joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423ac0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4b1240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, 0xf
cmp byte [0x4b553e], bl
je 0x423b3f
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x208], esp
mov byte [0x4b553e], bl
push 9
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push str.bird_idle
mov byte [ecx], bl
call fcn.00414ba0
mov ecx, dword [0x4b290c]
call fcn.004019c0
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x208], esp
push 9
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push str.bird_idle
mov byte [ecx], bl
call fcn.00414ba0
mov ecx, dword [0x4b290c]
call fcn.00402010
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x208], esp
mov byte [0x4b553c], 1
push 0xb
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push str.bird_attack
mov byte [ecx], bl
call fcn.00414ba0
mov ecx, dword [0x4b290c]
call fcn.004018e0
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x208], esp
mov byte [0x4b5534], 1
push 5
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push str.Spark
mov byte [ecx], bl
call fcn.00414ba0
mov ecx, dword [0x4b290c]
call fcn.004018e0
mov eax, dword [0x4b5560]
fld dword [eax*8 + 0x4b0e30]
sub esp, 0x24
fstp dword [esp + 0x20]
mov ecx, esp
fld dword [eax*8 + 0x4b0e2c]
mov dword [ebp - 0x208], esp
fstp dword [esp + 0x1c]
push 5
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push str.Spark
mov byte [ecx], bl
call fcn.00414ba0
mov ecx, dword [0x4b290c]
call fcn.00401d70
fld dword [0x498c88]
sub esp, 0x24
fstp dword [esp + 0x20]
mov ecx, esp
fld1
mov dword [ebp - 0x208], esp
fstp dword [esp + 0x1c]
mov dword [ecx + 0x14], esi
push 5
mov dword [ecx + 0x10], ebx
push str.Spark
mov byte [ecx], bl
call fcn.00414ba0
mov ecx, dword [0x4b290c]
call fcn.00401e50
push ebx
push 1
push 0x36
call fcn.00409510
add esp, 0xc
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x208], esp
mov byte [0x4b553d], 1
push esi
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push str.bird_attack_eff
mov byte [ecx], bl
call fcn.00414ba0
mov ecx, dword [0x4b290c]
call fcn.004018e0
lea eax, [ebp - 0x204]
push str.Spark__bird_attack_eff__n
push eax
call fcn.00409550
add esp, 8
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [0x4b5978]
push 0x498
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00463931
mov esp, ebp
pop ebp
ret
Function at 0x423cb0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4b1240]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x408], esp
push 7
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.Thunder
mov byte [ecx], 0
call fcn.00414ba0
mov ecx, dword [0x4b290c]
call fcn.00402870
lea eax, [ebp - 0x404]
push str.DatamoviesThunder.bik
push eax
call fcn.00409550
lea ecx, [ebp - 0x404]
push 0x497e88
push ecx
call fcn.004644f9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x423d4b
push 0
push 0x3a1be
push esi
call fcn.00464bad
push esi
push 1
push 0x308
push 0x4b2910
call fcn.00464d80
push esi
call fcn.004643ac
add esp, 0x20
lea edx, [ebp - 0x104]
push edx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x204]
push 0x49864c
push eax
call fcn.00463940
lea eax, [ebp - 0x204]
add esp, 8
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423d80
lea edi, [ebp - 0x104]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x423d90
fld1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ecx
lea ecx, [ebp - 0x104]
fst dword [esp]
push 1
sub esp, 0x10
fst dword [esp + 0xc]
fstp dword [esp + 8]
fldz
fst dword [esp + 4]
fstp dword [esp]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x408], esp
push 7
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.Thunder
mov byte [ecx], 0
call fcn.00414ba0
mov ecx, dword [0x4b290c]
call fcn.00402ce0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00463931
mov esp, ebp
pop ebp
ret
Function at 0x424150
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4b1240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x408], esp
xor ebx, ebx
push 7
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push str.Thunder
mov byte [ecx], bl
call fcn.00414ba0
mov ecx, dword [0x4b290c]
call fcn.00402870
lea eax, [ebp - 0x404]
push str.DatamoviesThunder.bik
push eax
call fcn.00409550
lea ecx, [ebp - 0x404]
push 0x497df4
push ecx
call fcn.004644f9
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x424251
push 2
push ebx
push esi
call fcn.00464bad
push esi
call fcn.00464abe
add esp, 0x10
cmp eax, 0x399c8
jle 0x42423c
push ebx
push 0x3aaa0
push esi
call fcn.00464bad
push esi
push 1
push 4
push 0x4b2c50
call fcn.0046490d
mov eax, dword [0x4b2c50]
inc eax
add esp, 0x1c
mov dword [0x4b2c50], eax
cmp eax, ebx
jle 0x42423c
xor ecx, ecx
mov edx, 0x14
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00462b8e
mov ebx, eax
mov eax, dword [0x4b2c50]
lea eax, [eax + eax*4]
push esi
add eax, eax
push 1
add eax, eax
push eax
push ebx
call fcn.0046490d
add esp, 0x14
push esi
call fcn.004643ac
lea ecx, [ebp - 0x404]
push ecx
call fcn.00408e60
add esp, 8
lea edx, [ebp - 0x104]
push edx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x204]
push 0x49864c
push eax
call fcn.00463940
lea eax, [ebp - 0x204]
add esp, 8
mov esi, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424280
lea edi, [ebp - 0x104]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x424290
fld1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ecx
lea ecx, [ebp - 0x104]
fst dword [esp]
push 1
sub esp, 0x10
fst dword [esp + 0xc]
fstp dword [esp + 8]
fldz
fst dword [esp + 4]
fstp dword [esp]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x408], esp
push 7
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.Thunder
mov byte [ecx], 0
call fcn.00414ba0
mov ecx, dword [0x4b290c]
call fcn.00402ce0
test ebx, ebx
je 0x424309
push ebx
call fcn.00464dfa
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00463931
mov esp, ebp
pop ebp
ret
Function at 0x424320
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4b1240]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x414]
movzx edx, word [ebp - 0x40e]
mov ax, word [ebp - 0x40c]
mov word [0x4b2890], cx
movzx ecx, word [ebp - 0x40a]
mov word [0x4b2896], cx
mov cl, byte [0x4b57e4]
mov word [0x4b2892], dx
movzx edx, word [ebp - 0x408]
sub esp, 0x1c
mov word [0x4b2894], ax
mov al, byte [0x4b55ac]
mov byte [0x4b28a2], cl
mov ecx, esp
mov dword [ebp - 0x418], esp
mov word [0x4b2898], dx
mov byte [0x4b289b], al
push 7
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.Thunder
mov byte [ecx], 0
call fcn.00414ba0
mov ecx, dword [0x4b290c]
call fcn.00402870
lea edx, [ebp - 0x404]
push str.DatamoviesThunder.bik
push edx
call fcn.00409550
lea eax, [ebp - 0x404]
push 0x497e88
push eax
call fcn.004644f9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x424490
push 2
push 0
push esi
call fcn.00464bad
push esi
call fcn.00464abe
add esp, 0x10
cmp eax, 0x399c8
jle 0x42447b
push 0
push 0x3aaa0
push esi
call fcn.00464bad
push esi
push 1
push 4
push 0x4b2c50
call fcn.00464d80
mov eax, dword [0x4b2c50]
lea ecx, [eax + eax*4]
push 0
lea edx, [ecx*4 + 0x3aaa4]
push edx
push esi
call fcn.00464bad
push esi
push 1
push 0x14
push 0x4b2890
call fcn.00464d80
mov eax, dword [0x4b2c50]
inc eax
add esp, 0x38
mov dword [0x4b2c50], eax
cmp eax, 0x2710
jle 0x42447b
mov dword [0x4b2c50], 0
push esi
call fcn.004643ac
lea eax, [ebp - 0x404]
push eax
call fcn.00408e60
add esp, 8
lea ecx, [ebp - 0x104]
push ecx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [ebp - 0x204]
push 0x49864c
push edx
call fcn.00463940
lea eax, [ebp - 0x204]
add esp, 8
mov esi, eax
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4244c0
lea edi, [ebp - 0x104]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4244d0
fld1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ecx
lea eax, [ebp - 0x104]
fst dword [esp]
push 1
sub esp, 0x10
fst dword [esp + 0xc]
fstp dword [esp + 8]
fldz
fst dword [esp + 4]
fstp dword [esp]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x418], esp
push 7
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.Thunder
mov byte [ecx], 0
call fcn.00414ba0
mov ecx, dword [0x4b290c]
call fcn.00402ce0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00463931
mov esp, ebp
pop ebp
ret
Function at 0x42ab20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4b1240]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4a854c]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_KillTimer]
cmp dword [0x4a8548], eax
jg 0x42ab5f
mov ecx, dword [0x4a8550]
cmp ecx, dword [0x4a8554]
jl 0x42ab5f
cmp dword [0x4b5594], 1
jge 0x42ab64
cmp eax, 0x64
jl 0x42abde
call fcn.00463f1c
mov edx, dword [0x4b5978]
mov dword [ebp - 0x208], eax
fild dword [ebp - 0x208]
push 0x4a4
fnstcw word [ebp - 0x206]
push edx
movzx eax, word [ebp - 0x206]
fmul qword [0x498850]
or eax, 0xc00
mov dword [ebp - 0x20c], eax
fmul qword [0x497ab8]
fldcw word [ebp - 0x20c]
fistp qword [ebp - 0x210]
mov esi, dword [ebp - 0x210]
add esi, 0xa
fldcw word [ebp - 0x206]
imul esi, esi, 0x64
call edi
mov eax, dword [0x4b5978]
push 0
push esi
push 0x4a4
push eax
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x42acca
cmp byte [0x4b558b], 0
je 0x42acca
cmp dword [0x4a8560], 0
jg 0x42acca
call fcn.00463f1c
fnstcw word [ebp - 0x206]
mov dword [ebp - 0x20c], eax
fild dword [ebp - 0x20c]
movzx eax, word [ebp - 0x206]
or eax, 0xc00
mov dword [ebp - 0x20c], eax
fmul qword [0x497a98]
mov byte [0x4b558b], 0
fmul qword [0x497ab8]
fldcw word [ebp - 0x20c]
fistp qword [ebp - 0x210]
mov ecx, dword [ebp - 0x210]
add ecx, 5
cmp byte [0x4b5530], 0
fldcw word [ebp - 0x206]
mov dword [0x4a8560], ecx
jne 0x42acca
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x20c], esp
push str.poseidon_in
mov byte [0x4b5530], 1
call fcn.004154c0
mov ecx, dword [0x4b290c]
call fcn.004018e0
mov edx, dword [0x4a8548]
mov eax, dword [0x4a854c]
mov ecx, dword [0x4a8554]
push edx
mov edx, dword [0x4a8550]
push eax
push ecx
push edx
lea eax, [ebp - 0x204]
push str.poseidon_in:__d__d___d__d__n
push eax
mov byte [0x4b5564], 0
call fcn.00409550
add esp, 0x18
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [0x4b5978]
push 0x49e
push edx
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00463931
mov esp, ebp
pop ebp
ret
Function at 0x42acf0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4b1240]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4b5539], 0
push esi
push edi
jne 0x42ae20
mov byte [0x4b5539], 1
call fcn.00463f1c
mov dword [ebp - 0x208], eax
fild dword [ebp - 0x208]
fnstcw word [ebp - 0x206]
movzx eax, word [ebp - 0x206]
fmul qword [0x497ad8]
or eax, 0xc00
mov dword [ebp - 0x20c], eax
fmul qword [0x497ab8]
fldcw word [ebp - 0x20c]
fistp qword [ebp - 0x210]
mov esi, dword [ebp - 0x210]
inc esi
push esi
fldcw word [ebp - 0x206]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x20c], esp
push 9
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.lightning
mov byte [ecx], 0
call fcn.00414ba0
mov ecx, dword [0x4b290c]
call fcn.004018e0
cmp byte [0x4b27d8], 0
mov edi, dword [sym.imp.USER32.dll_KillTimer]
jne 0x42adde
push 0
push 1
push 0x28
call fcn.00409510
mov eax, dword [0x4b5978]
add esp, 0xc
push 0x4ad
push eax
call edi
mov ecx, dword [0x4b5978]
push 0
push 0xbb8
push 0x4ad
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
push 1
push 1
push 0x29
call fcn.00409510
mov edx, dword [0x4b576c]
push esi
push edx
lea eax, [ebp - 0x204]
push str.lightning__d_:_d_times_n
push eax
call fcn.00409550
add esp, 0x1c
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [0x4b5978]
push 0x4a3
push edx
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00463931
mov esp, ebp
pop ebp
ret
Function at 0x42fe60
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4b1240]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x404]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push str.pgo.dat
push 0x497c30
lea ecx, [ebp - 0x404]
push ecx
lea edx, [ebp - 0x204]
push str._s_s_s
push edx
call fcn.00409550
mov edx, dword [0x4b2c6c]
mov dword [0x4b28b0], edx
mov edx, dword [0x4b2c5c]
mov dword [0x4b28bc], edx
mov edx, dword [0x4b2c70]
mov dword [0x4b28c0], edx
mov edx, dword [0x4b2c74]
mov dword [0x4b28c4], edx
mov edx, dword [0x4b2c60]
mov dword [0x4b28d0], edx
mov edx, dword [0x4b2c64]
mov dword [0x4b28d4], edx
mov edx, dword [0x4b2c58]
mov dword [0x4b28d8], edx
mov edx, dword [0x4b2c54]
mov dword [0x4b28dc], edx
mov edx, dword [0x4b2c80]
mov dword [0x4b28e0], edx
mov edx, dword [0x4b2c84]
mov dword [0x4b28e4], edx
mov edx, dword [0x4b2c78]
mov dword [0x4b28c8], edx
mov edx, dword [0x4b2c7c]
mov dword [0x4b28cc], edx
mov edx, dword [0x4a8578]
mov dword [0x4b28b4], edx
mov edx, dword [0x4a857c]
mov cx, word [0x4a86a8]
mov ax, word [0x4b571c]
mov dword [0x4b28b8], edx
mov edx, dword [0x4b56b0]
mov dword [0x4b28e8], edx
movzx edx, byte [0x4b571e]
mov byte [0x4b28ec], dl
mov edx, dword [str.111111]
mov dword [0x4b28ed], edx
mov dx, word [0x4a86b4]
mov word [0x4b28f1], dx
movzx edx, byte [0x4a8699]
mov byte [0x4b28f3], dl
mov edx, dword [0x4b57e4]
mov dword [0x4b28f4], edx
movzx edx, byte [0x4a880c]
mov word [0x4b28aa], cx
mov byte [0x4b28f8], dl
movzx edx, byte [0x4a869a]
mov word [0x4b28a8], ax
mov eax, dword [0x4a86ac]
movzx ecx, cx
add esp, 0x14
mov dword [0x4b28ac], eax
mov byte [0x4b28f9], dl
mov dword [0x4b2a14], ecx
cmp eax, 0x32
jle 0x42fff1
mov dword [0x4b2a18], eax
jmp 0x42fffe
mov edx, dword [eax*4 + 0x4b2a1c]
mov dword [0x4b2a18], edx
fild dword [0x4b2c8c]
push esi
fdiv qword [0x481600]
fstp dword [0x4b2a1c]
call fcn.00423cb0
cmp byte [ebp + 8], 0
je 0x430063
lea eax, [ebp - 0x204]
push 0x49af70
push eax
call fcn.004644f9
mov esi, eax
add esp, 8
test esi, esi
je 0x430095
push esi
push 1
push 0x54
push 0x4b28a8
call fcn.00464d80
push esi
call fcn.004640c7
push esi
call fcn.004643ac
add esp, 0x18
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00463931
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x204]
push 0x497e88
push ecx
call fcn.004644f9
mov esi, eax
add esp, 8
test esi, esi
je 0x430095
push esi
push 1
push 0x54
push 0x4b28a8
call fcn.00464d80
push esi
call fcn.004643ac
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00463931
mov esp, ebp
pop ebp
ret
Function at 0x431dc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4b1240]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4a8784]
dec eax
mov dword [0x4a8784], eax
test eax, eax
jle 0x431e70
cmp eax, 1
jg 0x431fd2
push 1
push 1
push 0x3e
call fcn.00409510
mov al, byte [0x4a86ac]
mov byte [0x4b289f], al
mov cl, byte [0x4a86a8]
mov eax, 0x51eb851f
imul dword [0x4b2c8c]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov word [0x4b28a0], ax
mov eax, 0x51eb851f
imul dword [0x4a8570]
mov byte [0x4b289e], cl
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add esp, 0xc
mov byte [0x4b289a], 0
mov word [0x4b289c], cx
call fcn.00424320
mov edx, dword [0x4b2c6c]
mov dword [0x4b57a0], edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00463931
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4a8788]
sub dword [0x4a8570], eax
jns 0x431fb0
mov eax, dword [0x4b5978]
push esi
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 0x481
push eax
mov dword [0x4a8570], 0
call esi
mov ecx, dword [0x4a8570]
push ecx
push 0
call fcn.00411800
push 0
push 0
push 0x3e
mov dword [0x4b2c68], 0
call fcn.00409510
mov edx, dword [0x4b5978]
add esp, 0x14
push 0x465
push edx
call esi
mov eax, dword [0x4b5978]
push 0
push 0x7d0
push 0x465
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [0x4b61f8]
pop esi
cmp eax, dword [0x4b61fc]
je 0x431f3b
cmp dword [eax + 4], 3
jne 0x431f3b
mov eax, dword [0x4c56b8]
cmp eax, dword [0x4c56bc]
je 0x431f3b
cmp byte [eax], 0
je 0x431f3b
movzx ecx, word [0x4b289c]
imul ecx, ecx, 0xffffff9c
add dword [eax + 4], ecx
mov eax, dword [0x4c56b8]
cmp dword [eax + 4], 0
jg 0x431f3b
push eax
lea edx, [ebp - 0x208]
push edx
mov ecx, 0x4c56b8
call fcn.00415540
push 1
mov byte [0x4b5796], 1
call fcn.00417e20
movzx eax, byte [0x4b5796]
push eax
lea ecx, [ebp - 0x204]
push str._MultiplewinToBank__g_bWinOutDone:__d_n
push ecx
call fcn.00409550
add esp, 0x10
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x4b57a0]
push eax
mov dword [0x4b2c6c], eax
call fcn.0040bb70
movzx eax, word [0x4b289c]
imul eax, eax, 0x64
add dword [0x4b2c70], eax
add dword [0x4b2c74], eax
push 0
call fcn.0042fe60
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00463931
mov esp, ebp
pop ebp
ret
add dword [0x4b57a0], eax
mov eax, dword [0x4a8570]
push eax
push 1
call fcn.00411800
mov ecx, dword [0x4b57a0]
push ecx
call fcn.0040bb70
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00463931
mov esp, ebp
pop ebp
ret
Function at 0x44d220
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d088
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x4b1240]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x13c], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x138], 1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x103
lea eax, [ebp - 0x113]
push ebx
push eax
mov byte [ebp - 0x114], bl
call fcn.004639d0
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
dec eax
cmp eax, 0x103
ja 0x44d3db
lea esi, [ebp - 0x114]
mov dword [ebp - 0x134], esi
cmp byte [ebp - 0x114], bl
je 0x44d3db
jmp 0x44d2d6
mov esi, dword [ebp - 0x134]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x44d3ba
mov eax, esi
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], ebx
mov byte [ebp - 0x130], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44d302
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x130]
call fcn.00414ba0
lea edx, [ebp - 0x130]
push edx
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.0044cff0
cmp dword [ebp - 0x11c], 0x10
mov byte [ebp - 4], 0
jb 0x44d349
mov eax, dword [ebp - 0x130]
push eax
call fcn.00462d9e
add esp, 4
mov ebx, dword [edi]
mov ecx, dword [edi + 4]
sub ecx, ebx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea edx, [edx + ecx - 1]
lea esi, [edx*8]
sub esi, edx
push 2
add esi, esi
push 0
lea edx, [ebp - 0x130]
add esi, esi
lea ecx, [esi + ebx]
push edx
call fcn.00415500
mov ecx, dword [edi]
add ecx, esi
push eax
mov dword [ebp - 4], 2
call fcn.004020f0
cmp dword [ebp - 0x11c], 0x10
mov byte [ebp - 4], 0
jb 0x44d3b2
mov eax, dword [ebp - 0x130]
push eax
call fcn.00462d9e
add esp, 4
mov esi, dword [ebp - 0x134]
xor ebx, ebx
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44d3c0
sub eax, edx
lea eax, [esi + eax + 1]
mov dword [ebp - 0x134], eax
cmp byte [eax], cl
jne 0x44d2d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00463931
mov esp, ebp
pop ebp
ret
Function at 0x45d540
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x45d58e
mov eax, dword [esi + 4]
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, dword [esi]
push 0x2328
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x45d57b
mov edx, dword [esi]
push 0x8ae
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 8]
push ecx
call edi
pop edi
mov dword [esi], 0
pop esi
ret

Function at 0x45e2c0
Capabilities:
Create thread
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
push 0
jne 0x45e316
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x45de40
push 0
push 0
call fcn.00465429
mov ecx, dword [esi + 8]
add esp, 0x18
push 0x1388
push ecx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x45e324
push str.Error_starting_SplashThread_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop esi
ret
mov edx, dword [esi + 4]
push 2
push 6
push edx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
pop esi
ret