joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008f60
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x870
mov eax, dword [0x1004806c]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [0x1004f4b0]
push str.Running_From:__d
call fcn.10002f50
add esp, 8
cmp byte [0x1004f40a], 0
jne 0x10008fb4
cmp byte [0x1004f408], 0
jne 0x10008fb4
cmp byte [0x1004f409], 0
je 0x10008fe9
mov eax, dword [0x1004f4b0]
cmp eax, 1
je 0x10008fe9
cmp eax, 2
je 0x10008fe9
lea eax, [ebp - 0x808]
push eax
push 0x7ff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x808]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
je 0x10009037
jmp 0x10008fe0
push dword [0x1004bfc0]
push str.Before_EndDialog__d
call fcn.10002f50
add esp, 8
push 0
push 0
push 0x3e8
push dword [0x1004bfc0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x3e8
push dword [0x1004bfc0]
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001327e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
sub ecx, edx
lea eax, [ebp - 0x808]
add eax, ecx
push 0x10035004
push eax
call fcn.10011080
lea eax, [ebp - 0x808]
push eax
call fcn.10002f50
push 0x44
lea eax, [ebp - 0x868]
push 0
push eax
call fcn.10015640
add esp, 0x18
lea eax, [ebp - 0x820]
xorps xmm0, xmm0
movaps xmmword [ebp - 0x820], xmm0
push eax
lea eax, [ebp - 0x868]
push eax
push 0
push 0
push 0x8000020
push 0
push 0
push 0
lea eax, [ebp - 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 1
call fcn.10018866
int3
Function at 0x1000d1e0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x1004806c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x104
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea eax, [ebp - 0x310]
push eax
call fcn.100223ef
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.10015640
push 0x1004c8d8
lea eax, [ebp - 0x108]
push 0x1003533c
push eax
call fcn.10011080
lea ecx, [ebp - 0x108]
add esp, 0x1c
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d260
sub ecx, edx
dec ecx
cmp ecx, 0x104
jae 0x1000d374
mov byte [ebp + ecx - 0x108], al
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d286
sub ecx, edx
cmp ecx, 0x104
jae 0x1000d374
mov byte [ebp + ecx - 0x108], al
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d2b0
sub ecx, edx
inc ecx
cmp ecx, 0x104
jae 0x1000d374
mov byte [ebp + ecx - 0x108], al
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d2d6
sub ecx, edx
add ecx, 2
cmp ecx, 0x104
jae 0x1000d374
push 0x1004c0d8
mov byte [ebp + ecx - 0x108], al
call fcn.100223ef
add esp, 4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x330], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x328], eax
mov eax, 0x614
mov word [ebp - 0x320], ax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x330]
mov dword [ebp - 0x31e], 0
push eax
mov dword [ebp - 0x324], 0
mov dword [ebp - 0x32c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
push eax
push str.Deleting_tmp_folder__d__s
call fcn.10002f50
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
call fcn.1001327e
mov esp, ebp
pop ebp
ret
call fcn.100133e5
int3
Function at 0x1000d500
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.100134c0
mov eax, dword [0x1004806c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1004c8d8
call fcn.100223ef
push 0x1004bfd0
lea eax, [ebp - 0x804]
push str._sdata_streamspcmpcm.wad
push eax
call fcn.10011080
push 0x1004bfd0
lea eax, [ebp - 0x1004]
push str._sdata_streamspcmpcm.dat
push eax
call fcn.10011080
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea eax, [ebp - 0x804]
add esp, 0x1c
push eax
call esi
test eax, eax
je 0x1000d58f
lea eax, [ebp - 0x1004]
push eax
call esi
test eax, eax
je 0x1000d58f
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x804]
push 0
push str.pcm.wad
push eax
call esi
lea eax, [ebp - 0x1004]
jmp 0x1000d5f6
call fcn.1000ecd0
push eax
lea eax, [ebp - 0x1804]
push str._sdata_streamspcmpcm.wad
push eax
call fcn.10011080
call fcn.1000ecd0
push eax
lea eax, [ebp - 0x2004]
push str._sdata_streamspcmpcm.dat
push eax
call fcn.10011080
add esp, 0x18
lea eax, [ebp - 0x1804]
push eax
call esi
test eax, eax
je 0x1000d600
lea eax, [ebp - 0x2004]
push eax
call esi
test eax, eax
je 0x1000d600
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x1804]
push 0
push str.pcm.wad
push eax
call esi
lea eax, [ebp - 0x2004]
push 0
push str.pcm.dat
push eax
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001327e
mov esp, ebp
pop ebp
ret
Function at 0x1000eaa0
Capabilities:
Create directory
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x1004806c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x1004c8d8
call fcn.100223ef
push 0x10035030
push str.pcm.wad
call fcn.1001c30b
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x80c], edi
test edi, edi
jne 0x1000eaeb
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001327e
mov esp, ebp
pop ebp
ret
push ebx
push esi
mov ecx, 0x1004d13c
call fcn.10010960
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov esi, eax
movzx ecx, si
shl ecx, 0x10
push ecx
push 0
push 0x401
push dword [0x1004bfc8]
call ebx
push 0
push 0
push 0x402
push dword [0x1004bfc8]
call ebx
push esi
push str.Streams:_files__d
call fcn.10002f50
add esp, 8
lea eax, [ebp - 0x808]
mov ecx, 0x1004d13c
push eax
call fcn.1000b870
lea eax, [ebp - 0x814]
mov ecx, 0x1004d13c
push eax
call fcn.1000e960
push eax
lea ecx, [ebp - 0x808]
call fcn.100077c0
test al, al
je 0x1000ec76
nop word [eax + eax]
lea eax, [ebp - 0x818]
mov ecx, 0x1004d13c
push eax
call fcn.1000b870
push eax
lea ecx, [ebp - 0x808]
call fcn.100079e0
inc eax
lea ecx, [ebp - 0x808]
mov dword [ebp - 0x810], eax
call fcn.100078f0
mov ebx, eax
push 0
push dword [ebx + 4]
push edi
call fcn.1001c86c
mov ecx, dword [ebx + 8]
add ecx, 0xa
push ecx
call fcn.100185af
push dword [ebp - 0x80c]
mov edi, eax
push dword [ebx + 8]
push 1
push edi
call fcn.1001c50a
push 0x10035058
call fcn.1001e573
push dword [ebx]
lea eax, [ebp - 0x804]
push str.streams__08x.bik
push eax
call fcn.10011080
lea eax, [ebp - 0x804]
push 0x10035074
push eax
call fcn.1001c30b
mov esi, eax
push esi
push dword [ebx + 8]
push 1
push edi
call fcn.1001d0ab
add esp, 0x48
push esi
call fcn.1001c1e4
push dword [ebx + 8]
push edi
push 0
call fcn.10003260
push edi
mov dword [ebx + 0xc], eax
call fcn.1001816e
add esp, 0x14
push 0
push dword [ebp - 0x810]
push 0x402
push dword [0x1004bfc8]
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x808]
call fcn.10007950
lea eax, [ebp - 0x814]
mov ecx, 0x1004d13c
push eax
call fcn.1000e960
push eax
lea ecx, [ebp - 0x808]
call fcn.100077c0
mov edi, dword [ebp - 0x80c]
test al, al
jne 0x1000eb70
push edi
call fcn.1001c1e4
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop esi
pop ebx
pop edi
call fcn.1001327e
mov esp, ebp
pop ebp
ret
Function at 0x1000ecd0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push esi
push eax
push 1
push 0
push str.SoftwareTHUG_ProSettings_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000ed80
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
push 0x1004b7b8
push 0
push 0
push str.thug2_path
push dword [ebp - 4]
mov dword [ebp - 8], 0x400
call esi
lea eax, [ebp - 8]
push eax
push 0x1004bbb8
push 0
push 0
push str.thug_pro_path
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push 0x1004b7b8
call esi
test eax, eax
je 0x1000ed56
mov eax, 0x1004b7b8
pop esi
mov esp, ebp
pop ebp
ret
push 0x1004f418
call esi
test eax, eax
je 0x1000ed6b
mov eax, 0x1004f418
pop esi
mov esp, ebp
pop ebp
ret
push 0x1004f45c
call esi
test eax, eax
je 0x1000ed80
mov eax, 0x1004f45c
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000f090
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 0x10035030
push edi
call fcn.1001c30b
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000f0c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.File_error__s__d
call fcn.10002f50
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
ret
push ebx
push 2
push 0
push esi
call fcn.1001c86c
push esi
call fcn.1001ce87
push esi
mov ebx, eax
call fcn.1001d110
push ebx
call fcn.100185af
mov edi, eax
add esp, 0x18
test edi, edi
je 0x1000f121
push esi
push ebx
push 1
push edi
call fcn.1001c50a
add esp, 0x10
cmp eax, ebx
jne 0x1000f121
push esi
call fcn.1001c1e4
push ebx
push edi
push 0
call fcn.10003260
push edi
mov esi, eax
call fcn.1001816e
add esp, 0x14
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
ret
push str.Update_Manifest_Reading_Error
call fcn.10002f50
push esi
call fcn.1001c1e4
push edi
call fcn.1001816e
add esp, 0xc
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x1000f150
Capabilities:
Check if file exists
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x1004806c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x80c], eax
lea eax, [ebp - 0x804]
push edi
push eax
push esi
mov dword [ebp - 0x810], esi
call fcn.10008cf0
add esp, 8
test eax, eax
js 0x1000f286
push str.succeeded
call fcn.10002f50
lea eax, [ebp - 0x804]
push eax
push 0x1003533c
call fcn.10002f50
add esp, 0xc
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push eax
push str.exist:__d
call fcn.10002f50
lea eax, [ebp - 0x804]
push 0x10035030
push eax
call fcn.1001c30b
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1000f1f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Manifest_Reading_Error__d
call fcn.10002f50
mov edi, dword [ebp - 0x80c]
jmp 0x1000f23e
push 2
push 0
push ebx
call fcn.1001c86c
push ebx
call fcn.1001ce87
mov edi, eax
push ebx
mov dword [ebp - 0x808], edi
call fcn.1001d110
push str.malloc
call fcn.10002f50
lea ecx, [edi + 0x3c]
push ecx
call fcn.100185af
mov edi, eax
add esp, 0x1c
test edi, edi
jne 0x1000f299
push esi
push str.Manifest_Reading_Error__s
call fcn.10002f50
add esp, 8
push str.no_manifest
call fcn.10002f50
add esp, 4
test ebx, ebx
je 0x1000f25b
push ebx
call fcn.1001c1e4
add esp, 4
test edi, edi
je 0x1000f268
push edi
call fcn.1001816e
add esp, 4
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1000f286
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001327e
mov esp, ebp
pop ebp
ret
push ebx
push dword [ebp - 0x808]
push 1
push edi
call fcn.1001c50a
push dword [ebp - 0x808]
mov esi, eax
push str.size:__d
call fcn.10002f50
mov eax, dword [ebp - 0x808]
add esp, 0x18
mov byte [edi + eax], 0
cmp esi, eax
je 0x1000f2d6
push dword [ebp - 0x810]
jmp 0x1000f234
push str.before_parse
call fcn.10002f50
mov ecx, dword [ebp - 0x80c]
add esp, 4
push edi
call fcn.10008870
push str.buffer
call fcn.10002f50
mov ecx, dword [ebp - 0x80c]
add esp, 4
call fcn.10008540
test al, al
jne 0x1000f241
push str.No_parse_error
call fcn.10002f50
push ebx
call fcn.1001c1e4
push str.fclosed
call fcn.10002f50
push edi
call fcn.1001816e
push str.buffer_freed
call fcn.10002f50
add esp, 0x14
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.delete_file
call fcn.10002f50
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.1001327e
mov esp, ebp
pop ebp
ret
Function at 0x1000f370
Capabilities:
Check if file exists
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc04
mov eax, dword [0x1004806c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1004f4b0]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1000f3a9
cmp eax, 1
je 0x1000f3a9
push 0x1004bfd0
call esi
test eax, eax
je 0x1000f54d
jmp 0x1000f3c5
push 0x800
push 0x1004c0d8
call fcn.10022089
push 0x1004c0d8
call sym.updt.dll_setTHUGProPath
add esp, 0xc
push 0x1004bfd0
lea eax, [ebp - 0xc04]
push str._s_thugpro.dll
push eax
call fcn.10011080
add esp, 0xc
lea eax, [ebp - 0xc04]
push eax
call esi
test eax, eax
lea eax, [ebp - 0xc04]
jne 0x1000f410
push eax
push str.thugpro.dll_not_found_at__s
call fcn.10002f50
add esp, 8
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001327e
mov esp, ebp
pop ebp
ret
push edi
push eax
push str.thugpro.dll:__s
call fcn.10002f50
add esp, 8
lea eax, [ebp - 0xc04]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x1000f451
push str.Couldnt_open_thugpro.dll
call fcn.10002f50
add esp, 4
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001327e
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push str.FrequencyKenneth
push edi
call esi
push str.BenzedrineUhHuh
push edi
mov ebx, eax
call esi
mov esi, eax
test ebx, ebx
je 0x1000f526
test esi, esi
je 0x1000f526
call ebx
mov dword [0x1004f400], eax
call esi
push edi
mov dword [0x1004f404], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [0x1004f400]
movsx eax, cl
push eax
movsx eax, ch
push eax
movsx eax, byte [0x1004f402]
push eax
movsx eax, byte [0x1004f403]
push eax
lea eax, [ebp - 0x404]
push str._d._d._d._d
push eax
call fcn.10011080
lea eax, [ebp - 0x404]
push eax
push 0x1003533c
push 0x1004b3d0
call fcn.10011080
cmp dword [0x1004f404], 0
mov ecx, str.beta
mov eax, str.public
cmove eax, ecx
push eax
push 0x1003533c
push 0x1004afe8
call fcn.10011080
lea eax, [ebp - 0x404]
push eax
push 0x1004afe8
push str.We_have__s__s
call fcn.10002f50
add esp, 0x3c
mov al, 1
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001327e
mov esp, ebp
pop ebp
ret
push str.hmm....
call fcn.10002f50
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
xor al, al
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.1001327e
mov esp, ebp
pop ebp
ret
push 0x30
push str.THUG_Pro_Update
push str.Invalid_calling_parameters._THUG_Pro_Path_not_provided.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.10018866
int3
Function at 0x1000f880
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1004806c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1004c8d8
call fcn.100223ef
push 0x10035030
push str.pcm.dat
call fcn.1001c30b
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x1000f8c2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001327e
mov esp, ebp
pop ebp
ret
push edi
push esi
push 1
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.1001c50a
xor edi, edi
add esp, 0x10
cmp dword [ebp - 0x14], edi
jle 0x1000f917
nop dword [eax + eax]
push esi
push 1
lea eax, [ebp - 0x10]
push 0xc
push eax
call fcn.1001c50a
mov eax, dword [ebp - 0x10]
add esp, 0x10
mov dword [ebp - 0x30], eax
mov ecx, 0x1004d13c
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
push eax
call fcn.100103f0
inc edi
cmp edi, dword [ebp - 0x14]
jl 0x1000f8e0
push esi
call fcn.1001c1e4
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop edi
pop esi
call fcn.1001327e
mov esp, ebp
pop ebp
ret
Function at 0x1000fb00
Capabilities:
Copy file
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x1004806c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x1004c8d8
call fcn.100223ef
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
add esp, 4
push 0
push dword [0x1004bfc4]
call edi
push 0
push dword [0x1004bfc8]
call edi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 2
push dword [0x1004bfc0]
call esi
push eax
call edi
push 5
push 0x3e9
push dword [0x1004bfc0]
call esi
push eax
call edi
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.10015640
push 0x1004c8d8
lea eax, [ebp - 0x108]
push 0x100357f4
push eax
call fcn.10011080
lea ecx, [ebp - 0x108]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000fb98
sub ecx, edx
cmp ecx, 0x104
jae 0x1000fcea
mov byte [ebp + ecx - 0x108], al
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000fbc0
sub ecx, edx
inc ecx
cmp ecx, 0x104
jae 0x1000fcea
mov byte [ebp + ecx - 0x108], al
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000fbe6
sub ecx, edx
add ecx, 2
cmp ecx, 0x104
jae 0x1000fcea
mov byte [ebp + ecx - 0x108], al
mov ecx, 0x1004bfd0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000fc10
sub ecx, edx
cmp ecx, 0x104
jae 0x1000fcea
mov byte [ecx + 0x1004bfd0], al
mov ecx, 0x1004bfd0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000fc33
sub ecx, edx
inc ecx
cmp ecx, 0x104
jae 0x1000fcea
mov byte [ecx + 0x1004bfd0], al
lea eax, [ebp - 0x108]
push 0x1004bfd0
push eax
push str.Copying_over_files__s_____s
call fcn.10002f50
add esp, 0xc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x120], eax
mov eax, 0x614
mov word [ebp - 0x118], ax
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x116], 0
mov dword [ebp - 0x11c], 0x1004bfd0
mov dword [ebp - 0x124], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov esi, eax
lea eax, [ebp - 0x108]
push 0x1004bfd0
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.SHCopy__d___d___s__s
call fcn.10002f50
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
call fcn.1001327e
mov esp, ebp
pop ebp
ret
call fcn.100133e5
int3
Function at 0x1000fec0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1004806c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x1004c8d8
call fcn.100223ef
push 0x10035074
push str.pcm2.dat
call fcn.1001c30b
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000ff02
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001327e
mov esp, ebp
pop ebp
ret
push ebx
mov ecx, 0x1004d0e4
call fcn.10010960
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x18], eax
movzx eax, ax
shl eax, 0x10
push eax
push 0
push 0x401
push dword [0x1004bfc8]
call ebx
push 0
push 0
push 0x402
push dword [0x1004bfc8]
call ebx
push dword [ebp - 0x18]
push str.Packing_Streams_Dat:_files__d
call fcn.10002f50
push edi
push 4
lea eax, [ebp - 0x18]
push 1
push eax
call fcn.1001d0ab
add esp, 0x18
lea eax, [ebp - 0x14]
mov ecx, 0x1004d0e4
push eax
call fcn.1000b870
lea eax, [ebp - 0x1c]
mov ecx, 0x1004d0e4
push eax
call fcn.1000e960
push eax
lea ecx, [ebp - 0x14]
call fcn.100077c0
test al, al
je 0x10010003
push esi
lea eax, [ebp - 0x20]
mov ecx, 0x1004d0e4
push eax
call fcn.1000b870
push eax
lea ecx, [ebp - 0x14]
call fcn.100079e0
lea ecx, [ebp - 0x14]
lea esi, [eax + 1]
call fcn.100078f0
cmp byte [eax + 0x18], 0
je 0x1000ffcf
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 8]
push edi
mov dword [ebp - 8], ecx
mov eax, dword [eax + 4]
push 0xc
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.1001d0ab
add esp, 0x10
push 0
push esi
push 0x402
push dword [0x1004bfc8]
call ebx
lea ecx, [ebp - 0x14]
call fcn.10007950
lea eax, [ebp - 0x1c]
mov ecx, 0x1004d0e4
push eax
call fcn.1000e960
push eax
lea ecx, [ebp - 0x14]
call fcn.100077c0
test al, al
jne 0x1000ff85
pop esi
push edi
call fcn.1001c1e4
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop ebx
pop edi
call fcn.1001327e
mov esp, ebp
pop ebp
ret
Function at 0x10010030
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x1004806c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x1004c8d8
call fcn.100223ef
push 0x10035074
push str.pcm2.wad
call fcn.1001c30b
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x80c], edi
test edi, edi
jne 0x1001007b
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001327e
mov esp, ebp
pop ebp
ret
push ebx
push esi
mov ecx, 0x1004d0e4
call fcn.10010960
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov esi, eax
movzx ecx, si
shl ecx, 0x10
push ecx
push 0
push 0x401
push dword [0x1004bfc8]
mov dword [ebp - 0x818], ebx
call ebx
push 0
push 0
push 0x402
push dword [0x1004bfc8]
call ebx
push esi
push str.Packing_Streams_Wad:_files__d
call fcn.10002f50
add esp, 8
lea eax, [ebp - 0x808]
mov ecx, 0x1004d0e4
push eax
call fcn.1000b870
lea eax, [ebp - 0x81c]
mov ecx, 0x1004d0e4
push eax
call fcn.1000e960
push eax
lea ecx, [ebp - 0x808]
call fcn.100077c0
test al, al
je 0x1001023f
lea eax, [ebp - 0x820]
mov ecx, 0x1004d0e4
push eax
call fcn.1000b870
push eax
lea ecx, [ebp - 0x808]
call fcn.100079e0
inc eax
lea ecx, [ebp - 0x808]
mov dword [ebp - 0x814], eax
call fcn.100078f0
mov esi, eax
lea eax, [ebp - 0x804]
mov dword [ebp - 0x810], esi
push dword [esi]
push str.streams__08x.bik
push eax
call fcn.10011080
lea eax, [ebp - 0x804]
push 0x10035030
push eax
call fcn.1001c30b
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x100101d7
push 2
push 0
push ebx
call fcn.1001c86c
push ebx
call fcn.1001ce87
push 0
push 0
push ebx
mov edi, eax
call fcn.1001c86c
lea ecx, [edi + 0xa]
mov dword [esi + 8], edi
push ecx
call fcn.100185af
push ebx
push edi
mov esi, eax
push 1
push esi
call fcn.1001c50a
push dword [ebp - 0x80c]
call fcn.1001ce87
push dword [ebp - 0x80c]
mov ecx, dword [ebp - 0x810]
push edi
push 1
push esi
mov dword [ecx + 4], eax
call fcn.1001d0ab
add esp, 0x44
push ebx
call fcn.1001c1e4
push esi
call fcn.1001816e
mov esi, dword [ebp - 0x810]
add esp, 8
mov al, 1
jmp 0x100101ed
lea eax, [ebp - 0x804]
push eax
push str.File_to_be_packed_not_found__s
call fcn.10002f50
add esp, 8
xor al, al
push 0
push dword [ebp - 0x814]
mov byte [esi + 0x18], al
push 0x402
push dword [0x1004bfc8]
call dword [ebp - 0x818]
lea ecx, [ebp - 0x808]
call fcn.10007950
lea eax, [ebp - 0x81c]
mov ecx, 0x1004d0e4
push eax
call fcn.1000e960
push eax
lea ecx, [ebp - 0x808]
call fcn.100077c0
test al, al
jne 0x10010100
mov edi, dword [ebp - 0x80c]
push edi
call fcn.1001c1e4
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop esi
pop ebx
pop edi
call fcn.1001327e
mov esp, ebp
pop ebp
ret