joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462340
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 0x208], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x462493
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x204]
xor ecx, ecx
mov edx, 0x200
call fcn.00403094
push 0
push 0
push 0x7200
push edi
call sub.kernel32.dll_SetFilePointer_1
lea esi, [ebp - 0x204]
push 0
lea eax, [ebp - 4]
push eax
push 0x200
lea eax, [ebp - 0x204]
push eax
push edi
call sub.kernel32.dll_ReadFile_1
xor edx, edx
push ebp
push 0x46246b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi + 4]
test eax, eax
je 0x46243a
cmp dword [esi + 8], 0
je 0x46243a
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 8]
mov dword [ebx + 0x3c], eax
lea edx, [ebp - 0x208]
lea eax, [esi + 0xc]
call fcn.00409568
mov edx, dword [ebp - 0x208]
lea eax, [ebx + 0x40]
call fcn.00404688
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x48], eax
lea edx, [ebp - 0x20c]
lea eax, [esi + 0x30]
call fcn.00409568
mov edx, dword [ebp - 0x20c]
lea eax, [ebx + 0x50]
call fcn.00404688
lea edx, [ebp - 0x210]
lea eax, [esi + 0x34]
call fcn.00409568
mov edx, dword [ebp - 0x210]
lea eax, [ebx + 0x4c]
call fcn.00404688
mov eax, dword [esi + 0x134]
mov dword [ebx + 0x54], eax
jmp 0x462461
xor eax, eax
mov dword [ebx + 0x38], eax
xor eax, eax
mov dword [ebx + 0x3c], eax
lea eax, [ebx + 0x40]
call fcn.00404634
xor eax, eax
mov dword [ebx + 0x48], eax
lea eax, [ebx + 0x50]
call fcn.00404634
lea eax, [ebx + 0x4c]
call fcn.00404634
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x462475
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46249a
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.00404658
ret
Function at 0x4639e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, 0x47adec
test edx, edx
jne 0x4639f8
xor eax, eax
pop esi
pop ebx
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0x463ac0
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
sub ecx, 8
cmp ecx, 8
jae 0x463a04
test ecx, ecx
je 0x463adf
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
dec ecx
test ecx, ecx
jne 0x463ac4
xor eax, 0xffffffff
pop esi
pop ebx
ret

Function at 0x464460
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403094
ret

Function at 0x46489c
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
call fcn.0045d878
test al, al
je 0x4648fa
push 1
lea eax, [ebp - 0x14]
push eax
call sub.advapi32.dll_InitializeSecurityDescriptor
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
call sub.advapi32.dll_SetSecurityDescriptorDacl
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x18], 0xffffffff
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], eax
lea ebx, [ebp - 0x20]
push 0xffff
push ebx
push edi
push esi
call sub.kernel32.dll_CreatePipe
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464904
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x46490d
mov eax, dword [ebp - 4]
add esp, 0xffffff88
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00404af0
mov eax, dword [ebp - 8]
call fcn.00404af0
xor eax, eax
push ebp
push 0x464aa0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
test ebx, ebx
je 0x464981
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.0046489c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x50]
mov dword [ebp - 0x24], eax
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x24]
call fcn.00409344
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WriteFile_1
test esi, esi
je 0x464990
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.0046489c
lea eax, [ebp - 0x6c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403094
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], 0x101
mov word [ebp - 0x3c], 5
test ebx, ebx
je 0x4649bd
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
test esi, esi
je 0x4649cd
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404b00
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404b00
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x464a18
mov eax, dword [ebp - 0x78]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x7c]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
sete byte [ebp - 9]
test ebx, ebx
je 0x464a36
mov eax, dword [ebp - 0x24]
call fcn.004095c8
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
test esi, esi
je 0x464a85
push 0
lea eax, [ebp - 0x28]
push eax
push 0xffff
lea eax, [ebp - 0x1007b]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_ReadFile_1
cmp dword [ebp - 0x28], 0
jbe 0x464a73
mov eax, dword [ebp - 0x28]
