joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445080
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0xe64]
push edi
test eax, eax
je 0x44510b
mov ecx, dword [eax]
lea esi, [ebx + 0x1fa8]
push esi
push 0x100
push eax
call dword [ecx + 0x24]
test eax, eax
jge 0x4450d7
mov eax, dword [ebx + 0xe64]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp eax, 0x8007001e
je 0x4450c1
cmp eax, 0x80070005
jne 0x4450cf
mov eax, dword [ebx + 0xe64]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
jmp 0x4450b3
test eax, eax
jl 0x445251
mov edi, 0xffffe058
mov eax, esi
sub edi, ebx
mov cl, byte [eax]
mov dl, byte [eax + 0x100]
xor dl, cl
and dl, cl
mov byte [eax + 0x200], dl
inc eax
lea ecx, [edi + eax]
cmp ecx, 0x100
jl 0x4450e0
lea edi, [ebx + 0x20a8]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0xe68]
test eax, eax
je 0x445158
mov edx, dword [eax]
lea ecx, [ebx + 0x22a8]
push ecx
push 0x10
push eax
call dword [edx + 0x24]
test eax, eax
jge 0x445158
mov eax, dword [ebx + 0xe68]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp eax, 0x8007001e
je 0x445142
cmp eax, 0x80070005
jne 0x445150
mov eax, dword [ebx + 0xe68]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
jmp 0x445134
test eax, eax
jl 0x445251
mov eax, dword [0x7e0e34]
mov dword [esp + 0x10], 0
test eax, eax
jle 0x44520d
mov ebp, 0x7e0df0
lea esi, [ebx + 0xf18]
mov eax, dword [ebp]
test eax, eax
je 0x4451f0
mov edx, dword [eax]
push eax
call dword [edx + 0x64]
mov eax, dword [ebp]
lea edx, [esi - 0x30]
push edx
push 0x50
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov edi, eax
test edi, edi
jge 0x4451c8
mov eax, dword [ebp]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edi, eax
cmp edi, 0x8007001e
je 0x4451b5
cmp edi, 0x80070005
jne 0x4451c0
mov eax, dword [ebp]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
jmp 0x4451a3
test edi, edi
jl 0x445257
xor ecx, ecx
mov dl, byte [esi + ecx]
mov al, byte [esi + ecx + 0xaa0]
xor al, dl
mov byte [esi + ecx + 0xaa0], dl
and al, dl
mov byte [esi + ecx + 0x550], al
inc ecx
cmp ecx, 0x10
jl 0x4451ca
test edi, edi
jl 0x445257
mov eax, dword [esp + 0x10]
mov ecx, dword [0x7e0e34]
inc eax
add ebp, 4
add esi, 0x50
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x445178
mov eax, dword [0x7e0df0]
test eax, eax
je 0x44524f
lea esi, [ebx + 0xee8]
lea edi, [ebx + 0xe98]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0x1438]
lea edi, [ebx + 0x13e8]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0x1988]
lea edi, [ebx + 0x1938]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x446770
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, dword [0x7e1454]
mov ecx, 8
sub esp, 0x10
mov dword [0x7e144c], ecx
mov eax, 0x8000
test eax, edx
jne 0x446794
shr eax, 1
inc ecx
test eax, eax
jne 0x446789
mov edx, dword [0x7e0e38]
mov dword [0x7e144c], ecx
mov ecx, 8
mov eax, 0x8000
mov dword [0x7e1444], ecx
test eax, edx
jne 0x4467bb
shr eax, 1
inc ecx
test eax, eax
jne 0x4467b0
mov edx, dword [0x7e1450]
mov dword [0x7e1444], ecx
mov ecx, 8
mov eax, 0x8000
mov dword [0x7e1458], ecx
test eax, edx
jne 0x4467e2
shr eax, 1
inc ecx
test eax, eax
jne 0x4467d7
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
test ebx, ebx
mov dword [0x7e1458], ecx
push edi
je 0x446914
test byte [ebx + 8], 0x20
jne 0x446914
xor eax, eax
xor ecx, ecx
mov ax, word [ebx + 6]
mov cx, word [ebx + 4]
imul eax, ecx
mov edi, dword [ebx + 0xc]
mov ebp, dword [ebx + 0x10]
test eax, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
jle 0x446906
add ebp, 0xc
mov dword [esp + 0x18], ebp
mov cx, word [edi]
mov esi, dword [0x7e1454]
mov eax, ecx
and eax, 0xffff
mov edx, eax
and edx, esi
mov esi, eax
and esi, dword [0x7e0e38]
and eax, dword [0x7e1450]
mov word [ebp + 2], cx
cmp word [edi], 0
mov dword [esp + 0x1c], eax
jne 0x446876
mov eax, ebp
mov ecx, 7
mov word [eax], 0
sub eax, 2
dec ecx
jne 0x446869
jmp 0x4468d8
mov edi, 1
mov ecx, 8
mov ebx, dword [0x7e1450]
sub ecx, edi
mov eax, ecx
imul eax, dword [esp + 0x1c]
shr eax, 3
and eax, ebx
mov ebx, ecx
imul ebx, esi
imul ecx, edx
shr ebx, 3
and ebx, dword [0x7e0e38]
shr ecx, 3
or eax, ebx
mov ebx, dword [0x7e1454]
and ecx, ebx
or eax, ecx
test ax, ax
mov word [ebp], ax
jne 0x4468c3
mov word [ebp], 1
inc edi
sub ebp, 2
cmp edi, 8
jl 0x44687b
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
xor edx, edx
xor ecx, ecx
mov dx, word [ebx + 6]
mov cx, word [ebx + 4]
mov eax, dword [esp + 0x10]
imul edx, ecx
inc eax
add edi, 2
add ebp, 0x10
cmp eax, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
jl 0x446832
mov ebx, dword [ebx]
test ebx, ebx
mov dword [esp + 0x24], ebx
jne 0x4467f8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x446b20
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0xc
test edx, edx
push ebx
push ebp
push esi
push edi
je 0x446c48
test byte [edx + 8], 0x20
jne 0x446c48
xor eax, eax
xor ecx, ecx
mov ax, word [edx + 6]
mov cx, word [edx + 4]
imul eax, ecx
xor esi, esi
test eax, eax
jle 0x446c3e
mov ecx, dword [edx + 0xc]
mov edi, dword [0x7e1454]
mov ebx, dword [0x7e1450]
xor eax, eax
mov ax, word [ecx + esi*2]
mov ebp, dword [0x7e0e38]
mov ecx, eax
and ecx, edi
mov edi, eax
and eax, ebx
and edi, ebp
mov ebx, eax
shr ebx, 2
shr eax, 1
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], eax
mov ebx, edi
mov eax, ecx
shr ebx, 2
shr eax, 2
shr ecx, 1
shr edi, 1
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
lea ebp, [eax + ecx]
add ebx, edi
mov edi, dword [0x7e0e38]
and ebp, dword [0x7e1454]
and ebx, edi
mov edi, dword [esp + 0x20]
or ebp, ebx
mov ebx, dword [esp + 0x10]
add edi, ebx
mov ebx, dword [0x7e1450]
and edi, ebx
or ebp, edi
mov edi, dword [edx + 0x18]
mov word [edi + esi*2], bp
mov edi, dword [0x7e1454]
mov ebp, dword [0x7e0e38]
and ecx, edi
mov edi, dword [esp + 0x14]
and edi, ebp
mov ebp, dword [0x7e1450]
or ecx, edi
mov edi, dword [esp + 0x20]
and edi, ebp
or ecx, edi
mov edi, dword [edx + 0x1c]
mov word [edi + esi*2], cx
mov ebp, dword [0x7e1454]
mov ecx, dword [esp + 0x18]
mov ebx, dword [0x7e0e38]
and eax, ebp
mov ebp, dword [0x7e1450]
and ecx, ebx
or eax, ecx
mov ecx, dword [esp + 0x10]
and ecx, ebp
or eax, ecx
mov ecx, dword [edx + 0x20]
mov word [ecx + esi*2], ax
xor eax, eax
mov ax, word [edx + 6]
xor ecx, ecx
mov cx, word [edx + 4]
inc esi
imul eax, ecx
cmp esi, eax
jl 0x446b56
mov edx, dword [edx]
test edx, edx
jne 0x446b33
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x448390
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esp + 0x20]
push edi
mov eax, dword [esi]
xor edi, edi
mov ecx, dword [eax]
mov eax, dword [esp + 0x2c]
cmp eax, edi
mov dword [esp + 0x1c], ecx
jne 0x4483c2
mov eax, dword [esi + 0x324]
mov edx, dword [ebp]
push eax
push 0x8b
push ebp
call dword [edx + 0x50]
mov ecx, dword [esi]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov edx, dword [ecx + 0x4c]
cmp dword [edx + 4], edi
jle 0x448560
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x4483fd
mov eax, dword [esi + 0xc]
test byte [ebx + eax], 2
jne 0x4483fd
mov eax, dword [esi + 0x328]
test eax, eax
je 0x448536
mov eax, dword [esi + 0x1c4]
test eax, eax
je 0x44844f
mov ecx, dword [esi + 0x90]
push 0
push ebx
push ecx
call fcn.004756f0
mov ebp, dword [esi + 4]
mov ecx, dword [0x4aef34]
add esp, 0xc
add ebp, edi
mov edx, dword [ecx]
push ebp
push eax
mov eax, dword [esi + 8]
add eax, edi
push eax
call dword [edx]
mov ecx, dword [esi + 8]
lea ebp, [esi + 0x32c]
push ebp
lea eax, [ecx + edi]
mov ecx, dword [0x4aef34]
push eax
push eax
mov edx, dword [ecx]
call dword [edx]
mov ebp, dword [esp + 0x24]
jmp 0x44846c
mov ecx, dword [0x4aef34]
lea edx, [esi + 0x32c]
push edx
mov edx, dword [esi + 4]
mov eax, dword [ecx]
add edx, edi
push edx
mov edx, dword [esi + 8]
add edx, edi
push edx
call dword [eax]
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x448536
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x4484d5
mov ecx, dword [esi + 8]
mov eax, dword [ebp]
add ecx, edi
push ecx
push 1
push ebp
call dword [eax + 0x2c]
mov eax, dword [ebp]
push 1
push 0x1d
push ebp
call dword [eax + 0x50]
mov edx, dword [esi]
mov eax, dword [esp + 0x18]
mov ecx, dword [edx + 0x58]
add ecx, eax
mov eax, dword [esp + 0x30]
neg eax
sbb eax, eax
and eax, 4
cmp dword [esp + 0x2c], 0
je 0x4484e7
mov edx, dword [edx + 8]
push edx
mov dx, word [ecx + 0x22]
mov cx, word [ecx + 0x20]
push edx
push ecx
push eax
push 0x152
call fcn.0043cc90
add esp, 0x14
jmp 0x448528
mov edx, dword [esi + 8]
add edx, edi
push edx
push 1
call fcn.0043aed0
add esp, 8
jmp 0x44849a
mov edi, dword [edx + 4]
xor edx, edx
mov dx, word [ecx + 0x20]
push 0
push ebp
mov ebp, dword [esp + 0x24]
mov ebx, dword [edi]
push edx
push ebp
xor ebp, ebp
mov bp, word [ecx + 0x22]
or eax, 0x409
push ebp
push edx
push eax
push edi
call dword [ebx + 0x14]
test eax, eax
jge 0x44851c
push str.Didnt_process_verts_for_model
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x14]
mov edx, dword [esi + 0xc]
mov cl, byte [edx + ebx]
lea eax, [edx + ebx]
and cl, 0xfd
mov byte [eax], cl
mov ecx, dword [esp + 0x18]
mov eax, dword [esi]
add ecx, 0xec
inc ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 0x4c]
add edi, 0x40
mov dword [esp + 0x10], ebx
mov eax, dword [ecx + 4]
mov dword [esp + 0x14], edi
cmp ebx, eax
jl 0x4483de
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0x14
Function at 0x448a30
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x47a1ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x20c]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x18], ebp
je 0x448ae6
mov eax, dword [esi + 0x21c]
mov edi, dword [esi + 0x1bc]
cmp eax, ebp
je 0x448a87
mov ecx, dword [esi + 0x1c4]
cmp ecx, ebp
je 0x448a87
push eax
push ecx
call fcn.00475650
add esp, 8
mov ecx, dword [esi + 0x1c4]
cmp ecx, ebp
je 0x448aa5
mov eax, dword [esi + 0x90]
cmp eax, ebp
je 0x448aa5
push ecx
push eax
call fcn.004755d0
add esp, 8
cmp edi, ebp
je 0x448ad3
push ebx
mov eax, dword [edi + 0x12c]
mov ebx, dword [edi + 0x128]
cmp eax, ebp
je 0x448ac3
push eax
call fcn.00474df0
add esp, 4
push edi
call fcn.004650df
add esp, 4
cmp ebx, ebp
mov edi, ebx
jne 0x448aaa
pop ebx
mov eax, dword [esi + 0x90]
cmp eax, ebp
je 0x448ae6
push eax
call fcn.00475210
add esp, 4
mov eax, dword [esi + 0x78]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp eax, ebp
je 0x448afa
push str.Deleting_duplicate_Objmodel_n
jmp 0x448aff
push str.Deleting_ORIGINAL_Objmodel_n
call edi
cmp dword [esi + 0x78], ebp
jne 0x448b8f
mov eax, dword [esi + 0x88]
cmp eax, ebp
je 0x448b23
push eax
call fcn.004650df
add esp, 4
mov dword [esi + 0x88], ebp
mov eax, dword [esi]
mov eax, dword [eax]
cmp eax, ebp
je 0x448b35
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [esi]
mov dword [edx], ebp
mov eax, dword [esi]
mov eax, dword [eax + 4]
cmp eax, ebp
je 0x448b49
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [esi]
mov dword [edx + 4], ebp
mov eax, dword [esi]
add eax, 8
cmp dword [eax], ebp
je 0x448b60
push eax
call fcn.0043d580
mov eax, dword [esi]
add esp, 4
mov dword [eax + 8], ebp
push esi
call fcn.0043ef20
mov eax, dword [esi + 0x36c]
add esp, 4
cmp eax, ebp
mov dword [esi], ebp
je 0x448b7e
push eax
call fcn.0044b5d0
add esp, 4
cmp word [esi + 0x370], 1
je 0x448b8f
push str.Deleted_an_ORIGINAL_ObjectModel_whose_wUseCount_wasnt_1_______n
call edi
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x448ba2
push eax
call fcn.004650df
add esp, 4
mov dword [esi + 4], ebp
mov eax, dword [esi + 8]
cmp eax, ebp
je 0x448bb5
push eax
call fcn.004650df
add esp, 4
mov dword [esi + 8], ebp
mov eax, dword [esi + 0xc]
cmp eax, ebp
je 0x448bc8
push eax
call fcn.004650df
add esp, 4
mov dword [esi + 0xc], ebp
push esi
call fcn.00448ec0
mov eax, dword [esi + 0x1cc]
add esp, 4
cmp eax, ebp
mov dword [esp + 0x18], 0xffffffff
je 0x448bf5
mov edi, dword [eax + 0x28]
push eax
call fcn.004650df
add esp, 4
cmp edi, ebp
mov eax, edi
jne 0x448be3
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x1cc], ebp
mov dword [esi + 0x1d0], ebp
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x449060
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x78]
test eax, eax
je 0x449095
mov ax, word [esi + 0x372]
push eax
call fcn.00448f30
add esp, 4
dec word [eax + 0x370]
mov ecx, esi
call fcn.00448a30
push esi
call fcn.004650df
add esp, 4
pop esi
ret
cmp word [esi + 0x370], 1
je 0x449083
push str.Parent_Objmodel_not_destroyed___wUseCount_1__must_have_duplicates_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
ret
Function at 0x44b400
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x70]
test eax, eax
je 0x44b435
mov ax, word [esi + 0x37e]
push eax
call fcn.0044b2e0
add esp, 4
dec word [eax + 0x37c]
mov ecx, esi
call fcn.0044ac20
push esi
call fcn.004650df
add esp, 4
pop esi
ret
cmp word [esi + 0x37c], 1
je 0x44b423
push str.Parent_Animmodel_not_destroyed___wUseCount_1__must_have_duplicates_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
ret

Function at 0x44c260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.0044c540
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
and eax, 0xffff
push str.WAVE
push eax
push ebx
mov dword [esi + 0xc], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x44c297
pop edi
pop esi
pop ebx
ret 8
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x44c2b8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push ebx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 8], eax
mov ecx, dword [esi + 4]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
pop ebx
ret 8

Function at 0x4544b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x4c
mov eax, dword [esp + 0x50]
push ebx
mov dword [esp + 0xc], eax
push esi
mov edx, dword [eax + 0x10]
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x24], edx
mov edx, dword [eax + 0x18]
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 0x14]
mov dword [esp + 0x2c], edx
mov edx, dword [eax + 0x20]
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + 0x1c]
mov dword [esp + 0x34], edx
xor edx, edx
mov dx, word [eax + 6]
mov dword [esp + 0x30], ecx
xor ecx, ecx
xor esi, esi
mov cx, word [eax + 4]
lea eax, [edx - 1]
mov dword [esp + 0x18], eax
mov al, 1
lea ebx, [ecx - 1]
mov dword [esp + 8], ecx
test al, bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x58], ebx
je 0x454523
shr word [esp + 0x58], 1
mov bl, byte [esp + 0x58]
inc esi
test al, bl
jne 0x454515
fild dword [esp + 8]
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20], esi
fstp dword [esp + 0x3c]
fild dword [esp + 0x10]
mov dword [esp + 0x54], edx
fstp dword [esp + 0x40]
call fcn.0047b71c
add esp, 4
pop esi
pop ebx
add esp, 0x4c
ret
Function at 0x454970
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.WINMM.dll_mciSendCommandA]
push esi
push 2
push 0x804
push 0xffffffffffffffff
call edi
lea eax, [esp + 0x3c]
mov dword [esp + 0x44], str.cdaudio
push eax
push 0x2000
push 0x803
push esi
call edi
test eax, eax
je 0x4549be
push str.Cant_open_CD_Audio_device__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
mov ebp, dword [esp + 0x40]
lea ecx, [esp + 0x20]
push ecx
push 0x400
push 0x80d
push ebp
mov dword [esp + 0x34], 0xa
call edi
test eax, eax
je 0x4549f4
push esi
push esi
push 0x804
push ebp
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
mov eax, dword [esp + 0x54]
mov dword [esp + 0x1c], esi
mov ebx, eax
mov dword [esp + 0x14], esi
and ebx, 0xff
cmp eax, 0xff
mov dword [esp + 0x18], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], 1
mov dword [esp + 0x30], esi
jne 0x454a4e
lea edx, [esp + 0x10]
mov dword [esp + 0x10], esi
push edx
push 1
push 0x808
push ebp
call edi
push esi
push esi
push 0x804
push ebp
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
lea eax, [esp + 0x2c]
push eax
push 0x110
push 0x814
push ebp
call edi
mov eax, dword [esp + 0x30]
mov ecx, eax
and ecx, 0xff
shr eax, 8
lea ecx, [ecx + ecx*2]
and eax, 0x7f
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea esi, [eax + eax*4]
shl esi, 3
cmp esi, 0x3e8
ja 0x454a99
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
sub esi, 0x3e8
mov eax, 0x45e7b273
mul esi
mov ecx, edx
shr ecx, 0xe
lea eax, [ecx + ecx*2]
and ecx, 0xffff
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, esi
shl edx, 5
sub eax, edx
mov edx, eax
mov eax, 0x10624dd3
mul edx
shr edx, 6
xor eax, eax
mov ah, dl
or eax, ecx
lea ecx, [esp + 0x14]
shl eax, 8
push ecx
push 0xd
or eax, ebx
push 0x806
push ebp
mov dword [esp + 0x2c], eax
call edi
push 0
push 0
push 0x804
push ebp
call edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x454b10
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x174
push esi
call dword [sym.imp.WINMM.dll_mixerGetNumDevs]
test eax, eax
jne 0x454b36
push str.CD_Audio:_No_Mixer_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop esi
add esp, 0x174
ret
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp eax, 1
jle 0x454b48
push str.CD_Audio:__1_Mixer_
call esi
push 0
push 0
push 0
lea eax, [esp + 0x10]
push 0
push eax
call dword [sym.imp.WINMM.dll_mixerOpen]
test eax, eax
je 0x454b70
push str.CD_Audio:_mixerOpen_Failed_
call esi
xor eax, eax
pop esi
add esp, 0x174
ret
mov edx, dword [esp + 4]
lea ecx, [esp + 0xd0]
push 3
push ecx
push edx
mov dword [esp + 0xdc], 0xa8
mov dword [esp + 0xf4], 0x1005
call dword [sym.imp.WINMM.dll_mixerGetLineInfoA]
test eax, eax
je 0x454bb0
push str.CD_Audio:_mixerGetLineInfo_Failed_
call esi
xor eax, eax
pop esi
add esp, 0x174
ret
mov ecx, dword [esp + 0xdc]
lea eax, [esp + 0x3c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 4]
lea edx, [esp + 0x24]
push 2
push edx
push eax
mov dword [esp + 0x30], 0x18
mov dword [esp + 0x3c], 1
mov dword [esp + 0x34], ecx
mov dword [esp + 0x40], 0x94
mov dword [esp + 0x38], 0x50030001
call dword [sym.imp.WINMM.dll_mixerGetLineControlsA]
test eax, eax
je 0x454c0a
push str.CD_Audio:_mixerGetLineControls_Failed_
call esi
xor eax, eax
pop esi
add esp, 0x174
ret
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
push 0
lea edx, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x28], 4
mov dword [esp + 0x2c], edx
mov dword [esp + 0x20], 1
call dword [sym.imp.WINMM.dll_mixerGetControlDetailsA]
test eax, eax
je 0x454c61
push str.CD_Audio:_mixerGetControlDetails_Failed_
call esi
xor eax, eax
pop esi
add esp, 0x174
ret
mov ecx, dword [esp + 0xa0]
mov esi, dword [esp + 0xa4]
sub esi, ecx
lea eax, [ecx + ecx*4]
lea edx, [eax + eax*4]
mov eax, dword [esp + 8]
shl edx, 2
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
sub eax, edx
xor edx, edx
div esi
mov esi, eax
push esi
push str.Old_Vol:__d_n
call fcn.00466cc8
mov edx, dword [esp + 0xac]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0xa8]
mov eax, dword [esp + 0x48]
sub edx, ecx
imul edx, dword [esp + 0x184]
mov dword [esp + 0x18], eax
mov eax, 0x51eb851f
mul edx
add esp, 8
lea eax, [esp + 0xc]
shr edx, 5
add edx, ecx
mov ecx, dword [esp + 4]
push 0
push eax
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x28], 4
mov dword [esp + 0x20], 1
mov dword [esp + 0x14], edx
call dword [sym.imp.WINMM.dll_mixerSetControlDetails]
test eax, eax
je 0x454d20
push str.CD_Audio:_mixerSetControlDetails_Failed_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop esi
add esp, 0x174
ret
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.WINMM.dll_mixerClose]
mov eax, esi
pop esi
add esp, 0x174
ret
Function at 0x454ddf
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [0x7e89d8]
mov eax, dword [0x7e89c8]
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
shr esi, 1
cmp eax, ebx
je 0x454f95
push ebp
push edi
lea edi, [esp + 0x1c]
push 2
push edi
lea edi, [esp + 0x20]
mov edx, dword [eax]
push edi
lea edi, [esp + 0x2c]
push edi
lea edi, [esp + 0x24]
push edi
push ecx
push ebx
push eax
call dword [edx + 0x2c]
mov al, byte [esp + 0x28]
mov edx, dword [esp + 0x14]
neg al
sbb eax, eax
and eax, esi
add eax, edx
mov edi, eax
mov eax, dword [0x7e8a18]
cmp eax, ebx
jne 0x454e78
mov edx, dword [0x7e89e0]
xor eax, eax
mov dword [esp + 0x28], ebx
mov ecx, esi
cmp word [edx + 0xe], 8
mov edx, ecx
setne al
dec eax
and eax, 0x80
mov bl, al
mov bh, bl
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x28]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov dword [0x7e8a10], ebx
mov dword [0x4af298], 0xffffffff
jmp 0x454f7c
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x10]
push ebx
push ecx
push esi
push edi
push eax
call ebp
mov edx, dword [esp + 0x10]
cmp edx, esi
jae 0x454f7c
cmp dword [0x7e8a04], ebx
je 0x454ed4
mov edx, dword [0x7e8a18]
push ebx
push ebx
push 0x2c
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [0x7e8a18]
lea eax, [esp + 0x10]
push ebx
push eax
mov eax, dword [esp + 0x18]
mov ecx, esi
sub ecx, eax
add eax, edi
push ecx
push eax
push edx
mov dword [0x7e89fc], ebx
call ebp
jmp 0x454f7c
mov ebx, dword [0x7e89e0]
mov ecx, esi
sub ecx, edx
xor eax, eax
cmp word [ebx + 0xe], 8
setne al
dec eax
add edi, edx
and eax, 0x80
mov edx, ecx
mov bl, al
mov bh, bl
mov eax, ebx
shl eax, 0x10
mov ax, bx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [0x7e8a18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [0x7e88a8]
xor ebx, ebx
cmp al, bl
mov dword [0x7e8a18], ebx
je 0x454f7c
push 0x7e88a8
call fcn.00454d40
add esp, 4
cmp eax, ebx
mov dword [0x7e8a18], eax
jne 0x454f45
mov dword [0x7e8a10], ebx
jmp 0x454f76
push ebx
push ebx
push 0x28
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [0x7e8a18]
lea ecx, [esp + 0x10]
push ebx
push ecx
push 4
push 0x7e89c4
push edx
call ebp
mov eax, dword [0x7e89a8]
mov dword [0x7e89fc], ebx
mov dword [0x7e8a04], eax
mov byte [0x7e88a8], bl
mov edx, dword [esp + 0x18]
mov eax, dword [0x7e89c8]
push ebx
push edx
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push esi
push edx
push eax
call dword [ecx + 0x4c]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x14
ret