joyce8/EMBER2024-capa huggingface dataset:
Function at 0x646881bc
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x10], 0
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
imul eax, dword [esp + 0x4c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
je 0x6468820c
mov eax, dword [esp + 0x2c]
xor edx, edx
div dword [esp + 0x48]
xor edx, edx
add esp, 0x3c
ret
call fcn.64685abc
mov dword [esp], eax
call sym.allegro_5.0.10_monolith_mt.dll___PHYSFS_setError
mov eax, 0xffffffff
mov edx, 0xffffffff
jmp 0x64688205

Function at 0x64688228
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x10], 0
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
imul eax, dword [esp + 0x4c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
je 0x64688278
mov eax, dword [esp + 0x2c]
xor edx, edx
div dword [esp + 0x48]
xor edx, edx
add esp, 0x3c
ret
call fcn.64685abc
mov dword [esp], eax
call sym.allegro_5.0.10_monolith_mt.dll___PHYSFS_setError
mov eax, 0xffffffff
mov edx, 0xffffffff
jmp 0x64688271

Function at 0x6468835c
Capabilities:
Get file size

Disassembly:
push ebx
sub esp, 0x28
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
mov ebx, eax
cmp eax, 0xffffffff
je 0x6468838c
mov eax, ebx
mov edx, dword [esp + 0x1c]
add esp, 0x28
pop ebx
ret
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x64688380
call fcn.64685abc
mov dword [esp], eax
call sym.allegro_5.0.10_monolith_mt.dll___PHYSFS_setError
mov eax, 0xffffffff
mov edx, 0xffffffff
jmp 0x64688386

Function at 0x646883b0
Capabilities:
Get file size

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov eax, dword [ebx]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 1
lea edi, [esp + 0x1c]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0x10
mov esi, eax
cmp eax, 0xffffffff
je 0x64688438
mov ebp, dword [esp + 0x1c]
mov eax, ebp
or eax, esi
jne 0x64688404
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], edi
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
mov edi, eax
cmp eax, 0xffffffff
je 0x64688454
mov ecx, edi
mov ebx, dword [esp + 0x1c]
xor esi, ecx
xor ebp, ebx
or esi, ebp
sete al
movzx eax, al
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x646883ef
call fcn.64685abc
mov dword [esp], eax
call sym.allegro_5.0.10_monolith_mt.dll___PHYSFS_setError
xor eax, eax
jmp 0x646883fb
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x6468841c
call fcn.64685abc
mov dword [esp], eax
call sym.allegro_5.0.10_monolith_mt.dll___PHYSFS_setError
or ecx, 0xffffffff
mov ebx, ecx
jmp 0x64688422
Function at 0x6468b374
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov dword [0x648765d4], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateSemaphoreA
sub esp, 0x10
mov dword [0x648765d8], eax
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x6468b3d4
mov dword [0x648765e0], eax
mov dword [esp + 4], 0x6468b338
mov dword [esp], eax
call fcn.647cb70c
test eax, eax
jne 0x6468b3db
add esp, 0x1c
ret
call sub.KERNEL32.dll_GetLastError
jmp 0x6468b3cc
call fcn.647d4304
Function at 0x6468b3e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov ecx, dword [0x64877b18]
test ecx, ecx
jne 0x6468b408
mov eax, dword [esi + 8]
test eax, eax
je 0x6468b518
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esi + 8]
test ebp, ebp
je 0x6468b498
mov ebx, dword [0x648765e0]
call sub.KERNEL32.dll_GetLastError
mov edi, eax
mov dword [esp], ebx
call sub.KERNEL32.dll_TlsGetValue
push ecx
mov ebx, eax
mov dword [esp], edi
call sub.KERNEL32.dll_SetLastError
push edi
test ebx, ebx
je 0x6468b458
mov edi, dword [ebx]
cmp ebp, edi
ja 0x6468b527
dec ebp
mov eax, dword [ebx + ebp*4 + 4]
test eax, eax
jne 0x6468b400
mov eax, esi
call fcn.647d68b0
mov dword [ebx + ebp*4 + 4], eax
jmp 0x6468b400
lea edi, [ebp + 0x20]
mov dword [esp + 4], 4
lea eax, [ebp + 0x21]
mov dword [esp], eax
call fcn.647d43cc
mov ebx, eax
test eax, eax
je 0x6468b5ed
mov dword [eax], edi
mov dword [esp + 4], ebx
mov eax, dword [0x648765e0]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
push edx
push edx
test eax, eax
jne 0x6468b442
call sub.KERNEL32.dll_GetLastError
jmp 0x6468b442
cmp dword [0x647dd41c], 0
je 0x6468b570
mov dword [esp], 0x648765d4
call fcn.647be90c
push edx
test eax, eax
jne 0x6468b5bc
mov ebp, dword [esi + 8]
test ebp, ebp
jne 0x6468b4d1
mov ebp, dword [0x648765dc]
inc ebp
mov dword [0x648765dc], ebp
mov dword [esi + 8], ebp
cmp dword [0x64877b18], 0
je 0x6468b413
mov dword [esp], 0x648765d4
call sub.KERNEL32.dll_InterlockedDecrement
push edx
test eax, eax
js 0x6468b413
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov eax, dword [0x648765d8]
mov dword [esp], eax
call sub.KERNEL32.dll_ReleaseSemaphore
sub esp, 0xc
jmp 0x6468b413
mov eax, esi
call fcn.647d68b0
mov dword [esi + 8], eax
jmp 0x6468b400
lea edx, [edi + edi]
cmp ebp, edx
jbe 0x6468b531
lea edx, [ebp + 0x20]
lea eax, [edx*4 + 4]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call fcn.647d43c4
mov ebx, eax
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x6468b5ed
mov dword [eax], edx
sub edx, edi
lea ecx, [edx*4]
lea edx, [eax + edi*4 + 4]
xor eax, eax
mov edi, edx
rep stosb byte es:[edi], al
jmp 0x6468b47a
mov dword [esp], 0x647dd420
call fcn.647be90c
push ebp
test eax, eax
jne 0x6468b590
jmp 0x6468b5ab
mov dword [esp], 0
call sub.KERNEL32.dll_Sleep
push edi
cmp dword [0x647dd41c], 0
je 0x6468b583
cmp dword [0x64877b18], 0
je 0x6468b4ba
jmp 0x6468b4a5
call fcn.6468b374
mov dword [0x647dd41c], 1
jmp 0x6468b599
mov dword [esp + 4], 0xffffffff
mov eax, dword [0x648765d8]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
push ebx
push ebx
test eax, eax
je 0x6468b4ba
mov dword [esp], 0x648765d4
call sub.KERNEL32.dll_InterlockedDecrement
push ecx
jmp 0x6468b4ba
call fcn.647d4304
nop
Function at 0x64698df8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x2c
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_EnterCriticalSection
push eax
mov eax, dword [0x6487661c]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
push edx
test eax, eax
je 0x64698e5f
mov dword [esp], 0x64876604
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_EnterCriticalSection
push eax
mov edx, dword [0x64876658]
test edx, edx
mov eax, dword [esp + 0x1c]
jne 0x64698e46
jmp 0x64698e78
mov edx, dword [edx + 0x88]
test edx, edx
je 0x64698e78
cmp eax, edx
jne 0x64698e3c
mov dword [esp], 0x64876604
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
mov eax, dword [esp + 0x1c]
mov dword [esp], 0x64876604
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
mov eax, dword [esp + 0x1c]
add esp, 0x2c
ret
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
mov dword [esp + 4], 0
mov eax, dword [0x6487661c]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
xor eax, eax
jmp 0x64698e5f

Function at 0x64699140
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_EnterCriticalSection
push eax
test ebx, ebx
je 0x6469918f
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_EnterCriticalSection
push eax
mov eax, dword [0x64876658]
test eax, eax
jne 0x6469917e
jmp 0x646991cc
mov eax, dword [eax + 0x88]
test eax, eax
je 0x646991cc
cmp ebx, eax
jne 0x64699174
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
mov dword [0x64876654], ebx
mov dword [esp + 4], 0
mov eax, dword [0x6487661c]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov al, 1
mov dword [esp], 0x64876604
mov byte [esp + 0x1c], al
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
mov al, byte [esp + 0x1c]
add esp, 0x28
pop ebx
ret
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_LeaveCriticalSection
push edx
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_EnterCriticalSection
push ecx
mov eax, dword [0x64876648]
test eax, eax
je 0x646991fa
nop
mov eax, dword [eax + 0x28a5c]
test eax, eax
jne 0x646991f0
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
mov dword [0x64876650], 0xa002
xor eax, eax
jmp 0x646991af
Function at 0x64699218
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_EnterCriticalSection
push eax
test ebx, ebx
je 0x64699267
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_EnterCriticalSection
push eax
mov eax, dword [0x64876658]
test eax, eax
jne 0x64699256
jmp 0x64699298
mov eax, dword [eax + 0x88]
test eax, eax
je 0x64699298
cmp ebx, eax
jne 0x6469924c
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_LeaveCriticalSection
push ecx
mov dword [esp + 4], ebx
mov eax, dword [0x6487661c]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov al, 1
mov dword [esp], 0x64876604
mov byte [esp + 0x1c], al
call sub.KERNEL32.dll_LeaveCriticalSection
push ebx
mov al, byte [esp + 0x1c]
add esp, 0x28
pop ebx
ret
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_EnterCriticalSection
push edx
mov eax, dword [0x64876648]
test eax, eax
je 0x646992c6
nop
mov eax, dword [eax + 0x28a5c]
test eax, eax
jne 0x646992bc
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
mov dword [0x64876650], 0xa002
xor eax, eax
jmp 0x6469927d

Function at 0x64699854
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x2c
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_EnterCriticalSection
push eax
mov eax, dword [0x6487661c]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
push edx
test eax, eax
je 0x64699919
mov dword [esp], 0x64876604
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_EnterCriticalSection
push eax
mov edx, dword [0x64876658]
test edx, edx
mov eax, dword [esp + 0x1c]
jne 0x646998a6
jmp 0x646998f4
mov edx, dword [edx + 0x88]
test edx, edx
je 0x646998f4
cmp eax, edx
jne 0x6469989c
mov dword [esp], 0x64876604
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_LeaveCriticalSection
push ecx
mov eax, dword [esp + 0x1c]
mov dword [esp], 0x64876604
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_EnterCriticalSection
push eax
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
mov eax, dword [esp + 0x1c]
add esp, 0x2c
ret
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
mov dword [esp + 4], 0
mov eax, dword [0x6487661c]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov eax, dword [0x64876654]
test eax, eax
jne 0x646998bf
mov dword [esp], 0x64876604
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_LeaveCriticalSection
push edx
mov eax, dword [esp + 0x1c]
add esp, 0x2c
ret
Function at 0x6469cd30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_EnterCriticalSection
push eax
mov eax, dword [0x6487661c]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
push edx
mov ebx, eax
test eax, eax
je 0x6469cdc1
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_EnterCriticalSection
push eax
mov edx, dword [0x64876658]
test edx, edx
jne 0x6469cd7a
jmp 0x6469cd9c
mov edx, dword [edx + 0x88]
test edx, edx
je 0x6469cd9c
cmp ebx, edx
jne 0x6469cd70
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_LeaveCriticalSection
push edx
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_EnterCriticalSection
push eax
jmp 0x6469cdcb
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_LeaveCriticalSection
push ecx
mov dword [esp + 4], 0
mov eax, dword [0x6487661c]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov ebx, dword [0x64876654]
test ebx, ebx
jne 0x6469cd8b
mov dword [esp], 0x64876604
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
mov eax, ebx
add esp, 0x18
pop ebx
ret
Function at 0x646a8860
Capabilities:
Get common file path

Disassembly:
push edi
push ebx
sub esp, 0x14
mov dword [esp + 4], 0xc
mov dword [esp], 1
call fcn.647d43cc
mov ebx, eax
mov dword [0x64876660], eax
mov dword [esp], str.general
call fcn.647cc1e0
mov dword [ebx], eax
mov dword [0x64876664], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1a
mov dword [esp + 4], 0x64876680
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetSpecialFolderPathA
sub esp, 0x10
test eax, eax
jne 0x646a8908
mov dword [esp], str.ALSOFT_CONF
call fcn.647d4314
test eax, eax
je 0x646a8902
mov dword [esp], str.ALSOFT_CONF
call fcn.647d4314
mov dword [esp + 4], 0x648031a6
mov dword [esp], eax
call fcn.647d431c
mov ebx, eax
test eax, eax
je 0x646a8902
call fcn.646a8288
mov dword [esp], ebx
call fcn.647d4324
add esp, 0x14
pop ebx
pop edi
ret
mov edi, 0x64876680
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 8], str._alsoft.ini
mov eax, 0x400
sub eax, ecx
mov dword [esp + 4], eax
add ecx, 0x64876680
mov dword [esp], ecx
call fcn.647cc834
mov dword [esp + 4], 0x64803197
mov dword [esp], 0x64876680
call fcn.647d431c
mov ebx, eax
test eax, eax
je 0x646a88c3
call fcn.646a8288
mov dword [esp], ebx
call fcn.647d4324
jmp 0x646a88c3
Function at 0x64709a98
Capabilities:
Create thread

Disassembly:
push ebx
sub esp, 0x38
mov dword [esp], 0xc
call fcn.647d4284
mov ebx, eax
test eax, eax
je 0x64709af5
mov eax, dword [esp + 0x40]
mov dword [ebx], eax
mov eax, dword [esp + 0x44]
mov dword [ebx + 4], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x64709a80
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [ebx + 8], eax
test eax, eax
je 0x64709afc
mov eax, ebx
add esp, 0x38
pop ebx
ret
mov dword [esp], ebx
call fcn.647d4274
xor ebx, ebx
jmp 0x64709af5
Function at 0x647103f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
test ebx, ebx
je 0x6471041e
mov dl, byte [ecx]
add ebx, eax
lea esi, [esi]
xor dl, byte [eax]
movzx edx, dl
mov dl, byte [edx + sym.allegro_5.0.10_monolith_mt.dll_FLAC__crc8_table]
mov byte [ecx], dl
inc eax
cmp eax, ebx
jne 0x6471040c
pop ebx
ret

Function at 0x64710420
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x64710441
add ecx, edx
xor eax, eax
xor al, byte [edx]
movzx eax, al
mov al, byte [eax + sym.allegro_5.0.10_monolith_mt.dll_FLAC__crc8_table]
inc edx
cmp edx, ecx
jne 0x64710430
ret
xor eax, eax
ret

Function at 0x64710444
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
test esi, esi
je 0x64710479
add esi, edx
xor eax, eax
nop
movzx ecx, byte [edx]
mov ebx, eax
shr ebx, 8
xor ecx, ebx
shl eax, 8
xor eax, dword [ecx*4 + sym.allegro_5.0.10_monolith_mt.dll_FLAC__crc16_table]
and eax, 0xffff
inc edx
cmp edx, esi
jne 0x64710458
pop ebx
pop esi
ret
xor eax, eax
jmp 0x64710476

Function at 0x64711010
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
push ecx
mov esi, dword [esp + 0x18]
mov ebp, dword [esi + 0x14]
test ebp, ebp
je 0x64711078
mov edx, dword [esi + 0x10]
mov eax, dword [esi]
mov eax, dword [eax + edx*4]
mov dword [esp], eax
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
cmp ebp, edx
jbe 0x64711070
mov ecx, 0x18
sub ecx, edx
mov edi, eax
shl edi, 8
and edi, 0xffff
mov ebx, dword [esp]
shr ebx, cl
and ebx, 0xff
shr eax, 8
xor ebx, eax
mov eax, dword [ebx*4 + sym.allegro_5.0.10_monolith_mt.dll_FLAC__crc16_table]
xor eax, edi
mov dword [esi + 0x18], eax
add edx, 8
mov dword [esi + 0x1c], edx
sub ecx, 8
cmp ebp, edx
ja 0x6471103c
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6471afc8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
call sym.allegro_5.0.10_monolith_mt.dll_ov_pcm_seek_page
test eax, eax
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
js 0x6471b09c
cmp dword [ebx + 0x58], 3
jg 0x6471b086
jne 0x6471b094
mov eax, dword [ebx + 4]
test eax, eax
jne 0x6471b0a4
mov eax, dword [ebx + 0x48]
mov dword [esp + 4], eax
lea esi, [ebx + 0x1e0]
mov dword [esp], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
call sym.allegro_5.0.10_monolith_mt.dll_vorbis_synthesis_init
test eax, eax
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
jne 0x6471b0c0
lea eax, [ebx + 0x250]
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
call sym.allegro_5.0.10_monolith_mt.dll_vorbis_block_init
mov dword [ebx + 0x58], 4
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x74], 0
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
jmp fcn.64718c98
mov eax, 0xffffff7f
lea esi, [esi]
add esp, 0x24
pop ebx
pop esi
ret
mov eax, dword [ebx + 0x60]
shl eax, 5
add eax, dword [ebx + 0x48]
mov dword [esp + 4], eax
lea esi, [ebx + 0x1e0]
mov dword [esp], esi
jmp 0x6471b030
mov eax, 0xffffff77
jmp 0x6471b09c
Function at 0x6471b0c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebp, dword [esp + 0x50]
fld qword [esp + 0x54]
cmp dword [ebp + 0x58], 1
jle 0x6471b17f
mov eax, dword [ebp + 4]
test eax, eax
je 0x6471b20e
fldz
fld st(0)
fucomp st(2)
fnstsw ax
test ah, 0x45
je 0x6471b183
mov edx, dword [ebp + 0x34]
mov dword [esp + 0x10], edx
cmp edx, 0
jle 0x6471b1f5
mov esi, 8
xor ecx, ecx
xor ebx, ebx
xor edx, edx
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp + 8], esi
mov dword [esp + 0x20], ebp
nop
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 8]
mov edi, dword [eax + esi]
mov ebp, dword [eax + esi + 4]
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebp
fild qword [esp + 0x28]
mov esi, edx
shl esi, 5
mov eax, dword [esp + 0x14]
fidiv dword [eax + esi + 8]
fadd st(1)
fucom st(2)
fnstsw ax
test ah, 0x45
je 0x6471b1a0
fstp st(1)
add ecx, edi
adc ebx, ebp
inc edx
add dword [esp + 8], 0x10
cmp edx, dword [esp + 0x10]
jne 0x6471b130
fstp st(0)
fstp st(0)
jmp 0x6471b190
fstp st(0)
jmp 0x6471b190
fstp st(0)
fstp st(0)
jmp 0x6471b190
fstp st(0)
fstp st(0)
lea esi, [esi]
mov eax, 0xffffff7d
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
fstp st(0)
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ebx
fild qword [esp + 0x28]
fxch st(1)
fsubp st(2)
fxch st(1)
mov eax, dword [esp + 0x18]
shl eax, 5
fimul dword [esi + eax + 8]
faddp st(1)
fnstcw word [esp + 0x26]
mov ax, word [esp + 0x26]
mov ah, 0xc
mov word [esp + 0x24], ax
fldcw word [esp + 0x24]
fistp qword [esp + 0x54]
fldcw word [esp + 0x26]
mov dword [esp + 0x50], ebp
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp sym.allegro_5.0.10_monolith_mt.dll_ov_pcm_seek_page
je 0x6471b189
mov dword [esp + 0x18], 0
xor ecx, ecx
xor ebx, ebx
mov edx, dword [ebp + 0x48]
mov dword [esp + 0x14], edx
mov esi, edx
jmp 0x6471b1aa
fstp st(0)
mov eax, 0xffffff76
jmp 0x6471b195
Function at 0x64727588
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edx, dword [esp + 0x54]
mov eax, dword [edx + 0x1c]
mov edx, dword [edx + 4]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x50]
mov dword [edx + 4], pe_nt_image_headers32
mov dword [edx + 8], 0x40
fld dword [eax + 0xb74]
fstp dword [edx + 0xc]
mov ecx, dword [esp + 0x24]
mov dword [edx], ecx
mov dword [edx + 0xa4], pe_nt_image_headers32
mov eax, dword [eax + 4]
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov edx, dword [esp + 0x50]
mov dword [edx + 0xb0], eax
mov dword [esp + 4], 4
mov dword [esp], pe_nt_image_headers32
call fcn.647d43cc
mov ecx, dword [esp + 0x50]
mov dword [ecx + 0x24], eax
mov dword [esp + 4], pe_nt_image_headers32
mov eax, ecx
add eax, 0x10
mov dword [esp], eax
call sym.allegro_5.0.10_monolith_mt.dll_mdct_init
mov edx, dword [esp + 0x50]
mov esi, dword [edx + 0x24]
fldz
xor ebx, ebx
jmp 0x64727635
fld dword [0x6480b4d8]
push ebx
fidivr dword [esp]
pop eax
fmul qword [0x6480b4e0]
fstp qword [esp]
call fcn.647d447c
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fmul st(0)
fstp dword [esi + ebx*4]
inc ebx
cmp ebx, 0x80
jne 0x6472761c
mov ecx, dword [esp + 0x50]
mov dword [ecx + 0x28], 2
mov dword [ecx + 0x2c], 4
mov dword [ecx + 0x38], 4
mov dword [ecx + 0x3c], 5
mov dword [ecx + 0x48], 6
mov dword [ecx + 0x4c], 6
mov dword [ecx + 0x58], 9
mov dword [ecx + 0x5c], 8
mov dword [ecx + 0x68], 0xd
mov dword [ecx + 0x6c], 8
mov dword [ecx + 0x78], 0x11
mov dword [ecx + 0x7c], 8
mov dword [ecx + 0x88], 0x16
mov dword [ecx + 0x8c], 8
mov ebp, ecx
mov dword [esp + 0x20], 7
lea esi, [esi]
mov ebx, dword [ebp + 0x2c]
lea eax, [ebx*4]
mov dword [esp], eax
call fcn.647d4284
mov esi, eax
mov dword [ebp + 0x30], eax
test ebx, ebx
jle 0x64727788
mov dword [esp + 0x28], ebx
fild dword [esp + 0x28]
fstp qword [esp + 0x18]
xor edi, edi
jmp 0x647276f6
fstp st(0)
fld qword [0x6480b4f0]
push edi
fiadd dword [esp]
pop eax
fdiv qword [esp + 0x18]
fmul qword [0x6480b4e0]
fstp qword [esp]
call fcn.647d447c
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fst dword [esi + edi*4]
fadd dword [ebp + 0x34]
fst dword [ebp + 0x34]
inc edi
cmp edi, ebx
jne 0x647276f4
fdivr dword [0x6480b4e8]
fstp dword [ebp + 0x34]
add ebp, 0x10
dec dword [esp + 0x20]
jne 0x647276c4
mov dword [esp + 4], 0x90
mov eax, dword [esp + 0x24]
shl eax, 3
sub eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.647d43cc
mov edx, dword [esp + 0x50]
mov dword [edx + 0x98], eax
mov dword [esp + 4], 4
mov eax, dword [edx + 0xa4]
mov dword [esp], eax
call fcn.647d43cc
mov ecx, dword [esp + 0x50]
mov dword [ecx + 0xa0], eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
fld dword [ebp + 0x34]
jmp 0x64727729