joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x448574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x448570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x448570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x336f71f3
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
mov ecx, 0x42bf6922
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2e92461c
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x5026646a
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x4a341b34
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x23bd5e49
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401250
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [0x4b5a88]
push ebx
xor ebx, ebx
cmp ecx, ebx
je 0x401265
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
push esi
mov esi, dword [0x4b5abc]
mov dword [0x4b5a88], ebx
cmp esi, ebx
je 0x40128d
call fcn.0040fa90
mov ecx, dword [0x4b5abc]
cmp ecx, ebx
je 0x40128d
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov esi, dword [0x4b5ac8]
mov dword [0x4b5abc], ebx
cmp esi, ebx
je 0x4012be
push edi
call fcn.0040db70
mov esi, dword [0x4b5ac8]
mov edi, esi
cmp esi, ebx
je 0x4012bd
call fcn.0040db70
push edi
call fcn.0045f755
add esp, 4
pop edi
mov esi, dword [0x4b5ac0]
mov dword [0x4b5ac8], ebx
cmp esi, ebx
je 0x4012ed
call fcn.00415fe0
mov eax, dword [0x4b5ac0]
mov esi, eax
cmp eax, ebx
je 0x4012ed
push eax
call fcn.00415f60
push esi
call fcn.0045f755
add esp, 4
mov esi, dword [0x4b5ac4]
mov dword [0x4b5ac0], ebx
cmp esi, ebx
je 0x401314
call fcn.00403760
mov ecx, dword [0x4b5ac4]
cmp ecx, ebx
je 0x401314
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, dword [0x4b5a8c]
mov dword [0x4b5ac4], ebx
cmp eax, ebx
je 0x40133c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x4b5a8c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4b5a8c], ebx
mov ecx, dword [0x4b5acc]
cmp ecx, ebx
je 0x401389
cmp dword [ecx + 0x5c68], ebx
je 0x40137d
add ecx, 0x5974
cmp dword [ecx + 0x18], 0x10
jb 0x40135f
mov esi, dword [ecx + 4]
jmp 0x401362
lea esi, [ecx + 4]
call fcn.004040f0
push ebx
push eax
push ebx
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [0x4b5acc]
cmp ecx, ebx
je 0x401389
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, dword [0x4b5ad0]
mov dword [0x4b5acc], ebx
cmp eax, ebx
je 0x4013b4
mov esi, eax
mov eax, dword [eax]
cmp eax, ebx
je 0x4013ab
push eax
call fcn.0045fc59
add esp, 4
mov dword [esi], ebx
push esi
call fcn.0045f755
add esp, 4
mov eax, dword [0x4b5ad4]
mov dword [0x4b5ad0], ebx
pop esi
cmp eax, ebx
je 0x4013d3
push eax
mov dword [eax], vtable.CDrawRect.0
call fcn.0045f755
add esp, 4
mov dword [0x4b5ad4], ebx
cmp dword [0x4b5a90], ebx
jne 0x4013ee
mov ecx, dword [0x4b5a94]
push ecx
call dword [sym.imp.WINMM.dll_timeEndPeriod]
mov eax, dword [0x4b5af0]
cmp eax, ebx
je 0x4013fe
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov dword [0x4b5af0], ebx
pop ebx
jmp dword [sym.imp.ole32.dll_CoUninitialize]
Function at 0x4018a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
push 1
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4018ce
lea ecx, [esp]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [edi + 0x10], 1
push ebx
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
jne 0x4018e7
call ebp
jmp 0x4018e9
call ebx
mov esi, eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
test eax, eax
je 0x401905
sub esi, dword [edi + 0x74]
cmp esi, 0x21
jbe 0x401901
push 0
jmp 0x401907
push 1
jmp 0x401907
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x10], 1
jne 0x401928
call ebp
mov dword [edi + 0x74], eax
xor eax, eax
cmp dword [edi + 0x38], 4
pop esi
pop ebp
setne al
pop ebx
add esp, 0x1c
ret
call ebx
mov dword [edi + 0x74], eax
xor eax, eax
cmp dword [edi + 0x38], 4
pop esi
pop ebp
setne al
pop ebx
add esp, 0x1c
ret

Function at 0x4028d0
Capabilities:
Hide graphical window

Disassembly:
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push DirectSoundCreate
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [esp + 4]
mov dword [eax + 0x38], 4
ret 4
Function at 0x403550
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push 0
push 0
push 1
mov dword [edi + 4], ebp
lea esi, [edi + 0x14]
push 0
mov dword [esi + 0x34], ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 8], eax
test eax, eax
je 0x403599
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esi + 0xc]
push eax
push 0
push esi
push 0x40b0f0
push 0x200000
push 0
call fcn.0045ff01
add esp, 0x18
mov dword [esi + 4], eax
mov ecx, dword [edi + 4]
push 0xfffffffffffffffa
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [edi + 8], eax
test eax, eax
je 0x40360e
cmp dword [0x4b5a64], 0
jne 0x403615
push 0
push 0x4b5a60
push 0x48443c
push 0x700
push eax
mov dword [0x4b5a64], 1
call sub.DINPUT.dll_DirectInputCreateEx
test eax, eax
je 0x403615
xor edx, edx
push edx
cmp edx, str.CKeyManager
jne 0x4035fd
push 0x48b6d0
push str.Direct_Input_Class
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
xor eax, eax
pop ebp
ret 4
push str.CKeyManager
push str.Direct_Input_Class
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
xor eax, eax
pop ebp
ret 4
mov eax, dword [0x4b5a60]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push ebx
mov ebx, dword [edi + 4]
push 0
lea esi, [edi + 0xc]
push esi
push 0x48444c
push 0x4844ac
push eax
call edx
test eax, eax
jne 0x403666
mov eax, dword [esi]
test eax, eax
je 0x403666
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push 0x4844e4
push eax
call edx
test eax, eax
jne 0x403666
mov eax, dword [esi]
test eax, eax
je 0x403666
mov ecx, dword [eax]
mov edx, dword [ecx + 0x34]
push 0x16
push ebx
push eax
call edx
test eax, eax
je 0x4036a2
xor eax, eax
push eax
cmp eax, str.CKeyManager
jne 0x403689
push 0x48b6d0
push 0x48b71c
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
pop esi
xor eax, eax
pop ebp
ret 4
push str.CKeyManager
push 0x48b71c
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
pop esi
xor eax, eax
pop ebp
ret 4
mov esi, dword [esi]
test esi, esi
je 0x4036b0
mov ecx, dword [esi]
mov edx, dword [ecx + 0x1c]
push esi
call edx
mov eax, dword [0x4b5a60]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
mov ebx, dword [edi + 4]
push 0
lea esi, [edi + 0x10]
push esi
push 0x48444c
push 0x48449c
push eax
call edx
test eax, eax
jne 0x4036e3
push ebx
mov edx, 0x4844cc
call fcn.004030a0
test eax, eax
jne 0x40371f
xor eax, eax
push eax
cmp eax, str.CKeyManager
jne 0x403706
push 0x48b6d0
push 0x48b748
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
pop esi
xor eax, eax
pop ebp
ret 4
push str.CKeyManager
push 0x48b748
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
pop esi
xor eax, eax
pop ebp
ret 4
mov esi, dword [esi]
test esi, esi
je 0x40372d
mov ecx, dword [esi]
mov edx, dword [ecx + 0x1c]
push esi
call edx
lea esi, [edi + 0x64]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x403746
mov eax, dword [edi + 0x48]
push esi
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
pop ebx
pop esi
mov eax, 1
pop ebp
ret 4
Function at 0x403e40
Capabilities:
Check mutex on windows

Disassembly:
push str._S_F_A_2_2_
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x403e62
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret 4
push esi
push str._S_F_A_2_2_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x403e9a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x403ea0
cmp eax, 0x80
je 0x403ea0
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret 4
mov eax, dword [esp + 8]
mov dword [eax], esi
mov eax, 1
pop esi
ret 4

Function at 0x405140
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
push 1
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40516e
lea ecx, [esp]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [0x4b5a90], 1
push ebx
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
jne 0x40518a
call ebp
jmp 0x40518c
call ebx
mov esi, eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
test eax, eax
je 0x4051b0
sub esi, dword [edi + 0x1015cac]
