joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451653
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x116c], 0
je 0x451713
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x116c], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1234]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1948]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x123c], ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x1238]
cdq
mov ecx, 5
idiv ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x1240], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x123c]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1948]
lea ecx, [ecx + eax + 1]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1244], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1240]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x194c]
lea ecx, [ecx + eax + 1]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1248], ecx
push 1
mov eax, dword [ebp - 4]
add eax, 0x123c
push eax
mov ecx, dword [ebp - 4]
call fcn.004163a0
mov ecx, dword [ebp - 4]
call fcn.00433de2
push 1
mov ecx, dword [ebp - 4]
call fcn.004cf9dd
push 3
push 0
push 0
push 0
push 0
push 0x536188
mov ecx, dword [ebp - 4]
call fcn.004cf98e
push 3
push 0
push 0
push 0
push 0
push 0x536148
mov ecx, dword [ebp - 4]
call fcn.004cf98e
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x6f664], 0
je 0x451767
push 0
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x6f664]
call fcn.004cf9dd
mov eax, dword [ebp - 4]
cmp dword [eax + 0x6f668], 0
je 0x451783
push 0
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x6f668]
call fcn.004cf9dd
mov edx, dword [ebp - 4]
cmp dword [edx + 0x118c], 0
je 0x4517ab
mov eax, dword [ebp - 4]
cmp dword [eax + 0x70d10], 0
je 0x4517ab
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x70d10]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret
Function at 0x48458f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov dword [ebp - 0x630], ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x210], ax
mov word [ebp - 0x41c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x420], 1
jmp 0x4845dd
mov eax, dword [ebp - 0x420]
add eax, 1
mov dword [ebp - 0x420], eax
mov ecx, dword [ebp - 0x630]
mov edx, dword [ebp - 0x420]
cmp edx, dword [ecx + 0x2ae4]
jg 0x4846ec
mov eax, dword [ebp - 0x420]
push eax
push str.Language__d
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004ba7bf
add esp, 0xc
mov edx, dword [ebp - 0x630]
add edx, 0xd58
push edx
push 0x104
lea eax, [ebp - 0x418]
push eax
push 0x5304f4
lea ecx, [ebp - 0x20c]
push ecx
push 0x512ab0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, dword [ebp - 0x630]
add edx, 0xd58
push edx
push 0x104
lea eax, [ebp - 0x62c]
push eax
push 0x5304f8
lea ecx, [ebp - 0x418]
push ecx
push str.LANGUAGE_INDEX
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x512af0
lea edx, [ebp - 0x62c]
push edx
call fcn.004bb8cf
add esp, 8
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
je 0x4846e7
mov eax, dword [ebp - 0x424]
push eax
call fcn.004ba82e
add esp, 4
mov word [ebp - 0x41c], ax
mov ecx, dword [ebp - 0x41c]
and ecx, 0xffff
mov edx, dword [ebp - 0x210]
and edx, 0xffff
cmp ecx, edx
jne 0x4846d0
mov eax, dword [ebp - 0x420]
mov dword [ebp - 4], eax
jmp 0x4846e7
push 0x512af8
push 0
call fcn.004bb8cf
add esp, 8
mov dword [ebp - 0x424], eax
jmp 0x48468a
jmp 0x4845ce
cmp dword [ebp - 4], 0
jne 0x4846f9
mov dword [ebp - 4], 1
push 0x52fc64
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ba79a
add esp, 8
mov edx, dword [ebp - 4]
push edx
push str.Language__d.ini
lea eax, [ebp - 0x20c]
push eax
call fcn.004ba7bf
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004ba770
add esp, 8
mov esp, ebp
pop ebp
ret 4
Function at 0x4954c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
cmp dword [0x5348f8], 0
je 0x49555c
mov eax, dword [ebp - 0xc]
add eax, 0x894
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x8c
push ecx
mov edx, dword [0x5348f8]
push edx
call fcn.004ae3bb
add esp, 0xc
push 0x52fa5c
push 6
push str.bSpdifSampleRateOld
push 0x51ec14
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x495524
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x495544
mov ecx, dword [ebp - 8]
xor edx, edx
cmp ecx, dword [ebp - 4]
sete dl
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + eax*4 + 0x8b8], edx
jmp 0x49551b
mov edx, dword [ebp - 0xc]
add edx, 0x894
push edx
mov eax, dword [0x5348f8]
push eax
call fcn.004ae4ef
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x495560
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1af0], 0
jne 0x49557a
jmp 0x495753
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x6f6a8], 0
je 0x49566d
cmp dword [ebp + 8], 0
jne 0x49561e
push 0x52fa5c
push 0
push str.bSpdifDolbyAc3EnableOld
push 0x51ec60
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 4]
mov dword [edx + 0x727a0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x19f4], 0
je 0x4955c9
mov dword [ebp - 8], 0x51ec7c
jmp 0x4955d0
mov dword [ebp - 8], 0x51ec80
push 0x52fa5c
mov ecx, dword [ebp - 8]
push ecx
push 0x51ec84
push 0x51ecb0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [ebp - 4]
cmp dword [edx + 0x7357c], 0
je 0x4955fe
mov dword [ebp - 0xc], 0x51eccc
jmp 0x495605
mov dword [ebp - 0xc], 0x51ecd0
push 0x52fa5c
mov eax, dword [ebp - 0xc]
push eax
push 0x51ecd4
push 0x51ecfc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x727a0], 0
je 0x495668
mov edx, dword [ebp - 4]
mov dword [edx + 0x19f4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x19f4]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0048182b
mov edx, dword [ebp - 4]
mov dword [edx + 0x7357c], 0
mov ecx, dword [ebp - 4]
call fcn.004953c4
push 0
mov ecx, dword [ebp - 4]
call fcn.004111e4
jmp 0x495741
mov eax, dword [ebp - 4]
cmp dword [eax + 0x727a0], 0
je 0x495682
mov dword [ebp - 0x10], 0x51ed18
jmp 0x495689
mov dword [ebp - 0x10], 0x51ed1c
push 0x52fa5c
mov ecx, dword [ebp - 0x10]
push ecx
push 0x51ed20
push 0x51ed50
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [ebp - 4]
cmp dword [edx + 0x727a0], 0
je 0x4956bb
mov eax, dword [ebp - 4]
mov dword [eax + 0x727a0], 0
push 0x52fa5c
push 0
push 0x51ed6c
push 0x51ed94
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x7357c], eax
je 0x4956fd
push 0x52fa5c
push 0
push str.bDolbyVshEnableOld
push 0x51edd8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 4]
mov dword [edx + 0x7357c], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.004111e4
push 0x23
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x52fa5c
push 0
push str.bMasterVolumeMuteOld
push str.MIXER_WINDOW
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x19f4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x19f4]
push eax
mov ecx, dword [ebp - 4]
call fcn.0048182b
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x727a0]
mov dword [ecx + 0x1a0c], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4aba68
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x28
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [ebp - 0x24]
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 2
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0x10
lea ecx, [ebp - 0x34]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esp, ebp
pop ebp
ret
Function at 0x4abada
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x644
mov dword [ebp - 0x220], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x218], 4
push str.SystemCurrentControlSetControlClass4d36e96c_e325_11ce_bfc1_08002be10318
lea eax, [ebp - 0x214]
push eax
call fcn.004ba79a
add esp, 8
lea ecx, [ebp - 0x220]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x214]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x4abcb4
cmp dword [ebp - 0xc], 0
jne 0x4abcb4
mov dword [ebp - 0x228], 0x104
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x430]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x4abca0
mov dword [ebp - 0x63c], 0
lea ecx, [ebp - 0x430]
push ecx
lea edx, [ebp - 0x214]
push edx
push str._s_sGlobalSettings
lea eax, [ebp - 0x638]
push eax
call fcn.004ba7bf
add esp, 0x10
lea ecx, [ebp - 8]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x638]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x63c], eax
mov eax, 1
test eax, eax
je 0x4abc1c
mov dword [ebp - 0x640], 0
jmp 0x4abc31
lea ecx, [ebp - 0x638]
push ecx
call fcn.0040d5a0
add esp, 4
mov dword [ebp - 0x640], eax
mov edx, 1
test edx, edx
je 0x4abc46
mov dword [ebp - 0x644], 0
jmp 0x4abc59
push 0x523974
call fcn.0040d5a0
add esp, 4
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x63c], 0
jne 0x4abca0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x523978
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x63c], 0
jne 0x4abca0
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 0x21c]
add ecx, 1
mov dword [ebp - 0x21c], ecx
jmp 0x4abb5a
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 1
jne 0x4abcce
mov eax, 1
jmp 0x4abcd0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4ae3bb
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x894
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x88c], eax
cmp dword [ebp - 0x88c], 0xffffffff
jne 0x4ae403
push str.GetHDAudCapsAndPolicyState:_CreateFile:_INVALID_HANDLE_VALUE_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae4e9
push 0
lea ecx, [ebp - 0x894]
push ecx
push 0x808
lea edx, [ebp - 0x888]
push edx
push 0
push 0
push 0x1d6000
mov eax, dword [ebp - 0x88c]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x890], eax
cmp dword [ebp - 0x890], 0
je 0x4ae449
cmp dword [ebp - 0x894], 0x808
jae 0x4ae468
mov ecx, dword [ebp - 0x88c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.GetHDAudCapsAndPolicyState:_DeviceIoControl:_IOCTL_HDAUD_GET_CAPS_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae4e9
mov ecx, 0x202
lea esi, [ebp - 0x888]
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
push 0
lea edx, [ebp - 0x894]
push edx
push 0x80
lea eax, [ebp - 0x80]
push eax
push 0
push 0
push 0x1d6004
mov ecx, dword [ebp - 0x88c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x890], eax
mov edx, dword [ebp - 0x88c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x890], 0
je 0x4ae4c8
cmp dword [ebp - 0x894], 0x80
jae 0x4ae4d7
push str.GetHDAudCapsAndPolicyState:_DeviceIoControl:_IOCTL_HDAUD_GET_POLICY_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae4e9
mov ecx, 0x20
lea esi, [ebp - 0x80]
mov edi, dword [ebp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ae4ef
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xffffffff
jne 0x4ae534
push str.SetHDAudPolicyState:_CreateFile:_INVALID_HANDLE_VALUE_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae599
mov esi, dword [ebp + 0xc]
mov ecx, 0x20
lea edi, [ebp - 0x80]
rep movsd dword es:[edi], dword [esi]
push 0
lea ecx, [ebp - 0x8c]
push ecx
push 0
push 0
push 0x80
lea edx, [ebp - 0x80]
push edx
push 0x1da008
mov eax, dword [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x84]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x88], 0
jne 0x4ae594
push str.SetHDAudPolicyState:_DeviceIoControl:_IOCTL_HDAUD_SET_POLICY_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae599
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ae59f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc14
lea ecx, [ebp - 0xc08]
call fcn.004517d0
lea ecx, [ebp - 0x804]
call fcn.00451800
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc0c], eax
cmp dword [ebp - 0xc0c], 0xffffffff
jne 0x4ae5fb
push str.SendHDAudCommand:_CreateFile:_INVALID_HANDLE_VALUE_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae68e
push 0x404
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0xc08]
push edx
call fcn.004bae30
add esp, 0xc
push 0
lea eax, [ebp - 0xc14]
push eax
push 0x804
lea ecx, [ebp - 0x804]
push ecx
push 0x404
lea edx, [ebp - 0xc08]
push edx
push 0x220004
mov eax, dword [ebp - 0xc0c]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0xc10], eax
mov ecx, dword [ebp - 0xc0c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x804
lea edx, [ebp - 0x804]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.004bae30
add esp, 0xc
cmp dword [ebp - 0xc10], 0
jne 0x4ae689
push str.SendHDAudCommand:_DeviceIoControl:_IOCTL_AZALIABUS_SENDVERBS_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae68e
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4ae692
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffff
jne 0x4ae6ce
push str.GetHDAudPeakMeter:_CreateFile:_INVALID_HANDLE_VALUE_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae731
push 0
lea ecx, [ebp - 0x54]
push ecx
push 0x48
lea edx, [ebp - 0x48]
push edx
push 0
push 0
push 0x1d600c
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x4ae6fc
cmp dword [ebp - 0x54], 0x48
jae 0x4ae715
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.GetHDAudPeakMeter:_DeviceIoControl:_IOCTL_HDAUD_GET_PEAK_METER_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae731
mov ecx, 0x12
lea esi, [ebp - 0x48]
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ae737
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x4ae773
push str.GetHDAudioMultiChannelVolume:_CreateFile:_INVALID_HANDLE_VALUE_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae7d6
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0x24
lea edx, [ebp - 0x24]
push edx
push 0
push 0
push 0x1d6010
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x4ae7a1
cmp dword [ebp - 0x30], 0x24
jae 0x4ae7ba
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.GetHDAudioMultiChannelVolume:_DeviceIoControl:_IOCTL_HDAUD_GET_PEAK_METER_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae7d6
mov ecx, 9
lea esi, [ebp - 0x24]
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ae7dc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x4ae818
push 0x52567c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae86b
mov esi, dword [ebp + 0xc]
mov ecx, 9
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0
push 0
push 0x24
lea edx, [ebp - 0x24]
push edx
push 0x1da014
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c], 0
jne 0x4ae866
push 0x5256fc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae86b
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ae87b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4ae8b5
push 0x525798
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae915
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ecx + 4]
mov dword [ebp - 0x14], eax
mov edx, dword [ecx + 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0xc], eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push 0x10
lea edx, [ebp - 0x18]
push edx
push 0x1da018
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
jne 0x4ae910
push 0x525818
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae915
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4ae919
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x4ae955
push str.SetHDAudioMultiChannelVolume:_CreateFile:_INVALID_HANDLE_VALUE_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae9a8
mov esi, dword [ebp + 0xc]
mov ecx, 5
lea edi, [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
push 0
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0
push 0x14
lea edx, [ebp - 0x14]
push edx
push 0x1da01c
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], 0
jne 0x4ae9a3
push str.SetHDAudioMultiChannelVolume:_DeviceIoControl:_IOCTL_HDAUD_SET_POLICY_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4ae9a8
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ae9ae
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x4ae9eb
push str.HDAudioEqualizer:_CreateFile:_INVALID_HANDLE_VALUE_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4aea9c
cmp dword [ebp + 0xc], 0
je 0x4aea27
push 0
lea ecx, [ebp - 0x38]
push ecx
push 0x2c
lea edx, [ebp - 0x2c]
push edx
push 0
push 0
push 0x1d6020
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x34], eax
push 0x2c
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.004bae30
add esp, 0xc
jmp 0x4aea5b
push 0x2c
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004bae30
add esp, 0xc
push 0
lea edx, [ebp - 0x38]
push edx
push 0
push 0
push 0x2c
lea eax, [ebp - 0x2c]
push eax
push 0x1da024
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x4aea8d
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0xc], 0
je 0x4aea7e
push str.HDAudioEqualizer:_DeviceIoControl:_IOCTL_HDAUD_GET_VIAEQ_PARAMS_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4aea89
push str.HDAudioEqualizer:_DeviceIoControl:_IOCTL_HDAUD_SET_VIAEQ_PARAMS_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4aea9c
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret