joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4155d0
Capabilities:
Get common file path
Read .ini file

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edi
push str.HeroMp3.ini
push 1
push str.AutoClear
push str.SETTING
call esi
push str.HeroMp3.ini
push 1
push str.AutoEject
push str.SETTING
mov dword [0x4271f0], eax
call esi
push str.HeroMp3.ini
push 0xffffffffffffffff
push str.CanEject
push str.SETTING
mov dword [0x82f54c], eax
call esi
push str.HeroMp3.ini
push 0
push str.LoopDisc
push str.SETTING
mov dword [0x4271f4], eax
call esi
push str.HeroMp3.ini
push 0
push str.PullTrack
push str.SETTING
mov dword [0x82f550], eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [0x82d8a8], eax
cmp dword [0x4271f4], 0xffffffff
jne 0x4156b5
call fcn.004155c0
mov dword [0x4271f4], eax
test eax, eax
mov eax, 0x42681c
jne 0x415677
mov eax, 0x42677c
push str.HeroMp3.ini
push eax
push str.CanEject
push str.SETTING
call edi
push str.HeroMp3.ini
push 0x42681c
push str.AutoClear
push str.SETTING
call edi
push str.HeroMp3.ini
push 0x42681c
push str.AutoEject
push str.SETTING
call edi
push str.HeroMp3.ini
push 0xffffffffffffffff
push str.BufferFrames
push str.SETTING
call esi
cmp eax, 0xffffffff
jne 0x4156e3
push str.HeroMp3.ini
push 0x427504
push str.BufferFrames
push str.SETTING
call edi
push str.HeroMp3.ini
push 2
push str.MP3SearchDepth
push str.SETTING
call esi
push str.HeroMp3.ini
push 0x64
push str.MP3SearchFiles
push str.SETTING
mov dword [0x428e50], eax
call esi
push str.HeroMp3.ini
push 0
push str.EnableMicroPhone
push str.SETTING
mov dword [0x428e54], eax
call esi
push str.HeroMp3.ini
push 1
push str.SaveAudioSetting
push str.SETTING
mov dword [0x82d8b4], eax
call esi
push str.HeroMp3.ini
push 1
push str.EnableDirectCDROM
push str.SETTING
mov dword [0x82f308], eax
call esi
push str.HeroMp3.ini
push 1
push str.EnableMciPlay
push str.SETTING
mov dword [0x426ea0], eax
call esi
push str.HeroMp3.ini
push 0
push str.Random
push str.SAVEAUDIODECODER
mov dword [0x426ea4], eax
call esi
push str.HeroMp3.ini
push 1
push str.EnableIconRun
push str.SETTING
mov dword [0x82f424], eax
call esi
push str.HeroMp3.ini
push 0
push str.PlayVCDMode
push str.SETTING
mov dword [0x426718], eax
call esi
push str.HeroMp3.ini
push 0x104
push 0x426f40
push 0x82d6c0
push str.SAVETOPATH
push str.SETTING
mov dword [0x82f538], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x415807
push 0x426f40
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x415807
push 0x4274e4
push 0x426f40
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.HeroMp3.ini
push 1
push str.ISSAVETO
push str.SETTING
call esi
push str.HeroMp3.ini
push 0
push str.ENABLEDAB
push str.SETTING
mov dword [0x427044], eax
call esi
pop edi
mov dword [0x943ecc], eax
pop esi
ret
Function at 0x415b00
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x82f308]
test eax, eax
je 0x415be9
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push str.HeroMp3.ini
push 0
push str.Echo
push str.SAVEAUDIODECODER
call esi
test eax, eax
jge 0x415b2f
xor eax, eax
jmp 0x415b39
cmp eax, 7
jle 0x415b39
mov eax, 7
push str.HeroMp3.ini
push 0xffffffffffffffff
push str.Karaoke
push str.SAVEAUDIODECODER
mov dword [0x4266cc], eax
call esi
cmp eax, 0xffffffff
je 0x415b5b
mov dword [0x82f418], eax
mov eax, dword [0x82f418]
test eax, eax
je 0x415b7c
mov eax, dword [0x82d8b4]
test eax, eax
jne 0x415b7c
mov dword [0x82d8b4], 1
call fcn.00407ee0
push str.HeroMp3.ini
push 0
push str.Frequency
push str.SAVEAUDIODECODER
call esi
cmp eax, 0xffffffff
jge 0x415b99
or eax, 0xffffffff
jmp 0x415ba3
cmp eax, 1
jle 0x415ba3
mov eax, 1
push eax
push 0xa
call fcn.00404300
add esp, 8
push str.HeroMp3.ini
push 2
push str.Channel
push str.SAVEAUDIODECODER
call esi
test eax, eax
pop esi
jge 0x415bd4
xor eax, eax
push eax
push 0xb
call fcn.00404300
add esp, 8
ret
cmp eax, 3
jle 0x415bde
mov eax, 3
push eax
push 0xb
call fcn.00404300
add esp, 8
ret
Function at 0x415bf0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
mov ecx, dword [0x82f304]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
push esi
lea eax, [esp + 8]
push edi
push eax
push ecx
call ebx
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
sub esi, edx
mov edx, dword [esp + 0x18]
push str.HeroMp3.ini
push 0
mov dword [esp + 0x1c], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
sub edx, eax
push str.AudioWith
push str.SAVEAUDIODECODER
mov dword [esp + 0x28], edx
call esi
push str.HeroMp3.ini
push 0
push str.AudioHigh
push str.SAVEAUDIODECODER
mov dword [0x82f314], eax
call esi
mov ecx, dword [esp + 0x14]
mov edx, dword [0x82f314]
cmp edx, ecx
mov dword [0x82f318], eax
jge 0x415c70
mov dword [0x82f314], ecx
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jge 0x415c7e
mov dword [0x82f318], ecx
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push str.HeroMp3.ini
push 0xffffffffffffffff
push str.PositionX
push str.SAVEAUDIODECODER
call esi
push str.HeroMp3.ini
push 0xffffffffffffffff
push str.PositionY
push str.SAVEAUDIODECODER
mov edi, eax
call esi
cmp edi, 0xffffffff
mov esi, eax
je 0x415d35
cmp esi, 0xffffffff
je 0x415d35
mov eax, dword [0x82f304]
lea edx, [esp + 0x1c]
push edx
push eax
call ebx
test edi, edi
jge 0x415cd3
xor edi, edi
test esi, esi
jge 0x415cd9
xor esi, esi
mov ecx, dword [esp + 0x34]
lea edx, [ecx - 0x78]
cmp edi, edx
jle 0x415cf7
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
sub eax, edi
add eax, ecx
cdq
sub eax, edx
mov edi, eax
sar edi, 1
mov ecx, dword [esp + 0x38]
lea eax, [ecx - 0x28]
cmp esi, eax
jle 0x415d15
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x28]
sub eax, esi
add eax, ecx
cdq
sub eax, edx
mov esi, eax
sar esi, 1
mov ecx, dword [0x82f318]
mov edx, dword [0x82f314]
mov eax, dword [0x82f304]
push 4
push ecx
push edx
push esi
push edi
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x415da0
Capabilities:
Hide graphical window
Read .ini file

Disassembly:
mov eax, dword [0x82f40c]
test eax, eax
je 0x415dae
call fcn.00415ed0
push esi
push edi
push str.HeroMp3.ini
push 0x100
push 0x82f55c
push 0x82d6c0
push str.SthADOPlusDLLName
push str.SETTING
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x415ebe
mov eax, dword [0x82f558]
test eax, eax
jne 0x415dff
push 0x82f55c
call fcn.00415d40
add esp, 4
mov dword [0x82f558], eax
test eax, eax
je 0x415ebe
push str.HeroMp3.ini
push 1
push str.SthADOEnablePlusDLL
push str.SETTING
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x415ebe
push 0x82f55c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x82f40c], eax
je 0x415ebe
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.QueryPlusCaps
push eax
call edi
mov esi, eax
mov eax, dword [0x82f40c]
push str.CreatePlusWindow
push eax
call edi
test esi, esi
mov edi, eax
je 0x415ea7
test edi, edi
je 0x415ea7
call esi
test al, 2
je 0x415ea7
mov edx, dword [0x82f304]
mov eax, dword [0x82f300]
push fcn.004160d0
push 2
push edx
push eax
call edi
test eax, eax
mov dword [0x82f554], eax
je 0x415ea7
mov edx, dword [0x82f304]
push 0
push edx
mov dword [0x82f3ec], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x82f3ec]
push 1
push eax
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
pop edi
pop esi
ret
mov ecx, dword [0x82f40c]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x82f40c], 0
pop edi
pop esi
ret

Function at 0x415ed0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x82f40c]
test eax, eax
je 0x415f25
mov eax, dword [0x82f3ec]
push 0
push eax
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
mov ecx, dword [0x82f40c]
push str.ReleasePlusWindow
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov edx, dword [0x82f40c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x82f304]
push 5
push eax
mov dword [0x82f40c], 0
mov dword [0x82f3ec], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x415f30
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x358
mov ax, word [0x82d7a0]
push ebx
push esi
push edi
mov word [esp + 0x58], ax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x5a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x104
push str.HeroMp3.ini
lea ecx, [esp + 0x5c]
push edi
push ecx
push 0x82d6c0
xor ebx, ebx
push str.SthADOPlusDLLName
push str.SETTING
mov byte [esp + 0x70], bl
call esi
test eax, eax
jne 0x415fa5
push str.HeroMp3.ini
lea edx, [esp + 0x264]
push edi
push edx
push 0x82d6c0
push str.INSTALLPATH
push str.INSTALL
call esi
jmp 0x415fd5
lea eax, [esp + 0x260]
lea ecx, [esp + 0x15c]
push eax
lea edx, [esp + 0x5c]
push ecx
push edx
call fcn.00405520
add esp, 0xc
lea eax, [esp + 0x15c]
lea ecx, [esp + 0x58]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [0x82f304]
mov eax, dword [0x82f33c]
lea ecx, [esp + 0x58]
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x15c]
lea eax, [esp + 0x260]
push ecx
mov dword [esp + 0x10], 0x4c
mov dword [esp + 0x1c], str.SthADO_Plug_Ins_.STH_
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], str.Preview_File
mov word [esp + 0x48], bx
mov word [esp + 0x4a], bx
mov dword [esp + 0x4c], 0x4275c8
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], 0x9b
mov dword [esp + 0x44], 0x81804
call sub.comdlg32.dll_GetOpenFileNameA
test eax, eax
je 0x4160c5
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea edx, [esp + 0x58]
push str.HeroMp3.ini
push edx
push str.SthADOPlusDLLName
push str.SETTING
call esi
lea eax, [esp + 0x58]
push eax
call fcn.00415d40
add esp, 4
mov dword [0x82f558], eax
cmp eax, ebx
mov eax, 0x42681c
jne 0x4160a6
mov eax, 0x42677c
push str.HeroMp3.ini
push eax
push str.SthADOEnablePlusDLL
push str.SETTING
call esi
cmp dword [0x82f558], ebx
je 0x4160c5
call fcn.00415da0
pop edi
pop esi
pop ebx
add esp, 0x358
ret
Function at 0x417130
Capabilities:
Create thread

Disassembly:
push ebp
call fcn.00416ff0
push 3
mov ebp, eax
call fcn.00404210
add esp, 4
test eax, eax
je 0x417224
mov eax, dword [0x82f328]
mov dword [0x83070c], 0
test eax, eax
jne 0x417180
mov eax, dword [0x82f3dc]
test eax, eax
je 0x417180
mov eax, dword [0x82f304]
push 0
push 0x64
push 0x5678
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x82f328], eax
mov eax, dword [0x82f32c]
test eax, eax
jne 0x4171cc
mov eax, dword [0x82f3dc]
test eax, eax
jne 0x4171cc
push 0x82f330
push 0
push 0
push 0x40ece0
push 0
push 0
mov dword [0x426eb8], 0x64
mov dword [0x426eb4], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x82f32c], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [0x82f304]
push esi
push edi
push ecx
call dword [sym.imp.USER32.dll_GetMenu]
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
mov esi, eax
push 0x400
push 1
push esi
call edi
push 0x400
push 2
push esi
call edi
push 0x400
push 3
push esi
call edi
mov edx, dword [0x82f304]
push esi
push edx
call dword [sym.imp.USER32.dll_SetMenu]
push 1
call fcn.00408aa0
add esp, 4
pop edi
pop esi
call fcn.004199b0
mov eax, ebp
pop ebp
ret
mov eax, dword [0x82f2f4]
test eax, eax
je 0x41721b
mov eax, dword [0x82f304]
push 0
push 0x9c4b
push 0x111
push eax
mov dword [0x83070c], 1
mov byte [0x82f31c], 1
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
pop ebp
ret

Function at 0x4174a0
Capabilities:
Get disk information

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov byte [esp + 9], 0x3a
mov byte [esp + 0xa], 0x5c
mov byte [esp + 0xb], 0
mov ebx, 0x41
lea eax, [esp + 8]
mov byte [esp + 8], bl
push eax
call esi
cmp eax, 5
jne 0x4174db
lea ecx, [ebx - 0x41]
push 0
push ecx
call fcn.0040a970
add esp, 8
inc ebx
cmp ebx, 0x5a
jle 0x4174bd
pop esi
pop ebx
pop ecx
ret

Function at 0x417530
Capabilities:
Get disk information

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov byte [esp + 9], 0x3a
mov byte [esp + 0xa], 0x5c
mov byte [esp + 0xb], 0
mov ebx, 0x41
lea eax, [esp + 8]
mov byte [esp + 8], bl
push eax
call esi
cmp eax, 5
jne 0x41756b
lea ecx, [ebx - 0x41]
push 1
push ecx
call fcn.0040a970
add esp, 8
inc ebx
cmp ebx, 0x5a
jle 0x41754d
pop esi
pop ebx
pop ecx
ret
Function at 0x4178a0
Capabilities:
Create http request

Disassembly:
sub esp, 0xa8
push ebx
push ebp
push esi
mov esi, dword [esp + 0xbc]
push edi
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
test ebp, ebp
je 0x417a3b
push edi
push ebp
call fcn.00401df0
mov ecx, dword [0x42d3c4]
add esp, 8
cmp eax, ecx
jge 0x4178ee
push ebp
push 0x91a580
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, 1
jmp 0x4179e9
push 0x42728c
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + ebp - 3]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x417a34
push eax
push eax
push eax
push eax
push str.InetAll
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x14], ebx
je 0x417a34
push 0
push Ordinal_2
push 0
push 0
push ebp
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
jne 0x417967
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [esp + 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa8
ret
lea edx, [esp + 0x18]
push edx
push esi
call fcn.004181a0
add esp, 8
test eax, eax
je 0x4179d2
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, 0x91a580
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00401df0
mov ecx, dword [0x42d3c4]
add esp, 8
cmp eax, ecx
jge 0x4179b4
lea ecx, [esp + 0x18]
push ecx
push esi
call ebx
add esi, 0xa0
inc edi
cmp esi, 0x942580
jge 0x4179ca
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
call fcn.004181a0
add esp, 8
test eax, eax
jne 0x417984
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
mov esi, dword [esp + 0xc0]
test edi, edi
je 0x417a34
push ebp
call fcn.004039d0
add esp, 4
test eax, eax
je 0x4179ff
push ebp
call fcn.00418090
add esp, 4
call fcn.00417410
mov dword [0x830818], edi
mov dword [0x88e0dc], 0
mov byte [0x830815], 0
mov dword [0x82f2f4], 1
mov dword [0x428ca8], 0x70
call fcn.00417430
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa8
ret
Function at 0x418090
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
mov ebx, dword [esp + 0x110]
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
xor ebp, ebp
lea eax, [esp + 0x10]
push 0xa
push eax
push ebp
call fcn.0041babc
add esp, 0xc
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push 0x943900
push 0x100
push ecx
push 0x82d6c0
push edx
push str.Cache
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x418175
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x418187
cmp ebp, 0x13
jne 0x418160
push 0x943900
push 0
push str.CacheNum
push str.Cache
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x10]
mov esi, eax
push 0xa
push ecx
push esi
call fcn.0041babc
add esp, 0xc
lea edx, [esp + 0x10]
push 0x943900
push ebx
push edx
push str.Cache
call edi
lea eax, [esp + 0x10]
push 0xa
inc esi
push eax
push esi
call fcn.0041babc
add esp, 0xc
lea ecx, [esp + 0x10]
push 0x943900
push ecx
push str.CacheNum
push str.Cache
call edi
inc ebp
cmp ebp, 0x14
jl 0x4180a9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
push 0x943900
lea edx, [esp + 0x14]
push ebx
push edx
push str.Cache
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x418220
Capabilities:
Create http request

Disassembly:
sub esp, 0x150
push ebx
push ebp
push esi
mov esi, dword [esp + 0x160]
push edi
xor ebp, ebp
push esi
mov dword [esp + 0x14], ebp
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebp
jl 0x418457
mov eax, 1
sub eax, esi
mov dword [esp + 0x18], eax
jmp 0x418264
mov esi, dword [esp + 0x164]
mov al, byte [esi + ebp]
lea edi, [esi + ebp]
cmp al, 0x40
je 0x418276
test al, al
jne 0x41840d
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x164]
mov esi, ebp
sub esi, eax
add eax, edx
lea ecx, [esi + 1]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x20]
add ecx, edi
push 0
push edx
mov byte [esp + esi + 0x29], 0
mov dword [esp + 0x18], ecx
call fcn.00401df0
mov ecx, dword [0x42d3c4]
add esp, 8
cmp eax, ecx
jge 0x418307
lea ecx, [ebx + ebx*4]
lea eax, [esp + 0x20]
shl ecx, 5
add ecx, 0x91a580
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x20]
push edx
call fcn.004039d0
add esp, 4
test eax, eax
je 0x4182f5
lea eax, [esp + 0x20]
push eax
call fcn.00418090
add esp, 4
inc ebx
cmp ebx, 0x400
jge 0x41841e
jmp 0x41840d
lea ecx, [esp + 0x20]
push 0x42728c
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x24]
sub edx, 3
add eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x41840d
push eax
push eax
push eax
push eax
push str.InetAll
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebp, eax
test ebp, ebp
je 0x418457
push 0
push Ordinal_2
push 0
lea eax, [esp + 0x2c]
push 0
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
je 0x418462
lea ecx, [esp + 0xc0]
push ecx
push edi
call fcn.004181a0
add esp, 8
test eax, eax
je 0x4183fd
lea esi, [ebx + ebx*4]
shl esi, 5
add esi, 0x91a580
lea edx, [esp + 0xc0]
push 0
push edx
call fcn.00401df0
mov ecx, dword [0x42d3c4]
add esp, 8
cmp eax, ecx
jge 0x4183e8
lea eax, [esp + 0xc0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0xc0]
push ecx
call fcn.004039d0
add esp, 4
test eax, eax
je 0x4183d9
lea edx, [esp + 0xc0]
push edx
call fcn.00418090
add esp, 4
add esi, 0xa0
inc ebx
cmp esi, 0x942580
jge 0x4183fd
lea eax, [esp + 0xc0]
push eax
push edi
call fcn.004181a0
add esp, 8
test eax, eax
jne 0x41838a
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
push ebp
call esi
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ebp
cmp ebp, eax
mov dword [esp + 0x14], ebp
jle 0x41825d
test ebx, ebx
je 0x418457
call fcn.00417410
mov dword [0x830818], ebx
mov dword [0x88e0dc], 0
mov byte [0x830815], 0
mov dword [0x82f2f4], 1
mov dword [0x428ca8], 0x70
call fcn.00417430
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x150
ret
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x150
ret
Function at 0x418480
Capabilities:
Get disk information