mov byte [ebp + eax - 0x1007b], 0
lea edx, [ebp - 0x1007b]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x7c]
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464aa7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404658
ret
Function at 0x464df4
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [esp + 4]
mov ebx, dword [eax]
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
imul ecx, dword [esp], 0x9e3779b9
mov esi, dword [esp]
dec esi
test esi, esi
jl 0x464e5f
inc esi
mov dword [esp + 8], esi
mov esi, ebx
shl esi, 4
add esi, dword [edx + 8]
lea edi, [ecx + ebx]
xor esi, edi
mov edi, ebx
shr edi, 5
add edi, dword [edx + 0xc]
xor esi, edi
sub eax, esi
mov esi, eax
shl esi, 4
add esi, dword [edx]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [edx + 4]
xor esi, edi
sub ebx, esi
sub ecx, 0x9e3779b9
dec dword [esp + 8]
jne 0x464e22
mov edx, dword [esp + 4]
mov dword [edx], ebx
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x466ad0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov edi, dword [ebx + 0x24]
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0x466afa
cmp dword [ebx + 0x64], 0
jne 0x466afa
cmp dword [ebx + 0x6c], 0
jne 0x466afa
mov esi, edi
jmp 0x466b88
cmp esi, 0xffffffff
jne 0x466b05
dec esi
jmp 0x466b88
mov eax, dword [ebx + 0x64]
lea edx, [edi + edi]
sub edx, 0x106
cmp eax, edx
jb 0x466b88
mov eax, dword [ebx + 0x30]
lea edx, [eax + edi]
mov ebp, edi
mov ecx, ebp
call fcn.00464ee8
sub dword [ebx + 0x68], edi
sub dword [ebx + 0x64], edi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x466b50
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x466b55
mov word [edx], 0
dec eax
test eax, eax
jne 0x466b36
mov eax, edi
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x466b7c
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x466b81
mov word [edx], 0
dec eax
test eax, eax
jne 0x466b62
add esi, edi
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x466be6
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.00466858
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x466bd1
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x466be6
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x466ada
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46b370
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, edx
and ecx, 0x80000007
jns 0x46b380
dec ecx
or ecx, 0xfffffff8
inc ecx
test ecx, ecx
je 0x46b389
or eax, 0xffffffff
pop ebx
ret
mov ecx, eax
test edx, edx
jns 0x46b392
add edx, 3
sar edx, 2
dec edx
test edx, edx
jl 0x46b3af
inc edx
xor eax, eax
mov ebx, dword [ecx + eax*4]
xor ebx, 0x1321a1d
xor ebx, eax
mov dword [ecx + eax*4], ebx
inc eax
dec edx
jne 0x46b39d
xor eax, eax
pop ebx
ret

Function at 0x46f6a4
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov ebx, eax
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 8], esi
inc esi
je 0x46f791
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0xffff
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_setsockopt
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 0x20
push 0xffff
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_setsockopt
mov dword [esp], 0x10000
push 4
lea eax, [esp + 4]
push eax
push 0x1002
push 0xffff
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_setsockopt
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x10
call fcn.00403094
mov word [esp + 4], 2
mov eax, dword [ebx + 4]
test eax, eax
je 0x46f746
mov eax, dword [eax + 0x18]
mov dword [esp + 8], eax
jmp 0x46f74c
xor eax, eax
mov dword [esp + 8], eax
mov ax, word [ebx + 0xc]
push eax
call sub.wsock32.dll_htons
mov word [esp + 6], ax
push 0x10
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_bind
test eax, eax
je 0x46f77f
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_closesocket
mov dword [ebx + 8], 0xffffffff
mov eax, dword [ebx + 4]
test eax, eax
je 0x46f791
mov edx, dword [eax + 4]
mov eax, dword [ebx + 8]
call fcn.0045f4c4
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x46f7cc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
add esp, 0xfffffff8
mov word [eax + 0x20], 2
push 0x10
lea ebx, [eax + 0x20]
push ebx
push 0
push ecx
push edx
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_sendto
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46f80b
call fcn.004633cc
mov dword [esp], eax
mov byte [esp + 4], 0
mov edx, esp
xor ecx, ecx
mov eax, 0x46f81c
call fcn.00463484
mov eax, ebx
pop ecx
pop edx
pop ebx
ret
Function at 0x470334
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
mov dword [ebp - 0x108], eax
call fcn.0040a794
fstp qword [ebp - 0x118]
wait
jmp 0x47047c
xor eax, eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], 0x186a0
lea eax, [ebp - 0x110]
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push ebp
call fcn.004702c0
pop ecx
push eax
call sub.wsock32.dll_select
test eax, eax
jge 0x470398
push 0x3e8
call sub.kernel32.dll_Sleep_1
jmp 0x47047c
test eax, eax
jle 0x4703eb
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx]
xor eax, eax
push ebp
push 0x4703e4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0x108]
call fcn.004704a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4703eb
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx + 4]
ret
call fcn.0040a794
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x114]
push dword [ebp - 0x118]
call fcn.0045de28
push edx
push eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x38]
cdq
cmp edx, dword [esp + 4]
jne 0x470423
cmp eax, dword [esp]
pop edx
pop eax
jae 0x47047c
jmp 0x470427
pop edx
pop eax
jge 0x47047c
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx]
xor eax, eax
push ebp
push 0x470475
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040a794
fstp qword [ebp - 0x118]
wait
mov eax, dword [ebp - 0x108]
call fcn.004704ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47047c
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx + 4]
ret
call fcn.00406a24
cmp byte [eax + 0x10], 0
jne 0x47049a
mov eax, dword [ebp - 0x108]
cmp byte [eax + 0xd], 0
je 0x470354
mov esp, ebp
pop ebp
ret
Function at 0x408730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4379af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], 0
mov eax, dword [0x447518]
mov dword [esp + 0x24], 1
mov dword [esp + 0xc], eax
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x2c], 2
call fcn.00423ac6
mov ecx, esi
call fcn.00407dd0
fld qword [esp + 0x34]
test eax, eax
je 0x4087ac
call fcn.004147c0
fld qword [esp + 0x34]
and eax, 0xff
mov esi, eax
call fcn.004147c0
xor ecx, ecx
mov cl, ah
and ecx, 0xff
jmp 0x4087d4
call fcn.004147c0
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov esi, edx
mov ecx, 0x3c
cdq
idiv ecx
mov ecx, edx
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov edi, edx
mov ecx, 0xa
cdq
idiv ecx
mov eax, 0x66666667
mov ecx, edx
imul esi
sar edx, 2
mov eax, edx
push ecx
shr eax, 0x1f
add edx, eax
mov eax, esi
mov ebp, edx
mov esi, 0xa
cdq
idiv esi
push edi
lea ecx, [esp + 0x1c]
push edx
push ebp
push str._d_d:_d_d
push ecx
call fcn.00414bea
add esp, 0x18
lea edx, [esp + 0x14]
lea ecx, [esp + 0x34]
push edx
call fcn.00423dbf
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 3
call fcn.00423e8a
mov esi, dword [esp + 0x2c]
push eax
mov ecx, esi
call fcn.00423ac6
mov dword [esp + 0x10], 1
lea ecx, [esp + 0x34]
mov byte [esp + 0x24], 2
call fcn.00423d51
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 1
call fcn.00423d51
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 0
call fcn.00423d51
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x1c
ret 0x10
Function at 0x4092f0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x28]
cmp edi, 0x10
jl 0x409308
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 0xc
mov eax, dword [esp + 0x24]
push 0
push 0
push 3
push 0
push 3
add eax, 4
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409341
push str.SetEaxProperties___faill_from_calling_CreateFile___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 0xc
mov ecx, dword [0x439f90]
mov edx, dword [0x439f94]
mov eax, dword [0x439f98]
mov dword [esp + 8], ecx
mov ecx, dword [0x439f9c]
cmp edi, 0xf
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], edi
ja case.default.0x409379
jmp dword [edi*4 + 0x409408]
mov edi, 1
jmp 0x4093d5
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x28]
push 0
push edx
push 0x38
push eax
lea ecx, [esp + 0x18]
push 0x18
push ecx
push 0x2f0003
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
jmp 0x4093d5
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x28]
push 0
push edx
push 4
push eax
lea ecx, [esp + 0x18]
push 0x18
push ecx
push 0x2f0003
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
jmp 0x4093d5
mov edi, dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x4093fb
push str.GetEaxProperties___fail_from_calling_DeviceIoControl___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 0xc
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret 0xc
Function at 0x409450
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x28]
cmp edi, 0x10
jl 0x409468
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 0xc
mov eax, dword [esp + 0x24]
push 0
push 0
push 3
push 0
push 3
add eax, 4
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4094a1
push str.SetEaxProperties___fail_from_calling_CreateFile___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 0xc
mov ecx, dword [0x439f90]
mov edx, dword [0x439f94]
mov eax, dword [0x439f98]
mov dword [esp + 8], ecx
mov ecx, dword [0x439f9c]
cmp edi, 0xf
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], edi
ja case.default.0x4094d9
jmp dword [edi*4 + 0x409568]
mov edi, 1
jmp 0x409535
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x28]
push 0
push edx
push 0x38
push eax
lea ecx, [esp + 0x18]
push 0x18
push ecx
push 0x2f0003
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
jmp 0x409535
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x28]
push 0
push edx
push 4
push eax
lea ecx, [esp + 0x18]
push 0x18
push ecx
push 0x2f0003
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
jmp 0x409535
mov edi, dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x40955b
push str.SetEaxProperties___fail_from_calling__DeviceIoControl___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 0xc
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret 0xc
Function at 0x409650
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x28]
cmp edi, 2
jb 0x409668
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 0xc
mov eax, dword [esp + 0x24]
push 0
push 0
push 3
push 0
push 3
add eax, 4
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4096a1
push str.GetKaraokProperty___fail_from_caliing_CreateFile___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 0xc
mov eax, dword [0x439fb8]
mov ecx, dword [0x439fb0]
mov edx, dword [0x439fb4]
mov dword [esp + 0x10], eax
mov dword [esp + 8], ecx
mov ecx, dword [0x439fbc]
mov eax, edi
mov dword [esp + 0xc], edx
sub eax, 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], edi
je 0x4096e2
dec eax
je 0x4096e2
xor edi, edi
jmp 0x409705
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x28]
push 0
push edx
push 4
push eax
lea ecx, [esp + 0x18]
push 0x18
push ecx
push 0x2f0003
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x40972b
push str.GetKaraokProperty___fail_from_calling_DeviceIoControl___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 0xc
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret 0xc

Function at 0x409740
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x28]
cmp edi, 2
jb 0x409758
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 0xc
mov eax, dword [esp + 0x24]
push 0
push 0
push 3
push 0
push 3
add eax, 4
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409791
push str.SetKaraokProperty___fail_from_calling_CreateFile___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 0xc
mov eax, dword [0x439fb8]
mov ecx, dword [0x439fb0]
mov edx, dword [0x439fb4]
mov dword [esp + 0x10], eax
mov dword [esp + 8], ecx
mov ecx, dword [0x439fbc]
mov eax, edi
mov dword [esp + 0xc], edx
sub eax, 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], edi
je 0x4097d2
dec eax
je 0x4097d2
xor edi, edi
jmp 0x4097f5
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x28]
push 0
push edx
push 4
push eax
lea ecx, [esp + 0x18]
push 0x18
push ecx
push 0x2f0003
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x40981b
push str.SetKaraokProperty___fail_from_calling_DeviceIoControl___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 0xc
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret 0xc
Function at 0x409830
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x28]
cmp edi, 2
jb 0x409846
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
mov eax, dword [esp + 0x24]
push 0
push 0
push 3
push 0
push 3
add eax, 4
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40987d
push str.GetAvanceEaxProperty___fail_from_caliing_CreateFile___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
mov ecx, dword [0x439fc0]
mov edx, dword [0x439fc4]
mov eax, dword [0x439fc8]
mov dword [esp + 8], ecx
mov ecx, dword [0x439fcc]
mov dword [esp + 0xc], edx
test edi, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], edi
je 0x4098b8
xor edi, edi
jmp 0x4098db
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x28]
push 0
push edx
push 4
push eax
lea ecx, [esp + 0x18]
push 0x18
push ecx
push 0x2f0003
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x4098ff
push str.GetAvanceEaxProperty___fail_from_calling_DeviceIoControl___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret