joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413a9b
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4c7008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x413ae6
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00413c3a
test al, al
jne 0x413ae0
sub edx, 2
cmp edx, edi
jne 0x413ac6
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x413b08
lea eax, [edi + 2]
cmp edx, eax
je 0x413b08
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004139e7
add esp, 0x10
jmp 0x413c02
push esi
lea ecx, [ebp - 0x255]
call fcn.00413c3a
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413b4b
push dword [ebp - 0x25c]
jmp 0x413af8
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x413b88
cmp word [ebp - 0x226], 0
je 0x413ba9
cmp word [ebp - 0x226], ax
jne 0x413b88
cmp word [ebp - 0x224], 0
je 0x413ba9
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004139e7
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x413bf5
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x413b62
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x413bdd
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x413c02
push 0x413817
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00418d00
add esp, 0x10
jmp 0x413bd2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040661f
leave
ret

Function at 0x414659
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x41466a
pop esi
ret
push ebx
push edi
push esi
call fcn.00414622
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0040fa1c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x414692
push ebx
push esi
push edi
call fcn.00407b10
add esp, 0xc
push 0
call fcn.0040f9e2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x414a56
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004146a7
Function at 0x41c200
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41c22d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41c22d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40983f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0xc3
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], 0xa
ja case.0x409867.8
mov edx, dword [ebp - 0x3c]
jmp dword [edx*4 + 0x409a27]
mov eax, dword [ebp + 0xc]
push eax
push 0x4eabec
lea ecx, [ebp - 0x34]
push ecx
call fcn.004ba7bf
add esp, 0xc
push 0x52fa5c
push 0x104
mov edx, dword [ebp - 0x38]
add edx, 0x948
push edx
push 0x4eac10
lea eax, [ebp - 0x34]
push eax
push 0x4eac38
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp case.0x409867.8
push 0x52fa5c
push 0x104
mov ecx, dword [ebp - 0x38]
add ecx, 0x948
push ecx
push 0x4eac54
push str.eq_classic_info
push 0x4eac9c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp case.0x409867.8
push 0x52fa5c
push 0x104
mov edx, dword [ebp - 0x38]
add edx, 0x948
push edx
push 0x4eacb8
push str.eq_vocal_info
push 0x4eacfc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp case.0x409867.8
push 0x52fa5c
push 0x104
mov eax, dword [ebp - 0x38]
add eax, 0x948
push eax
push 0x4ead18
push str.eq_jazz_info
push 0x4ead5c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp case.0x409867.8
push 0x52fa5c
push 0x104
mov ecx, dword [ebp - 0x38]
add ecx, 0x948
push ecx
push 0x4ead78
push str.eq_pop_info
push 0x4eadb8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp case.0x409867.8
push 0x52fa5c
push 0x104
mov edx, dword [ebp - 0x38]
add edx, 0x948
push edx
push 0x4eadd4
push str.eq_rock_info
push 0x4eae18
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp case.0x409867.8
push 0x52fa5c
push 0x104
mov eax, dword [ebp - 0x38]
add eax, 0x948
push eax
push 0x4eae34
push str.eq_dance_info
push 0x4eae78
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp case.0x409867.8
push 0x52fa5c
push 0x104
mov ecx, dword [ebp - 0x38]
add ecx, 0x948
push ecx
push 0x4eae94
push str.eq_party_info
push 0x4eaed8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp case.0x409867.8
push 0x52fa5c
push 0x104
mov edx, dword [ebp - 0x38]
add edx, 0x948
push edx
push str.0_0_0_0_0_0_0_0_0_0
push str.eq_default_info
push 0x4eaf3c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [ebp - 0x38]
add eax, 0x948
push eax
mov ecx, dword [ebp - 0x38]
call fcn.00409bcf
mov esp, ebp
pop ebp
ret 8
Function at 0x40a173
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0x73990
call fcn.0040d5e0
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 9
jg 0x40a198
jmp 0x40a394
mov ecx, dword [ebp - 0x44]
add ecx, 0x73990
call fcn.004047c0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
jmp 0x40a1ba
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x3c]
sub edx, 1
cmp dword [ebp - 0x38], edx
jge 0x40a2b3
mov eax, dword [ebp - 0x38]
add eax, 1
push eax
push 0x4eb26c
lea ecx, [ebp - 0x34]
push ecx
call fcn.004ba7bf
add esp, 0xc
push 0x52fa5c
push 0x104
mov edx, dword [ebp - 0x44]
add edx, 0x948
push edx
push 0x52f87c
lea eax, [ebp - 0x34]
push eax
push 0x4eb290
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp - 0x38]
push ecx
push 0x4eb2ac
lea edx, [ebp - 0x34]
push edx
call fcn.004ba7bf
add esp, 0xc
push 0x52fa5c
mov eax, dword [ebp - 0x44]
add eax, 0x948
push eax
lea ecx, [ebp - 0x34]
push ecx
push 0x4eb2d0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [ebp - 0x38]
add edx, 1
push edx
push 0x4eb2ec
lea eax, [ebp - 0x34]
push eax
call fcn.004ba7bf
add esp, 0xc
push 0x52fa5c
push 0x104
mov ecx, dword [ebp - 0x44]
add ecx, 0x948
push ecx
push 0x52f880
lea edx, [ebp - 0x34]
push edx
push 0x4eb310
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [ebp - 0x38]
push eax
push 0x4eb32c
lea ecx, [ebp - 0x34]
push ecx
call fcn.004ba7bf
add esp, 0xc
push 0x52fa5c
mov edx, dword [ebp - 0x44]
add edx, 0x948
push edx
lea eax, [ebp - 0x34]
push eax
push 0x4eb350
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x40a1b1
mov ecx, dword [ebp - 0x3c]
sub ecx, 1
push ecx
push 0x4eb36c
lea edx, [ebp - 0x34]
push edx
call fcn.004ba7bf
add esp, 0xc
push 0x52fa5c
push 0x52f884
lea eax, [ebp - 0x34]
push eax
push 0x4eb390
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0x3c]
sub ecx, 1
push ecx
push str.eq_preset__d_info
lea edx, [ebp - 0x34]
push edx
call fcn.004ba7bf
add esp, 0xc
push 0x52fa5c
push 0x52f888
lea eax, [ebp - 0x34]
push eax
push 0x4eb3d0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0x40]
push ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0x73990
call fcn.0040d640
mov edx, dword [ebp - 0x3c]
sub edx, 1
push edx
push 0x4eb3ec
lea eax, [ebp - 0x34]
push eax
call fcn.004ba7bf
add esp, 0xc
push 0x52fa5c
lea ecx, [ebp - 0x34]
push ecx
push 0x4eb3f4
push 0x4eb414
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [ebp - 0x3c]
sub edx, 1
cmp dword [ebp - 0x40], edx
jge 0x40a377
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x73990
call fcn.004047f0
jmp 0x40a38c
mov ecx, dword [ebp - 0x40]
sub ecx, 1
push ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0x73990
call fcn.004047f0
mov ecx, dword [ebp - 0x44]
call fcn.0040a479
mov esp, ebp
pop ebp
ret
Function at 0x40a398
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x40], ecx
push 0x52fa5c
push 0
push str.eq_preset_count
push 0x4eb450
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x40]
add ecx, 0x73990
call fcn.0040d670
mov dword [ebp - 0x38], 0
jmp 0x40a3db
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x3c]
jge 0x40a475
mov edx, dword [ebp - 0x38]
push edx
push str.eq_preset__d_name
lea eax, [ebp - 0x34]
push eax
call fcn.004ba7bf
add esp, 0xc
cmp dword [ebp - 0x38], 9
jg 0x40a431
mov ecx, dword [ebp - 0x40]
add ecx, 0x2820
push ecx
push 0x104
mov edx, dword [ebp - 0x40]
add edx, 0x948
push edx
push 0x52f88c
lea eax, [ebp - 0x34]
push eax
push 0x4eb490
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x40a459
push 0x52fa5c
push 0x104
mov ecx, dword [ebp - 0x40]
add ecx, 0x948
push ecx
push 0x52f890
lea edx, [ebp - 0x34]
push edx
push 0x4eb4ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [ebp - 0x40]
add eax, 0x948
push eax
mov ecx, dword [ebp - 0x40]
add ecx, 0x73990
call fcn.0040d610
jmp 0x40a3d2
mov esp, ebp
pop ebp
ret
Function at 0x40d700
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x52fa5c
push 0x104
mov eax, dword [ebp - 4]
add eax, 0x948
push eax
push 0x52f8a0
push 0x4ec348
push 0x4ec370
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp - 4]
add ecx, 0x72754
push ecx
mov edx, dword [ebp - 4]
add edx, 0x948
push edx
call fcn.004a87d4
add esp, 8
push 0x52fa5c
push 0x104
mov eax, dword [ebp - 4]
add eax, 0x948
push eax
push 0x52f8a4
push str.dolby_dev_txt_rect
push 0x4ec3b4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp - 4]
add ecx, 0x72774
push ecx
mov edx, dword [ebp - 4]
add edx, 0x948
push edx
call fcn.004a87d4
add esp, 8
mov ecx, dword [ebp - 4]
call fcn.0040e32a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1af0], 0
je 0x40d7bd
mov ecx, dword [ebp - 4]
call fcn.0040d7c1
mov ecx, dword [ebp - 4]
call fcn.0040ddd8
push 1
mov ecx, dword [ebp - 4]
call fcn.00495560
mov esp, ebp
pop ebp
ret
Function at 0x410e56
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [0x5348f8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x410e98
push str.IO_GetDolbyParameters:_CreateFile:_INVALID_HANDLE_VALUE_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x410f93
cmp dword [ebp + 0xc], 0
jne 0x410ea9
mov ecx, dword [ebp + 8]
mov dword [ecx], 1
jmp 0x410eb8
cmp dword [ebp + 0xc], 1
jne 0x410eb8
mov edx, dword [ebp + 8]
mov dword [edx], 2
push 0
lea eax, [ebp - 0xc]
push eax
push 0x38
mov ecx, dword [ebp + 8]
push ecx
push 0x38
mov edx, dword [ebp + 8]
push edx
push 0x1d60ac
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x410f12
mov ecx, 1
test ecx, ecx
je 0x410ef4
mov dword [ebp - 0x14], 0
jmp 0x410f0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IO_GetDolbyParameters_IOCTRL_ERROR:__d
call fcn.0040d5a0
add esp, 8
mov dword [ebp - 0x14], eax
xor eax, eax
jmp 0x410f93
mov edx, 1
test edx, edx
je 0x410f24
mov dword [ebp - 0x18], 0
jmp 0x410f8e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x28]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x30]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.Get::_d__d__d__d__d__d__d__d__d__d__d__d__d_n
call fcn.0040d5a0
add esp, 0x38
mov dword [ebp - 0x18], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x410f99
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [0x5348f8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x410fdb
push str.IO_SetDolbyParameters:_CreateFile:_INVALID_HANDLE_VALUE_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4110d6
cmp dword [ebp + 0xc], 0
jne 0x410fec
mov ecx, dword [ebp + 8]
mov dword [ecx], 1
jmp 0x410ffb
cmp dword [ebp + 0xc], 1
jne 0x410ffb
mov edx, dword [ebp + 8]
mov dword [edx], 2
push 0
lea eax, [ebp - 0xc]
push eax
push 0x38
mov ecx, dword [ebp + 8]
push ecx
push 0x38
mov edx, dword [ebp + 8]
push edx
push 0x1da0b0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x411055
mov ecx, 1
test ecx, ecx
je 0x411037
mov dword [ebp - 0x14], 0
jmp 0x41104e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IO_SetDolbyParameters_IOCTRL_ERROR:__d_n
call fcn.0040d5a0
add esp, 8
mov dword [ebp - 0x14], eax
xor eax, eax
jmp 0x4110d6
mov edx, 1
test edx, edx
je 0x411067
mov dword [ebp - 0x18], 0
jmp 0x4110d1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x28]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x30]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.Set::_d__d__d__d__d__d__d__d__d__d__d__d__d_n
call fcn.0040d5a0
add esp, 0x38
mov dword [ebp - 0x18], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x411591
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x411606
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14134], 0
jne 0x411604
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x7357c], 0
je 0x4115c1
mov dword [ebp - 8], 0x4ed224
jmp 0x4115c8
mov dword [ebp - 8], 0x4ed228
push 0x52fa5c
mov edx, dword [ebp - 8]
push edx
push 0x4ed22c
push 0x4ed25c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x7357c], 1
jne 0x411604
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x7357c], 0
push 0
mov ecx, dword [ebp - 4]
call fcn.004112ed
jmp 0x411645
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14134], 0
jne 0x411645
push 0x52fa5c
push 0
push str.bDolbyVshEnBySpkTestOld
push 0x4ed2a8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x411645
mov eax, dword [ebp - 4]
mov dword [eax + 0x7357c], 1
push 0
mov ecx, dword [ebp - 4]
call fcn.004112ed
mov esp, ebp
pop ebp
ret 4

Function at 0x4116f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x52fa5c
push 0x104
mov eax, dword [ebp - 4]
add eax, 0x948
push eax
push 0x52f924
mov ecx, dword [ebp + 8]
push ecx
push 0x4edd9c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
add eax, 0x948
push eax
call fcn.004a87d4
add esp, 8
mov esp, ebp
pop ebp
ret 8
Function at 0x412454
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b64], 0
jne 0x41246c
jmp 0x41251d
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x70d6c], 0
je 0x412504
mov edx, dword [ebp - 4]
cmp dword [edx + 0x714c0], 0
je 0x4124b7
mov eax, dword [ebp - 4]
add eax, 0x2820
push eax
push 0x104
mov ecx, dword [ebp - 4]
add ecx, 0x948
push ecx
push str.Switch_to_Page_for_Headphone
push str.middle_effect_dts_sur_pageswitch_hp
push 0x4eefac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x4124e4
mov edx, dword [ebp - 4]
add edx, 0x2820
push edx
push 0x104
mov eax, dword [ebp - 4]
add eax, 0x948
push eax
push 0x4eefc0
push str.middle_effect_dts_sur_pageswitch_sp
push 0x4ef040
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xa
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x948
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1b64]
call fcn.004caa04
jmp 0x41251d
push 0xa
mov ecx, dword [ebp - 4]
push ecx
push 0x52f940
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x1b64]
call fcn.004caa04
mov esp, ebp
pop ebp
ret 4
Function at 0x414249
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x714d8], 0
jne 0x414286
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x71500], 0
jne 0x414286
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x7152c], 0
jne 0x414286
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x71540], 0
je 0x4143b0
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x71458], 0
push 0x52fa5c
push 0xc3
push 0x4eff40
push 0x4eff5c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 8], eax
push 0x52fa5c
push 0
push 0x4eff78
push 0x4eff9c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00409a53
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x71494], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x71494]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.0040c800
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x714d0], 0
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x714d4], 0
mov ecx, dword [ebp - 0xc]
call fcn.0040c87e
cmp dword [0x5348f8], 0
je 0x4143b0
mov eax, dword [ebp - 0xc]
add eax, 0x894
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x8c
push ecx
mov edx, dword [0x5348f8]
push edx
call fcn.004ae3bb
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x8e0], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x8dc], 0
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x8d8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x8d4], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x8d0], 1
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x8cc], 0
mov eax, dword [ebp - 0xc]
add eax, 0x894
push eax
mov ecx, dword [0x5348f8]
push ecx
call fcn.004ae4ef
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x4163e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x52fa5c
push 0x104
mov eax, dword [ebp - 4]
add eax, 0x948
push eax
push 0x52f990
push 0x4f1398
push 0x4f13b0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp - 4]
add ecx, 0x7359c
push ecx
mov edx, dword [ebp - 4]
add edx, 0x948
push edx
call fcn.004a87d4
add esp, 8
push 0x52fa5c
push 0x104
mov eax, dword [ebp - 4]
add eax, 0x948
push eax
push 0x52f994
push str.kala_ok_off
push 0x4f13e4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp - 4]
add ecx, 0x735bc
push ecx
mov edx, dword [ebp - 4]
add edx, 0x948
push edx
call fcn.004a87d4
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x41672a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x735dc], 0
jne 0x416892
mov ecx, dword [ebp - 4]
add ecx, 0x2820
push ecx
push 0x104
mov edx, dword [ebp - 4]
add edx, 0x948
push edx
push str.Voice_Cancel
push str.middle_effect_voice_cancle
push 0x4f1454
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 1
mov eax, dword [ebp - 4]
add eax, 0x719fc
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x948
push ecx
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 4]
add ecx, 0x2560
call fcn.004ca943
mov eax, dword [ebp - 4]
add eax, 0x2820
push eax
push 0x104
mov ecx, dword [ebp - 4]
add ecx, 0x948
push ecx
push str.Reset_Key
push str.middle_effect_reset_key
push 0x4f14ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 2
mov edx, dword [ebp - 4]
add edx, 0x71a3c
push edx
mov eax, dword [ebp - 4]
add eax, 0x948
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x2560
call fcn.004ca943
mov edx, dword [ebp - 4]
add edx, 0x2820
push edx
push 0x104
mov eax, dword [ebp - 4]
add eax, 0x948
push eax
push 0x4f14c0
push str.middle_effect_keyshift_text
push 0x4f1500
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 3
mov ecx, dword [ebp - 4]
add ecx, 0x71a4c
push ecx
mov edx, dword [ebp - 4]
add edx, 0x948
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2560
call fcn.004ca943
mov ecx, dword [ebp - 4]
add ecx, 0x2820
push ecx
push 0x104
mov edx, dword [ebp - 4]
add edx, 0x948
push edx
push str.Set_Key___3__3_
push str.middle_effect_keyshift_spin
push 0x4f1570
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0
mov eax, dword [ebp - 4]
add eax, 0x948
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x736c0
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x2560
call fcn.004ca943
mov esp, ebp
pop ebp
ret
Function at 0x417a84
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
je 0x417a96
cmp dword [ebp + 0xc], 0
jne 0x417aa0
mov eax, 0x80070057
jmp 0x417b61
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x417b5c
mov edx, dword [ebp - 4]
push edx
call fcn.004d0006
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x417adf
mov eax, 0x8007000e
jmp 0x417b61
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x417b4a
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x4f2cb4
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x417b4a
cmp dword [ebp - 0x10], 0
je 0x417b4a
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.004d002f
add esp, 4
xor eax, eax
jmp 0x417b61
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004d002f
add esp, 4
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret