joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd3d0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x5e4ec8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x65f810]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x44]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4bd53b
push 0
push ebp
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push 0
mov ebx, eax
push ebx
push 0
push 2
push 0
push ebp
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
mov esi, eax
mov dword [esp + 0x44], esi
test esi, esi
je 0x4bd520
cmp esi, 0xffffffff
je 0x4bd520
push ebx
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x4bd507
mov esi, dword [esp + 0x48]
push ebx
mov ecx, esi
call fcn.00435d70
push 0x5f15dc
push 0x5fa1a4
push esi
mov ecx, edi
call fcn.004bd320
push 0x61e83c
push 0x5fa1a0
push esi
mov ecx, edi
call fcn.004bd320
push 0
push 0x5fa188
mov ecx, esi
call fcn.0048ca80
push eax
push 0x5fa184
mov ecx, esi
call fcn.0048ca80
push 0xffffffffffffffff
push 0x61e488
mov ecx, esi
mov edi, eax
call fcn.004bcc90
cmp edi, 0xffffffff
je 0x4bd503
cmp eax, 0xffffffff
je 0x4bd503
sub eax, edi
dec eax
push eax
inc edi
push edi
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00436ab0
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.00436320
lea ecx, [esp + 0x18]
call fcn.00436170
mov esi, dword [esp + 0x44]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebp
call edi
push ebx
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push esi
call edi
mov eax, dword [esp + 0x14]
jmp 0x4bd53d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Could_not_create_file_mapping_object___d_._n
call fcn.0057c74b
add esp, 8
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
Function at 0x4bfd70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x230
mov eax, dword [0x65f810]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 0x20019
mov ecx, 0x22
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallNETPAS_ACC
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push 0
lea ecx, [esp + 0x24]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x4bfdd6
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.005792fc
mov esp, ebp
pop ebp
ret
xor edx, edx
push 0x18e
push edx
lea eax, [esp + 0xaa]
push eax
mov word [esp + 0xac], dx
call fcn.00578cb0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xa4]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push str.displayicon
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0xc]
mov esi, eax
neg esi
sbb esi, esi
push ecx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x234]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.005792fc
mov esp, ebp
pop ebp
ret

Function at 0x4bfe40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x3d8
mov eax, dword [0x65f810]
xor eax, esp
mov dword [esp + 0x3d4], eax
push esi
push edi
mov ecx, 0xb
mov esi, str.SOFTWARENETPASDUOWAN
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 8]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x20]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [esp + 8]
test esi, esi
jne 0x4bfea5
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x3d4]
xor ecx, esp
call fcn.005792fc
add esp, 0x3d8
ret
xor edx, edx
push 0x18e
push edx
lea eax, [esp + 0x4e]
push eax
mov word [esp + 0x50], dx
call fcn.00578cb0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp esi, 1
jne 0x4bff32
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x1de]
push edx
mov word [esp + 0x1e0], cx
call fcn.00578cb0
lea eax, [esp + 0x50]
push eax
push str._sNetpas_Acc.exe
lea ecx, [esp + 0x1e8]
push 0x104
push ecx
call fcn.00579c26
lea edx, [esp + 0x1f0]
push 2
push edx
call fcn.0045b820
add esp, 0x24
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x3dc]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.005792fc
add esp, 0x3d8
ret
Function at 0x4bff60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x3d4
mov eax, dword [0x65f810]
xor eax, esp
mov dword [esp + 0x3d0], eax
push esi
push edi
mov ecx, 0xa
mov esi, str.SoftwareTencentLOL
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 8]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x20]
push ecx
push SysReAllocStringLen
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [esp + 8]
test esi, esi
jne 0x4bffc5
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x3d0]
xor ecx, esp
call fcn.005792fc
add esp, 0x3d4
ret
xor edx, edx
push 0x18e
push edx
lea eax, [esp + 0x4a]
push eax
mov word [esp + 0x4c], dx
call fcn.00578cb0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.InstallPath
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp esi, 1
jne 0x4c0055
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x1da]
push edx
mov word [esp + 0x1dc], cx
call fcn.00578cb0
lea eax, [esp + 0x4c]
push eax
push str._sGameLeague_of_Legends.exe
lea ecx, [esp + 0x1e4]
push 0x104
push ecx
call fcn.00579c26
lea edx, [esp + 0x1ec]
push 2
push edx
call fcn.0045b820
add esp, 0x24
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x3d8]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.005792fc
add esp, 0x3d4
ret

Function at 0x4c2fa0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x40
push esi
xor esi, esi
cmp ecx, esi
push edi
lea eax, [ebp + 0x10]
jle 0x4c2fc9
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x28], edx
mov edx, dword [ebp + 0x14]
dec ecx
mov dword [ebp + 0xc], ecx
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], edx
jmp 0x4c2fcf
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
cmp ecx, esi
jle 0x4c2fe8
dec ecx
add eax, 8
mov dword [ebp + 0xc], ecx
mov edx, dword [eax - 8]
mov dword [ebp - 0x20], edx
mov edx, dword [eax - 4]
mov dword [ebp - 0x1c], edx
jmp 0x4c2fee
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
cmp ecx, esi
jle 0x4c3007
dec ecx
add eax, 8
mov dword [ebp + 0xc], ecx
mov edx, dword [eax - 8]
mov dword [ebp - 0x18], edx
mov edx, dword [eax - 4]
mov dword [ebp - 0x14], edx
jmp 0x4c300d
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
cmp ecx, esi
jle 0x4c3026
dec ecx
add eax, 8
mov dword [ebp + 0xc], ecx
mov edx, dword [eax - 8]
mov dword [ebp - 0x10], edx
mov edx, dword [eax - 4]
mov dword [ebp - 0xc], edx
jmp 0x4c302c
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp + 8], esi
mov dword [ebp + 8], esp
and esp, 0xfffffff8
push 0x33
call 0x4c305b
add dword [esp], 5
retf
Function at 0x4c30d0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor eax, eax
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push 0x33
call 0x4c30ea
add dword [esp], 5
retf

Function at 0x4c4760
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x5e571b
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x65f810]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
push edi
mov eax, dword [0x65f810]
xor eax, esp
push eax
lea eax, [esp + 0xa4]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x4c4987
cmp dword [esi + 0x44], 0
je 0x4c4987
cmp dword [esi + 0x48], 0
je 0x4c4987
cmp dword [esi + 0x4c], 0
je 0x4c4987
call fcn.004c7ca0
test eax, eax
je 0x4c4987
cmp dword [esi + 0x3c], 0
je 0x4c4987
push 0xffffffffffffffff
lea edi, [esi + 0x40]
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchangeAdd]
cmp dword [edi], 0
ja 0x4c4987
mov ecx, dword [esi + 0x50]
push 0
call fcn.004ce610
mov ecx, dword [esi + 0x50]
call fcn.004c7c80
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
lea ecx, [esp + 0x68]
push ecx
mov ecx, dword [esi + 0x50]
mov dword [esp + 0xb0], eax
call fcn.004c99e0
push 1
push 0xffffffffffffffff
push 0x5f1164
lea ecx, [esp + 0x74]
call fcn.00456450
cmp eax, 0xffffffff
je 0x4c4966
push 0xffffffffffffffff
inc eax
push eax
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x74]
call fcn.0043b3d0
mov edi, eax
push 0x5fb0c4
add esi, 0x20
lea eax, [esp + 0x34]
push esi
push eax
mov byte [esp + 0xb8], 1
call fcn.0043bbd0
push str.enCN_
push eax
lea ecx, [esp + 0x60]
push ecx
mov byte [esp + 0xc4], 2
call fcn.0043bbd0
add esp, 0x18
mov esi, eax
push 0xf
push str.wow_update_enCN
push 0xf
push 0
mov ecx, edi
mov byte [esp + 0xbc], 3
call fcn.004c4140
push eax
lea edx, [esp + 0x88]
push esi
push edx
call fcn.0043bca0
add esp, 0xc
lea ecx, [esp + 0x4c]
call fcn.00495410
lea ecx, [esp + 0x30]
call fcn.00495410
lea ecx, [esp + 0x14]
mov byte [esp + 0xac], 7
call fcn.00495410
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
xor eax, eax
push 0xffffffffffffffff
push eax
lea edx, [esp + 0xac]
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
push edx
mov word [ecx + 4], ax
call fcn.00439be0
call fcn.0059f0f0
mov ecx, dword [esp + 0xa8]
mov esi, 8
add esp, 0x20
cmp dword [esp + 0x9c], esi
jae 0x4c493d
lea ecx, [esp + 0x88]
mov eax, dword [esp + 0x6c]
cmp dword [esp + 0x80], esi
jae 0x4c494e
lea eax, [esp + 0x6c]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
lea ecx, [esp + 0x84]
call fcn.00495410
jmp 0x4c496b
mov esi, 8
cmp dword [esp + 0x80], esi
jb 0x4c4981
mov eax, dword [esp + 0x6c]
push eax
call fcn.00506f70
add esp, 4
mov eax, dword [esp + 0xc]
jmp 0x4c4989
xor eax, eax
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005792fc
add esp, 0xa4
ret
Function at 0x4c7cb0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x3200c
call fcn.0057c720
mov eax, dword [0x65f810]
xor eax, esp
mov dword [esp + 0x32008], eax
mov eax, dword [esp + 0x32014]
push ebx
mov ebx, dword [esp + 0x3201c]
push esi
push edi
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocStringLen
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4c7d9e
push ebp
xor ebp, ebp
push ebp
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edx, dword [edi + 4]
lea ecx, [esp + 0x10]
push ecx
push 0x80000200
push ebp
push eax
push ebp
push ebp
push ebx
push edx
mov dword [esp + 0x30], ebp
call fcn.00403050
test al, al
je 0x4c7d92
cmp dword [esp + 0x10], ebp
je 0x4c7d92
mov edi, dword [sym.imp.KERNEL32.DLL_ReadFile]
push ebp
lea eax, [esp + 0x18]
push eax
push 0x32000
lea ecx, [esp + 0x24]
push ecx
push esi
mov dword [esp + 0x28], ebp
call edi
test eax, eax
je 0x4c7d83
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x4c7d83
push 0x10
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push edx
push eax
call fcn.00403190
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x32000
lea edx, [esp + 0x24]
push edx
push esi
call edi
test eax, eax
jne 0x4c7d51
mov eax, dword [esp + 0x10]
push eax
call fcn.00403240
mov ebp, 1
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebp
pop ebp
jmp 0x4c7da0
xor eax, eax
mov ecx, dword [esp + 0x32014]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005792fc
add esp, 0x3200c
ret 0xc
Function at 0x4ca7d0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x40]
push edi
cmp eax, 0xffffffff
je 0x4ca94e
xor ebp, ebp
push ebp
push ebp
push ebp
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edx, dword [esi + 0x40]
mov edi, dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebp
lea eax, [esp + 0x14]
push eax
push 0x14
lea ecx, [esi + 4]
push ecx
push edx
mov dword [esp + 0x24], ebp
call edi
test eax, eax
je 0x4ca93b
cmp dword [esp + 0x10], 0x14
jne 0x4ca93b
mov ecx, dword [esi + 0x3c]
cmp ecx, dword [esi + 8]
jne 0x4ca934
mov eax, dword [esi + 0x18]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, ebp
je 0x4ca890
imul ecx, ecx, 0x4c
push ebp
lea edx, [esp + 0x14]
push edx
push ecx
push eax
mov eax, dword [esi + 0x40]
push eax
call edi
test eax, eax
je 0x4ca85f
mov ecx, dword [esi + 0x3c]
imul ecx, ecx, 0x4c
cmp dword [esp + 0x10], ecx
jne 0x4ca85f
mov ebp, 1
jmp 0x4ca8c2
push 0x5fb250
call ebx
push eax
push 0x5fb56c
push str._DBE::CDBase_struct_DBE::_DBASE_struct_DBE::_CREDISPLAY_::Commit_
push 0x66ded8
call fcn.00432d30
add esp, 8
push eax
call fcn.00432d30
add esp, 8
mov ecx, eax
call fcn.004c2b10
jmp 0x4ca8a7
push 0x5fb51c
push str._DBE::CDBase_struct_DBE::_DBASE_struct_DBE::_CREDISPLAY_::Commit_
push 0x66ded8
call fcn.00432d30
add esp, 8
push eax
call fcn.00432d30
add esp, 8
mov edi, eax
push 0xa
mov ecx, edi
call fcn.0047bab0
mov ecx, edi
call fcn.00435770
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4ca92d
mov ecx, dword [esi + 0x14]
push 0
lea edx, [esp + 0x14]
push edx
mov edx, dword [esi + 0x40]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4ca8fc
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0x14]
jne 0x4ca8fc
test ebp, ebp
je 0x4ca980
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
push 0x5fb250
call ebx
push eax
push 0x5fb56c
push str._DBE::CDBase_struct_DBE::_DBASE_struct_DBE::_CREDISPLAY_::Commit_
push 0x66ded8
call fcn.00432d30
add esp, 8
push eax
call fcn.00432d30
add esp, 8
mov ecx, eax
call fcn.004c2b10
jmp 0x4ca965
push 0x5fb508
jmp 0x4ca953
push 0x5fb4ec
jmp 0x4ca953
push 0x5fb250
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x5fb4d8
jmp 0x4ca909
push 0x5fb4c8
push str._DBE::CDBase_struct_DBE::_DBASE_struct_DBE::_CREDISPLAY_::Commit_
push 0x66ded8
call fcn.00432d30
add esp, 8
push eax
call fcn.00432d30
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.0047bab0
mov ecx, esi
call fcn.00435770
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4cabe0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
push edi
cmp eax, 0xffffffff
je 0x4cad5e
xor ebp, ebp
push ebp
push ebp
push ebp
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edx, dword [esi + 0x5c]
mov edi, dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebp
lea eax, [esp + 0x14]
push eax
push 0x30
lea ecx, [esi + 4]
push ecx
push edx
mov dword [esp + 0x24], ebp
call edi
test eax, eax
je 0x4cad4b
cmp dword [esp + 0x10], 0x30
jne 0x4cad4b
mov ecx, dword [esi + 0x58]
cmp ecx, dword [esi + 8]
jne 0x4cad44
mov eax, dword [esi + 0x34]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, ebp
je 0x4caca0
push ebp
lea edx, [esp + 0x14]
push edx
shl ecx, 5
push ecx
push eax
mov eax, dword [esi + 0x5c]
push eax
call edi
test eax, eax
je 0x4cac6f
mov ecx, dword [esi + 0x58]
shl ecx, 5
cmp dword [esp + 0x10], ecx
jne 0x4cac6f
mov ebp, 1
jmp 0x4cacd2
push 0x5fb250
call ebx
push eax
push 0x5fb56c
push str._DBE::CDBase_struct_DBE::_DBINFO_struct_DBE::_ITEMDB_::Commit_
push 0x66ded8
call fcn.00432d30
add esp, 8
push eax
call fcn.00432d30
add esp, 8
mov ecx, eax
call fcn.004c2b10
jmp 0x4cacb7
push 0x5fb51c
push str._DBE::CDBase_struct_DBE::_DBINFO_struct_DBE::_ITEMDB_::Commit_
push 0x66ded8
call fcn.00432d30
add esp, 8
push eax
call fcn.00432d30
add esp, 8
mov edi, eax
push 0xa
mov ecx, edi
call fcn.0047bab0
mov ecx, edi
call fcn.00435770
mov eax, dword [esi + 0x38]
test eax, eax
je 0x4cad3d
mov ecx, dword [esi + 0x14]
push 0
lea edx, [esp + 0x14]
push edx
mov edx, dword [esi + 0x5c]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4cad0c
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0x14]
jne 0x4cad0c
test ebp, ebp
je 0x4cad90
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
push 0x5fb250
call ebx
push eax
push 0x5fb56c
push str._DBE::CDBase_struct_DBE::_DBINFO_struct_DBE::_ITEMDB_::Commit_
push 0x66ded8
call fcn.00432d30
add esp, 8
push eax
call fcn.00432d30
add esp, 8
mov ecx, eax
call fcn.004c2b10
jmp 0x4cad75
push 0x5fb508
jmp 0x4cad63
push 0x5fb4ec
jmp 0x4cad63
push 0x5fb250
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x5fb4d8
jmp 0x4cad19
push 0x5fb4c8
push str._DBE::CDBase_struct_DBE::_DBINFO_struct_DBE::_ITEMDB_::Commit_
push 0x66ded8
call fcn.00432d30
add esp, 8
push eax
call fcn.00432d30
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.0047bab0
mov ecx, esi
call fcn.00435770
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4caff0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x40]
push edi
cmp eax, 0xffffffff
je 0x4cb16e
xor ebp, ebp
push ebp
push ebp
push ebp
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edx, dword [esi + 0x40]
mov edi, dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebp
lea eax, [esp + 0x14]
push eax
push 0x14
lea ecx, [esi + 4]
push ecx
push edx
mov dword [esp + 0x24], ebp
call edi
test eax, eax
je 0x4cb15b
cmp dword [esp + 0x10], 0x14
jne 0x4cb15b
mov ecx, dword [esi + 0x3c]
cmp ecx, dword [esi + 8]
jne 0x4cb154
mov eax, dword [esi + 0x18]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, ebp
je 0x4cb0b0
imul ecx, ecx, 0x68
push ebp
lea edx, [esp + 0x14]
push edx
push ecx
push eax
mov eax, dword [esi + 0x40]
push eax
call edi
test eax, eax
je 0x4cb07f
mov ecx, dword [esi + 0x3c]
imul ecx, ecx, 0x68
cmp dword [esp + 0x10], ecx
jne 0x4cb07f
mov ebp, 1
jmp 0x4cb0e2
push 0x5fb250
call ebx
push eax
push 0x5fb56c
push str._DBE::CDBase_struct_DBE::_DBASE_struct_DBE::_ITEMDISPLAY_::Commit_
push 0x66ded8
call fcn.00432d30
add esp, 8
push eax
call fcn.00432d30
add esp, 8
mov ecx, eax
call fcn.004c2b10
jmp 0x4cb0c7
push 0x5fb51c
push str._DBE::CDBase_struct_DBE::_DBASE_struct_DBE::_ITEMDISPLAY_::Commit_
push 0x66ded8
call fcn.00432d30
add esp, 8
push eax
call fcn.00432d30
add esp, 8
mov edi, eax
push 0xa
mov ecx, edi
call fcn.0047bab0
mov ecx, edi
call fcn.00435770
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4cb14d
mov ecx, dword [esi + 0x14]
push 0
lea edx, [esp + 0x14]
push edx
mov edx, dword [esi + 0x40]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4cb11c
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0x14]
jne 0x4cb11c
test ebp, ebp
je 0x4cb1a0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
push 0x5fb250
call ebx
push eax
push 0x5fb56c
push str._DBE::CDBase_struct_DBE::_DBASE_struct_DBE::_ITEMDISPLAY_::Commit_
push 0x66ded8
call fcn.00432d30
add esp, 8
push eax
call fcn.00432d30
add esp, 8
mov ecx, eax
call fcn.004c2b10
jmp 0x4cb185
push 0x5fb508
jmp 0x4cb173
push 0x5fb4ec
jmp 0x4cb173
push 0x5fb250
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x5fb4d8
jmp 0x4cb129
push 0x5fb4c8
push str._DBE::CDBase_struct_DBE::_DBASE_struct_DBE::_ITEMDISPLAY_::Commit_
push 0x66ded8
call fcn.00432d30
add esp, 8
push eax
call fcn.00432d30
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.0047bab0
mov ecx, esi
call fcn.00435770
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4cb1b0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5e5dbb
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x65f810]
xor eax, esp
mov dword [esp + 0x210], eax
push ebp
push esi
push edi
mov eax, dword [0x65f810]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
mov eax, dword [esp + 0x234]
mov edi, dword [esp + 0x238]
mov esi, ecx
push eax
mov dword [esp + 0x18], esi
call fcn.004ca580
mov dword [esp + 0x22c], 0
mov dword [esi], vtable.DBE::CDBCDisp.0
test edi, edi
je 0x4cb2a6
push 1
sub esp, 0x1c
mov ecx, esp
xor eax, eax
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
mov word [ecx + 4], ax
mov eax, edi
mov dword [esp + 0x30], esp
lea ebp, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4cb241
sub eax, ebp
sar eax, 1
push eax
push edi
call fcn.00439ce0
call fcn.0059f0f0
add esp, 0x20
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [esi + 0x40], eax
cmp eax, 0xffffffff
je 0x4cb35e
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4cb290
sub eax, edx
sar eax, 1
push eax
push edi
jmp 0x4cb356
lea ecx, [esp + 0x18]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push str.box_dbc_temp_CreatureDisplayInfo.dbc
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.0057ee86
add esp, 0xc
push 1
sub esp, 0x1c
mov ecx, esp
xor eax, eax
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
mov word [ecx + 4], ax
lea eax, [esp + 0x38]
mov dword [esp + 0x30], esp
lea edi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4cb2f3
sub eax, edi
sar eax, 1
push eax
lea edx, [esp + 0x3c]
push edx
call fcn.00439ce0
call fcn.0059f0f0
add esp, 0x20
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [esi + 0x40], eax
cmp eax, 0xffffffff
je 0x4cb35e
lea eax, [esp + 0x18]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4cb341
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esi + 0x44]
call fcn.00439ce0
mov eax, esi
mov byte [esi + 0x60], 1
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.005792fc
add esp, 0x220
ret 8