joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e390
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4f4120
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ecx, dword [0x509c80]
mov edx, dword [0x509c84]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x509c88]
push 4
mov dword [eax + 4], edx
mov edx, dword [0x509c8c]
push 1
mov dword [eax + 8], ecx
push 0x37
push 0
lea ecx, [esp + 0x54]
mov dword [eax + 0xc], edx
call fcn.004585a0
add esp, 0x20
push str.SOFTWARERealtekAudioGUI_INFORMATION
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00401b10
lea eax, [esp + 0x18]
push eax
push 0x2001f
mov dword [esp + 0x34], 1
mov ecx, dword [esp + 0x14]
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x44e4a2
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x3c], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x44e4a2
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44e48c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret 4
cmp dword [esp + 0x34], 0
mov esi, dword [esp + 0x18]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], 0
mov eax, str.AsusGPIOHigh
jne 0x44e4c3
mov eax, str.AsusGPIOLow
push eax
lea ecx, [esp + 0x18]
call fcn.00401b10
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
push 0
push ecx
push esi
mov dword [esp + 0x34], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0x10]
add eax, 1
xor edx, edx
mov ecx, 0x64
div ecx
mov eax, dword [esp + 0x14]
push 4
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], edx
lea edx, [esp + 0x20]
push edx
push 4
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44e541
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x44e54c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44e574
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret 4
Function at 0x44ec50
Capabilities:
Check os version

Disassembly:
cmp dword [0x54af3c], 0
jne 0x44ec6e
push 0x54af38
mov dword [0x54af38], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [0x54af3c], 6
jne 0x44ec86
cmp dword [0x54af40], 2
jne 0x44ec86
mov eax, 1
ret
xor eax, eax
ret

Function at 0x4509e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f1c78
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CConexantSettingUI.0
mov dword [esi + 0x2c], vtable.CConexantSettingUI.1.0
mov dword [esi + 0x30], vtable.CConexantSettingUI.2.0
mov dword [esp + 0x14], 0
lea ecx, [esi + 0x30]
mov dword [esi + 0x2c], vtable.CPropSettingUI.1.0
mov dword [ecx], vtable.CPropSettingUI.0
call fcn.0044a4a0
mov ecx, esi
mov dword [esi], vtable.CConexantSetting.0
call fcn.0048ba90
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4528e0
Capabilities:
Get file size
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
test eax, eax
push ebx
push esi
jne 0x4528f4
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 3
push 0
push 1
mov dword [edi + 4], eax
mov eax, dword [0x54b9f0]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4528ec
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp esi, 0xffffffff
setne al
test eax, eax
je 0x4528ec
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004bb042
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4528ec
mov word [ebx], 0
mov eax, dword [0x54b9f0]
push eax
push esi
push ebx
push 0x50148c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0x50e43c
push str.DefLevel
mov ecx, 0x54b0b0
call fcn.004c539d
mov dword [edi + 8], eax
cmp word [ebx], 0
mov esi, ebx
je 0x4529ba
mov edx, esi
mov ecx, edi
call fcn.00452b20
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4529a0
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 + 2], cx
lea esi, [esi + eax*2 + 2]
jne 0x452992
cmp dword [edi + 0x10], 0
je 0x4529dc
add dword [edi + 8], 1
mov eax, dword [edi + 8]
push eax
push 0x50e43c
push str.DefLevel
mov ecx, 0x54b0b0
call fcn.004c5406
cmp dword [edi + 0xc], 0
jne 0x452a02
push 1
push str.Finished
push str.DefLevel
mov ecx, 0x54b0b0
call fcn.004c5406
mov dword [0x54b04c], 1
push ebx
call fcn.004bb03d
add esp, 4
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452e10
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4f3ee8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x536ed4]
xor eax, esp
mov dword [esp + 0x18], eax
push ebp
push edi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebp, ebp
xor eax, eax
cmp esi, ebp
je 0x452fe7
push ebp
lea edi, [ebx + 4]
push 0x50148c
mov ecx, edi
mov word [esp + 0x18], bp
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
mov word [ebx], bp
mov word [ebx + 2], bp
call fcn.00401e60
push ebp
lea ecx, [ebx + 8]
push 0x50148c
call fcn.00401e60
push 0x26
push esi
mov dword [ebx + 0xc], ebp
call fcn.004d08eb
add esp, 8
test eax, eax
je 0x452f00
push 0x26
push esi
call fcn.004d08eb
sub eax, esi
sar eax, 1
add eax, 1
add esp, 8
cmp eax, 0x7ffffffe
jbe 0x452ebd
mov word [esp + 0x10], bp
jmp 0x452ec8
mov edx, esi
lea ecx, [esp + 0x10]
call fcn.00452860
lea eax, [esp + 0x10]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x452ed0
sub eax, edx
sar eax, 1
cmp eax, 8
jb 0x452f00
push 0x10
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.004cf9a9
mov ecx, eax
add esp, 0xc
shr ecx, 0x10
mov word [ebx], cx
mov word [ebx + 2], ax
push 0x26
push esi
call fcn.004d08eb
add esp, 8
test eax, eax
je 0x452fa5
push 0x5f
push esi
call fcn.004d08eb
add esp, 8
test eax, eax
je 0x452fa5
push esi
mov ecx, edi
call fcn.00401d80
push 0x5f
push esi
call fcn.004d08eb
push 0x26
push esi
mov ebp, eax
call fcn.004d08eb
sub ebp, eax
add esp, 0x10
sar ebp, 1
sub ebp, 1
push ebp
push 0x26
push esi
call fcn.004d08eb
sub eax, esi
sar eax, 1
add esp, 8
add eax, 1
push eax
lea edx, [esp + 0x14]
push edx
mov ecx, edi
call fcn.004034c0
xor ebp, ebp
push eax
mov ecx, edi
mov dword [esp + 0x34], ebp
call fcn.00401de0
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x452fa0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.00443020
push 0x5f
push esi
call fcn.004d08eb
add esp, 8
test eax, eax
je 0x452fcb
push 0x5f
push esi
call fcn.004d08eb
add esp, 8
add eax, 2
push eax
lea ecx, [ebx + 8]
call fcn.00401d80
mov ecx, dword [0x54b9f0]
push ecx
push ebp
push str.MasterVol
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebx + 0xc], eax
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004cf0b8
add esp, 0x28
ret
Function at 0x453400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [0x54b04c], 0
jne 0x45345e
push 0
push str.Finished
push str.DefLevel
mov ecx, 0x54b0b0
call fcn.004c539d
test eax, eax
mov dword [0x54b04c], eax
jne 0x45345e
call fcn.00452a20
mov eax, dword [0x54b9f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x453461
push 1
push str.Finished
push str.DefLevel
mov ecx, 0x54b0b0
call fcn.004c5406
mov dword [0x54b04c], 1
xor eax, eax
ret
mov eax, 1
ret

Function at 0x455d30
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4f512e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [esp + 0x30]
lea ebp, [edi + 0x40c]
call fcn.004bb047
xor ecx, ecx
xor esi, esi
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x455d7f
push 0x80004005
call fcn.00401730
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp], eax
cmp ebx, esi
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x28], esi
mov ecx, dword [esp + 0x34]
mov dword [edi + 0x404], ecx
mov dword [edi + 0x400], edx
mov dword [edi + 0x408], esi
mov dword [edi + 0x410], esi
mov dword [edi + 0x414], eax
je 0x455e69
push esi
push 0x50148c
mov ecx, ebp
call fcn.00401e60
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x455dd6
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [edi + 0x40c]
call fcn.00404ab0
xor ebp, ebp
mov ebx, edi
push esi
push esi
push esi
push esi
mov dword [ebx + 4], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, esi
mov dword [ebx], eax
je 0x455e2a
mov ecx, dword [ebx + 4]
push ecx
mov edx, eax
push edx
mov ecx, ebp
lea esi, [esp + 0x20]
mov eax, edi
call fcn.00455fd0
mov ecx, dword [eax]
mov dword [ebx + 8], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0xc], edx
xor esi, esi
add ebp, 1
add ebx, 0x10
cmp ebp, 0x3f
jl 0x455df6
push esi
push esi
push esi
push esi
mov dword [edi + 0x3f4], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, esi
mov dword [edi + 0x3f0], eax
je 0x455e69
lea eax, [esp + 0x34]
push eax
push esi
push edi
push 0x4560c0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x408], eax
cmp dword [0x54b1b0], esi
jne 0x455e99
mov eax, dword [edi + 0x40c]
push 1
push ecx
sub eax, 0x10
mov dword [esp + 0x3c], esp
mov esi, esp
push eax
call fcn.00401850
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.0045a7c0
add esp, 8
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x456850
Capabilities:
Resume thread

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ebx, [esi + 0xb4]
mov ebp, 0x20
push 0
push 0
push 0
push 0
call edi
mov dword [ebx], eax
add ebx, 4
sub ebp, 1
jne 0x456867
push ebp
push 1
push ebp
push ebp
call edi
push ebp
push ebp
push ebp
push ebp
mov dword [esi + 0x134], eax
call edi
push ebp
push 4
push ebp
push ebp
push esi
push 0x456c00
mov dword [esi + 0x138], eax
call fcn.004c3db0
mov ebp, eax
test ebp, ebp
je 0x45699d
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
lea eax, [esi + 0x13c]
push eax
call ebx
mov ecx, dword [ebp + 0x2c]
push eax
push ecx
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edx, dword [ebp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x140], eax
call edi
push 0
push 4
push 0
push 0
push esi
push 0x456ce0
mov dword [esi + 0x144], eax
call fcn.004c3db0
mov ebp, eax
test ebp, ebp
je 0x45699d
push 2
push 0
push 0
lea eax, [esi + 0x148]
push eax
call ebx
mov ecx, dword [ebp + 0x2c]
push eax
push ecx
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edx, dword [ebp + 0x2c]
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edx
call ebp
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x188], eax
call edi
push 0
push 4
push 0
push 0
push esi
push 0x456d70
mov dword [esi + 0x18c], eax
call fcn.004c3db0
mov edi, eax
test edi, edi
je 0x45699d
push 2
push 0
push 0
add esi, 0x190
push esi
call ebx
push eax
mov eax, dword [edi + 0x2c]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [edi + 0x2c]
push ecx
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x45be50
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4f1978
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0x1c], 0
call fcn.004bb047
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45be96
push 0x80004005
call fcn.00401730
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c], 1
cmp dword [esp + 0x2c], 0
mov eax, 0x50f940
jne 0x45bebc
mov eax, str.failed
cmp dword [esp + 0x34], 0
mov ebp, str.get_Property
jne 0x45becd
mov ebp, str.get_Value
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
push ecx
push eax
push ecx
mov dword [esp + 0x38], esp
add esi, 0xfffffff0
mov edi, esp
push esi
call fcn.00401850
mov ecx, dword [esp + 0x34]
add esp, 4
lea edx, [esp + 0x38]
add eax, 0x10
push edx
mov dword [edi], eax
call fcn.0045bd80
mov byte [esp + 0x24], 2
mov eax, dword [eax]
push eax
push ebp
lea ecx, [esp + 0x20]
push str._RTK___s__s__s___val_d_r_n
push ecx
call fcn.00401af0
mov byte [esp + 0x34], 1
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
add esp, 0x18
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x45bf3d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [edi - 0x10]
mov byte [esp + 0x1c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45bf69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45bf8a
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 0x14
Function at 0x45bfa0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4f1978
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0x1c], 0
call fcn.004bb047
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45bfe6
push 0x80004005
call fcn.00401730
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c], 1
cmp dword [esp + 0x2c], 0
mov eax, 0x50f940
jne 0x45c00c
mov eax, str.failed
cmp dword [esp + 0x34], 0
mov ebp, str.put_Property
jne 0x45c01d
mov ebp, str.put_Value
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
push ecx
push eax
push ecx
mov dword [esp + 0x38], esp
add esi, 0xfffffff0
mov edi, esp
push esi
call fcn.00401850
mov ecx, dword [esp + 0x34]
add esp, 4
lea edx, [esp + 0x38]
add eax, 0x10
push edx
mov dword [edi], eax
call fcn.0045bd80
mov byte [esp + 0x24], 2
mov eax, dword [eax]
push eax
push ebp
lea ecx, [esp + 0x20]
push str._RTK___s__s__s___val_d_r_n
push ecx
call fcn.00401af0
mov byte [esp + 0x34], 1
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
add esp, 0x18
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x45c08d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [edi - 0x10]
mov byte [esp + 0x1c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45c0b9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45c0da
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 0x14
Function at 0x45d960
Capabilities:
Print debug messages

Disassembly:
push ecx
push edi
mov edi, eax
cmp dword [edi + 0x2c], 0
mov dword [esp + 4], 0
je 0x45d982
mov eax, dword [edi + 0x10]
test eax, eax
je 0x45d982
cmp dword [eax + 0xc8], 1
jne 0x45d997
cmp dword [edi + 0x28], 0
je 0x45d99a
mov ecx, edi
call fcn.0045df00
push eax
mov ecx, edi
call fcn.0045e0a0
pop edi
pop ecx
ret
lea eax, [esp + 4]
push eax
call fcn.0045c340
mov ecx, dword [esp + 4]
mov edx, edi
pop edi
add esp, 4
jmp fcn.0045c4a0

Function at 0x45df00
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4f1910
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x45e08a
lea esi, [ecx + 0xc0]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push esi
push eax
call edx
test eax, eax
jne 0x45e08a
call fcn.004bb047
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45df65
push 0x80004005
call fcn.00401730
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], 0
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [ecx + 0x10]
call eax
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call fcn.00401f70
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, dword [esp + 0x14]
mov eax, dword [edi - 0xc]
test eax, eax
jge 0x45dfb5
or eax, 0xffffffff
jmp 0x45dfd0
push 0x5032c0
push edi
call fcn.004ced30
add esp, 8
test eax, eax
jne 0x45dfcc
or eax, 0xffffffff
jmp 0x45dfd0
sub eax, edi
sar eax, 1
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
call fcn.004bb047
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45dff3
push 0x80004005
call fcn.00401730
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push esi
push edi
lea ecx, [esp + 0x20]
push str._RTK__IsInHPXOffMode:_OpMode__s__bInOffMode___d_r_n
push ecx
mov byte [esp + 0x34], 1
call fcn.00401af0
mov ebp, dword [esp + 0x28]
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor edx, edx
test esi, esi
sete dl
lea eax, [ebp - 0x10]
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
mov esi, edx
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45e051
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45e075
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
Function at 0x45e0a0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4f5b48
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x28], 0
je 0x45e0f8
cmp dword [esi + 0xb0], 0
je 0x45e0f8
cmp dword [esp + 0x20], 0
je 0x45e10d
push esi
lea edi, [esp + 0x24]
mov dword [esp + 0x24], 0
call fcn.0045ddb0
mov ecx, dword [esp + 0x20]
mov edx, esi
call fcn.0045c4a0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
mov ecx, dword [esi + 0x10]
mov ebx, dword [esi + 0x94]
call fcn.00440f50
test eax, eax
jne 0x45e13c
mov eax, dword [esi + 0x10]
cmp dword [eax + 0x10c], 3
je 0x45e13c
call fcn.00441050
test eax, eax
je 0x45e142
mov ebx, dword [esi + 0x98]
jmp 0x45e142
mov ebx, dword [esi + 0x90]
test ebx, ebx
jl 0x45e0f8
cmp ebx, dword [esi + 0xcc]
jge 0x45e1c7
mov eax, dword [esi + 0xc8]
lea eax, [eax + ebx*4]
lea edi, [esi + 0xc0]
call fcn.0045e1d0
mov edi, dword [edi]
test edi, edi
je 0x45e0f8
mov esi, dword [esi + 0xb0]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x20]
push edi
push esi
call edx
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.00469270
push esi
push ebx
lea eax, [esp + 0x28]
push str._RTK__pSRSEpInfo__put_OpMode__OpMode__d___:_hr___x_r_n
push eax
mov dword [esp + 0x28], 0
call fcn.00401af0
mov ecx, dword [esp + 0x30]
add esp, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [esp + 0x20]
call fcn.00401fb0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
call fcn.004bb5cf
int3
Function at 0x463ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f17b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CDtsS2ApoSettingUI.0
mov dword [esi + 0x2c], vtable.CDtsS2ApoSettingUI.1.0
mov dword [esi + 0x30], vtable.CDtsS2ApoSettingUI.2.0
mov dword [esp + 0x14], 0
lea ecx, [esi + 0x30]
mov dword [esi + 0x2c], vtable.CPropSettingUI.1.0
mov dword [ecx], vtable.CPropSettingUI.0
call fcn.0044a4a0
mov ecx, esi
mov dword [esi], vtable.CDtsSetting.0
call fcn.0048ba90
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret