joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426aa0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4ab000]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, 1
sub dword [0x4aa124], ebx
cmp byte [0x4af507], 0
push esi
jne 0x426b5f
cmp dword [0x4aa124], 0
jg 0x426b5f
mov eax, dword [0x4af578]
mov esi, dword [sym.imp.USER32.dll_KillTimer]
add eax, 0xffffffe8
cmp eax, 0x16
ja case.default.0x426a38
movzx eax, byte [eax + 0x426b7c]
jmp dword [eax*4 + 0x426b70]
mov ecx, dword [0x4a9f28]
cmp ecx, dword [0x4af4e4]
jge case.default.0x426a38
cmp dword [0x4a9f04], ebx
jne case.default.0x426a38
mov byte [0x4af4a9], bl
mov dword [0x4a9f14], ebx
mov edx, dword [0x4acc30]
push 0x4af
push edx
call esi
mov eax, dword [0x4acc30]
push 0
push 0xc8
push 0x4af
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push ebx
push ebx
push 0xf
call fcn.00409d80
add esp, 0xc
jmp case.default.0x426a38
mov ecx, dword [0x4a9f28]
cmp ecx, dword [0x4af4e4]
jge 0x426b0c
mov byte [0x4aca61], bl
mov dword [0x4acb54], 0
jmp 0x426a69
cmp dword [0x4a9f04], ebx
jle 0x426b0c
cmp byte [0x4af492], 0
jne 0x426b05
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x208], esp
push str.Multi_before_eft
mov byte [0x4af492], bl
call fcn.00417780
mov ecx, dword [0x4ac6d8]
call fcn.00401dc0
push 0
push ebx
push 0x28
call fcn.00409d80
add esp, 0xc
push str._ShakePreResultTH_:_Multi_before_eft_n
jmp 0x426b16
call fcn.0041fa50
push str._ShakePreResultTH_:_EndWithGamewin_n
lea ecx, [ebp - 0x204]
push 0x100
push ecx
call fcn.0045e09f
add esp, 0xc
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.004095b0
add esp, 8
mov ecx, dword [0x4acc30]
push 0x49c
push ecx
mov dword [0x4aa124], 0x64
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d691
mov esp, ebp
pop ebp
ret
Function at 0x426ac0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4ab000]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, 1
sub dword [0x4aa124], ebx
cmp byte [0x4af507], 0
push esi
jne 0x426b5f
cmp dword [0x4aa124], 0
jg 0x426b5f
mov eax, dword [0x4af578]
mov esi, dword [sym.imp.USER32.dll_KillTimer]
add eax, 0xffffffe8
cmp eax, 0x16
ja case.default.0x426a38
movzx eax, byte [eax + 0x426b7c]
jmp dword [eax*4 + 0x426b70]
mov ecx, dword [0x4a9f28]
cmp ecx, dword [0x4af4e4]
jge case.default.0x426a38
cmp dword [0x4a9f04], ebx
jne case.default.0x426a38
mov byte [0x4af4a9], bl
mov dword [0x4a9f14], ebx
mov edx, dword [0x4acc30]
push 0x4af
push edx
call esi
mov eax, dword [0x4acc30]
push 0
push 0xc8
push 0x4af
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push ebx
push ebx
push 0xf
call fcn.00409d80
add esp, 0xc
jmp case.default.0x426a38
mov ecx, dword [0x4a9f28]
cmp ecx, dword [0x4af4e4]
jge 0x426b0c
mov byte [0x4aca61], bl
mov dword [0x4acb54], 0
jmp 0x426a69
cmp dword [0x4a9f04], ebx
jle 0x426b0c
cmp byte [0x4af492], 0
jne 0x426b05
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x208], esp
push str.Multi_before_eft
mov byte [0x4af492], bl
call fcn.00417780
mov ecx, dword [0x4ac6d8]
call fcn.00401dc0
push 0
push ebx
push 0x28
call fcn.00409d80
add esp, 0xc
push str._ShakePreResultTH_:_Multi_before_eft_n
jmp 0x426b16
call fcn.0041fa50
push str._ShakePreResultTH_:_EndWithGamewin_n
lea ecx, [ebp - 0x204]
push 0x100
push ecx
call fcn.0045e09f
add esp, 0xc
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.004095b0
add esp, 8
mov ecx, dword [0x4acc30]
push 0x49c
push ecx
mov dword [0x4aa124], 0x64
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d691
mov esp, ebp
pop ebp
ret
Function at 0x427780
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4ab000]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4a9f08]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_KillTimer]
mov esi, 1
cmp dword [0x4a9f04], eax
jg 0x4277c3
mov ecx, dword [0x4a9f0c]
cmp ecx, dword [0x4a9f10]
jl 0x4277c3
cmp dword [0x4af4dc], esi
jge 0x4277c8
cmp eax, 0x64
jl 0x42783f
call fcn.0045dc7c
mov edx, dword [0x4acc30]
mov dword [ebp - 0x208], eax
fild dword [ebp - 0x208]
push 0x4a4
fnstcw word [ebp - 0x206]
push edx
movzx eax, word [ebp - 0x206]
fmul qword [0x4930d8]
or eax, 0xc00
mov dword [ebp - 0x20c], eax
fmul qword [0x492588]
fldcw word [ebp - 0x20c]
fistp qword [ebp - 0x210]
mov esi, dword [ebp - 0x210]
add esi, 0xa
fldcw word [ebp - 0x206]
imul esi, esi, 0x64
call edi
mov eax, dword [0x4acc30]
push 0
push esi
push 0x4a4
push eax
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x427878
call fcn.00420790
mov ecx, dword [0x4a9f1c]
add dword [0x4af4dc], esi
add dword [0x4a9f0c], esi
push ecx
lea edx, [ebp - 0x204]
push str.g_nPoseiOutCounter:__d_n
push edx
call fcn.00409dc0
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [0x4acc30]
push 0x49e
push ecx
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045d691
mov esp, ebp
pop ebp
ret
Function at 0x42c790
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4ab000]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x404]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push str.gm.dat
push 0x492740
lea ecx, [ebp - 0x404]
push ecx
lea edx, [ebp - 0x204]
push str._s_s_s
push edx
call fcn.00409dc0
mov edx, dword [0x4aca3c]
mov dword [0x4ac678], edx
mov edx, dword [0x4aca2c]
mov dword [0x4ac684], edx
mov edx, dword [0x4aca40]
mov dword [0x4ac688], edx
mov edx, dword [0x4aca44]
mov dword [0x4ac68c], edx
mov edx, dword [0x4aca30]
mov dword [0x4ac698], edx
mov edx, dword [0x4aca34]
mov dword [0x4ac69c], edx
mov edx, dword [0x4aca28]
mov dword [0x4ac6a0], edx
mov edx, dword [0x4aca24]
mov dword [0x4ac6a4], edx
mov edx, dword [0x4aca50]
mov dword [0x4ac6a8], edx
mov edx, dword [0x4aca54]
mov dword [0x4ac6ac], edx
mov edx, dword [0x4aca48]
mov dword [0x4ac690], edx
mov edx, dword [0x4aca4c]
mov dword [0x4ac694], edx
mov edx, dword [0x4a9f34]
mov dword [0x4ac67c], edx
mov edx, dword [0x4a9f38]
mov cx, word [0x4aa03c]
mov ax, word [0x4af654]
mov dword [0x4ac680], edx
mov edx, dword [0x4af5f0]
mov dword [0x4ac6b0], edx
movzx edx, byte [0x4af656]
mov byte [0x4ac6b4], dl
mov edx, dword [str.111111]
mov dword [0x4ac6b5], edx
mov dx, word [0x4aa048]
mov word [0x4ac6b9], dx
movzx edx, byte [0x4aa03e]
mov byte [0x4ac6bb], dl
mov edx, dword [0x4aca9c]
mov dword [0x4ac6bc], edx
mov edx, dword [0x4a1064]
mov word [0x4ac672], cx
mov dword [0x4ac6c0], edx
movzx edx, byte [0x4a1053]
mov word [0x4ac670], ax
mov eax, dword [0x4aa040]
movzx ecx, cx
add esp, 0x14
mov dword [0x4ac674], eax
mov byte [0x4ac6c4], dl
mov dword [0x4ac7e4], ecx
cmp eax, 0x32
jle 0x42c920
mov dword [0x4ac7e8], eax
jmp 0x42c92d
mov edx, dword [eax*4 + 0x4ac7ec]
mov dword [0x4ac7e8], edx
fild dword [0x4aca5c]
push esi
fdiv qword [0x47b628]
fstp dword [0x4ac7ec]
call fcn.004241b0
cmp byte [ebp + 8], 0
je 0x42c992
lea eax, [ebp - 0x204]
push 0x4950d0
push eax
call fcn.0045e277
mov esi, eax
add esp, 8
test esi, esi
je 0x42c9c4
push esi
push 1
push 0x58
push 0x4ac670
call fcn.0045eae2
push esi
call fcn.0045de27
push esi
call fcn.0045e12a
add esp, 0x18
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d691
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x204]
push 0x492998
push ecx
call fcn.0045e277
mov esi, eax
add esp, 8
test esi, esi
je 0x42c9c4
push esi
push 1
push 0x58
push 0x4ac670
call fcn.0045eae2
push esi
call fcn.0045e12a
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0045d691
mov esp, ebp
pop ebp
ret
Function at 0x42ea80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4ab000]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4aa118]
dec eax
mov dword [0x4aa118], eax
test eax, eax
jle 0x42eb30
cmp eax, 1
jg 0x42ec92
push 1
push 1
push 0x39
call fcn.00409d80
mov al, byte [0x4aa040]
mov byte [0x4ac667], al
mov cl, byte [0x4aa03c]
mov eax, 0x51eb851f
imul dword [0x4aca5c]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov word [0x4ac668], ax
mov eax, 0x51eb851f
imul dword [0x4a9f2c]
mov byte [0x4ac666], cl
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add esp, 0xc
mov byte [0x4ac662], 0
mov word [0x4ac664], cx
call fcn.00424810
mov edx, dword [0x4aca3c]
mov dword [0x4af6d8], edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d691
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4aa11c]
sub dword [0x4a9f2c], eax
jns 0x42ec70
mov eax, dword [0x4acc30]
push esi
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 0x481
push eax
mov dword [0x4a9f2c], 0
call esi
mov ecx, dword [0x4a9f2c]
push ecx
push 0
call fcn.00413d40
push 0
push 0
push 0x39
mov dword [0x4aca38], 0
call fcn.00409d80
mov edx, dword [0x4acc30]
add esp, 0x14
push 0x465
push edx
call esi
mov eax, dword [0x4acc30]
push 0
push 0x7d0
push 0x465
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [0x4aff3c]
pop esi
cmp eax, dword [0x4aff40]
je 0x42ebfb
cmp dword [eax + 4], 3
jne 0x42ebfb
mov eax, dword [0x4be914]
cmp eax, dword [0x4be918]
je 0x42ebfb
cmp byte [eax], 0
je 0x42ebfb
movzx ecx, word [0x4ac664]
imul ecx, ecx, 0xffffff9c
add dword [eax + 4], ecx
mov eax, dword [0x4be914]
cmp dword [eax + 4], 0
jg 0x42ebfb
push eax
lea edx, [ebp - 0x208]
push edx
mov ecx, 0x4be914
call fcn.00417800
push 1
mov byte [0x4af6b7], 1
call fcn.00419ac0
movzx eax, byte [0x4af6b7]
push eax
lea ecx, [ebp - 0x204]
push str._MultipleToBankTH____g_bWinOutDone:__d_n
push ecx
call fcn.00409dc0
add esp, 0x10
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x4af6d8]
push eax
mov dword [0x4aca3c], eax
call fcn.0040d870
movzx eax, word [0x4ac664]
imul eax, eax, 0x64
add dword [0x4aca40], eax
add dword [0x4aca44], eax
push 0
call fcn.0042c790
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d691
mov esp, ebp
pop ebp
ret
add dword [0x4af6d8], eax
mov eax, dword [0x4a9f2c]
push eax
push 1
call fcn.00413d40
mov ecx, dword [0x4af6d8]
push ecx
call fcn.0040d870
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d691
mov esp, ebp
pop ebp
ret
Function at 0x448c10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x476e28
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x4ab000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x13c], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x138], 1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x103
lea eax, [ebp - 0x113]
push ebx
push eax
mov byte [ebp - 0x114], bl
call fcn.0045d730
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
dec eax
cmp eax, 0x103
ja 0x448dcb
lea esi, [ebp - 0x114]
mov dword [ebp - 0x134], esi
cmp byte [ebp - 0x114], bl
je 0x448dcb
jmp 0x448cc6
mov esi, dword [ebp - 0x134]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x448daa
mov eax, esi
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], ebx
mov byte [ebp - 0x130], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x448cf2
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x130]
call fcn.00416c80
lea edx, [ebp - 0x130]
push edx
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.004489e0
cmp dword [ebp - 0x11c], 0x10
mov byte [ebp - 4], 0
jb 0x448d39
mov eax, dword [ebp - 0x130]
push eax
call fcn.0045cafe
add esp, 4
mov ebx, dword [edi]
mov ecx, dword [edi + 4]
sub ecx, ebx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea edx, [edx + ecx - 1]
lea esi, [edx*8]
sub esi, edx
push 2
add esi, esi
push 0
lea edx, [ebp - 0x130]
add esi, esi
lea ecx, [esi + ebx]
push edx
call fcn.004177c0
mov ecx, dword [edi]
add ecx, esi
push eax
mov dword [ebp - 4], 2
call fcn.00402550
cmp dword [ebp - 0x11c], 0x10
mov byte [ebp - 4], 0
jb 0x448da2
mov eax, dword [ebp - 0x130]
push eax
call fcn.0045cafe
add esp, 4
mov esi, dword [ebp - 0x134]
xor ebx, ebx
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x448db0
sub eax, edx
lea eax, [esi + eax + 1]
mov dword [ebp - 0x134], eax
cmp byte [eax], cl
jne 0x448cc0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045d691
mov esp, ebp
pop ebp
ret
Function at 0x4576e0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x45772e
mov eax, dword [esi + 4]
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, dword [esi]
push 0x2328
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x45771b
mov edx, dword [esi]
push 0x8ae
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 8]
push ecx
call edi
pop edi
mov dword [esi], 0
pop esi
ret

Function at 0x4584e0
Capabilities:
Create thread
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
push 0
jne 0x458536
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x458060
push 0
push 0
call fcn.0045f189
mov ecx, dword [esi + 8]
add esp, 0x18
push 0x1388
push ecx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x458544
push str.Error_starting_SplashThread_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop esi
ret
mov edx, dword [esi + 4]
push 2
push 6
push edx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
pop esi
ret
Function at 0x458ec0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x71c
mov eax, dword [0x4ab000]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x504]
push 0x497720
push eax
mov edi, ecx
call fcn.00409dc0
add esp, 0xc
lea ecx, [ebp - 0x304]
push ecx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edx, [ebp - 0x504]
push edx
lea eax, [ebp - 0x304]
push 0x100
push eax
call fcn.0045e02a
push 0x49771c
lea ecx, [ebp - 0x304]
push ecx
lea edx, [ebp - 0x708]
xor esi, esi
push edx
xor ebx, ebx
mov dword [ebp - 0x708], esi
call fcn.0045e28e
mov eax, dword [ebp - 0x708]
add esp, 0x18
cmp eax, esi
je 0x458f9b
push eax
call fcn.0045f3dd
add esp, 4
test eax, eax
jne 0x458f8c
jmp 0x458f60
mov eax, dword [ebp - 0x708]
push eax
lea ecx, [ebp - 0x704]
push 0x200
push ecx
call fcn.0045f324
mov edx, dword [ebp - 0x708]
push edx
inc ebx
call fcn.0045f3dd
add esp, 0x10
test eax, eax
je 0x458f60
mov eax, dword [ebp - 0x708]
push eax
call fcn.0045e12a
add esp, 4
push 0x492760
lea ecx, [ebp - 0x304]
push ecx
lea edx, [ebp - 0x708]
push edx
call fcn.0045e28e
add esp, 0xc
cmp dword [ebp - 0x708], esi
je 0x45906c
test ebx, ebx
jle 0x459032
mov dword [ebp - 0x714], ebx
lea esp, [esp]
lea eax, [ebp - 0x70c]
push eax
lea ecx, [ebp - 0x710]
push ecx
lea edx, [ebp - 0x718]
push edx
lea eax, [ebp - 0x71c]
push eax
mov eax, dword [ebp - 0x708]
push 0x40
lea ecx, [ebp - 0x104]
push ecx
push 0x40
lea edx, [ebp - 0x84]
push edx
push 0x4976f8
push eax
call fcn.0045f304
lea eax, [edi + 0xfc]
push eax
lea ecx, [ebp - 0x84]
push ecx
call fcn.0045f229
add esp, 0x30
test eax, eax
je 0x45902a
inc esi
dec dword [ebp - 0x714]
jne 0x458fd0
mov edx, dword [ebp - 0x708]
push edx
call fcn.0045e12a
add esp, 4
test esi, esi
je 0x45906c
xor ecx, ecx
mov eax, esi
mov edx, 0x10
mul edx
seto cl
mov dword [edi + 0xa8], esi
neg ecx
or ecx, eax
push ecx
call fcn.0045c8ee
add esp, 4
mov dword [edi + 0xac], eax
push 0x492760
lea eax, [ebp - 0x304]
push eax
lea ecx, [ebp - 0x708]
push ecx
call fcn.0045e28e
add esp, 0xc
cmp dword [ebp - 0x708], 0
je 0x459151
test ebx, ebx
jle 0x459142
xor esi, esi
mov edi, edi
lea edx, [ebp - 0x70c]
push edx
lea eax, [ebp - 0x710]
push eax
lea ecx, [ebp - 0x718]
push ecx
lea edx, [ebp - 0x71c]
push edx
mov edx, dword [ebp - 0x708]
push 0x40
lea eax, [ebp - 0x104]
push eax
push 0x40
lea ecx, [ebp - 0x84]
push ecx
push 0x4976f8
push edx
call fcn.0045f304
lea eax, [edi + 0xfc]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0045f229
add esp, 0x30
test eax, eax
je 0x45913b
mov ecx, dword [edi + 0xac]
mov edx, dword [ebp - 0x71c]
mov dword [esi + ecx], edx
mov eax, dword [edi + 0xac]
mov ecx, dword [ebp - 0x718]
mov dword [eax + esi + 4], ecx
mov edx, dword [edi + 0xac]
mov eax, dword [ebp - 0x710]
mov dword [edx + esi + 8], eax
mov ecx, dword [edi + 0xac]
mov edx, dword [ebp - 0x70c]
mov dword [ecx + esi + 0xc], edx
add esi, 0x10
dec ebx
jne 0x4590a0
mov eax, dword [ebp - 0x708]
push eax
call fcn.0045e12a
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d691
mov esp, ebp
pop ebp
ret 4
Function at 0x45c270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4ab000]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], 0
cmp eax, 1
jne 0x45c3f8
test edi, edi
jne 0x45c2c0
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d691
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi]
test eax, eax
je 0x45c2d5
push eax
call fcn.0045eb5c
add esp, 4
mov dword [esi], 0
push 0x10000
push 0
push edi
call dword [sym.imp.WINMM.dll_mmioOpenA]
mov dword [esi + 4], eax
test eax, eax
jne 0x45c3a6
push str.WAVE
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x45c32c
push 0x49796c
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x45c32c
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d691
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x50], eax
test eax, eax
je 0x45c314
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x45c314
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x45c314
push edi
call fcn.0045c8ee
push edi
push ebx
push eax
mov dword [esi + 0x90], eax
call fcn.0045cb10
push 0x48
lea ecx, [ebp - 0x4c]
push 0
push ecx
call fcn.0045d730
mov edx, dword [esi + 0x90]
add esp, 0x1c
push 0x10000
lea eax, [ebp - 0x4c]
push eax
push 0
mov dword [ebp - 0x48], 0x204d454d
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edx
call dword [sym.imp.WINMM.dll_mmioOpenA]
mov dword [esi + 4], eax
mov ecx, esi
call fcn.0045ba20
mov edi, eax
test edi, edi
jns 0x45c3d4
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.WINMM.dll_mmioClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d691
mov esp, ebp
pop ebp
ret 0xc
mov ecx, esi
call fcn.0045bbc0
test eax, eax
js 0x45c447
mov edx, dword [esi + 0xc]
pop edi
mov dword [esi + 0x30], edx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d691
mov esp, ebp
pop ebp
ret 0xc
push 0x11002
push 0
push edi
call dword [sym.imp.WINMM.dll_mmioOpenA]
mov dword [esi + 4], eax
test eax, eax
je 0x45c314
push ebx
mov ecx, esi
call fcn.0045bf20
mov edi, eax
test edi, edi
jns 0x45c440
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.WINMM.dll_mmioClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d691
mov esp, ebp
pop ebp
ret 0xc
mov ecx, esi
call fcn.0045bbc0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d691
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45d691
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ab000]
jne 0x45d69b
repz ret
jmp fcn.004617fc
Function at 0x46da5c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4ab000]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004611ef
and dword [ebp - 0x14], 0
cmp dword [0x4bf9b4], 0
mov dword [ebp - 0x18], eax
jne 0x46db0f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x46dbb7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x49cc74
push ebx
call edi
test eax, eax
je 0x46dbb7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4bf9b4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4bf9b8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4bf9bc], eax
call edi
push eax
call esi
mov dword [0x4bf9c4], eax
test eax, eax
je 0x46db0f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4bf9c0], eax
mov eax, dword [0x4bf9c0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x46db68
cmp dword [0x4bf9c4], ecx
je 0x46db68
push eax
call esi
push dword [0x4bf9c4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x46db68
test ebx, ebx
je 0x46db68
call edi
test eax, eax
je 0x46db5f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x46db5f
test byte [ebp - 8], 1
jne 0x46db68
or dword [ebp + 0x10], 0x200000
jmp 0x46db9b
mov eax, dword [0x4bf9b8]
cmp eax, dword [ebp - 0x18]
je 0x46db9b
push eax
call esi
test eax, eax
je 0x46db9b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x46db9b
mov eax, dword [0x4bf9bc]
cmp eax, dword [ebp - 0x18]
je 0x46db9b
push eax
call esi
test eax, eax
je 0x46db9b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4bf9b4]
call esi
test eax, eax
je 0x46dbb7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x46dbb9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d691
leave
ret