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 8
mov al, byte [ecx]
push esi
cmp al, 0x41
jb 0x4184d5
cmp al, 0x5a
ja 0x4184d5
and eax, 0xff
sub eax, 0x41
mov esi, eax
js 0x4184d5
cmp esi, 0x1f
jg 0x4184d5
xor eax, eax
lea edx, [esp + 4]
push eax
push eax
push eax
push eax
push edx
push eax
push eax
push ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esi*8 + 0x82f428], eax
mov dword [esi*8 + 0x82f42c], ecx
pop esi
add esp, 8
ret

Function at 0x4184e0
Capabilities:
Get disk information

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
cmp ebx, 0x5a
push esi
mov byte [esp + 9], 0x3a
mov byte [esp + 0xa], 0x5c
mov byte [esp + 0xb], 0
jg 0x418517
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea eax, [esp + 8]
mov byte [esp + 8], bl
push eax
call esi
cmp eax, 5
je 0x41851d
inc ebx
cmp ebx, 0x5a
jle 0x418501
pop esi
xor eax, eax
pop ebx
pop ecx
ret
lea ecx, [esp + 8]
push ecx
call fcn.00418480
add esp, 4
mov eax, ebx
pop esi
pop ebx
pop ecx
ret

Function at 0x418530
Capabilities:
Get disk information

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push edi
mov byte [esp + 0xd], 0x3a
mov byte [esp + 0xe], 0x5c
mov byte [esp + 0xf], 0
xor edi, edi
mov ebx, 0x41
lea eax, [esp + 0xc]
mov byte [esp + 0xc], bl
push eax
call esi
cmp eax, 5
jne 0x418561
inc edi
inc ebx
cmp ebx, 0x5a
jle 0x418550
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4195f0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [0x88e0d8]
push esi
mov esi, dword [eax*4 + 0x8320c4]
xor eax, eax
mov al, byte [esi]
add eax, 0xfffffff0
cmp eax, 0xf
ja case.0x419615.19
xor ecx, ecx
mov cl, byte [eax + 0x419768]
jmp dword [ecx*4 + 0x419758]
xor eax, eax
mov ax, word [esi + 4]
push eax
call fcn.004185d0
mov edx, dword [esp + 0xc]
mov dword [edx], eax
xor eax, eax
mov ax, word [esi + 6]
push eax
call fcn.004185d0
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
xor eax, eax
mov ax, word [esi + 8]
push eax
call fcn.004185d0
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov dword [edx], eax
mov eax, dword [esp + 0x18]
pop esi
mov dword [eax], 0xffff
mov dword [ecx], 0xffff
ret
xor eax, eax
mov ax, word [esi + 6]
push eax
call fcn.004185d0
mov edx, dword [esp + 0xc]
mov dword [edx], eax
xor eax, eax
mov ax, word [esi + 8]
push eax
call fcn.004185d0
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
xor eax, eax
mov ax, word [esi + 0xa]
push eax
call fcn.004185d0
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov dword [edx], eax
xor eax, eax
mov al, byte [esi + 2]
test eax, eax
jne 0x4196c3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
pop esi
mov dword [eax], 0xffff
mov dword [ecx], 0xffff
ret
mov edx, dword [esp + 0x14]
xor ecx, ecx
mov cl, byte [esi + 3]
pop esi
mov dword [edx], ecx
lea eax, [ecx + eax - 1]
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
ret
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [0x8320c0], 1
mov dword [edx], 0xffff
mov edx, dword [esp + 0xc]
mov dword [eax], 0xffff
mov eax, dword [esp + 8]
mov dword [ecx], 0xffff
mov dword [edx], 0xffff
mov dword [eax], 0xffff
pop esi
ret
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [0x8320c0], 1
mov dword [ecx], 0xffff
mov ecx, dword [esp + 0xc]
mov dword [edx], 0xffff
mov edx, dword [esp + 8]
mov dword [eax], 0xffff
mov dword [ecx], 0xffff
mov dword [edx], 0xffff
pop esi
ret