joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009ce0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046018
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x10156054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
mov byte [ebp - 0x128], 0
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae eax, dword [ebp + 8]
push eax
push 0x100
lea eax, [ebp - 0x110]
push eax
push 0x10054348
push ecx
push str.TrainerSettings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x110], 0
je 0x10009df4
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009d80
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.1001fd70
call fcn.1002fa49
cmp dword [ebp - 0x114], 0x10
lea esi, [ebp - 0x128]
mov edi, eax
lea eax, [ebp - 0x12c]
cmovae esi, dword [ebp - 0x128]
push eax
push esi
mov dword [edi], 0
call fcn.1002c9c8
add esp, 8
fstp qword [ebp - 0x138]
cmp esi, dword [ebp - 0x12c]
je 0x10009e95
cmp dword [edi], 0x22
je 0x10009e9f
movsd xmm0, qword [ebp - 0x138]
movsd qword [ebx], xmm0
mov edx, dword [ebp - 0x114]
cmp edx, 0x10
jb 0x10009e2e
mov ecx, dword [ebp - 0x128]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10009e24
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10009ea9
push edx
push ecx
call fcn.10024b33
add esp, 8
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
mov byte [ebp - 0x128], 0
cmp edx, 0x10
jb 0x10009e79
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10009e6f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10009ea9
push edx
push ecx
call fcn.10024b33
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100244b6
mov esp, ebp
pop ebp
ret
push str.invalid_stod_argument
call fcn.10023596
push str.stod_argument_out_of_range
call fcn.100235d6
call fcn.10030a00
int3
Function at 0x10015e60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046168
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x10156054]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
mov byte [ebp - 4], 1
lea eax, [ebp + 0x14]
cmp dword [ebp + 0x28], 0x10
cmovae eax, dword [ebp + 0x14]
push eax
push 0x100
lea eax, [ebp - 0x114]
push eax
push 0x10054348
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x114], 0
je 0x10015f66
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10015f00
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.1001fd70
call fcn.1002fa49
cmp dword [ebp - 0x118], 0x10
lea esi, [ebp - 0x12c]
mov edi, eax
lea eax, [ebp - 0x130]
cmovae esi, dword [ebp - 0x12c]
push 0xa
push eax
push esi
mov dword [edi], 0
call fcn.1002ddd0
add esp, 0xc
cmp esi, dword [ebp - 0x130]
je 0x10016005
cmp dword [edi], 0x22
je 0x10016014
mov dword [ebx], eax
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x10015f9c
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10015f92
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001600f
push edx
push ecx
call fcn.10024b33
add esp, 8
mov edx, dword [ebp + 0x28]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
cmp edx, 0x10
jb 0x10015fe7
mov ecx, dword [ebp + 0x14]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10015fdd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001600f
push edx
push ecx
call fcn.10024b33
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100244b6
mov esp, ebp
pop ebp
ret 0x24
push str.invalid_stoi_argument
call fcn.10023596
call fcn.10030a00
push str.stoi_argument_out_of_range
call fcn.100235d6
int3
Function at 0x10018300
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100461dd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x24
mov eax, dword [0x10156054]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x18
mov esi, esp
mov ecx, esi
push 0x20
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.1001ffd0
mov dword [esi + 0x10], 0x16
mov dword [esi + 0x14], 0x1f
movups xmm0, xmmword [0x1005437c]
movups xmmword [eax], xmm0
mov ecx, dword [0x1005438c]
mov dword [eax + 0x10], ecx
mov cx, word [0x10054390]
mov word [eax + 0x14], cx
lea ecx, [ebp - 0x2c]
mov byte [eax + 0x16], 0
mov dword [esi], eax
call fcn.10009260
add esp, 0x18
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1001847a
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x10156a04
mov ecx, str.MenuUp
call fcn.100095c0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x101569fc
mov ecx, str.MenuDn
call fcn.100095c0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x10156ba4
mov ecx, str.MenuLeft
call fcn.100095c0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x10156a00
mov ecx, str.MenuRight
call fcn.100095c0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x10156a0c
mov ecx, str.MenuEnter
call fcn.100095c0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x101569b4
mov ecx, str.MenuBack
call fcn.100095c0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x101569cc
mov ecx, str.MenuToggle
call fcn.100095c0
add esp, 0x18
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x100184aa
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100184a0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184c7
push edx
push ecx
call fcn.10024b33
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100244b6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.10030a00
int3
Function at 0x10018770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100461dd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x24
mov eax, dword [0x10156054]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x18
mov esi, esp
mov ecx, esi
push 0x20
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.1001ffd0
mov dword [esi + 0x10], 0x16
mov dword [esi + 0x14], 0x1f
movups xmm0, xmmword [0x1005437c]
movups xmmword [eax], xmm0
mov ecx, dword [0x1005438c]
mov dword [eax + 0x10], ecx
mov cx, word [0x10054390]
mov word [eax + 0x14], cx
lea ecx, [ebp - 0x2c]
mov byte [eax + 0x16], 0
mov dword [esi], eax
call fcn.10009260
add esp, 0x18
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10018950
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov ecx, 0x10156a20
call fcn.10016020
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x10156a20
mov ecx, str.IVControls
call fcn.100093f0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x10156a21
mov ecx, str.IVControls_CycleWeapon
call fcn.100093f0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x10156a22
mov ecx, str.IVControls_FullDriveby
call fcn.100093f0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x10156a23
mov ecx, str.IVControls_Walk
call fcn.100093f0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x10156a25
mov ecx, str.IVControls_CrouchJump
call fcn.100093f0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x10156a26
mov ecx, str.IVControls_CrouchSprint
call fcn.100093f0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x10156a27
mov ecx, str.IVControls_AimStrafeFix
call fcn.100093f0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x10156a24
mov ecx, str.IVControls_VehicleWepSwitch
call fcn.100093f0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x10156a28
mov ecx, str.IVControls_IVLookBehind
call fcn.100093f0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1001ee90
mov edx, 0x10156a29
mov ecx, str.IVControls_IVWeakHeliControls
call fcn.100093f0
add esp, 0x18
call fcn.10018300
call fcn.100184d0
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x1001898a
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10018980
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100189a7
push edx
push ecx
call fcn.10024b33
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100244b6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.10030a00
int3
Function at 0x1001d200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x1001d2e8
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x1001d2d7
jg 0x1001d240
test edx, edx
je 0x1001d2d7
nop dword [eax]
call fcn.1001fa90
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1001d294
jg 0x1001d257
test esi, esi
je 0x1001d294
cmp ebx, eax
jg 0x1001d267
jl 0x1001d261
cmp edi, esi
jae 0x1001d267
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.10025f10
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x1001d2bb
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x1001d2d1
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x1001d240
jl 0x1001d2d1
test edi, edi
jne 0x1001d240
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1001d30a
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x1001d30c
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x1001d38a
jg 0x1001d31f
test esi, esi
je 0x1001d38a
test eax, eax
jl 0x1001d36e
jg 0x1001d329
test ebx, ebx
je 0x1001d36e
cmp edi, eax
jg 0x1001d339
jl 0x1001d333
cmp esi, ebx
jae 0x1001d339
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.10025f10
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x1001d38a
jg 0x1001d371
test esi, esi
je 0x1001d38a
jmp 0x1001d371
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x1001d38a
push eax
push esi
push 1
push edx
call fcn.1002f96d
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001d9c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10156054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1001d9f0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100244b6
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1001da2c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1001da2c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100244b6
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x1001db16
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001da54
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001da87
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.1002926a
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100244b6
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x1001dae9
sub eax, 1
je 0x1001dae9
sub eax, 2
jne 0x1001db16
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.1002926a
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100244b6
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001db06
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1002f96d
add esp, 0x10
cmp edi, eax
jne 0x1001db16
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x1001da17
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100244b6
mov esp, ebp
pop ebp
ret 4
Function at 0x1001f5c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10156054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1001f67c
cmp byte [esi + 0x3d], 0
je 0x1001f67c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1001f66a
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x1001f632
sub eax, 1
je 0x1001f636
sub eax, 2
jne 0x1001f66a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100244b6
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001f653
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1002f96d
add esp, 0x10
cmp edi, eax
jne 0x1001f66a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100244b6
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100244b6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100244b6
mov esp, ebp
pop ebp
ret

Function at 0x10020380
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046750
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10156054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100246d4
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10023782
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10021450
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov esi, dword [esi]
test eax, eax
je 0x10021496
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100214a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov bl, byte [esi]
test eax, eax
je 0x100214e7
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10023320
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
call fcn.10023300
mov ecx, dword [0x105a19b8]
mov esi, eax
test cl, 1
jne 0x10023365
or ecx, 1
mov dword [0x105a17c8], 0x10054110
mov dword [0x105a19b8], ecx
mov dword [0x105a17d0], 0
mov dword [0x105a17cc], 0
call fcn.10008570
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 4
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov esi, dword [esi]
test eax, eax
je 0x100233a1
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1003847a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100382f0
Function at 0x4021b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x438ea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov edx, dword [esp + 0x30]
mov eax, edx
push esi
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4021e7
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x10]
call fcn.00401d70
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
mov ecx, 0x4512e0
mov dword [esp + 0x34], 0
call fcn.00401f10
mov eax, dword [esp + 0x20]
mov esi, 0x10
cmp eax, esi
jb 0x402231
mov edx, dword [esp + 0xc]
push edx
call fcn.0042a823
add esp, 4
mov eax, dword [esp + 4]
cmp eax, dword [0x4512e4]
jne 0x40224f
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
cmp dword [eax + 0x40], esi
jb 0x402267
mov eax, dword [eax + 0x2c]
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov ecx, dword [esp + 0x24]
add eax, 0x2c
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x402e80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push esi
push 0x43b870
push str.patchlog.txt
call fcn.0041c101
mov esi, eax
add esp, 8
test esi, esi
je 0x402eeb
lea eax, [esp + 4]
push eax
call fcn.0041c069
lea ecx, [esp + 8]
push ecx
call fcn.0041c050
push eax
push str.Log_start_:__s_n
push esi
call fcn.0041bff2
add esp, 0x14
lea edx, [esp + 0xc]
push edx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0xc]
push eax
push str.Current_Directory_:__s_n
push esi
call fcn.0041bff2
push esi
call fcn.0041bfa1
add esp, 0x10
pop esi
add esp, 0x208
ret

Function at 0x4038e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4038f9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40390d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40392e
cmp esi, eax
jae 0x403907
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403920
cmp esi, eax
jae 0x403907
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret