joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4063da
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
xor eax, eax
xor ecx, ecx
inc eax
push edi
push 0x20
or dword [esi + 0x90], 0xffffffff
or dword [esi + 0x94], 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
pop ebx
cmp eax, ebx
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], ecx
cmova eax, ebx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x70], ecx
mov dword [esi + 0x88], ecx
mov dword [esi + 0x68], ecx
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], ecx
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], ecx
mov dword [esi + 0x58], ecx
cmp eax, dword [esi + 0x20]
je 0x40647f
lea edi, [esi + 0xc8]
cmp dword [edi + 8], ecx
je 0x406460
mov ecx, edi
call fcn.00405314
xor ecx, ecx
add edi, 0x28
sub ebx, 1
jne 0x406452
cmp dword [esi + 0x5c], ebx
je 0x40647a
mov eax, dword [esi + 0x14]
push dword [esi + 0x5c]
push eax
call dword [eax + 4]
and dword [esi + 0x5c], ebx
mov eax, dword [esi]
mov dword [esi + 0x20], eax
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.00405223
mov ecx, dword [esi + 0x58]
and dword [esi + 0x24], 0
and dword [esi + 0x28], 0
lea eax, [ecx + 5]
imul ebx, eax, 0x28
lea eax, [ecx + 1]
mov dword [esi + 0x58], eax
add ebx, esi
mov ecx, ebx
call fcn.004052c9
mov edi, eax
test edi, edi
jne 0x4064e6
lea ecx, [ebx + 0x20]
call fcn.004065de
mov edi, eax
test edi, edi
jne 0x4064e6
lea ecx, [ebx + 0x1c]
call fcn.004065de
mov edi, eax
test edi, edi
jne 0x4064e6
push ebx
call fcn.00406167
mov edi, eax
test edi, edi
je 0x4064e6
and dword [esi + 0x44], 0
mov ecx, esi
call fcn.0040536f
mov ecx, edi
call fcn.00405215
test eax, eax
je 0x4064f4
mov dword [esi + 0x40], eax
cmp dword [esi + 0x38], 0
jne 0x40650a
cmp dword [esi + 0x40], 0
jne 0x40650a
cmp dword [esi + 0x3c], 0
jne 0x40650a
and dword [esi + 0x44], 0
xor ecx, ecx
cmp dword [esi + 0x44], ecx
pop edi
pop esi
cmovne eax, ecx
pop ebx
ret
Function at 0x41b4b3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd4
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x34], ebx
mov ecx, dword [ebx + 0x1c]
mov edi, dword [ebx]
call fcn.0041c4dc
test eax, eax
jne 0x41c097
xor esi, esi
inc eax
mov dword [esp + 0xbc], eax

Function at 0x41b51b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.0041b378
mov ecx, eax
mov dword [esp + 0x44], esi
mov eax, dword [edi + 0x70]
xorps xmm0, xmm0
mov dword [esp + 0xc], ecx
Function at 0x41c362
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
xor eax, eax
xor ecx, ecx
inc eax
push edi
push 0x20
or dword [esi + 0x90], 0xffffffff
or dword [esi + 0x94], 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
pop ebx
cmp eax, ebx
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], ecx
cmova eax, ebx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x70], ecx
mov dword [esi + 0x88], ecx
mov dword [esi + 0x68], ecx
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], ecx
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], ecx
mov dword [esi + 0x58], ecx
cmp eax, dword [esi + 0x20]
je 0x41c407
lea edi, [esi + 0xc8]
cmp dword [edi + 8], ecx
je 0x41c3e8
mov ecx, edi
call fcn.0041b29c
xor ecx, ecx
add edi, 0x28
sub ebx, 1
jne 0x41c3da
cmp dword [esi + 0x5c], ebx
je 0x41c402
mov eax, dword [esi + 0x14]
push dword [esi + 0x5c]
push eax
call dword [eax + 4]
and dword [esi + 0x5c], ebx
mov eax, dword [esi]
mov dword [esi + 0x20], eax
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.0041b1ab
mov ecx, dword [esi + 0x58]
and dword [esi + 0x24], 0
and dword [esi + 0x28], 0
lea eax, [ecx + 5]
imul ebx, eax, 0x28
lea eax, [ecx + 1]
mov dword [esi + 0x58], eax
add ebx, esi
mov ecx, ebx
call fcn.0041b251
mov edi, eax
test edi, edi
jne 0x41c46e
lea ecx, [ebx + 0x20]
call fcn.0041c566
mov edi, eax
test edi, edi
jne 0x41c46e
lea ecx, [ebx + 0x1c]
call fcn.0041c566
mov edi, eax
test edi, edi
jne 0x41c46e
push ebx
call fcn.0041c0ef
mov edi, eax
