joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427acb
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
jne 0x427ae3
jmp 0x427b4b
mov ecx, dword [0x4602b0]
add ecx, 1
mov dword [0x4602b0], ecx
mov edx, dword [0x4602b0]
push edx
mov eax, dword [0x4532c8]
push eax
push str.queryid_d._d
lea ecx, [ebp - 0x50]
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0x10
lea edx, [ebp - 0x50]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x10
mov ecx, dword [ebp + 8]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [0x4532cc]
push ecx
call sub.WSOCK32.dll_sendto
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
mov esp, ebp
pop ebp
ret

Function at 0x4281c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push 0x460194
mov eax, dword [0x4601ac]
push eax
push str.heartbeat_dgamename_s
lea ecx, [ebp - 0x100]
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0x10
cmp dword [ebp + 8], 0
je 0x428202
push str._statechanged_
lea edx, [ebp - 0x100]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
lea eax, [ebp - 0x100]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x100]
push ecx
mov edx, dword [0x4532d0]
push edx
call sub.WSOCK32.dll_send
call fcn.00434de0
mov dword [0x4602c4], eax
mov esp, ebp
pop ebp
ret

Function at 0x42a9a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x434005
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00433e9f
add esp, 0xc
test eax, eax
je 0x43402f
mov eax, 1
jmp 0x434157
mov dword [ebp - 0x24], 0
jmp 0x434041
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x434155
cmp dword [ebp - 0x24], 0
jne 0x434060
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x69b338]
mov dword [ebp - 0xc], edx
jmp 0x43406d
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x69b330]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jne 0x434075
jmp 0x434038
mov dword [ebp - 0x20], 0x10
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.WSOCK32.dll_recvfrom
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x434100
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x2733
jne 0x4340bc
jmp 0x434038
mov eax, dword [0x6c810c]
fld dword [eax + 0x14]
fcomp dword [0x44c308]
fnstsw ax
test ah, 0x40
jne 0x4340e6
call fcn.00434aa3
push eax
push 0x4571a4
call fcn.0042050d
add esp, 8
jmp 0x4340fb
call fcn.00434aa3
push eax
push str.NET_GetPacket:__s
push 1
call fcn.0042071a
add esp, 0xc
jmp 0x434038
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.00433768
add esp, 8
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0xc]
jne 0x434145
sub esp, 0x14
mov ecx, 5
mov esi, dword [ebp + 0xc]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00433986
add esp, 0x14
push eax
push str.Oversize_packet_from__s_n
call fcn.0042050d
add esp, 8
jmp 0x434038
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, 1
jmp 0x434157
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43415d
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
cmp dword [ebp + 0x14], 0
jne 0x434193
sub esp, 0x14
mov ecx, 5
lea esi, [ebp + 0x14]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00433f8e
add esp, 0x20
jmp 0x4342fb
cmp dword [ebp + 0x14], 1
jne 0x4341b3
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x69b338]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x4341b1
jmp 0x4342fb
jmp 0x434222
cmp dword [ebp + 0x14], 2
jne 0x4341d3
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x69b338]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4341d1
jmp 0x4342fb
jmp 0x434222
cmp dword [ebp + 0x14], 3
jne 0x4341f3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x69b330]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jne 0x4341f1
jmp 0x4342fb
jmp 0x434222
cmp dword [ebp + 0x14], 4
jne 0x434213
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x69b330]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x434211
jmp 0x4342fb
jmp 0x434222
push str.NET_SendPacket:_bad_address_type
push 0
call fcn.0042071a
add esp, 8
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp + 0x14]
push eax
call fcn.00433660
add esp, 8
push 0x10
lea ecx, [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.WSOCK32.dll_sendto
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4342fb
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2733
jne 0x43426e
jmp 0x4342fb
cmp dword [ebp - 0x1c], 0x2741
jne 0x434285
cmp dword [ebp + 0x14], 1
je 0x434283
cmp dword [ebp + 0x14], 4
jne 0x434285
jmp 0x4342fb
mov edx, dword [0x6c810c]
fld dword [edx + 0x14]
fcomp dword [0x44c308]
fnstsw ax
test ah, 0x40
jne 0x4342b0
call fcn.00434aa3
push eax
push 0x45720c
call fcn.0042050d
add esp, 8
jmp 0x4342fb
cmp dword [ebp - 0x1c], 0x2741
jne 0x4342e6
sub esp, 0x14
mov ecx, 5
lea esi, [ebp + 0x14]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00433986
add esp, 0x14
push eax
call fcn.00434aa3
push eax
push str.NET_SendPacket_Warning:__s_:__s_n
call fcn.00420689
add esp, 0xc
jmp 0x4342fb
call fcn.00434aa3
push eax
push str.NET_SendPacket_ERROR:__s_n
push 1
call fcn.0042071a
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x434301
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 1
push 0x11
push 2
push 2
call sub.WSOCK32.dll_socket
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x434354
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x273f
je 0x43434d
call fcn.00434aa3
push eax
push str.WARNING:_UDP_OpenSocket:_socket:__s
call fcn.0042050d
add esp, 8
xor eax, eax
jmp 0x434451
lea eax, [ebp - 0x20]
push eax
push 0x8004667e
mov ecx, dword [ebp - 0x14]
push ecx
call sub.WSOCK32.dll_ioctlsocket
cmp eax, 0xffffffff
jne 0x434385
call fcn.00434aa3
push eax
push str.WARNING:_UDP_OpenSocket:_ioctl_FIONBIO:__s_n
call fcn.0042050d
add esp, 8
xor eax, eax
jmp 0x434451
push 4
lea edx, [ebp - 0x1c]
push edx
push 0x20
push 0xffff
mov eax, dword [ebp - 0x14]
push eax
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x4343ba
call fcn.00434aa3
push eax
push str.WARNING:_UDP_OpenSocket:_setsockopt_SO_BROADCAST:__s_n
call fcn.0042050d
add esp, 8
xor eax, eax
jmp 0x434451
cmp dword [ebp + 8], 0
je 0x4343df
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
test edx, edx
je 0x4343df
push 0x4572f0
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll__stricmp
add esp, 8
test eax, eax
jne 0x4343e8
mov dword [ebp - 0xc], 0
jmp 0x4343f8
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00433a89
add esp, 8
cmp dword [ebp + 0xc], 0xffffffff
jne 0x434406
mov word [ebp - 0xe], 0
jmp 0x434414
mov ax, word [ebp + 0xc]
push eax
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
mov word [ebp - 0x10], 2
push 0x10
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x43444e
call fcn.00434aa3
push eax
push str.WARNING:_UDP_OpenSocket:_bind:__s_n
call fcn.0042050d
add esp, 8
mov eax, dword [ebp - 0x14]
push eax
call sub.WSOCK32.dll_closesocket
xor eax, eax
jmp 0x434451
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x4345f3
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], 1
push 0x3e8
push 2
push 6
call sub.WSOCK32.dll_socket
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x434642
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x273f
je 0x43463b
call fcn.00434aa3
push eax
push str.WARNING:_IPX_Socket:_socket:__s_n
call fcn.0042050d
add esp, 8
xor eax, eax
jmp 0x43471e
lea eax, [ebp - 0x1c]
push eax
push 0x8004667e
mov ecx, dword [ebp - 0x14]
push ecx
call sub.WSOCK32.dll_ioctlsocket
cmp eax, 0xffffffff
jne 0x434673
call fcn.00434aa3
push eax
push str.WARNING:_IPX_Socket:_ioctl_FIONBIO:__s_n
call fcn.0042050d
add esp, 8
xor eax, eax
jmp 0x43471e
push 4
lea edx, [ebp - 0x1c]
push edx
push 0x20
push 0xffff
mov eax, dword [ebp - 0x14]
push eax
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x4346a5
call fcn.00434aa3
push eax
push str.WARNING:_IPX_Socket:_setsockopt_SO_BROADCAST:__s_n
call fcn.0042050d
add esp, 8
xor eax, eax
jmp 0x43471e
mov word [ebp - 0x10], 6
push 4
push 0
lea ecx, [ebp - 0xe]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 6
push 0
lea edx, [ebp - 0xa]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp + 8], 0xffffffff
jne 0x4346d9
mov word [ebp - 4], 0
jmp 0x4346e7
mov ax, word [ebp + 8]
push eax
call sub.WSOCK32.dll_htons
mov word [ebp - 4], ax
push 0xe
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x43471b
call fcn.00434aa3
push eax
push str.WARNING:_IPX_Socket:_bind:__s_n
call fcn.0042050d
add esp, 8
mov eax, dword [ebp - 0x14]
push eax
call sub.WSOCK32.dll_closesocket
xor eax, eax
jmp 0x43471e
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x434943
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
cmp dword [0x69b33c], 0
je 0x434973
cmp dword [0x6c810c], 0
je 0x434978
mov eax, dword [0x6c810c]
fld dword [eax + 0x14]
fcomp dword [0x44c308]
fnstsw ax
test ah, 0x40
je 0x434978
jmp 0x4349fc
mov dword [ebp - 0x104], 0
cmp dword [ebp - 0x104], 0x40
jae 0x4349ad
mov ecx, dword [ebp - 0x104]
mov edx, dword [0x69b33c]
mov dword [ebp + ecx*4 - 0x100], edx
mov eax, dword [ebp - 0x104]
add eax, 1
mov dword [ebp - 0x104], eax
xor ecx, ecx
test ecx, ecx
jne 0x434982
mov eax, dword [ebp + 8]
cdq
mov ecx, 0x3e8
idiv ecx
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 8]
cdq
mov ecx, 0x3e8
idiv ecx
imul edx, edx, 0x3e8
mov dword [ebp - 0x108], edx
lea edx, [ebp - 0x10c]
push edx
push 0
push 0
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [0x69b33c]
add ecx, 1
push ecx
call sub.WSOCK32.dll_select
mov esp, ebp
pop ebp
ret
Function at 0x434a00
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov word [ebp - 8], 0x101
push 0x480b80
push 0x101
call sub.WSOCK32.dll_WSAStartup
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x434a33
push str.Winsock_initialization_failed.
push 0
call fcn.0042071a
add esp, 8
push str.Winsock_Initialized_n
call fcn.0042050d
add esp, 4
push 8
push 0x4574f0
push str.noudp
call fcn.00424a7e
add esp, 0xc
mov dword [0x480d14], eax
push 8
push 0x4574fc
push str.noipx
call fcn.00424a7e
add esp, 0xc
mov dword [0x480d10], eax
push 0
push 0x457508
push str.net_shownet
call fcn.00424a7e
add esp, 0xc
