joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100098a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push str.Wrapper_not_implemented:SteamUninstall
mov dword [ecx], 1
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [str.Wrapper_not_implemented]
mov dword [ecx + 0xc], eax
mov eax, dword [0x100567d4]
mov dword [ecx + 0x10], eax
mov eax, dword [0x100567d8]
mov dword [ecx + 0x14], eax
mov eax, dword [0x100567dc]
mov dword [ecx + 0x18], eax
mov eax, dword [0x100567e0]
mov dword [ecx + 0x1c], eax
mov eax, dword [0x100567e4]
mov dword [ecx + 0x20], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop ebp
ret

Function at 0x10009900
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push str.Wrapper_not_implemented:SteamUnsubscribe
mov dword [ecx], 1
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [str.Wrapper_not_implemented]
mov dword [ecx + 0xc], eax
mov eax, dword [0x100567d4]
mov dword [ecx + 0x10], eax
mov eax, dword [0x100567d8]
mov dword [ecx + 0x14], eax
mov eax, dword [0x100567dc]
mov dword [ecx + 0x18], eax
mov eax, dword [0x100567e0]
mov dword [ecx + 0x1c], eax
mov eax, dword [0x100567e4]
mov dword [ecx + 0x20], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop ebp
ret

Function at 0x10009960
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push str.Wrapper_not_implemented:SteamUpdateAccountBillingInfo
mov dword [ecx], 1
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [str.Wrapper_not_implemented]
mov dword [ecx + 0xc], eax
mov eax, dword [0x100567d4]
mov dword [ecx + 0x10], eax
mov eax, dword [0x100567d8]
mov dword [ecx + 0x14], eax
mov eax, dword [0x100567dc]
mov dword [ecx + 0x18], eax
mov eax, dword [0x100567e0]
mov dword [ecx + 0x1c], eax
mov eax, dword [0x100567e4]
mov dword [ecx + 0x20], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop ebp
ret

Function at 0x100099c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push str.Wrapper_not_implemented:SteamUpdateSubscriptionBillingInfo
mov dword [ecx], 1
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [str.Wrapper_not_implemented]
mov dword [ecx + 0xc], eax
mov eax, dword [0x100567d4]
mov dword [ecx + 0x10], eax
mov eax, dword [0x100567d8]
mov dword [ecx + 0x14], eax
mov eax, dword [0x100567dc]
mov dword [ecx + 0x18], eax
mov eax, dword [0x100567e0]
mov dword [ecx + 0x1c], eax
mov eax, dword [0x100567e4]
mov dword [ecx + 0x20], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop ebp
ret
Function at 0x10009a20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push str.Wrapper_not_implemented:SteamVerifyEmailAddress
mov dword [ecx], 1
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [str.Wrapper_not_implemented]
mov dword [ecx + 0xc], eax
mov eax, dword [0x100567d4]
mov dword [ecx + 0x10], eax
mov eax, dword [0x100567d8]
mov dword [ecx + 0x14], eax
mov eax, dword [0x100567dc]
mov dword [ecx + 0x18], eax
mov eax, dword [0x100567e0]
mov dword [ecx + 0x1c], eax
mov eax, dword [0x100567e4]
mov dword [ecx + 0x20], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop ebp
ret

Function at 0x10009a80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push str.Wrapper_not_implemented:SteamVerifyPassword
mov dword [ecx], 1
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [str.Wrapper_not_implemented]
mov dword [ecx + 0xc], eax
mov eax, dword [0x100567d4]
mov dword [ecx + 0x10], eax
mov eax, dword [0x100567d8]
mov dword [ecx + 0x14], eax
mov eax, dword [0x100567dc]
mov dword [ecx + 0x18], eax
mov eax, dword [0x100567e0]
mov dword [ecx + 0x1c], eax
mov eax, dword [0x100567e4]
mov dword [ecx + 0x20], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop ebp
ret

Function at 0x10009ae0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push str.Wrapper_not_implemented:SteamWaitForAppReadyToLaunch
mov dword [ecx], 1
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [str.Wrapper_not_implemented]
mov dword [ecx + 0xc], eax
mov eax, dword [0x100567d4]
mov dword [ecx + 0x10], eax
mov eax, dword [0x100567d8]
mov dword [ecx + 0x14], eax
mov eax, dword [0x100567dc]
mov dword [ecx + 0x18], eax
mov eax, dword [0x100567e0]
mov dword [ecx + 0x1c], eax
mov eax, dword [0x100567e4]
mov dword [ecx + 0x20], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop ebp
ret

Function at 0x10009b40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push str.Wrapper_not_implemented:SteamWaitForAppResources
mov dword [ecx], 1
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [str.Wrapper_not_implemented]
mov dword [ecx + 0xc], eax
mov eax, dword [0x100567d4]
mov dword [ecx + 0x10], eax
mov eax, dword [0x100567d8]
mov dword [ecx + 0x14], eax
mov eax, dword [0x100567dc]
mov dword [ecx + 0x18], eax
mov eax, dword [0x100567e0]
mov dword [ecx + 0x1c], eax
mov eax, dword [0x100567e4]
mov dword [ecx + 0x20], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop ebp
ret
Function at 0x10009ba0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push str.Wrapper_not_implemented:SteamWasBlobRegistryDeleted
mov dword [ecx], 1
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [str.Wrapper_not_implemented]
mov dword [ecx + 0xc], eax
mov eax, dword [0x100567d4]
mov dword [ecx + 0x10], eax
mov eax, dword [0x100567d8]
mov dword [ecx + 0x14], eax
mov eax, dword [0x100567dc]
mov dword [ecx + 0x18], eax
mov eax, dword [0x100567e0]
mov dword [ecx + 0x1c], eax
mov eax, dword [0x100567e4]
mov dword [ecx + 0x20], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop ebp
ret

Function at 0x1000a7d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push dword [ebp + 0x18]
call fcn.10005d80
mov esi, dword [ebp + 0x10]
add esp, 4
test esi, esi
je 0x1000a7ef
mov dword [esi], 0
xor eax, eax
cmp dword [0x100749f4], eax
je 0x1000a869
push edi
mov edi, dword [ebp + 8]
test edi, edi
cmovne eax, dword [ebp + 0xc]
push eax
push edi
push str.SteamUser
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test esi, esi
je 0x1000a816
mov dword [esi], eax
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x1000a84c
mov ecx, dword [0x100749f4]
lea edx, [ebp - 8]
push edx
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [eax]
xor eax, eax
mov word [ebp - 0x10], ax
mov ecx, edx
mov eax, dword [ebp - 0x10]
and ecx, 1
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
shr edx, 1
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
cmp byte [0x10075258], 0
je 0x1000a863
push edi
push str.SteamGetUser:__s
call fcn.10025ee0
add esp, 8
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a940
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc10
push ebx
push esi
push edi
push dword [ebp + 0x14]
call fcn.10005d80
mov esi, dword [ebp + 0x10]
add esp, 4
cmp byte [0x10075258], 0
mov edi, dword [ebp + 8]
je 0x1000a975
push esi
push edi
push str.SteamLaunchApp_uAppId__u__args___s_
call fcn.10025ee0
add esp, 0xc
push 0x410
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.10034990
lea eax, [ebp - 0x410]
push 0x410
push eax
call fcn.100106b0
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x1000aa70
push 0xffffffffffffffff
push 0x410
lea eax, [ebp - 0x410]
push 0x10058a18
push eax
call fcn.1002eeb0
push 0xffffffffffffffff
push 0x410
lea eax, [ebp - 0x410]
push ebx
push eax
call fcn.1002eeb0
test esi, esi
mov eax, 0x1005646a
cmovne eax, esi
push eax
push edi
push 0x10058a1c
lea eax, [ebp - 0xc10]
push 0x400
push eax
call fcn.1000aec0
add esp, 0x34
xor eax, eax
mov word [ebp - 0x412], ax
push 1
push eax
lea eax, [ebp - 0xc10]
push eax
push 4
push 0
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.1002fcf0
xor ecx, ecx
mov esi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1003249e
push 0
mov edi, eax
lea eax, [ebp - 0x410]
push esi
push edi
push eax
call fcn.1002fcf0
add esp, 0x24
push edi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
mov esi, eax
call fcn.100324a7
add esp, 4
cmp esi, 0x20
jbe 0x1000aa70
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000aa80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [0x100749fc], 0
jne 0x1000aacc
push 0x100
lea eax, [ebp - 0x118]
push eax
push str.SteamGameId
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1000aacc
cmp eax, 0x100
jae 0x1000aacc
push 0xa
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.1003b37c
add esp, 0xc
mov dword [0x100749fc], eax
push esi
push edi
push 0x20
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0xf
call fcn.1000a0d0
mov dword [ebp - 8], 0x1b
mov edi, eax
mov dword [ebp - 4], 0x1f
mov ecx, 6
mov esi, str.cser.steampowered.com:27013
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [eax + 0x1b], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
call fcn.10015400
mov edx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
cmp edx, 0x10
jb 0x1000ab51
mov ecx, dword [ebp - 0x18]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000ab47
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000ab5f
push edx
push ecx
call fcn.10032490
add esp, 8
push 0xa
call fcn.100153e0
add esp, 4
mov esp, ebp
pop ebp
ret
call fcn.1003a720
int3
Function at 0x1000aca0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 0xc]
push esi
call fcn.10005d80
push str.SteamClient021
push 0
push 0
push 0x100749e0
call fcn.10010360
add esp, 0x14
mov dword [0x100749e4], eax
test eax, eax
je 0x1000ae47
cmp dword [0x100749e0], 0
je 0x1000ae47
mov edx, dword [eax]
mov ecx, eax
call dword [edx]
mov ecx, dword [0x100749e4]
mov dword [0x100749e8], eax
push eax
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [0x100749e4]
mov dword [0x100749ec], eax
push str.SteamUtils010
push dword [0x100749e8]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, dword [0x100749e4]
push str.SteamUser023
push dword [0x100749e8]
mov dword [0x100749f0], eax
mov eax, dword [ecx]
push dword [0x100749ec]
call dword [eax + 0x14]
mov ecx, dword [0x100749e4]
push str.STEAMAPPS_INTERFACE_VERSION008
push dword [0x100749e8]
mov dword [0x100749f4], eax
mov eax, dword [ecx]
push dword [0x100749ec]
call dword [eax + 0x3c]
mov ecx, dword [0x100749f0]
mov dword [0x100749f8], eax
test ecx, ecx
je 0x1000ae30
cmp dword [0x100749f4], 0
je 0x1000ae30
cmp dword [0x100749ec], 0
je 0x1000ae30
test eax, eax
je 0x1000ae30
cmp byte [0x10075258], 0
je 0x1000ada8
push 0x10058834
call fcn.10025ee0
mov ecx, dword [0x100749f0]
add esp, 4
mov eax, dword [ecx]
call dword [eax + 0x24]
mov edx, eax
mov dword [0x100749fc], edx
test edx, edx
jne 0x1000adfe
push 0x100
lea eax, [ebp - 0x100]
push eax
push str.SteamGameId
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1000adf8
cmp eax, 0x100
jae 0x1000adf8
push 0xa
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.1003b37c
mov edx, eax
add esp, 0xc
mov dword [0x100749fc], edx
jmp 0x1000adfe
mov edx, dword [0x100749fc]
mov ecx, dword [0x100749f8]
push 0x400
push 0x10074a00
push edx
mov eax, dword [ecx]
call dword [eax + 0x48]
call fcn.1000ce60
test al, al
je 0x1000ae57
call fcn.1000d4b0
test al, al
je 0x1000ae57
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push 1
push str.Missing_interface
push esi
call fcn.100073f0
add esp, 0xc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 1
push str.SteamAPI_Init_Internal_failed
push esi
call fcn.100073f0
add esp, 0xc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000c650
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x100
mov ecx, dword [0x100f1e18]
push esi
mov esi, dword [eax + ecx*4]
mov eax, dword [0x10075248]
cmp eax, dword [esi + 4]
jg 0x1000c7e5
mov eax, dword [0x1007524c]
cmp eax, dword [esi + 4]
jg 0x1000c81b
mov eax, dword [0x10075250]
cmp eax, dword [esi + 4]
jg 0x1000c851
mov eax, dword [0x10075254]
cmp eax, dword [esi + 4]
jg 0x1000c887
mov esi, dword [ebp + 8]
test esi, esi
je 0x1000c7de
mov ecx, 0x1005a330
mov eax, esi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000c6e0
test dl, dl
je 0x1000c6dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000c6e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000c6c0
xor eax, eax
jmp 0x1000c6e5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000c6f3
mov eax, 0x10073600
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, str.Steam004
mov eax, esi
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000c720
test dl, dl
je 0x1000c71c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000c720
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000c700
xor eax, eax
jmp 0x1000c725
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000c733
mov eax, 0x10073604
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, str.Steam005
mov eax, esi
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000c760
test dl, dl
je 0x1000c75c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000c760
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000c740
xor eax, eax
jmp 0x1000c765
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000c773
mov eax, 0x10073608
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, str.Steam006
mov eax, esi
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000c7a0
test dl, dl
je 0x1000c79c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000c7a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000c780
xor eax, eax
jmp 0x1000c7a5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000c7b3
mov eax, 0x1007360c
pop esi
mov esp, ebp
pop ebp
ret
push esi
push str.Steam_interface_not_implemented:__s
lea eax, [ebp - 0x100]
push 0x100
push eax
call fcn.1000ae80
add esp, 0x10
mov byte [ebp - 1], 0
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0x10075248
call fcn.100328f9
add esp, 4
cmp dword [0x10075248], 0xffffffff
jne 0x1000c67a
push 0x10054a70
call fcn.100327b1
push 0x10075248
call fcn.100328af
add esp, 8
jmp 0x1000c67a
push 0x1007524c
call fcn.100328f9
add esp, 4
cmp dword [0x1007524c], 0xffffffff
jne 0x1000c68b
push 0x10054a80
call fcn.100327b1
push 0x1007524c
call fcn.100328af
add esp, 8
jmp 0x1000c68b
push 0x10075250
call fcn.100328f9
add esp, 4
cmp dword [0x10075250], 0xffffffff
jne 0x1000c69c
push 0x10054a90
call fcn.100327b1
push 0x10075250
call fcn.100328af
add esp, 8
jmp 0x1000c69c
push 0x10075254
call fcn.100328f9
add esp, 4
cmp dword [0x10075254], 0xffffffff
jne 0x1000c6ad
push 0x10054aa0
call fcn.100327b1
push 0x10075254
call fcn.100328af
add esp, 8
jmp 0x1000c6ad
Function at 0x1000f4a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0xc]
call fcn.10005d80
add esp, 4
test dword [ebp + 8], 0x40000000
je 0x1000f4d4
push str.__hFile__VPK_FILE_HANDLE_FLAG_
push 0x2bb
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_steam2wrapper_steam2wrapper_stdio.cpp
call fcn.10024040
add esp, 0xc
test al, al
jne 0x1000f4d4
int3
push esi
push edi
push 0x1005a4f8
push str.nul:
lea edi, [ebp + 0x14]
call fcn.10036b05
add esp, 8
mov esi, eax
xor eax, eax
test esi, esi
cmove edi, eax
push edi
push eax
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push esi
call fcn.10005b90
push dword [eax + 4]
push dword [eax]
call fcn.1003a36a
push esi
mov edi, eax
call fcn.100369ca
add esp, 0x1c
test eax, eax
jne 0x1000f576
test edi, edi
js 0x1000f576
je 0x1000f576
call fcn.10023bc0
lea esi, [edi + 1]
push esi
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x1000f576
push dword [ebp - 4]
push dword [ebp + 0x10]
push esi
push edi
call fcn.1000fb60
push dword [ebp + 8]
mov esi, eax
call fcn.1000cdf0
push eax
push esi
push 1
push edi
call fcn.1003bc04
add esp, 0x24
mov esi, eax
call fcn.10023bc0
push 0
push edi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000f5d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x18]
call fcn.10005d80
mov esi, dword [ebp + 0x14]
push esi
call fcn.1000d450
mov ebx, eax
add esp, 8
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x1000f6d7
mov edx, dword [ebp + 0xc]
imul edx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ecx, dword [ebx + 0x18]
push edx
push esi
push ebx
call fcn.100050a0
test dword [ebp + 0x14], 0x20000000
mov edi, eax
je 0x1000f6a8
cmp edi, 1
jbe 0x1000f65e
add edi, esi
xor ebx, ebx
mov ecx, esi
cmp esi, edi
jae 0x1000f657
jmp 0x1000f630
mov dl, byte [esi]
cmp dl, 0xd
jne 0x1000f64a
lea eax, [esi + 1]
cmp eax, edi
jae 0x1000f64a
cmp byte [eax], 0xa
jne 0x1000f64a
mov byte [ecx], 0xa
mov esi, eax
jmp 0x1000f650
cmp ecx, esi
je 0x1000f650
mov byte [ecx], dl
inc esi
inc ecx
inc ebx
cmp esi, edi
jb 0x1000f630
mov edi, ebx
mov ebx, dword [ebp - 4]
jmp 0x1000f6a8
jne 0x1000f6a8
cmp byte [esi], 0xd
jne 0x1000f6a8
mov ecx, dword [ebx + 0x18]
lea eax, [ebp - 4]
push 1
push eax
push ebx
mov dword [ebp - 4], 0
call fcn.100050a0
test eax, eax
je 0x1000f6a8
cmp dword [ebp - 4], 0xa
jne 0x1000f68a
mov byte [esi], 0xa
jmp 0x1000f6a8
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
dec ecx
cmp edx, ecx
mov eax, edx
cmovge eax, ecx
test eax, eax
jns 0x1000f6a0
xor ecx, ecx
jmp 0x1000f6a5
cmp edx, ecx
cmovl ecx, edx
mov dword [ebx + 0xc], ecx
mov ecx, dword [ebp + 0xc]
cmp ecx, 1
jbe 0x1000f6b8
mov eax, edi
xor edx, edx
div ecx
mov edi, eax
cmp edi, dword [ebp + 0x10]
je 0x1000f705
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebx + 8]
jl 0x1000f705
mov eax, dword [ebp + 0x18]
mov dword [eax], 0xb
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.1000cdf0
mov esi, dword [ebp + 0x10]
mov ebx, eax
push ebx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10036d02
mov edi, eax
add esp, 0x14
cmp edi, esi
je 0x1000f707
push ebx
call fcn.1003b3fa
add esp, 4
test eax, eax
jne 0x1000f6c5
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000fb10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
call fcn.10005d80
add esp, 4
test dword [ebp + 0x14], 0x40000000
je 0x1000fb43
push str.__hFile__VPK_FILE_HANDLE_FLAG_
push 0x29d
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_steam2wrapper_steam2wrapper_stdio.cpp
call fcn.10024040
add esp, 0xc
test al, al
jne 0x1000fb43
int3
push dword [ebp + 0x14]
call fcn.1000cdf0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1003bc04
add esp, 0x14
pop ebp
ret
Function at 0x1000fe10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.10010040
mov ebx, dword [ebp + 0xc]
add esp, 4
mov edi, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x1000fe36
sub edi, ecx
mov edx, 2
inc edi
xor ecx, ecx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1003249e
add esp, 4
mov esi, eax
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1000fe76
mov word [esi], ax
lea eax, [ebp - 4]
push eax
push 0x20219
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
mov edi, eax
call fcn.100324a7
add esp, 4
test edi, edi
jne 0x1000ff34
mov ebx, dword [ebp + 0x18]
xor ecx, ecx
mov edx, 2
lea eax, [ebx + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1003249e
add esp, 4
lea ecx, [ebx + ebx]
mov dword [ebp - 8], ecx
mov esi, eax
lea ecx, [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.1000fc20
lea ecx, [ebp - 8]
push ecx
push esi
lea ecx, [ebp - 0x10]
push ecx
push edi
push dword [eax]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xc]
mov edi, eax
call fcn.100324a7
add esp, 4
test edi, edi
jne 0x1000ff20
mov eax, dword [ebp - 8]
xor ecx, ecx
push ecx
push ecx
push ebx
push dword [ebp + 0x14]
shr eax, 1
push 0xffffffffffffffff
push esi
push ecx
push 0xfde9
mov word [esi + eax*2], cx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
mov ecx, 0x7a
cmove edi, ecx
push esi
call fcn.100324a7
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ff50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
push dword [ebp + 8]
call fcn.10010040
mov edi, dword [ebp + 0xc]
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea ecx, [edi + 1]
lea esp, [esp]
mov al, byte [edi]
inc edi
test al, al
jne 0x1000ff80
sub edi, ecx
mov edx, 2
inc edi
xor ecx, ecx
mov eax, edi
mul edx
push esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1003249e
add esp, 4
mov esi, eax
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1000ffc3
mov word [esi], ax
lea eax, [ebp - 4]
push eax
push 0x20219
push 0
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
mov edi, eax
call fcn.100324a7
add esp, 4
pop esi
test edi, edi
jne 0x10010029
push dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], 4
call fcn.1000fc20
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push 0
push dword [eax]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call fcn.100324a7
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x14]
test edi, edi
pop edi
cmove eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret