160
cmp eax, 1
jne 0x42e902
mov edx, dword [esp + 0x14]
mov dword [edx + 0x5c7c], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
Function at 0x42e910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov ecx, dword [0x4b5acc]
mov eax, dword [ecx + 0x5c7c]
sub eax, 1
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
mov esi, 0
je 0x42e942
sub eax, 2
je 0x42e93b
lea ebp, [esi + 1]
jmp 0x42e94e
mov ebp, 2
jmp 0x42e94e
xor ebp, ebp
mov dword [ecx + 0x5c7c], 2
mov edi, dword [edx + 8]
mov ebx, dword [edx + 4]
xor eax, eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov ecx, 1
mov word [esp + 0x48], cx
mov cx, word [edx + 0xe]
mov eax, edi
neg eax
mov dword [esp + 0x44], eax
mov edx, dword [edx + 0x4d0]
movzx eax, cx
shr eax, 3
imul eax, ebx
mov dword [esp + 0x40], ebx
mov ebx, eax
add eax, 3
imul ebx, edi
and eax, 0xfffffffc
mov word [esp + 0x4a], cx
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x7c]
shr cx, 3
push eax
mov word [esp + 0x6c], cx
push ebp
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], vtable.CBuffer.0
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], 0x20
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], esi
mov dword [esp + 0x48], 0x28
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x34], edx
mov dword [esp + 0x78], 0x4b5adc
call fcn.00414380
cmp eax, 1
jne 0x42ea42
mov edx, dword [esp + 0x14]
mov dword [edx + 0x5c7c], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
Function at 0x4352e7
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [0xe51458]
mov ecx, dword [esi + 0x10]
push ebx
mov ebx, dword [esp + 0x18]
push edi
mov edi, dword [ebx + 0x10]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
cmp eax, 0x10
ja case.0x4352bc.1
movzx eax, byte [eax + 0x4353ec]
jmp dword [eax*4 + 0x4353e0]
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
cdq
push 0
push 0
xor eax, edx
sub eax, edx
push eax
push ecx
push 0
push 0
mov eax, ebx
mov ecx, esi
call fcn.00408dc0
pop edi
pop ebx
add esp, 0x10
ret
mov dword [esp + 0xc], 7
mov eax, dword [esi + 0x2c]
cdq
xor eax, edx
push ebp
sub eax, edx
add edi, 0xb40
xor ebp, ebp
lea ebx, [ecx + 0xb40]
test eax, eax
jle 0x435349
mov dword [esp + 0xc], 0x140
mov edx, dword [esp + 0xc]
push edx
push edi
push ebx
call fcn.00463fd0
mov eax, dword [esi + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x28]
add dword [esp + 0x18], 4
lea ebx, [ebx + eax*4 - 4]
mov eax, dword [esi + 0x2c]
lea edi, [edi + edx*4 - 4]
cdq
xor eax, edx
inc ebp
sub eax, edx
add esp, 0xc
cmp ebp, eax
jl 0x435312
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 0x2c]
cdq
mov edi, ecx
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
cdq
and edx, 0xf
add eax, edx
mov edx, dword [esp + 0x18]
sar eax, 4
imul eax, dword [esp + 0x10]
xor ebx, ebx
lea ebp, [edx + eax*4]
test ecx, ecx
jle 0x4353d8
mov eax, ecx
cdq
and edx, 0xf
add eax, edx
sar eax, 4
imul eax, dword [esp + 0x10]
cmp eax, ebx
jle 0x4353a2
mov eax, 0x2d0
sub eax, ebx
add eax, eax
add eax, eax
push eax
push 0
push edi
call fcn.00463f50
mov ecx, dword [esi + 0x28]
lea edi, [edi + ecx*4]
jmp 0x4353c6
mov edx, 0x2d0
sub edx, ebx
add edx, edx
add edx, edx
push edx
push ebp
push edi
call fcn.00463fd0
mov ecx, dword [esp + 0x2c]
mov eax, dword [esi + 0x28]
mov edx, dword [ecx + 0x28]
lea edi, [edi + eax*4]
lea ebp, [ebp + edx*4]
mov eax, dword [esi + 0x2c]
cdq
mov ecx, eax
xor ecx, edx
inc ebx
sub ecx, edx
add esp, 0xc
cmp ebx, ecx
jl 0x435372
pop ebp
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x43c640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov ebx, eax
mov esi, ecx
test ebp, ebp
jl 0x43c77c
mov eax, dword [esi + 0x28]
sub eax, dword [esp + 0x14]
cmp ebp, eax
jle 0x43c665
mov ebp, eax
mov dword [esp + 0x1c], ebp
test ebp, ebp
je 0x43c77c
mov ecx, dword [esp + 0x20]
test ecx, ecx
jl 0x43c77c
mov eax, dword [esi + 0x2c]
cdq
xor eax, edx
sub eax, edx
sub eax, dword [esp + 0x18]
cmp ecx, eax
jle 0x43c68f
mov dword [esp + 0x20], eax
mov ecx, eax
test ecx, ecx
je 0x43c77c
mov ecx, dword [ebx + 0x4c]
mov edx, dword [esi + 0x4c]
push edi
movzx edi, word [ebx + 0x50]
imul edi, dword [esp + 0x28]
mov eax, ecx
imul eax, dword [esp + 0x2c]
add edi, eax
add edi, dword [ebx + 0x10]
movzx eax, word [esi + 0x50]
imul eax, dword [esp + 0x18]
mov ebx, edx
imul ebx, dword [esp + 0x1c]
add eax, ebx
add eax, dword [esi + 0x10]
lea esi, [ebp*4]
sub ecx, esi
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x24]
sub edx, esi
mov dword [esp + 0x2c], edx
test ecx, ecx
jle 0x43c77b
mov dword [esp + 0x24], ecx
jmp 0x43c6f0
test ebp, ebp
jle 0x43c768
movzx ecx, byte [esp + 0x38]
movzx edx, byte [esp + 0x34]
mov dword [esp + 0x18], ecx
movzx ecx, byte [esp + 0x30]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x28], ecx
nop
mov cl, byte [eax]
mov dl, byte [edi + 3]
mov ebx, dword [esp + 0x18]
movzx esi, dl
movzx edx, cl
sub ebx, edx
imul ebx, esi
sar ebx, 8
add bl, cl
mov byte [eax], bl
mov cl, byte [eax + 1]
mov ebx, dword [esp + 0x1c]
inc eax
movzx edx, cl
sub ebx, edx
imul ebx, esi
sar ebx, 8
add bl, cl
mov byte [eax], bl
mov cl, byte [eax + 1]
mov ebx, dword [esp + 0x28]
inc eax
movzx edx, cl
sub ebx, edx
imul ebx, esi
sar ebx, 8
add bl, cl
mov byte [eax], bl
add edi, 4
add eax, 2
sub ebp, 1
jne 0x43c710
mov ebp, dword [esp + 0x20]
add eax, dword [esp + 0x2c]
add edi, dword [esp + 0x10]
sub dword [esp + 0x24], 1
jne 0x43c6f0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x24
Function at 0x4542d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x508
mov eax, dword [0x49b470]
xor eax, esp
mov dword [esp + 0x504], eax
mov eax, dword [0x4b5af0]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebp
push esi
push edi
test eax, eax
jne 0x4542f9
call ebx
push 0x10000
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, dword [0x4b41e0]
xor edi, edi
mov ebp, eax
test esi, esi
je 0x454417
lea esp, [esp]
push 0x100
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00463f50
mov cl, byte [esi]
add esp, 0xc
lea eax, [esp + 0x14]
test cl, cl
je 0x454352
mov edx, esi
mov ebx, eax
sub edx, ebx
sub cl, 0x61
mov byte [eax], cl
mov cl, byte [edx + eax + 1]
inc eax
test cl, cl
jne 0x454344
mov byte [eax], 0x9f
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x454360
sub eax, edx
inc eax
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [ebp + edi*4]
push edx
call fcn.00463fd0
mov eax, esi
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x454382
sub eax, ecx
add eax, 5
shr eax, 2
add edi, eax
movsx eax, byte [esi + 0xf3]
mov dword [ebp + edi*4], eax
movsx eax, byte [esi + 0xf3]
inc edi
sub eax, 0x21
je 0x4543f6
sub eax, 3
je 0x4543c3
sub eax, 1
jne 0x454403
mov ecx, dword [esi + 0xf4]
mov edx, dword [ecx]
mov dword [ebp + edi*4], edx
jmp 0x454402
mov ecx, dword [esi + 0xf4]
lea edx, [ebp + edi*4]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4543d0
mov eax, dword [esi + 0xf4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4543e3
sub eax, edx
add eax, 4
shr eax, 2
add edi, eax
jmp 0x454403
mov eax, dword [esi + 0xf4]
fld dword [eax]
fstp dword [ebp + edi*4]
inc edi
mov esi, dword [esi + 0xfc]
test esi, esi
jne 0x454320
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov cx, word [0x495940]
mov word [ebp + edi*4], cx
mov dl, byte [0x495942]
push 0x4b3848
lea eax, [esp + 0x118]
push str._s_saveglobal.dat
mov byte [ebp + edi*4 + 2], dl
push eax
inc edi
call fcn.0045f116
add esp, 0xc
push 0
push 0x80000080
push 4
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
add edi, edi
add edi, edi
push edi
push 0
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
test eax, eax
jne 0x45449b
mov edx, dword [0x4b3c9c]
push 0x48ba48
push 0x495958
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4544d2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4b5af0]
test eax, eax
jne 0x4544e4
call ebx
push ebp
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x514]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045f0aa
add esp, 0x508
ret
Function at 0x4549c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x49b470]
xor eax, esp
mov dword [esp + 0x404], eax
mov eax, dword [0x4b5acc]
cmp dword [eax + 0x5c74], 0
jne 0x454b21
push ebx
push esi
push edi
push 0x40000
call fcn.0045fd36
push 0x40000
mov edi, eax
push 0
push edi
call fcn.00463f50
add esp, 0x10
call fcn.004548d0
mov eax, dword [0x4b3d18]
xor esi, esi
test eax, eax
je 0x454a64
lea edx, [esi*4]
sub edx, eax
mov ecx, eax
lea ebx, [edx + edi]
mov dl, byte [ecx]
mov byte [ebx + ecx], dl
inc ecx
test dl, dl
jne 0x454a23
mov ecx, eax
lea ebx, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x454a32
sub ecx, ebx
add ecx, 4
shr ecx, 2
add esi, ecx
movsx ecx, byte [eax + 0xf3]
mov dword [edi + esi*4], ecx
mov edx, dword [eax + 0xf4]
mov ecx, dword [edx]
inc esi
mov dword [edi + esi*4], ecx
mov eax, dword [eax + 0xfc]
inc esi
test eax, eax
jne 0x454a15
push 0x4b3848
lea edx, [esp + 0x14]
push str._s_save_readal.dat
mov dword [edi + esi*4], 0
push edx
inc esi
call fcn.0045f116
add esp, 0xc
push 0
push 0x80000080
push 4
push 0
push 0
push 0x40000000
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
add esi, esi
add esi, esi
push esi
push 0
mov ebx, eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
test eax, eax
jne 0x454ad3
mov ecx, dword [0x4b3c9c]
push 0x48ba48
push 0x4959c8
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x454b0a
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [esp + 0x10]
push edx
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
push esi
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x454b1e
push edi
call fcn.0045fc59
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.0045f0aa
add esp, 0x408
ret