mov dword [0x69872c], eax
mov esp, ebp
pop ebp
ret

Function at 0x437530
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov esi, 0xa
mov edi, 0x6986ac
fld dword [edi]
fmul dword [0x44c360]
call sub.MSVCRT.dll__ftol
mov ecx, dword [0x698718]
add esi, 2
add edi, 4
cmp esi, 0x10
mov word [esi + ecx - 2], ax
jl 0x437541
mov edi, dword [0x698718]
xor ebp, ebp
mov ebx, 4
xor esi, esi
fld dword [esi + 0x6986a0]
fcomp dword [0x44c308]
fnstsw ax
test ah, 1
jne 0x437590
mov dword [esp + esi + 0x18], 1
jmp 0x437598
mov dword [esp + esi + 0x18], 0xffffffff
fld dword [esi + 0x6986a0]
fmul dword [0x44c360]
call sub.MSVCRT.dll__ftol
mov word [ebx + edi], ax
mov edi, dword [0x698718]
movsx edx, word [ebx + edi]
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fmul qword [0x44c350]
fld dword [esi + 0x6986a0]
fcompp
fnstsw ax
test ah, 0x40
je 0x4375d8
mov dword [esp + esi + 0x18], ebp
add ebx, 2
add esi, 4
cmp ebx, 0xa
jl 0x437573
mov ax, word [edi + 4]
mov cx, word [edi + 6]
mov dx, word [edi + 8]
mov word [esp + 0x10], ax
mov word [esp + 0x12], cx
mov word [esp + 0x14], dx
mov ebp, 0x457804
jmp 0x43760b
mov edi, dword [0x698718]
mov ax, word [esp + 0x10]
mov ebx, dword [ebp]
mov dx, word [esp + 0x12]
mov word [edi + 4], ax
mov ecx, dword [0x698718]
mov word [ecx + 6], dx
mov eax, dword [0x698718]
mov cx, word [esp + 0x14]
lea edx, [esp + 0x18]
mov word [eax + 8], cx
xor ecx, ecx
mov eax, 4
mov esi, 1
shl esi, cl
test ebx, esi
je 0x437657
mov esi, dword [0x698718]
mov di, word [edx]
add word [eax + esi], di
add eax, 2
inc ecx
add edx, 4
cmp eax, 0xa
jl 0x43763f
call fcn.004374a0
test eax, eax
jne 0x4376b6
add ebp, 4
cmp ebp, str.Bad_InitialSnapPosition_n
jl 0x437605
fld dword [0x698708]
call sub.MSVCRT.dll__ftol
mov edx, dword [0x698718]
mov word [edx + 4], ax
fld dword [0x69870c]
call sub.MSVCRT.dll__ftol
mov ecx, dword [0x698718]
mov word [ecx + 6], ax
fld dword [0x698710]
call sub.MSVCRT.dll__ftol
mov edx, dword [0x698718]
mov word [edx + 8], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x439f7d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll__mkdir
add esp, 4
pop ebp
ret
Function at 0x43ec28
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [ebp + 8]
push eax
push str.SV_WipeSaveGame__s__n
call fcn.00420689
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call fcn.00425c30
push eax
push 0x4585a4
push 0x80
lea edx, [ebp - 0x84]
push edx
call fcn.004397ec
add esp, 0x14
lea eax, [ebp - 0x84]
push eax
call sub.MSVCRT.dll_remove
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.00425c30
push eax
push 0x4585bc
push 0x80
lea edx, [ebp - 0x84]
push edx
call fcn.004397ec
add esp, 0x14
lea eax, [ebp - 0x84]
push eax
call sub.MSVCRT.dll_remove
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.00425c30
push eax
push 0x4585d0
push 0x80
lea edx, [ebp - 0x84]
push edx
call fcn.004397ec
add esp, 0x14
push 0
push 0
lea eax, [ebp - 0x84]
push eax
call fcn.00439f8e
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43ed02
mov ecx, dword [ebp - 4]
push ecx
call sub.MSVCRT.dll_remove
add esp, 4
push 0
push 0
call fcn.0043a13e
add esp, 8
mov dword [ebp - 4], eax
jmp 0x43ecdf
call fcn.0043a1be
mov edx, dword [ebp + 8]
push edx
call fcn.00425c30
push eax
push str._s_save__s_.sv2
push 0x80
lea eax, [ebp - 0x84]
push eax
call fcn.004397ec
add esp, 0x14
push 0
push 0
lea ecx, [ebp - 0x84]
push ecx
call fcn.00439f8e
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43ed63
mov edx, dword [ebp - 4]
push edx
call sub.MSVCRT.dll_remove
add esp, 4
push 0
push 0
call fcn.0043a13e
add esp, 8
mov dword [ebp - 4], eax
jmp 0x43ed40
call fcn.0043a1be
mov esp, ebp
pop ebp
ret

Function at 0x43ed6c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000c
call fcn.0044b860
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.CopyFile___s___s__n
call fcn.00420689
add esp, 0xc
push 0x45860c
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 0x1000c], eax
cmp dword [ebp - 0x1000c], 0
jne 0x43edb3
jmp 0x43ee4e
push 0x458610
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43edde
mov ecx, dword [ebp - 0x1000c]
push ecx
call sub.MSVCRT.dll_fclose
add esp, 4
jmp 0x43ee4e
mov edx, 1
test edx, edx
je 0x43ee33
mov eax, dword [ebp - 0x1000c]
push eax
push 0x10000
push 1
lea ecx, [ebp - 0x10004]
push ecx
call sub.MSVCRT.dll_fread
add esp, 0x10
mov dword [ebp - 0x10008], eax
cmp dword [ebp - 0x10008], 0
jne 0x43ee15
jmp 0x43ee33
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x10008]
push eax
push 1
lea ecx, [ebp - 0x10004]
push ecx
call sub.MSVCRT.dll_fwrite
add esp, 0x10
jmp 0x43edde
mov edx, dword [ebp - 0x1000c]
push edx
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, dword [ebp - 4]
push eax
call sub.MSVCRT.dll_fclose
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x43f0a8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push str.SV_WriteLevelFile___n
call fcn.00420689
add esp, 4
push 0x48ab14
call fcn.00425c30
push eax
push 0x4586d8
push 0x80
lea eax, [ebp - 0x84]
push eax
call fcn.004397ec
add esp, 0x14
push 0x4586f0
lea ecx, [ebp - 0x84]
push ecx
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43f115
lea edx, [ebp - 0x84]
push edx
push 0x4586f4
call fcn.0042050d
add esp, 8
jmp 0x43f17c
mov eax, dword [ebp - 4]
push eax
push 1
push 0x30800
push 0x48af54
call sub.MSVCRT.dll_fwrite
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.004203d0
add esp, 4
mov edx, dword [ebp - 4]
push edx
call sub.MSVCRT.dll_fclose
add esp, 4
push 0x48ab14
call fcn.00425c30
push eax
push 0x458708
push 0x80
lea eax, [ebp - 0x84]
push eax
call fcn.004397ec
add esp, 0x14
lea ecx, [ebp - 0x84]
push ecx
mov edx, dword [0x669cf0]
call dword [edx + 0x18]
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x43f560
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push str.SV_ReadServerFile___n
call fcn.00420689
add esp, 4
call fcn.00425c30
push eax
push str._s_save_current_server.ssv
push 0x80
lea eax, [ebp - 0x1a4]
push eax
call fcn.004397ec
add esp, 0x10
push 0x458860
lea ecx, [ebp - 0x1a4]
push ecx
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x43f5d1
lea edx, [ebp - 0x1a4]
push edx
push str.Couldnt_read__s_n
call fcn.0042050d
add esp, 8
jmp 0x43f6cf
mov eax, dword [ebp - 0x84]
push eax
push 0x20
lea ecx, [ebp - 0x124]
push ecx
call fcn.0042576e
add esp, 0xc
mov edx, dword [ebp - 0x84]
push edx
push 0x80
lea eax, [ebp - 0x104]
push eax
call fcn.0042576e
add esp, 0xc
mov ecx, 1
test ecx, ecx
je 0x43f675
mov edx, dword [ebp - 0x84]
push edx
push 0x80
push 1
lea eax, [ebp - 0x1a4]
push eax
call sub.MSVCRT.dll_fread
add esp, 0x10
test eax, eax
jne 0x43f630
jmp 0x43f675
mov ecx, dword [ebp - 0x84]
push ecx
push 0x80
lea edx, [ebp - 0x80]
push edx
call fcn.0042576e
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x1a4]
push ecx
push str.Set__s___s_n
call fcn.00420689
add esp, 0xc
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x1a4]
push eax
call fcn.00424dfe
add esp, 8
jmp 0x43f604
mov ecx, dword [ebp - 0x84]
push ecx
call sub.MSVCRT.dll_fclose
add esp, 4
call fcn.004430e7
lea edx, [ebp - 0x104]
push edx
push 0x4834c8
call sub.MSVCRT.dll_strcpy
add esp, 8
call fcn.00425c30
push eax
push str._s_save_current_game.ssv
push 0x80
lea eax, [ebp - 0x1a4]
push eax
call fcn.004397ec
add esp, 0x10
lea ecx, [ebp - 0x1a4]
push ecx
mov edx, dword [0x669cf0]
call dword [edx + 0x14]
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x441aea
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8374
call fcn.0044b860
cmp dword [0x48a560], 0
jne 0x441b05
jmp 0x441d0d
push 0x350
push 0
lea eax, [ebp - 0x8370]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x8000
lea ecx, [ebp - 0x8000]
push ecx
lea edx, [ebp - 0x8018]
push edx
call fcn.00421fcd
add esp, 0xc
push 0x16
lea eax, [ebp - 0x8018]
push eax
call fcn.004208d8
add esp, 8
mov ecx, dword [0x48ab10]
push ecx
lea edx, [ebp - 0x8018]
push edx
call fcn.0042092c
add esp, 8
push 0x14
lea eax, [ebp - 0x8018]
push eax
call fcn.004208d8
add esp, 8
mov dword [ebp - 0x8020], 1
mov ecx, dword [0x669cf0]
mov edx, dword [ecx + 0x50]
imul edx, dword [ebp - 0x8020]
mov eax, dword [0x669cf0]
mov ecx, dword [eax + 0x4c]
add ecx, edx
mov dword [ebp - 0x801c], ecx
mov edx, dword [0x669cf0]
mov eax, dword [ebp - 0x8020]
cmp eax, dword [edx + 0x54]
jge 0x441c86
mov ecx, dword [ebp - 0x801c]
cmp dword [ecx + 0x354], 0
je 0x441c52
mov edx, dword [ebp - 0x801c]
cmp dword [edx], 0
je 0x441c52
mov eax, dword [ebp - 0x801c]
cmp dword [eax + 0x350], 0
jne 0x441c1a
mov ecx, dword [ebp - 0x801c]
cmp dword [ecx + 0x4c], 0
jne 0x441c1a
mov edx, dword [ebp - 0x801c]
cmp dword [edx + 0x28], 0
jne 0x441c1a
mov eax, dword [ebp - 0x801c]
cmp dword [eax + 0x34], 0
jne 0x441c1a
mov ecx, dword [ebp - 0x801c]
cmp dword [ecx + 0x40], 0
jne 0x441c1a
mov edx, dword [ebp - 0x801c]
cmp dword [edx + 0x44], 0
je 0x441c52
mov eax, dword [ebp - 0x801c]
mov ecx, dword [eax + 0x3b4]
and ecx, 1
test ecx, ecx
jne 0x441c52
push 0x64
push 0
push 1
push 0
lea edx, [ebp - 0x8018]
push edx
mov eax, dword [ebp - 0x801c]
push eax
lea ecx, [ebp - 0x8370]
push ecx
call fcn.00420dcc
add esp, 0x1c
mov edx, dword [ebp - 0x8020]
add edx, 1
mov dword [ebp - 0x8020], edx
mov eax, dword [0x669cf0]
mov ecx, dword [eax + 0x50]
imul ecx, dword [ebp - 0x8020]
mov edx, dword [0x669cf0]
mov eax, dword [edx + 0x4c]
add eax, ecx
mov dword [ebp - 0x801c], eax
jmp 0x441b98
push 0
lea ecx, [ebp - 0x8018]
push ecx
call fcn.004208f9
add esp, 8
mov edx, dword [0x48a574]
push edx
mov eax, dword [0x48a56c]
push eax
lea ecx, [ebp - 0x8018]
push ecx
call fcn.004220b1
add esp, 0xc
push 0x48a564
call fcn.00421ff4
add esp, 4
mov edx, dword [ebp - 0x8008]
push edx
call fcn.0043921e
add esp, 4
mov dword [ebp - 0x8374], eax
mov eax, dword [0x48a560]
push eax
push 1
push 4
lea ecx, [ebp - 0x8374]
push ecx
call sub.MSVCRT.dll_fwrite
add esp, 0x10
mov edx, dword [0x48a560]
push edx
push 1
mov eax, dword [ebp - 0x8008]
push eax
mov ecx, dword [ebp - 0x8010]
push ecx
call sub.MSVCRT.dll_fwrite
add esp, 0x10
mov esp, ebp
pop ebp
ret