test edi, edi
je 0x41c46e
and dword [esi + 0x44], 0
mov ecx, esi
call fcn.0041b2f7
mov ecx, edi
call fcn.0041b19d
test eax, eax
je 0x41c47c
mov dword [esi + 0x40], eax
cmp dword [esi + 0x38], 0
jne 0x41c492
cmp dword [esi + 0x40], 0
jne 0x41c492
cmp dword [esi + 0x3c], 0
jne 0x41c492
and dword [esi + 0x44], 0
xor ecx, ecx
cmp dword [esi + 0x44], ecx
pop edi
pop esi
cmovne eax, ecx
pop ebx
ret

Function at 0x13b946c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x13b9476
pushal
call 0x13b947c
pop ebp
sub ebp, 0x10
sub ebp, 0x3b946c
jmp 0x13b9492
mov eax, 0x3b946c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5da
mov edx, 0xae2ef931
xor byte [eax], dl
inc eax
dec ecx
jne 0x13b94a9
jmp 0x13b94bc
mov edx, 0xdb8bafc
xor dword [ecx], esi
xor dword [eax + 0x3131c9f0], esi
xor dword [edx], esi
cld
mov dword [ecx + esi], esi
xor dword [ecx], esi
mov ebx, dword [ecx]
xor dword [ecx], esi
xor esi, eax
sal dword [edx], cl
stc
mov edx, 0x31313db0
xor dword [edx], esi
hlt
Function at 0xa7d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a7d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa7d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa7d06a
add dl, dl
jne 0xa7d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa7d0dc
xor eax, eax
add dl, dl
jne 0xa7d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa7d17d
add dl, dl
jne 0xa7d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa7d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa7d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa7d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa7d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa7d075
mov eax, 1
add dl, dl
jne 0xa7d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa7d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa7d0e1
sub eax, ebx
mov ebx, 1
jne 0xa7d128
mov ecx, 1
add dl, dl
jne 0xa7d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa7d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa7d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa7d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa7d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa7d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa7d136
cmp eax, 0x7d00
jae 0xa7d16d
cmp eax, 0x500
jb 0xa7d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa7d075
cmp eax, 0x7f
ja 0xa7d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa7d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa7d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa7d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403550
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x40364e
mov eax, dword [esi + 8]
dec eax
cmp eax, 4
ja case.default.0x40356b
jmp dword [eax*4 + 0x403654]
mov eax, dword [esi + 0x448]
jmp 0x403588
mov eax, dword [esi + 0x448]
jmp 0x403588
mov eax, dword [esi + 0x44c]
push eax
call fcn.00401040
mov eax, dword [esi + 0x470]
test eax, eax
je case.default.0x40356b
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [esi + 0x470]
push 0
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x40356b
mov eax, dword [esi + 0x448]
push eax
call fcn.00401040
jmp case.default.0x40356b
mov eax, dword [esi + 0x450]
test eax, eax
je case.default.0x40356b
mov eax, dword [esi + 0x454]
mov ecx, dword [esi + 0x45c]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esi + 0x450]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esi + 0x45c]
test eax, eax
je 0x403607
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esi + 0x47c]
test eax, eax
je 0x403617
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [esi + 0x478]
test eax, eax
je 0x403627
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [esi + 0x484]
test eax, eax
je case.default.0x40356b
push eax
call sym.smackplw.exe__SmackBlitClose_4
mov eax, dword [esi + 0x458]
test eax, eax
je 0x403648
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call fcn.00401040
pop esi
pop ebx
ret 4
Function at 0x404b70
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x148
push ebx
push esi
push edi
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov edi, dword [esp + 0x160]
mov ecx, 0xffffffff
mov dword [0x41854c], eax
mov eax, dword [esp + 0x158]
mov dword [0x418be8], eax
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
push 0x23
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x5c]
push eax
call fcn.00401290
push 0x23
mov dword [0x418628], eax
lea eax, [esp + 0x58]
push eax
call fcn.00401210
mov eax, dword [0x418628]
test eax, eax
je 0x404c3a
lea eax, [esp + 0x34]
push 0x1f
push eax
mov ecx, dword [0x418628]
push ecx
mov edi, str.Smacker_for_Windows
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea esi, [esp + 0x34]
mov ecx, 0x13
repe cmpsb byte [esi], byte es:[edi]
jne 0x404c3a
push 0
mov eax, dword [0x418628]
push 0
push 0x2723
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0x2323
jne 0x404c33
mov dword [0x418628], 0
mov byte [0x416110], 0
call fcn.00403e30
lea eax, [esp + 0x54]
push eax
call fcn.00405670
add esp, 4
mov eax, dword [0x418628]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x404d39
mov dword [esp + 0x2c], str.SmackPlay
lea eax, [esp + 0x54]
mov dword [esp + 0x30], eax
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
cld
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, 0
jne 0x404c79
dec edx
mov eax, edx
mov dword [esp + 0x24], str.___V
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
cld
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, 0
jne 0x404c9b
dec edx
mov eax, edx
mov dword [esp + 0x1c], 0x416030
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
cld
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, 0
jne 0x404cbd
dec edx
mov eax, edx
mov dword [esp + 0x14], 0x41651c
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
cld
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, 0
jne 0x404cdf
dec edx
mov eax, edx
mov dword [esp + 0xc], 0x416040
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
cld
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, 0
jne 0x404d01
dec edx
mov eax, edx
lea eax, [esp + 0x54]
lea edi, [esp + 0x54]
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xf
mov edx, dword [0x418628]
push ecx
push 0x1234
push 0
push edx
call fcn.00401670
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x148
ret 0x10
Function at 0x406650
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
mov dword [esp], 0
push ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
push ebp
nop
mov ecx, dword [esi + 0x374]
mov eax, dword [esi + 0xc]
cmp ecx, eax
jae 0x406765
mov eax, dword [esi + 0x464]
mov ecx, dword [esi + 0x460]
sub eax, ecx
cmp eax, 0x1000
jl 0x406765
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
call ebx
mov edi, eax
push 0
lea eax, [esp + 0x14]
mov ecx, dword [esi + 0x45c]
push eax
mov edx, dword [esi + 0x3b0]
push 0x1000
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esi + 0x460]
mov eax, dword [esp + 0x10]
add ecx, eax
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x45c]
mov ebp, dword [esi + 0x454]
add eax, edx
mov dword [esi + 0x460], ecx
mov dword [esi + 0x45c], eax
cmp ebp, eax
jae 0x4066f8
mov dword [esi + 0x454], eax
mov eax, dword [esi + 0x450]
mov dword [esi + 0x45c], eax
mov eax, dword [esi + 0x47c]
cmp eax, ecx
jae 0x406708
mov dword [esi + 0x47c], ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x474]
add ecx, eax
mov eax, dword [esi + 0x4c4]
mov dword [esi + 0x474], ecx
test eax, eax
je 0x406753
mov dword [esp + 0x18], 0x3e8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mul ecx
mov ecx, dword [esp + 0x14]
div ecx
lea ebp, [eax + edi]
call ebx
cmp ebp, eax
ja 0x40674b
jmp 0x406755
call ebx
sub eax, edi
mov ecx, dword [esi + 0x478]
add ecx, eax
mov dword [esi + 0x478], ecx
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x407280
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
test esi, esi
je 0x4073c7
mov al, byte [0x417a10]
cmp al, 1
jne 0x4072c6
lea eax, [esp + 0xc]
push 0xa
push eax
push esi
call fcn.0040b860
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.SmackClose:
call edi
lea eax, [esp + 0xc]
push eax
call edi
push 0x417bb0
call edi
mov eax, dword [esi + 0x444]
cmp eax, 0xffffffff
je 0x407317
lea ebx, [esi + 0x428]
mov edi, 7
mov eax, dword [ebx]
test eax, eax
je 0x407307
push eax
call dword [0x418bc4]
mov eax, dword [ebx]
mov ecx, dword [eax]
push ecx
call fcn.00401040
mov ecx, dword [ebx]
push ecx
call fcn.00401040
mov dword [ebx], 0
dec dword [0x4179f0]
add ebx, 4
dec edi
jne 0x4072dc
mov dword [esi + 0x444], 0xffffffff
mov eax, dword [0x4179f0]
test eax, eax
jne 0x407339
mov eax, dword [0x4179f4]
test eax, eax
je 0x407339
push eax
call fcn.00401040
mov dword [0x4179f4], 0
mov eax, dword [esi + 0x3b0]
cmp eax, 0xffffffff
je 0x407356
mov ecx, dword [esi + 0x390]
test ch, 0x10
jne 0x407356
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x3bc]
test eax, eax
je 0x407366
push eax
call fcn.00401040
mov eax, dword [esi + 0x3b8]
test eax, eax
je 0x407376
push eax
call fcn.00401040
mov eax, dword [esi + 0x3e0]
test eax, eax
je 0x407386
push eax
call fcn.00401040
mov eax, dword [esi + 0x3d0]
test eax, eax
je 0x407396
push eax
call fcn.00401040
mov eax, dword [esi + 0x450]
test eax, eax
je 0x4073a6
push eax
call fcn.00401040
mov eax, dword [esi + 0x390]
mov edi, esi
mov ecx, 0x132
test eax, 0x2000000
mov eax, 0
rep stosd dword es:[edi], eax
jne 0x4073c7
push esi
call fcn.00401040
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x408740
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x20
mov word [esp], 1
push ebx
push esi
mov esi, dword [esp + 0x2c]
push edi
push ebp
nop
mov ecx, dword [esi + 0x50]
mov eax, dword [esi + 0x54]
inc al
and eax, 0xffff00ff
cmp ecx, 1
mov word [esp + 0x12], ax
sbb eax, eax
and eax, 0xfffffff8
xor ecx, ecx
mov cx, word [esp + 0x12]
add eax, 0x10
mov word [esp + 0x1e], ax
mov eax, dword [esi + 0x48]
mov di, word [esp + 0x1e]
mov dword [esp + 0x14], eax
shr di, 3
mov edx, edi
and edx, 0xffff
imul ecx, edx
imul ecx, eax
mov ax, word [esp + 0x12]
mov dl, byte [0x417a10]
imul ax, di
mov word [esp + 0x1c], ax
mov dword [esp + 0x18], ecx
cmp dl, 1
jne 0x4087c6
push str.Using_standard_waveOut_r_n
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call edi
jmp 0x4087cc
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ebx, [esi + 0x40]
push 0
mov eax, dword [esi + 0x78]
lea ecx, [esp + 0x14]
push eax
mov ebp, dword [sym.imp.WINMM.dll_waveOutOpen]
push 0
push ecx
push 0xffffffffffffffff
push ebx
call ebp
test eax, eax
je 0x408825
mov cl, byte [0x417a10]
cmp cl, 1
jne 0x40881b
lea ecx, [esp + 0x20]
push 0xa
push ecx
push eax
call fcn.0040b860
add esp, 0xc
push str.WaveOut_open_failed___error_:
call edi
lea eax, [esp + 0x20]
push eax
call edi
push 0x417bf4
call edi
xor al, al
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret
mov edi, dword [esi + 0x64]
xor eax, eax
mov ecx, 8
rep stosd dword es:[edi], eax
mov ecx, 8
nop
mov edi, dword [esi + 0x68]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x64]
lea ecx, [eax + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x68]
lea edx, [eax + 0x20]
mov dword [eax], edx
push 0x20
mov ebp, dword [esi + 0x44]
mov ecx, dword [esi + 0x64]
mov dword [ecx + 4], ebp
mov ebp, dword [esi + 0x44]
mov eax, dword [esi + 0x68]
mov edi, dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
mov dword [eax + 4], ebp
mov ecx, dword [esi + 0x64]
mov edx, dword [ebx]
push ecx
push edx
call edi
push 0x20
mov ecx, dword [esi + 0x68]
push ecx
mov eax, dword [ebx]
push eax
call edi
mov ecx, dword [esi + 0x68]
or dword [ecx + 0x10], 1
mov edx, dword [esi + 0x64]
mov dword [edx + 4], 4
mov edx, dword [esi + 0x44]
cmp dword [esi + 0x50], 1
sbb eax, eax
and eax, 0x80
mov edi, dword [esi + 0x64]
mov cl, al
add edi, 0x20
mov ch, cl
mov cl, al
mov eax, ecx
shl eax, 0x10
mov ax, cx
mov ecx, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push 0x20
mov ecx, dword [esi + 0x64]
push ecx
mov edx, dword [ebx]
push edx
mov ebp, 1
call dword [sym.imp.WINMM.dll_waveOutWrite]
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
call edi
lea ebx, [eax + 0x3e8]
call edi
cmp eax, ebx
mov eax, dword [esi + 0x64]
mov ecx, dword [eax + 0x10]
jae 0x4088f7
test ebp, ecx
je 0x4088dd
mov al, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret
or ecx, 1
push esi
mov dword [eax + 0x10], ecx
call fcn.00408910
add esp, 4
xor al, al
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x408c90
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x10
mov eax, dword [0x417c04]
test eax, eax
nop
push ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
mov dword [0x417c00], esi
je 0x408d42
mov eax, dword [0x417c10]
test eax, eax
je 0x408cb9
call eax
push 2
mov eax, dword [0x417c04]
mov ebx, dword [eax]
push esi
push eax
call dword [ebx + 0x18]
mov edi, eax
mov eax, dword [0x417c14]
test eax, eax
je 0x408cd4
call eax
test edi, edi
je 0x408d0e
mov al, byte [0x417a10]
cmp al, 1
jne 0x408d0e
lea eax, [esp + 0xc]
push 0xa
push eax
push edi
call fcn.0040b860
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Unable_to_set_cooperative_level___Error_:
call edi
lea eax, [esp + 0xc]
push eax
call edi
push 0x417c50
call edi
jmp 0x408d14
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [0x417a10]
cmp al, 1
jne 0x408d42
lea eax, [esp + 0xc]
push 0xa
push eax
push esi
call fcn.0040b860
add esp, 0xc
push str.DirectSound_using_HWND:
call edi
lea eax, [esp + 0xc]
push eax
call edi
push 0x417c70
call edi
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x40b9a0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x417e08], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x40b9be
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x417e04], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x417e00], bl
jne 0x40ba18
cmp dword [0x418d60], 0
je 0x40ba06
mov edi, dword [0x418d5c]
sub edi, 4
cmp dword [0x418d60], edi
ja 0x40ba06
mov eax, dword [edi]
test eax, eax
je 0x40b9fb
call eax
sub edi, 4
cmp dword [0x418d60], edi
jbe 0x40b9f3
push 0x416014
push 0x416010
call fcn.0040ba50
add esp, 8
push 0x41601c
push 0x416018
call fcn.0040ba50
add esp, 8
test ebx, ebx
jne 0x40ba3f
mov dword [0x417e08], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret

Function at 0x40bdb0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x40cf3c
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x417dcc], eax
xor eax, eax
mov al, byte [0x417dcd]
mov dword [0x417dd8], eax
mov eax, dword [0x417dcc]
shr dword [0x417dcc], 0x10
and eax, 0xff
mov dword [0x417dd4], eax
shl eax, 8
add eax, dword [0x417dd8]
mov dword [0x417dd0], eax
call fcn.0040bf90
mov dword [ebp - 4], 0
call fcn.0040cd60
call fcn.0040c570
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x418d58], eax
call fcn.0040cbc0
mov dword [0x417e10], eax
test eax, eax
je 0x40be49
cmp dword [0x418d58], 0
jne 0x40be53
push 0xffffffffffffffff
call fcn.0040b960
add esp, 4
call fcn.0040c940
call fcn.0040c860
call fcn.0040b930
mov esi, dword [0x418d58]
mov al, byte [esi]
cmp al, 0x22
je 0x40be7a
cmp al, 0x20
jbe 0x40bea7
inc esi
cmp byte [esi], 0x20
ja 0x40be72
jmp 0x40bea7
inc esi
cmp byte [esi], 0x22
je 0x40bea6
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x40bea1
xor eax, eax
mov al, bl
push eax
call fcn.0040c800
add esp, 4
test eax, eax
je 0x40be9b
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x40be83
cmp byte [esi], 0x22
jne 0x40bea7
inc esi
cmp byte [esi], 0
je 0x40beb7
cmp byte [esi], 0x20
ja 0x40beb7
inc esi
cmp byte [esi], 0
jne 0x40beac
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x40bedb
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0040b960
jmp 0x40bf1c
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret