joyce8/EMBER2024-capa huggingface dataset:
Function at 0x645c3024
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
cmp byte [0x648710a8], 0
jne 0x645c314f
mov dword [esp + 4], str.shutdown_libdumb
mov dword [esp], 0x645c2570
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edx
call sym.allegro_5.0.10_monolith_mt.dll__al_add_exit_func
mov dword [0x64871060], 0x64734fe0
mov dword [0x64871064], 0x647352a8
mov dword [0x64871068], 0x647358fc
mov dword [0x6487106c], 0x647359c4
mov dword [0x64871070], 0x64735150
mov dword [0x64871074], 0x64735aac
mov dword [0x64871078], 0x64735f84
mov dword [0x6487107c], 0x64736000
mov dword [0x64871080], 0x64735a58
mov dword [0x64871084], 0x64736034
mov dword [0x64871088], 0x64736058
mov dword [0x6487108c], 0x6473607c
mov dword [0x64871090], 0x647360a0
mov esi, 0x648710ac
mov dword [0x648710ac], 0x645c2328
mov dword [0x648710b0], 0x645c22fc
mov dword [0x648710b4], 0x645c22f4
mov dword [0x648710b8], 0x645c22d4
mov dword [0x648710bc], 0x645c2194
mov dword [esp], esi
call sym.allegro_5.0.10_monolith_mt.dll_register_dumbfile_system
mov edi, 0x64871094
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov dword [0x64871094], 0
mov dword [0x648710a4], 0
mov byte [0x648710a8], 1
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x6487108c]
mov dword [esp + 0x30], ecx
mov ecx, ebx
add esp, 0x20
pop ebx
pop esi
pop edi
jmp fcn.645c2344
Function at 0x645cafc8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x645cb067
mov ecx, dword [ebx + 0xf0]
test ecx, ecx
je 0x645cafeb
mov dword [esp], ebx
call dword [ebx + 0xf8]
mov dword [esp], ebx
call sym.allegro_5.0.10_monolith_mt.dll__al_kcm_detach_from_parent
mov dword [esp], ebx
call sym.allegro_5.0.10_monolith_mt.dll_al_destroy_user_event_source
mov dword [esp + 0xc], str.al_destroy_audio_stream
mov dword [esp + 8], str.d:Libraries_build_allegro_src_allegro_git_allegro_git_addons_audiokcm_stream.c
mov dword [esp + 4], 0x98
mov eax, dword [ebx + 0xe0]
mov dword [esp], eax
call sym.allegro_5.0.10_monolith_mt.dll_al_free_with_context
mov dword [esp + 0xc], str.al_destroy_audio_stream
mov dword [esp + 8], str.d:Libraries_build_allegro_src_allegro_git_allegro_git_addons_audiokcm_stream.c
mov dword [esp + 4], 0x99
mov eax, dword [ebx + 0xe8]
mov dword [esp], eax
call sym.allegro_5.0.10_monolith_mt.dll_al_free_with_context
mov dword [esp + 0xc], str.al_destroy_audio_stream
mov dword [esp + 8], str.d:Libraries_build_allegro_src_allegro_git_allegro_git_addons_audiokcm_stream.c
mov dword [esp + 4], 0x9a
mov dword [esp], ebx
call sym.allegro_5.0.10_monolith_mt.dll_al_free_with_context
add esp, 0x18
pop ebx
ret
Function at 0x645d6018
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x5c4], edx
mov eax, dword [ebp - 0x5c4]
cmp eax, dword [ebp - 0xe98]
je 0x645d603c
mov ecx, dword [ebp - 0x5c4]
cmp dword [ecx + 0x30], 0
jne 0x645d5df2
mov dword [ebp - 0x398], 0
Function at 0x645d6940
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xchg ebp, eax
cwde
in eax, 0xff
call dword [edx - 1]
xchg ebp, eax
push esp
fcos
inc dword [ebp + 0x504175c0]
Function at 0x645d6c3c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
out 0xff, al
inc dword [ebx - 0x191743]
inc dword [eax]
jne 0x645d6c88
push esi
push esi
add esp, 4
or esi, 0xe3e0
xor esi, 0xa9e9
pop esi
push ecx
call 0x645d6c6a
add byte [ebx + 0x34], al
cmp al, 0x43
inc esi
inc edx
dec ebp
inc ebp
push eax
add esp, 4
xor ecx, 0x1fe9
or ecx, 0x14fc0
pop ecx
mov ecx, dword [ebp - 0x5cc]
mov dword [ebp - 0x398], ecx
jmp 0x645d6cf0
push edi
push esi
add esp, 4
add edi, 0x575e
call 0x645d6ca2
add byte [0x453f3446], dh
inc ecx
inc edi
add esp, 4
pop edi
push esi
sub esi, 0x13e0f
sub esi, 0x10e0d
xor esi, 0x14188
pop esi
mov edx, dword [ebp - 0x5cc]
mov eax, dword [edx]
mov dword [ebp - 0x5cc], eax
mov ecx, dword [ebp - 0x5cc]
cmp ecx, dword [ebp - 0xeb4]
je 0x645d6ce6
mov edx, dword [ebp - 0x5cc]
cmp dword [edx + 0x30], 0
jne 0x645d6a9c
mov dword [ebp - 0x398], 0

Function at 0x645d6c6a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
out 0xff, al
inc dword [ebx - 0x191743]
inc dword [eax]
jne 0x645d6c88
push esi
push esi
add esp, 4
or esi, 0xe3e0
xor esi, 0xa9e9
pop esi
push ecx
call 0x645d6c6a
add byte [ebx + 0x34], al
cmp al, 0x43
inc esi
inc edx
dec ebp
inc ebp
push eax
add esp, 4
xor ecx, 0x1fe9
or ecx, 0x14fc0
pop ecx
mov ecx, dword [ebp - 0x5cc]
mov dword [ebp - 0x398], ecx
jmp 0x645d6cf0
push edi
push esi
add esp, 4
add edi, 0x575e
call 0x645d6ca2
add byte [0x453f3446], dh
inc ecx
inc edi
add esp, 4
pop edi
push esi
sub esi, 0x13e0f
sub esi, 0x10e0d
xor esi, 0x14188
pop esi
mov edx, dword [ebp - 0x5cc]
mov eax, dword [edx]
mov dword [ebp - 0x5cc], eax
mov ecx, dword [ebp - 0x5cc]
cmp ecx, dword [ebp - 0xeb4]
je 0x645d6ce6
mov edx, dword [ebp - 0x5cc]
cmp dword [edx + 0x30], 0
jne 0x645d6a9c
mov dword [ebp - 0x398], 0

Function at 0x645d6ca2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
out 0xff, al
inc dword [ebx - 0x191743]
inc dword [eax]
jne 0x645d6c88
push esi
push esi
add esp, 4
or esi, 0xe3e0
xor esi, 0xa9e9
pop esi
push ecx
call 0x645d6c6a
add byte [ebx + 0x34], al
cmp al, 0x43
inc esi
inc edx
dec ebp
inc ebp
push eax
add esp, 4
xor ecx, 0x1fe9
or ecx, 0x14fc0
pop ecx
mov ecx, dword [ebp - 0x5cc]
mov dword [ebp - 0x398], ecx
jmp 0x645d6cf0
push edi
push esi
add esp, 4
add edi, 0x575e
call 0x645d6ca2
add byte [0x453f3446], dh
inc ecx
inc edi
add esp, 4
pop edi
push esi
sub esi, 0x13e0f
sub esi, 0x10e0d
xor esi, 0x14188
pop esi
mov edx, dword [ebp - 0x5cc]
mov eax, dword [edx]
mov dword [ebp - 0x5cc], eax
mov ecx, dword [ebp - 0x5cc]
cmp ecx, dword [ebp - 0xeb4]
je 0x645d6ce6
mov edx, dword [ebp - 0x5cc]
cmp dword [edx + 0x30], 0
jne 0x645d6a9c
mov dword [ebp - 0x398], 0
Function at 0x645d8004
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edx, 0x11d5
pop edx
push ecx
and ecx, 0x3f3d
xor ecx, 0x117d8
pop ecx
lea eax, [ebp - 0x1a68]
mov dword [ebp - 0xedc], eax
mov ecx, dword [ebp - 0x5dc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xed8], edx
xor eax, eax
mov word [ebp - 0x278], ax
xor ecx, ecx
mov word [ebp - 0x48], cx
push esi
xor esi, 0x19d0
sub esi, 0x8c27
pop esi
push ecx
push eax
add esp, 4
and ecx, 0x1002f
xor ecx, 0x147b6
add ecx, 0x5ea
pop ecx
push edx
push edx
add esp, 4
sub edx, 0xc75e
pop edx
mov edx, dword [ebp - 0xed8]
mov ax, word [edx]
mov word [ebp - 0x12c2], ax
mov ecx, dword [ebp - 0xed8]
add ecx, 2
mov dword [ebp - 0xed8], ecx
mov dx, word [ebp - 0x12c2]
mov word [ebp - 0x278], dx
mov eax, dword [ebp - 0xedc]
mov cx, word [eax]
mov word [ebp - 0x12c4], cx
mov edx, dword [ebp - 0xedc]
add edx, 2
mov dword [ebp - 0xedc], edx

Function at 0x645d80c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ax, word [ebp - 0x12c4]
mov word [ebp - 0x48], ax
push edx
jmp 0x645d80d9
call 0x645d80e9
add byte [edx + 0x45], cl
cmp eax, 0x493b4d43
xor ecx, dword ss:[esi - 0x7d]
les eax, [ecx + eax*4]
loop 0x645d80d0
add byte [eax], al
pop edx
push esi
add esi, 0x17aac
xor esi, 0x1246d
pop esi
movzx ecx, word [ebp - 0x48]
test ecx, ecx
jne 0x645d811e
movzx edx, word [ebp - 0x278]
movzx eax, word [ebp - 0x48]
sub edx, eax
mov dword [ebp - 0x1998], edx
jmp 0x645d8178
movzx ecx, word [ebp - 0x278]
movzx edx, word [ebp - 0x48]
cmp ecx, edx
je 0x645d8046
movzx eax, word [ebp - 0x278]
xor eax, 0x20
movzx ecx, word [ebp - 0x48]
cmp eax, ecx
je 0x645d8046
movzx edx, word [ebp - 0x278]
movzx eax, word [ebp - 0x48]
cmp edx, eax
jge 0x645d8162
mov dword [ebp - 0x1994], 0xffffffff
jmp 0x645d816c
mov dword [ebp - 0x1994], 1
mov ecx, dword [ebp - 0x1994]
mov dword [ebp - 0x1998], ecx
cmp dword [ebp - 0x1998], 0
jne 0x645d81c1
push esi
push eax
add esp, 4
xor esi, 0x4eda
add esi, 0x184e4
sub esi, 0x331b
pop esi
push eax
push edx
add esp, 4
sub eax, 0x13aef
and eax, 0xf043
jmp 0x645d81b2
pop eax
mov edx, dword [ebp - 0x5dc]
mov dword [ebp - 0x394], edx
jmp 0x645d8229
push ebx
push ecx
add esp, 4
add ebx, 0x1557
pop ebx
push eax
add eax, 0xcaa8
or eax, 0x16e1c
pop eax
push esi
and esi, 0x8d2
call 0x645d81ef
add byte [eax + 0x3d], dl
cmp al, 0x4c
dec ecx
xor al, byte [edi - 0x7d]
les eax, [esi + ebx*2]
mov eax, dword [ebp - 0x5dc]
mov ecx, dword [eax]
mov dword [ebp - 0x5dc], ecx
mov edx, dword [ebp - 0x5dc]
cmp edx, dword [ebp - 0xee0]
je 0x645d821f
mov eax, dword [ebp - 0x5dc]
cmp dword [eax + 0x30], 0
jne 0x645d7fea
mov dword [ebp - 0x394], 0
Function at 0x645d80e9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ax, word [ebp - 0x12c4]
mov word [ebp - 0x48], ax
push edx
jmp 0x645d80d9
call 0x645d80e9
add byte [edx + 0x45], cl
cmp eax, 0x493b4d43
xor ecx, dword ss:[esi - 0x7d]
les eax, [ecx + eax*4]
loop 0x645d80d0
add byte [eax], al
pop edx
push esi
add esi, 0x17aac
xor esi, 0x1246d
pop esi
movzx ecx, word [ebp - 0x48]
test ecx, ecx
jne 0x645d811e
movzx edx, word [ebp - 0x278]
movzx eax, word [ebp - 0x48]
sub edx, eax
mov dword [ebp - 0x1998], edx
jmp 0x645d8178
movzx ecx, word [ebp - 0x278]
movzx edx, word [ebp - 0x48]
cmp ecx, edx
je 0x645d8046
movzx eax, word [ebp - 0x278]
xor eax, 0x20
movzx ecx, word [ebp - 0x48]
cmp eax, ecx
je 0x645d8046
movzx edx, word [ebp - 0x278]
movzx eax, word [ebp - 0x48]
cmp edx, eax
jge 0x645d8162
mov dword [ebp - 0x1994], 0xffffffff
jmp 0x645d816c
mov dword [ebp - 0x1994], 1
mov ecx, dword [ebp - 0x1994]
mov dword [ebp - 0x1998], ecx
cmp dword [ebp - 0x1998], 0
jne 0x645d81c1
push esi
push eax
add esp, 4
xor esi, 0x4eda
add esi, 0x184e4
sub esi, 0x331b
pop esi
push eax
push edx
add esp, 4
sub eax, 0x13aef
and eax, 0xf043
jmp 0x645d81b2
pop eax
mov edx, dword [ebp - 0x5dc]
mov dword [ebp - 0x394], edx
jmp 0x645d8229
push ebx
push ecx
add esp, 4
add ebx, 0x1557
pop ebx
push eax
add eax, 0xcaa8
or eax, 0x16e1c
pop eax
push esi
and esi, 0x8d2
call 0x645d81ef
add byte [eax + 0x3d], dl
cmp al, 0x4c
dec ecx
xor al, byte [edi - 0x7d]
les eax, [esi + ebx*2]
mov eax, dword [ebp - 0x5dc]
mov ecx, dword [eax]
mov dword [ebp - 0x5dc], ecx
mov edx, dword [ebp - 0x5dc]
cmp edx, dword [ebp - 0xee0]
je 0x645d821f
mov eax, dword [ebp - 0x5dc]
cmp dword [eax + 0x30], 0
jne 0x645d7fea
mov dword [ebp - 0x394], 0
Function at 0x645d81ef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ax, word [ebp - 0x12c4]
mov word [ebp - 0x48], ax
push edx
jmp 0x645d80d9
call 0x645d80e9
add byte [edx + 0x45], cl
cmp eax, 0x493b4d43
xor ecx, dword ss:[esi - 0x7d]
les eax, [ecx + eax*4]
loop 0x645d80d0
add byte [eax], al
pop edx
push esi
add esi, 0x17aac
xor esi, 0x1246d
pop esi
movzx ecx, word [ebp - 0x48]
test ecx, ecx
jne 0x645d811e
movzx edx, word [ebp - 0x278]
movzx eax, word [ebp - 0x48]
sub edx, eax
mov dword [ebp - 0x1998], edx
jmp 0x645d8178
movzx ecx, word [ebp - 0x278]
movzx edx, word [ebp - 0x48]
cmp ecx, edx
je 0x645d8046
movzx eax, word [ebp - 0x278]
xor eax, 0x20
movzx ecx, word [ebp - 0x48]
cmp eax, ecx
je 0x645d8046
movzx edx, word [ebp - 0x278]
movzx eax, word [ebp - 0x48]
cmp edx, eax
jge 0x645d8162
mov dword [ebp - 0x1994], 0xffffffff
jmp 0x645d816c
mov dword [ebp - 0x1994], 1
mov ecx, dword [ebp - 0x1994]
mov dword [ebp - 0x1998], ecx
cmp dword [ebp - 0x1998], 0
jne 0x645d81c1
push esi
push eax
add esp, 4
xor esi, 0x4eda
add esi, 0x184e4
sub esi, 0x331b
pop esi
push eax
push edx
add esp, 4
sub eax, 0x13aef
and eax, 0xf043
jmp 0x645d81b2
pop eax
mov edx, dword [ebp - 0x5dc]
mov dword [ebp - 0x394], edx
jmp 0x645d8229
push ebx
push ecx
add esp, 4
add ebx, 0x1557
pop ebx
push eax
add eax, 0xcaa8
or eax, 0x16e1c
pop eax
push esi
and esi, 0x8d2
call 0x645d81ef
add byte [eax + 0x3d], dl
cmp al, 0x4c
dec ecx
xor al, byte [edi - 0x7d]
les eax, [esi + ebx*2]
mov eax, dword [ebp - 0x5dc]
mov ecx, dword [eax]
mov dword [ebp - 0x5dc], ecx
mov edx, dword [ebp - 0x5dc]
cmp edx, dword [ebp - 0xee0]
je 0x645d821f
mov eax, dword [ebp - 0x5dc]
cmp dword [eax + 0x30], 0
jne 0x645d7fea
mov dword [ebp - 0x394], 0
Function at 0x645de56c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x1010166
mov al, byte [bp - 0x1a4b]
add byte [eax], al
mov edx, 0x101016d
mov cl, byte [bp - 0x1a49]
add byte [eax], al
mov ebx, 0x1010134
mov dl, byte [bp - 0x1a47]
add byte [eax], al
mov ecx, 0x1010133
mov al, byte [bp - 0x1a45]
add byte [eax], al
mov edx, 0x101012f
mov cl, byte [bp - 0x1a43]
add byte [eax], al
mov ebx, 0x1010165
mov dl, byte [bp - 0x1a41]
add byte [eax], al
mov ecx, 0x101016d
mov al, byte [bp - 0x1a3f]
add byte [eax], al
mov edx, 0x101016d
mov cl, byte [bp - 0x1a3d]
add byte [eax], al
xor al, 0xd3
mov dl, byte [bp - 0x1a3b]
add byte [eax], al
push ecx
push esp
test ch, al
add eax, 0xe556e982
add dword [ecx], eax
add cl, 0x3a
push 0xe9820102
shl dword [ecx - 0x3e7dfeff], 1
cmc
push ecx
add al, byte [ecx]
pop ecx
pop eax
in eax, 1
add dword [edx + 0x2683ac1], eax
add dword [edx + 0x1a1d1e9], eax
add dword [edx + 0x251f5c1], eax
add dword [ecx + 0x58], ebx
xor al, 0x7c
pop dword [ecx]
add dword [eax + 0x58], esp
push ebx
test ch, al
add eax, 0x3be7e882
add al, byte [ecx]
pushal
mov dword [esi + 0xf645], 0x4686c74d
test byte [eax], 0
jo 0x645de5dd
xchg byte [edi - 0xa], al
add byte [eax], al
invalid

Function at 0x645e2c18
Capabilities:
Encode data using xor

Disassembly:
add byte [edx + 0x101016d], bh
mov cl, byte [bp - 0x1a93]
add byte [eax], al
mov ebx, 0x101016d
mov dl, byte [bp - 0x1a91]
add byte [eax], al
xor al, 0xc1
mov al, byte [bp - 0x1a8f]
add byte [eax], al
push edx
add dl, 0x9e
insb byte es:[edi], dx
add dword [ecx], eax
pop edx
push esp
xor ah, 0xbb
adc byte [edx], al
add dword [edx + edx*2 + 0x53], ebx
test ch, al
add eax, 0x10108e9
add dword [ecx], eax
inc esp
push eax
inc edi
cmp dword [esi], edi
aaa
test ch, al
add eax, 0x5dbef282
add al, byte [ecx]
in al, dx
push es
inc ebp
dec edi
inc edi
inc edi
aas
pop edx
mov dword [esi + 0xf675], 0x7686c74d
test byte [eax], 0
jo 0x645e2c42
xchg byte [edi - 0xa], dh
add byte [eax], al
invalid
Function at 0x6465ee80
Capabilities:
Check os version

Disassembly:
sub esp, 0xdc
mov dword [esp], 0x647f8310
call sym.allegro_5.0.10_monolith_mt.dll__al_win_safe_load_library
mov dword [0x648738b0], eax
test eax, eax
je 0x6465ef80
mov dword [esp + 0x3c], 0x94
lea eax, [esp + 0x3c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetVersionExA
push ecx
cmp dword [esp + 0x40], 5
seta byte [0x648738b4]
mov dword [esp + 4], str.Direct3DCreate9
mov eax, dword [0x648738b0]
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0x648738b8], eax
test eax, eax
je 0x6465efd4
mov dword [esp], 0x8000001f
call eax
push edx
mov dword [sym.allegro_5.0.10_monolith_mt.dll__al_d3d], eax
test eax, eax
je 0x6465efd4
mov edx, dword [eax]
lea ecx, [esp + 0x2c]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [edx + 0x20]
sub esp, 0xc
mov eax, dword [sym.allegro_5.0.10_monolith_mt.dll__al_d3d]
mov edx, dword [esp + 0x38]
mov ecx, dword [eax]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [ecx + 0x28]
sub esp, 0x1c
test eax, eax
jne 0x6465ef8c
mov byte [0x647dd100], 1
call sym.allegro_5.0.10_monolith_mt.dll_al_create_mutex
mov dword [0x648738bc], eax
call sym.allegro_5.0.10_monolith_mt.dll_al_create_mutex
mov dword [sym.allegro_5.0.10_monolith_mt.dll__al_d3d_lost_device_mutex], eax
call sym.allegro_5.0.10_monolith_mt.dll__al_d3d_bmp_init
mov al, 1
add esp, 0xdc
ret
xor eax, eax
add esp, 0xdc
ret
mov eax, dword [sym.allegro_5.0.10_monolith_mt.dll__al_d3d]
mov edx, dword [esp + 0x38]
mov ecx, dword [eax]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], edx
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [ecx + 0x28]
sub esp, 0x1c
test eax, eax
sete byte [0x647dd100]
jmp 0x6465ef5e
mov eax, dword [0x648738b0]
mov dword [esp], eax
call sub.KERNEL32.dll_FreeLibrary
push eax
xor eax, eax
add esp, 0xdc
ret
Function at 0x64668cc0
Capabilities:
Get common file path

Disassembly:
push edi
push esi
push ebx
sub esp, 0x140
cmp dword [esp + 0x150], 6
jbe 0x64668ce4
xor ebx, ebx
mov eax, ebx
add esp, 0x140
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x150]
jmp dword [eax*4 + 0x647f907c]
mov eax, 5
mov esi, 5
lea ebx, [esp + 0x3c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
test eax, eax
jne case.default.0x64668ceb
mov dword [esp], ebx
call sym.allegro_5.0.10_monolith_mt.dll_al_create_path_for_directory
mov ebx, eax
test eax, eax
je case.default.0x64668ceb
cmp esi, 0x1a
jne 0x64668cd5
call sym.allegro_5.0.10_monolith_mt.dll_al_get_org_name
mov edi, eax
call sym.allegro_5.0.10_monolith_mt.dll_al_get_app_name
test eax, eax
je 0x64668e75
cmp byte [eax], 0
je 0x64668e75
test edi, edi
je 0x64668d6a
cmp byte [edi], 0
jne 0x64668e5c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym.allegro_5.0.10_monolith_mt.dll_al_append_path_component
jmp 0x64668cd5
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [esp + 0xc], 0x104
lea ebx, [esp + 0x3c]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.PSAPI.DLL_GetModuleFileNameExA
sub esp, 0x10
mov dword [esp], ebx
call sym.allegro_5.0.10_monolith_mt.dll_al_create_path
mov ebx, eax
mov eax, ebx
add esp, 0x140
pop ebx
pop esi
pop edi
ret
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [esp + 0xc], 0x104
lea ebx, [esp + 0x3c]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.PSAPI.DLL_GetModuleFileNameExA
sub esp, 0x10
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
call fcn.647d42b4
test eax, eax
je case.default.0x64668ceb
mov byte [eax], 0
mov dword [esp], ebx
call sym.allegro_5.0.10_monolith_mt.dll_al_create_path_for_directory
mov ebx, eax
mov eax, ebx
add esp, 0x140
pop ebx
pop esi
pop edi
ret
lea ebx, [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call sub.KERNEL32.dll_GetTempPathA
sub esp, 8
cmp eax, 0x104
jbe 0x64668dff
jmp case.default.0x64668ceb
mov eax, 0x1a
mov esi, 0x1a
jmp 0x64668cfe
mov eax, 0x28
mov esi, 0x28
jmp 0x64668cfe
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 0x2c], eax
call sym.allegro_5.0.10_monolith_mt.dll_al_append_path_component
mov eax, dword [esp + 0x2c]
jmp 0x64668d6a
mov dword [esp], ebx
call sym.allegro_5.0.10_monolith_mt.dll_al_destroy_path
xor ebx, ebx
jmp 0x64668cd5
Function at 0x646736e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
nop
mov eax, edx
and eax, 1
neg eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [edx*4 + sym.allegro_5.0.10_monolith_mt.dll_g_CrcTable], eax
inc edx
cmp edx, 0x100
jne 0x646736ec
ret

Function at 0x64673784
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x646737b2
add ebx, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
lea esi, [esi]
mov cl, byte [edx]
xor ecx, eax
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + sym.allegro_5.0.10_monolith_mt.dll_g_CrcTable]
inc edx
cmp edx, ebx
jne 0x6467379c
pop ebx
ret

Function at 0x646737b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x646737e2
add ebx, edx
mov eax, 0xffffffff
mov cl, byte [edx]
xor ecx, eax
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + sym.allegro_5.0.10_monolith_mt.dll_g_CrcTable]
inc edx
cmp edx, ebx
jne 0x646737c8
not eax
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x64686bdc
Capabilities:
Get disk information

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [esp + 0x2c], 0x5c3a78
mov bl, 0x41
lea esi, [esp + 0x2c]
jmp 0x64686bfe
inc ebx
cmp bl, 0x5b
je 0x64686c8c
mov byte [esp + 0x2c], bl
mov dword [esp], esi
call sub.KERNEL32.dll_GetDriveTypeA
push ebp
cmp eax, 5
jne 0x64686bf4
mov dword [esp], 1
call sub.KERNEL32.dll_SetErrorMode
push ecx
mov edi, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
lea eax, [esp + 0x28]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.KERNEL32.dll_GetVolumeInformationA
sub esp, 0x20
mov ebp, eax
mov dword [esp], edi
call sub.KERNEL32.dll_SetErrorMode
push edi
test ebp, ebp
je 0x64686bf4
mov dword [esp + 4], esi
mov eax, dword [esp + 0x54]
mov dword [esp], eax
mov eax, dword [esp + 0x50]
call eax
inc ebx
cmp bl, 0x5b
jne 0x64686bfe
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret