joyce8/EMBER2024-capa huggingface dataset:
Function at 0x643db8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x867e6c]
jne 0x643dc2
repz ret
jmp fcn.00650816

Function at 0x65cb32
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x65cb63
call fcn.0064a227
mov dword [eax], esi
call fcn.0064a214
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00644191
add esp, 0x14
push 0x16
pop eax
jmp 0x65cbb8
test dword [ebp + 0xc], 0xfffffff9
jne 0x65cb3f
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x65cb90
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.0064a23a
pop ecx
call fcn.0064a214
mov eax, dword [eax]
jmp 0x65cbb8
test al, 0x10
jne 0x65cbb6
test al, 1
je 0x65cbb6
test byte [ebp + 0xc], 2
je 0x65cbb6
call fcn.0064a227
mov dword [eax], 5
call fcn.0064a214
mov dword [eax], 0xd
jmp 0x65cb87
xor eax, eax
pop esi
pop ebp
ret

Function at 0x66203e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.006509fe
and dword [ebp - 4], 0
cmp dword [0x880528], 0
mov ebx, eax
jne 0x6620ef
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x6621a0
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x79d2a0
push edi
call esi
test eax, eax
je 0x6621a0
push eax
call fcn.0065098c
mov dword [esp], 0x79d290
push edi
mov dword [0x880528], eax
call esi
push eax
call fcn.0065098c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x88052c], eax
call esi
push eax
call fcn.0065098c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x880530], eax
call esi
push eax
call fcn.0065098c
pop ecx
mov dword [0x880538], eax
test eax, eax
je 0x6620ef
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0065098c
pop ecx
mov dword [0x880534], eax
mov eax, dword [0x880534]
cmp eax, ebx
je 0x662147
cmp dword [0x880538], ebx
je 0x662147
push eax
call fcn.00650a07
push dword [0x880538]
mov esi, eax
call fcn.00650a07
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x662147
test edi, edi
je 0x662147
call esi
test eax, eax
je 0x66213e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x66213e
test byte [ebp - 0xc], 1
jne 0x662147
or dword [ebp + 0x10], 0x200000
jmp 0x662180
mov eax, dword [0x88052c]
cmp eax, ebx
je 0x662180
push eax
call fcn.00650a07
pop ecx
test eax, eax
je 0x662180
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x662180
mov eax, dword [0x880530]
cmp eax, ebx
je 0x662180
push eax
call fcn.00650a07
pop ecx
test eax, eax
je 0x662180
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x880528]
call fcn.00650a07
pop ecx
test eax, eax
je 0x6621a0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x6621a2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6d9680
Capabilities:
Check http status code

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x3178], 0
je 0x6d9699
mov ecx, dword [esi + 0x3178]
mov eax, dword [ecx]
mov edx, dword [eax + 0x2c]
call edx
mov ecx, esi
pop esi
jmp fcn.00744e90
Function at 0x6f1e60
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x776bec
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x867e6c]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [0x881218]
mov eax, edi
call fcn.00430c10
mov eax, dword [esi]
mov edx, dword [eax + 0x2b4]
mov ecx, esi
call edx
fmul qword [0x82dc80]
call fcn.0076f850
push eax
mov edx, 0xff
push 0xff
mov ecx, edx
lea eax, [esp + 0x54]
call fcn.004348b0
mov ecx, edi
call fcn.00430c20
push 4
xor ebx, ebx
push 0x7e6b6c
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.004016e0
mov ecx, 0x9f000000
lea eax, [esp + 0x4c]
mov dword [esp + 0x88], ebx
call fcn.00434820
mov ebx, dword [0x881218]
push eax
lea ecx, [esp + 0x18]
call fcn.0058a060
mov dword [esp + 0x88], 0xffffffff
cmp dword [esp + 0x2c], 0x10
jb 0x6f1f46
mov eax, dword [esp + 0x18]
push eax
call fcn.006441c7
add esp, 4
mov ecx, dword [esi + 0xd60]
lea esi, [esp + 0x5c]
call fcn.00439440
mov dword [esp + 0x88], 1
mov ecx, dword [0x88b12c]
mov ecx, dword [ecx + 0x9e0]
mov edx, ecx
imul ecx, ecx, 0xf2
imul edx, edx, 0xd2
mov eax, 0x1b4e81b5
imul edx
push 0xffffffffffffffff
push 0xffffffffffffffff
sar edx, 7
xor ebx, ebx
push ebx
push 1
mov eax, edx
push ebx
shr eax, 0x1f
add eax, edx
push 0xffffffffffffffff
push eax
mov eax, 0x1b4e81b5
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
mov edx, esi
push edx
mov ecx, edi
call fcn.004335e0
push 4
push 0x7e6b74
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
call fcn.004016e0
lea eax, [esp + 0x30]
mov byte [esp + 0x88], 2
mov ecx, dword [0x881218]
push eax
call fcn.0058a360
cmp dword [esp + 0x48], 0x10
jb 0x6f2000
mov ecx, dword [esp + 0x34]
push ecx
call fcn.006441c7
add esp, 4
cmp dword [esp + 0x74], 8
jb 0x6f2014
mov edx, dword [esp + 0x60]
push edx
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00643db8
mov esp, ebp
pop ebp
ret 4
Function at 0x6f80f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x775fc1
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esi + 8]
push eax
mov dword [esi], vtable.Sexy::Profile.0
call fcn.00428920
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov eax, 7
xor ecx, ecx
mov dword [esi + 0x5c], eax
mov dword [esi + 0x58], ebx
mov word [esi + 0x48], cx
xor edx, edx
mov dword [esi + 0x78], eax
mov dword [esi + 0x74], ebx
mov word [esi + 0x64], dx
mov dword [esi + 0x9c], eax
mov dword [esi + 0x98], ebx
mov word [esi + 0x88], cx
mov dword [esi + 0xb8], eax
mov dword [esi + 0xb4], ebx
mov word [esi + 0xa4], dx
mov ecx, 0xf
mov dword [esi + 0x25c], ecx
mov dword [esi + 0x258], ebx
mov byte [esi + 0x248], bl
mov dword [esi + 0x27c], ecx
mov dword [esi + 0x278], ebx
mov byte [esi + 0x268], bl
mov dword [esi + 0x29c], ecx
mov dword [esi + 0x298], ebx
mov byte [esi + 0x288], bl
mov byte [esp + 0x14], al
lea eax, [esi + 0x2d4]
push eax
call fcn.0040b990
mov byte [esp + 0x14], 8
call fcn.006f7da0
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x6f9470
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x778422
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x867e6c]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov ebx, ecx
lea esi, [esp + 0x34]
mov dword [esp + 0x14], ebx
call fcn.0054a360
xor esi, esi
mov eax, 0x391beef5
lea edi, [esp + 0x34]
mov dword [esp + 0x88], esi
call fcn.0054a5d0
lea eax, [esi + 8]
call fcn.0054a5b0
lea edi, [ebx + 0x60]
push edi
lea eax, [esp + 0x38]
call fcn.0054a650
push 8
push 0x7e6d5c
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], esi
mov byte [esp + 0x24], 0
call fcn.004016e0
push edi
lea eax, [esp + 0x1c]
mov byte [esp + 0x8c], 1
push eax
mov eax, dword [0x88b12c]
call fcn.00468370
mov byte [esp + 0x88], 0
cmp dword [esp + 0x30], 0x10
jb 0x6f953a
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.006441c7
add esp, 4
lea edx, [ebx + 0x44]
push edx
lea eax, [esp + 0x38]
call fcn.0054a650
add ebx, 0x20
push ebx
mov ebx, 8
lea edi, [esp + 0x38]
call fcn.0054a850
mov esi, dword [esp + 0x14]
lea eax, [esi + 0x28]
push eax
call fcn.0054a850
mov eax, dword [esi + 0x40]
call fcn.0054a5d0
lea ecx, [esi + 0x30]
push ecx
call fcn.0054a850
lea edx, [esi + 0x38]
push edx
call fcn.0054a850
mov ecx, dword [esi + 0x18]
sub ecx, dword [esi + 0x14]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
xor edi, edi
test eax, eax
jle 0x6f95f3
xor ebx, ebx
mov ecx, dword [esi + 0x18]
sub ecx, dword [esi + 0x14]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp edi, ecx
jb 0x6f95c3
call fcn.006441b7
mov edx, dword [esi + 0x14]
add edx, ebx
push edx
lea eax, [esp + 0x38]
call fcn.0054a650
mov ecx, dword [esi + 0x18]
sub ecx, dword [esi + 0x14]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
add ebx, 0x1c
cmp edi, eax
jl 0x6f95a1
lea esi, [esp + 0x18]
call fcn.00438580
push eax
mov edi, str.usersusers.dat
lea esi, [esp + 0x60]
mov byte [esp + 0x8c], 2
call fcn.00402fb0
add esp, 4
mov esi, 0x10
mov byte [esp + 0x88], 4
cmp dword [esp + 0x30], esi
jb 0x6f9636
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.006441c7
add esp, 4
mov eax, dword [0x88b12c]
lea edx, [esp + 0x5c]
push edx
xor ebx, ebx
push eax
mov edi, 0xf
lea eax, [esp + 0x3c]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00468e10
cmp dword [esp + 0x74], esi
jb 0x6f9670
mov ecx, dword [esp + 0x60]
push ecx
call fcn.006441c7
add esp, 4
lea ecx, [esp + 0x34]
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], 0
call fcn.0054a380
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00643db8
mov esp, ebp
pop ebp
ret
Function at 0x6f9860
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x7787d7
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x867e6c]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x5c]
mov eax, 8
mov esi, ecx
cmp dword [edi + 0x18], eax
jb 0x6f98a6
mov ecx, dword [edi + 4]
jmp 0x6f98a9
lea ecx, [edi + 4]
lea ebx, [ebp + 4]
cmp dword [ebp + 0x18], eax
jb 0x6f98b5
mov eax, dword [ebx]
jmp 0x6f98b7
mov eax, ebx
push ecx
push eax
call fcn.00644616
add esp, 8
test eax, eax
jne 0x6f98e7
push ebp
mov eax, esi
call fcn.006f7c90
push edi
mov eax, esi
call fcn.006f8440
push 0xffffffffffffffff
push 0
push edi
lea ecx, [esi + 0x60]
call fcn.00401880
jmp 0x6f99f0
mov ecx, esi
call fcn.006f8f80
push ebp
lea eax, [esp + 0x30]
push eax
call fcn.006f8270
push edi
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x5c], 0
call fcn.006f8270
lea edx, [esp + 0x10]
mov byte [esp + 0x54], 1
call fcn.00439510
lea edx, [esp + 0x10]
call fcn.004395c0
mov ecx, dword [esp + 0x14]
mov eax, 0x10
cmp dword [esp + 0x28], eax
jae 0x6f9936
lea ecx, [esp + 0x14]
cmp dword [esp + 0x44], eax
mov eax, dword [esp + 0x30]
jae 0x6f9944
lea eax, [esp + 0x30]
push ecx
push eax
call dword [sym.imp.kernel32.dll_MoveFileA]
test eax, eax
jne 0x6f995e
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x30]
call fcn.006f8500
push ebp
mov eax, esi
call fcn.006f7c90
push edi
mov eax, esi
call fcn.006f8440
add esi, 0x60
mov eax, 8
cmp dword [esi + 0x18], eax
jb 0x6f9980
mov ecx, dword [esi + 4]
jmp 0x6f9983
lea ecx, [esi + 4]
cmp dword [ebp + 0x18], eax
jb 0x6f998c
mov eax, dword [ebx]
jmp 0x6f998e
mov eax, ebx
push ecx
push eax
call fcn.00644616
add esp, 8
test eax, eax
jne 0x6f99a7
push 0xffffffffffffffff
push eax
push edi
mov ecx, esi
call fcn.00401880
lea edx, [esp + 0x2c]
call fcn.00439510
mov esi, 0x10
cmp dword [esp + 0x28], esi
jb 0x6f99c8
mov eax, dword [esp + 0x14]
push eax
call fcn.006441c7
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
cmp dword [esp + 0x44], esi
jb 0x6f99f0
mov ecx, dword [esp + 0x30]
push ecx
call fcn.006441c7
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00643db8
add esp, 0x48
ret 4

Function at 0x6facb0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x1c]
push eax
push 0
push esi
push 0x6fab20
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x14]
push 0xffffffffffffffff
push ecx
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov edx, dword [esi + 0x14]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esi + 0x14], 0
ret
Function at 0x704940
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x779b34
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x867e6c]
xor eax, esp
mov dword [esp + 0xb8], eax
push ebx
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov edi, edx
push edi
xor al, al
lea esi, [esp + 0x94]
mov ebx, ecx
call fcn.00439610
add esp, 4
mov edx, eax
mov dword [esp + 0xd8], 0
call fcn.004395c0
mov esi, 0x10
mov dword [esp + 0xd8], 0xffffffff
cmp dword [esp + 0xa8], esi
jb 0x7049d1
mov eax, dword [esp + 0x94]
push eax
call fcn.006441c7
add esp, 4
mov edx, edi
call fcn.00439520
test al, al
je 0x7049f5
cmp dword [edi + 0x18], esi
jb 0x7049e6
mov eax, dword [edi + 4]
jmp 0x7049e9
lea eax, [edi + 4]
push 0x80
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
lea esi, [esp + 0x68]
call fcn.0054a360
mov ecx, esi
push ecx
push ebx
mov dword [esp + 0xe0], 1
call fcn.00704830
test al, al
je 0x704b46
mov edx, dword [0x88b148]
push edi
push edx
mov eax, esi
call fcn.00468e10
test al, al
jne 0x704b75
mov ebx, edi
lea eax, [esp + 0xac]
call fcn.00438cb0
push str.Failed_to_create_high_score_file__n_n_s_n_nPlease_contact_Customer_Support_at_http:__www.popcap.com_support.
lea ecx, [esp + 0x50]
mov byte [esp + 0xdc], 2
call fcn.00403550
lea eax, [esp + 0x4c]
push eax
mov byte [esp + 0xdc], 3
mov eax, dword [0x88b148]
push 0x108
add eax, 0x7ec
lea esi, [esp + 0x38]
call fcn.004711e0
mov byte [esp + 0xd8], 4
mov ecx, dword [esp + 0xb0]
mov edi, 8
cmp dword [esp + 0xc4], edi
jae 0x704a9e
lea ecx, [esp + 0xb0]
cmp dword [eax + 0x18], edi
jb 0x704aa8
mov eax, dword [eax + 4]
jmp 0x704aab
add eax, 4
push ecx
push eax
lea esi, [esp + 0x1c]
call fcn.00439a90
add esp, 8
mov byte [esp + 0xd8], 5
mov ecx, dword [0x88b148]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x7c]
call eax
cmp dword [esp + 0x2c], edi
jb 0x704ae2
mov ecx, dword [esp + 0x18]
push ecx
call fcn.006441c7
add esp, 4
xor esi, esi
xor edx, edx
mov ebx, 7
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], esi
mov word [esp + 0x18], dx
cmp dword [esp + 0x48], edi
jb 0x704b0b
mov eax, dword [esp + 0x34]
push eax
call fcn.006441c7
add esp, 4
xor ecx, ecx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], esi
mov word [esp + 0x34], cx
cmp dword [esp + 0x64], edi
jb 0x704b2d
mov edx, dword [esp + 0x50]
push edx
call fcn.006441c7
add esp, 4
cmp dword [esp + 0xc4], edi
jb 0x704b46
mov eax, dword [esp + 0xb0]
push eax
call fcn.006441c7
add esp, 4
lea ecx, [esp + 0x68]
call fcn.0054a380
xor al, al
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.00643db8
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x68]
mov byte [ebx + 0x20], 0
call fcn.0054a380
mov al, 1
jmp 0x704b51
Function at 0x74d490
Capabilities:
Get disk information
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x77a983
mov eax, dword fs:[0]
push eax
sub esp, 0x308
mov eax, dword [0x867e6c]
xor eax, esp
mov dword [esp + 0x300], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x31c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x32c]
xor ebx, ebx
mov dword [esp + 0x324], ebx
lea esi, [esp + 0x40]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
call fcn.0054a360
mov dword [esp + 0x324], 1
lea esi, [esp + 0x18]
lea edi, [esp + 0x94]
mov dword [esp + 0x18], 0x10
call fcn.00748b70
mov eax, dword [esp + 0x18]
cmp eax, ebx
jle 0x74d53a
mov esi, edi
mov dword [esp + 0x18], eax
lea ecx, [ecx]
push esi
mov ebx, 8
lea edi, [esp + 0x44]
call fcn.0054a850
add esi, ebx
sub dword [esp + 0x18], 1
jne 0x74d520
xor ebx, ebx
push 0x100
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x2c]
push eax
push 0x100
lea ecx, [esp + 0x22c]
push ecx
push 0x80e810
mov dword [esp + 0x3c], ebx
call dword [sym.imp.kernel32.dll_GetVolumeInformationA]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x34]
push edx
push 0x80e814
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceA]
lea eax, [esp + 0x84]
push eax
call fcn.00644e55
mov eax, dword [esp + 0x20]
add esp, 4
lea edi, [esp + 0x40]
call fcn.0054a5d0
call dword [sym.imp.kernel32.dll_GetTickCount]
call fcn.0054a5d0
mov eax, dword [esp + 0x84]
call fcn.0054a5d0
mov eax, dword [esp + 0x20]
call fcn.0054a5d0
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], ebx
mov byte [ebp + 4], bl
mov dword [esp + 0x30], 1
xor edi, edi
jmp 0x74d600
movzx ecx, byte [esp + edi + 0x84]
push ecx
push 0x80e818
lea esi, [esp + 0x70]
call fcn.00439900
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, ebp
mov byte [esp + 0x330], 2
call fcn.00402720
mov byte [esp + 0x324], 1
cmp dword [esp + 0x80], 0x10
jb 0x74d64c
mov edx, dword [esp + 0x6c]
push edx
call fcn.006441c7
add esp, 4
inc edi
cmp edi, 0x10
jl 0x74d600
lea ecx, [esp + 0x40]
call fcn.0054a380
mov eax, ebp
mov ecx, dword [esp + 0x31c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x300]
xor ecx, esp
call fcn.00643db8
add esp, 0x314
ret
Function at 0x755380
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x774a7b
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [esp + 4], 0
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], 0
mov dword [esp + 8], edi
mov word [edi + 4], ax
mov dword [esp + 0x30], eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
mov dword [esp + 4], 1
call eax
cmp dword [esi + 8], eax
mov edx, dword [esi]
lea eax, [esp + 0xc]
mov ecx, esi
push eax
jge 0x7553f5
mov edx, dword [edx + 0x24]
call edx
mov dword [esp + 0x30], 1
jmp 0x755402
mov edx, dword [edx + 0x28]
call edx
mov dword [esp + 0x30], 2
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.00401880
cmp dword [esp + 0x24], 8
jb 0x755422
mov eax, dword [esp + 0x10]
push eax
call fcn.006441c7
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
add esp, 0x30
ret

Function at 0x756070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x77645e
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x867e6c]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
push 5
xor esi, esi
xor eax, eax
mov edi, 7
push str.Poker
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], esi
mov word [esp + 0x28], ax
call fcn.00403a80
mov dword [esp + 0xa0], esi
xor ecx, ecx
push 0xb
mov word [esp + 0x40], cx
push str.Butterflies
lea ecx, [esp + 0x40]
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], esi
call fcn.00403a80
mov byte [esp + 0xa0], 1
push 0xc
xor edx, edx
push str.Diamond_Mine
lea ecx, [esp + 0x5c]
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], esi
mov word [esp + 0x60], dx
call fcn.00403a80
mov byte [esp + 0xa0], 2
push 9
xor eax, eax
push str.Ice_Storm
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], edi
mov dword [esp + 0x8c], esi
mov word [esp + 0x7c], ax
call fcn.00403a80
mov dword [esp + 0xa0], 3
mov ebx, dword [0x88b12c]
lea esi, [esp + 0x1c]
mov dword [esp + 0x18], 4
mov ecx, dword [ebx + 0xba4]
mov edi, esi
call fcn.00704600
mov ebx, dword [0x88b12c]
mov ecx, eax
mov eax, dword [ebx + 0xb78]
mov edi, dword [eax + 0x74]
add eax, 0x60
cmp dword [eax + 0x18], 8
jb 0x75619d
mov eax, dword [eax + 4]
jmp 0x7561a0
add eax, 4
push eax
mov eax, dword [ecx + 0x14]
call fcn.00404150
test eax, eax
jne 0x7561b1
inc dword [esp + 0x14]
add esi, 0x1c
sub dword [esp + 0x18], 1
jne 0x756171
push fcn.00406fb0
push 4
push 0x1c
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0xb0], 0xffffffff
call fcn.0064441b
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.00643db8
mov esp, ebp
pop ebp
ret