cmp esi, 0x21
jbe 0x4051ac
mov eax, dword [edi + 0x5c6c]
push eax
jmp 0x4051b2
push 1
jmp 0x4051b2
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 1
cmp dword [0x4b5a90], esi
jne 0x4051c9
call ebp
jmp 0x4051cb
call ebx
mov dword [edi + 0x1015cac], eax
xor eax, eax
cmp dword [edi + 0x5a40], esi
pop esi
pop ebp
setne al
pop ebx
add esp, 0x1c
ret
Function at 0x405e30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4828ab
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x49b470]
xor eax, esp
mov dword [esp + 0xb4], eax
push esi
push edi
mov eax, dword [0x49b470]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
mov esi, ecx
push esi
mov ecx, 0x48b86c
mov edi, edx
call fcn.004062f0
test eax, eax
je 0x405f6c
lea eax, [esp + 0x14]
push eax
call fcn.00403eb0
lea ecx, [esi + 0x58cc]
mov dword [esp + 0xd0], 0
call fcn.004040f0
mov ecx, eax
lea esi, [ecx + 1]
jmp 0x405eb0
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x405eb0
sub ecx, esi
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00402b90
lea esi, [esp + 0x14]
call fcn.00404430
push str.save
mov eax, esi
call fcn.00404050
push 0x48b86c
mov eax, esi
call fcn.00404050
mov edx, edi
mov ecx, esi
call fcn.00404250
mov eax, dword [esp + 0x18]
mov edi, 0x10
cmp dword [esp + 0x2c], edi
jae 0x405f01
lea eax, [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 1
push DirectSoundCreate
push eax
call esi
cmp eax, 0xffffffff
je 0x405f2f
test eax, eax
je 0x405fbb
push eax
jmp 0x405fb5
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], edi
jae 0x405f3d
lea eax, [esp + 0x18]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call esi
mov esi, eax
cmp esi, 0xffffffff
jne 0x405f70
mov edi, 0x48b878
call fcn.004010a0
lea esi, [esp + 0x14]
call fcn.00403f80
xor eax, eax
jmp 0x405fc9
mov edx, dword [ebp + 8]
push 0
lea ecx, [esp + 0x14]
push ecx
push edx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x405f8e
cmp dword [esp + 0x10], 0
jne 0x405fb0
mov edi, 0x48b8a4
call fcn.004010a0
test esi, esi
je 0x405fa3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [esp + 0x14]
call fcn.00403f80
xor eax, eax
jmp 0x405fc9
test esi, esi
je 0x405fbb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [esp + 0x14]
call fcn.00403f80
mov eax, 1
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.0045f0aa
mov esp, ebp
pop ebp
ret 4
Function at 0x4062f0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4825db
mov eax, dword fs:[0]
push eax
sub esp, 0x568
mov eax, dword [0x49b470]
xor eax, esp
mov dword [esp + 0x560], eax
push esi
push edi
mov eax, dword [0x49b470]
xor eax, esp
push eax
lea eax, [esp + 0x574]
mov dword fs:[0], eax
mov eax, dword [esp + 0x584]
mov esi, ecx
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
lea ecx, [eax + 0x58cc]
mov dword [esp + 0x57c], 0
call fcn.004040f0
mov ecx, eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x406362
sub ecx, edi
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00402b90
push 4
push str.save
lea eax, [esp + 0x18]
call fcn.00408aa0
test esi, esi
je 0x4063b4
push 1
push 0x48b8f4
lea eax, [esp + 0x18]
call fcn.00408aa0
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4063a0
sub eax, edx
push eax
push esi
lea eax, [esp + 0x18]
call fcn.00408aa0
mov eax, dword [esp + 0x14]
mov esi, 0x10
cmp dword [esp + 0x28], esi
jae 0x4063c7
lea eax, [esp + 0x14]
lea ecx, [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x40643a
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], esi
jae 0x4063e6
lea eax, [esp + 0x14]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x406441
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], esi
jae 0x406401
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x170]
push 0x48b8f8
push edx
call fcn.0045f116
add esp, 0xc
lea edi, [esp + 0x16c]
call fcn.004010a0
cmp dword [esp + 0x28], esi
jb 0x406436
mov eax, dword [esp + 0x14]
push eax
call fcn.0045f755
add esp, 4
xor eax, eax
jmp 0x406459
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x28], esi
jb 0x406454
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0045f755
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x574]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x560]
xor ecx, esp
call fcn.0045f0aa
add esp, 0x574
ret 4
Function at 0x406520
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x482596
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x49b470]
xor eax, esp
mov dword [esp + 0x2c8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49b470]
xor eax, esp
push eax
lea eax, [esp + 0x2e4]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x2f4]
mov eax, dword [esp + 0x2fc]
mov ebp, dword [esp + 0x2f8]
xor edi, edi
cmp dword [ecx + 0x5c98], 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], edi
jne 0x40658f
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x2f0], edi
call fcn.00403eb0
mov byte [esp + 0x2ec], 1
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x18], edi
jmp 0x4065c0
lea eax, [edi + 0x41]
push eax
lea ecx, [esp + 0x1d8]
push 0x48b920
push ecx
call fcn.0045f116
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x1e0]
push edx
push eax
lea ecx, [esp + 0xe0]
push ecx
mov byte [esp + 0x1ef], 0
call fcn.0045f116
lea eax, [esp + 0xe4]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406605
sub eax, edx
push eax
lea edx, [esp + 0xd0]
push edx
lea ecx, [esp + 0x2c]
call fcn.00402b90
lea esi, [esp + 0x24]
call fcn.00404430
cmp dword [esp + 0x54], 0
jne 0x406635
call fcn.00404430
mov eax, dword [esp + 0x44]
mov esi, 0x10
cmp dword [esp + 0x58], esi
jae 0x406648
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 6
ja case.0x40665b.0
movzx eax, byte [eax + 0x406748]
jmp dword [eax*4 + 0x40673c]
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x3c], esi
jae 0x406670
lea eax, [esp + 0x28]
push eax
push ebp
call ebx
push 0
push 0x80
push 3
push 0
push 1
push DirectSoundCreate
lea ecx, [esp + 0xe4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x406705
mov edi, dword [esp + 0x18]
mov dword [esp + 0x1c], 0
inc edi
cmp edi, 0x1a
mov dword [esp + 0x18], edi
jl 0x4065c0
mov ecx, dword [esp + 0x2f4]
cmp dword [ecx + 0x5c98], 1
jne 0x4066d0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea esi, [esp + 0x24]
call fcn.00403f80
xor eax, eax
mov ecx, dword [esp + 0x2e4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c8]
xor ecx, esp
call fcn.0045f0aa
add esp, 0x2dc
ret 0xc
mov edx, dword [esp + 0x2f4]
cmp dword [edx + 0x5c98], 1
jne 0x406720
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea esi, [esp + 0x24]
call fcn.00403f80
test edi, edi
je 0x406734
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4066db
Function at 0x406750
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x482a9b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x49b470]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49b470]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24c]
mov ebp, dword [esp + 0x248]
xor ebx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x240], ebx
mov ecx, ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00407080
cmp eax, 1
je 0x406896
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor esi, esi
lea ebx, [ebx]
lea ecx, [esi + 0x41]
push ecx
lea edx, [esp + 0x28]
push 0x48b920
push edx
call fcn.0045f116
add esp, 0xc
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x2b], bl
call edi
cmp eax, 6
ja case.0x4067fd.36
movzx ecx, byte [eax + 0x4068ac]
jmp dword [ecx*4 + 0x4068a0]
push ebx
push ebx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push 0x104
lea ecx, [esp + 0x144]
push ecx
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je case.0x4067fd.36
push 0x48b924
lea eax, [esp + 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x406876
inc esi
cmp esi, 0x1a
jl 0x4067d0
xor eax, eax
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.0045f0aa
add esp, 0x230
ret 8
mov ecx, ebp
call fcn.00407510
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea esi, [esp + 0x18]
call fcn.004030e0
mov eax, 1
jmp 0x40684c