joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495ac0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5556e8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x18], eax
push ebp
push edi
mov eax, dword [0x5bc9cc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebp, ebp
xor eax, eax
cmp esi, ebp
je 0x495c97
push ebp
lea edi, [ebx + 4]
push 0x5703b8
mov ecx, edi
mov word [esp + 0x18], bp
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
mov word [ebx], bp
mov word [ebx + 2], bp
call fcn.00402fc0
push ebp
lea ecx, [ebx + 8]
push 0x5703b8
call fcn.00402fc0
push 0x26
push esi
mov dword [ebx + 0xc], ebp
call fcn.0052a2dc
add esp, 8
test eax, eax
je 0x495bb0
push 0x26
push esi
call fcn.0052a2dc
sub eax, esi
sar eax, 1
add eax, 1
add esp, 8
cmp eax, 0x7ffffffe
jbe 0x495b6d
mov word [esp + 0x10], bp
jmp 0x495b78
mov edx, esi
lea ecx, [esp + 0x10]
call fcn.00495580
lea eax, [esp + 0x10]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x495b80
sub eax, edx
sar eax, 1
cmp eax, 8
jb 0x495bb0
push 0x10
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.0052a612
mov ecx, eax
add esp, 0xc
shr ecx, 0x10
mov word [ebx], cx
mov word [ebx + 2], ax
push 0x26
push esi
call fcn.0052a2dc
add esp, 8
test eax, eax
je 0x495c55
push 0x5f
push esi
call fcn.0052a2dc
add esp, 8
test eax, eax
je 0x495c55
push esi
mov ecx, edi
call fcn.0040c050
push 0x5f
push esi
call fcn.0052a2dc
push 0x26
push esi
mov ebp, eax
call fcn.0052a2dc
sub ebp, eax
add esp, 0x10
sar ebp, 1
sub ebp, 1
push ebp
push 0x26
push esi
call fcn.0052a2dc
sub eax, esi
sar eax, 1
add esp, 8
add eax, 1
push eax
lea edx, [esp + 0x14]
push edx
mov ecx, edi
call fcn.0040bda0
xor ebp, ebp
push eax
mov ecx, edi
mov dword [esp + 0x34], ebp
call fcn.00402f40
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x495c50
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.0040b9e0
push 0x5f
push esi
call fcn.0052a2dc
add esp, 8
test eax, eax
je 0x495c7b
push 0x5f
push esi
call fcn.0052a2dc
add esp, 8
add eax, 2
push eax
lea ecx, [ebx + 8]
call fcn.0040c050
mov ecx, dword [0x5c9d78]
push ecx
push ebp
push str.MasterVol
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebx + 0xc], eax
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0052944d
add esp, 0x28
ret
Function at 0x4960f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [0x5c9b9c], 0
jne 0x49614e
push 0
push str.Finished
push str.DefLevel
mov ecx, 0x5c9c18
call fcn.00510303
test eax, eax
mov dword [0x5c9b9c], eax
jne 0x49614e
call fcn.00495740
mov eax, dword [0x5c9d78]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x496151
push 1
push str.Finished
push str.DefLevel
mov ecx, 0x5c9c18
call fcn.0051036c
mov dword [0x5c9b9c], 1
xor eax, eax
ret
mov eax, 1
ret

Function at 0x496160
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x11c], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jae 0x4961a7
call fcn.00496260
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0052944d
add esp, 0x120
ret
call fcn.00498770
cmp eax, 6
ja case.default.0x4961b1
jmp dword [eax*4 + 0x496238]
mov eax, 1
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0052944d
add esp, 0x120
ret
mov eax, 2
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0052944d
add esp, 0x120
ret
mov eax, 3
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0052944d
add esp, 0x120
ret
xor eax, eax
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0052944d
add esp, 0x120
ret
mov ecx, dword [esp + 0x11c]
xor ecx, esp
mov eax, DirectSoundCreate
call fcn.0052944d
add esp, 0x120
ret

Function at 0x496580
Capabilities:
Check os version

Disassembly:
sub esp, 0x170
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
xor edi, edi
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jb 0x496600
call fcn.00498700
test eax, eax
je 0x49667e
test byte [0x5c9d98], 3
jne 0x4965e3
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052944d
add esp, 0x170
ret
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052944d
add esp, 0x170
ret
push edi
push edi
push 3
push edi
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, 1
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
je 0x49667e
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], edi
call fcn.00498f60
test eax, eax
je 0x49665a
cmp dword [esp + 0x2c], edi
jne 0x496675
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], esi
call fcn.00498f60
test eax, eax
je 0x496677
cmp dword [esp + 0x2c], edi
je 0x496677
mov edi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x174]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052944d
add esp, 0x170
ret
Function at 0x4966a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x170
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
xor ebx, ebx
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jb 0x496703
call fcn.00498700
test eax, eax
je 0x49676d
mov eax, dword [0x5c9d98]
shr eax, 2
and eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052944d
add esp, 0x170
ret
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 1
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
je 0x49676d
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 3
call fcn.00498f60
test eax, eax
je 0x496766
cmp dword [esp + 0x2c], ebx
je 0x496766
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x174]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0052944d
add esp, 0x170
ret

Function at 0x496790
Capabilities:
Check os version

Disassembly:
sub esp, 0x170
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
xor ebx, ebx
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jb 0x4967f3
call fcn.00498700
test eax, eax
je 0x49685d
mov eax, dword [0x5c9d98]
shr eax, 3
and eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052944d
add esp, 0x170
ret
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 1
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
je 0x49685d
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 2
call fcn.00498f60
test eax, eax
je 0x496856
cmp dword [esp + 0x2c], ebx
je 0x496856
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x174]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0052944d
add esp, 0x170
ret
Function at 0x496880
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jae 0x4968c9
mov eax, DirectSoundCreate
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0052944d
add esp, 0x118
ret 8
cmp dword [0x5c9ba0], 0
push esi
mov esi, DirectSoundCreate
jne 0x496922
mov eax, 0x5c9988
lea ecx, [ecx]
mov dword [eax], 0
add eax, 8
cmp eax, 0x5c9a28
jl 0x4968e0
mov dword [0x5c9dc4], 0x496a10
mov dword [0x5c9dfc], 0
call fcn.00498eb0
mov dword [0x5c9e60], 0x496bb0
mov dword [0x5c9e90], 0
call fcn.00497f90
xor eax, eax
cmp dword [eax*8 + 0x5c9988], 0
je 0x496938
add eax, 1
cmp eax, 0x14
jl 0x496924
jmp 0x49695d
mov ecx, dword [esp + 0x120]
mov edx, dword [esp + 0x124]
add dword [0x5c9ba0], 1
mov dword [eax*8 + 0x5c9988], ecx
mov dword [eax*8 + 0x5c998c], edx
xor esi, esi
mov ecx, dword [esp + 0x118]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0052944d
add esp, 0x118
ret 8

Function at 0x496980
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
mov eax, DirectSoundCreate
jb 0x4969fa
xor edx, edx
xor ecx, ecx
cmp dword [ecx*8 + 0x5c9988], esi
je 0x4969dc
add ecx, 1
cmp ecx, 0x14
jl 0x4969b6
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0052944d
add esp, 0x118
ret
sub dword [0x5c9ba0], 1
mov dword [ecx*8 + 0x5c9988], edx
jne 0x4969f8
mov dword [0x5c9dc4], edx
mov dword [0x5c9e60], edx
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0052944d
add esp, 0x118
ret

Function at 0x496c00
Capabilities:
Check os version

Disassembly:
sub esp, 0x170
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
xor ebx, ebx
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jb 0x496c60
call fcn.00498700
test eax, eax
je 0x496cc3
mov eax, dword [0x5c9d98]
and eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052944d
add esp, 0x170
ret
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 1
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
je 0x496cc3
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], ebx
call fcn.00498f60
test eax, eax
je 0x496cbc
cmp dword [esp + 0x2c], ebx
je 0x496cbc
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x174]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0052944d
add esp, 0x170
ret
Function at 0x496ce0
Capabilities:
Check os version

Disassembly:
sub esp, 0x170
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
xor ebx, ebx
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jb 0x496d42
call fcn.00498700
test eax, eax
je 0x496da8
mov eax, dword [0x5c9d98]
shr eax, 1
and eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052944d
add esp, 0x170
ret
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 1
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
je 0x496da8
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], edi
call fcn.00498f60
test eax, eax
je 0x496da1
cmp dword [esp + 0x2c], ebx
je 0x496da1
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x174]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0052944d
add esp, 0x170
ret

Function at 0x496dd0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jae 0x496e83
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 1
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
je 0x496e6c
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], ebx
call fcn.00498f60
test eax, eax
je 0x496e65
cmp dword [esp + 0x30], ebx
je 0x496e65
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret
mov al, byte [0x5c9d98]
mov ecx, dword [esp + 0x174]
and al, 1
neg al
pop edi
pop esi
pop ebx
sbb eax, eax
and eax, dword [0x5c9d84]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret
Function at 0x496eb0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jae 0x496f63
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, 1
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
je 0x496f4c
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], esi
call fcn.00498f60
test eax, eax
je 0x496f45
cmp dword [esp + 0x30], ebx
je 0x496f45
mov ebx, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret
mov al, byte [0x5c9d98]
mov ecx, dword [esp + 0x174]
and al, 2
neg al
pop edi
pop esi
pop ebx
sbb eax, eax
and eax, dword [0x5c9d88]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret

Function at 0x496f90
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jae 0x49704b
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 1
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
je 0x497034
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 3
call fcn.00498f60
test eax, eax
je 0x49702d
cmp dword [esp + 0x30], ebx
je 0x49702d
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret
mov al, byte [0x5c9d98]
mov ecx, dword [esp + 0x174]
and al, 4
neg al
pop edi
pop esi
pop ebx
sbb eax, eax
and eax, dword [0x5c9d8c]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret
Function at 0x497080
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jae 0x49713b
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 1
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
je 0x497124
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 2
call fcn.00498f60
test eax, eax
je 0x49711d
cmp dword [esp + 0x30], ebx
je 0x49711d
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret
mov al, byte [0x5c9d98]
mov ecx, dword [esp + 0x174]
and al, 8
neg al
pop edi
pop esi
pop ebx
sbb eax, eax
and eax, dword [0x5c9d90]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret

Function at 0x497170
Capabilities:
Check os version

Disassembly:
sub esp, 0x174
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x16c], eax
push esi
push edi
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jae 0x497226
xor edi, edi
push edi
push edi
push 3
push edi
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x40], edi
je 0x49720d
push edi
lea ecx, [esp + 0x10]
push ecx
push edi
push edi
push 0x34
lea edx, [esp + 0x24]
push edx
push 0x222000
push esi
mov dword [esp + 0x2c], 0x34
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [0x5c9e94]
push edi
push edi
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x16c]
xor ecx, esp
call fcn.0052944d
add esp, 0x174
ret
test byte [0x5c9d98], 1
je 0x49724e
mov ecx, 0x11
mov esi, 0x5c9d80
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x10]
mov dword [esp + 0x14], ebx
call fcn.00498410
jmp 0x497250
xor eax, eax
mov ecx, dword [esp + 0x174]
neg eax
sbb eax, eax
pop edi
and eax, 0x80000000
pop esi
xor ecx, esp
add eax, 0x80000000
call fcn.0052944d
add esp, 0x174
ret
Function at 0x497280
Capabilities:
Check os version

Disassembly:
sub esp, 0x158
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x154], eax
push esi
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x40], 6
jae 0x49733a
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 8], 1
mov dword [esp + 0x14], edi
je 0x497322
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x34
lea edx, [esp + 0x1c]
push edx
push 0x222000
push esi
mov dword [esp + 0x24], 0x34
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [0x5c9e94]
push 0
push 0
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x154]
xor ecx, esp
call fcn.0052944d
add esp, 0x158
ret
mov eax, edi
call fcn.00498370
mov ecx, dword [esp + 0x158]
neg eax
sbb eax, eax
and eax, 0x80000000
pop esi
xor ecx, esp
add eax, 0x80000000
call fcn.0052944d
add esp, 0x158
ret

Function at 0x497370
Capabilities:
Check os version

Disassembly:
sub esp, 0x158
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x154], eax
push esi
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x40], 6
jae 0x49742a
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 8], 3
mov dword [esp + 0x14], edi
je 0x497412
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x34
lea edx, [esp + 0x1c]
push edx
push 0x222000
push esi
mov dword [esp + 0x24], 0x34
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [0x5c9e94]
push 0
push 0
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x154]
xor ecx, esp
call fcn.0052944d
add esp, 0x158
ret
mov eax, edi
call fcn.004983c0
mov ecx, dword [esp + 0x158]
neg eax
sbb eax, eax
and eax, 0x80000000
pop esi
xor ecx, esp
add eax, 0x80000000
call fcn.0052944d
add esp, 0x158
ret
Function at 0x497460
Capabilities:
Check os version

Disassembly:
sub esp, 0x174
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x16c], eax
push esi
push edi
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jae 0x49751c
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], 2
mov dword [esp + 0x1c], ebx
je 0x497503
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x34
lea edx, [esp + 0x24]
push edx
push 0x222000
push esi
mov dword [esp + 0x2c], 0x34
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [0x5c9e94]
push 0
push 0
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x16c]
xor ecx, esp
call fcn.0052944d
add esp, 0x174
ret
test byte [0x5c9d98], 8
je 0x497544
mov ecx, 0x11
mov esi, 0x5c9d80
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x10]
mov dword [esp + 0x20], ebx
call fcn.00498410
jmp 0x497546
xor eax, eax
mov ecx, dword [esp + 0x174]
neg eax
sbb eax, eax
pop edi
and eax, 0x80000000
pop esi
xor ecx, esp
add eax, 0x80000000
call fcn.0052944d
add esp, 0x174
ret

Function at 0x4976e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd0
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x20119
xor esi, esi
push esi
push 0x582c64
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4977fe
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push esi
push str.RenProperties
mov edi, 0x60
push ecx
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x497753
cmp dword [esp + 0xc], edi
jne 0x497753
cmp dword [esp + 0x18], 0xaee0aee0
jne 0x497753
lea esi, [edi - 0x5f]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4977fe
mov ecx, 0x18
mov esi, ebx
lea edi, [esp + 0x78]
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, 0x18
lea esi, [esp + 0x1c]
mov edi, ebx
push 0xffffffffffffffff
rep movsd dword es:[edi], dword [esi]
push str.LoadEQInfo_successful
mov ecx, ebx
call fcn.00497b30
cmp dword [ebp + 8], 0
je 0x4977fe
mov eax, dword [ebx + 0x60]
test eax, eax
je 0x4977fe
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esp + 0x84]
je 0x4977b6
mov edx, dword [ebx + 0x90]
push edx
push ecx
push 0
call eax
mov eax, dword [ebx + 0x90]
mov ecx, dword [ebx + 0x60]
push eax
push 0
push 1
call ecx
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x80]
je 0x4977e2
mov edx, dword [ebx + 0x90]
push edx
push eax
mov eax, dword [ebx + 0x60]
push 2
call eax
mov eax, dword [esp + 0x50]
cmp eax, dword [esp + 0xb0]
je 0x4977fe
mov ecx, dword [ebx + 0x90]
mov edx, dword [ebx + 0x60]
push ecx
push eax
push 3
call edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4