joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410de0
Capabilities:
Copy file
Get common file path
Set registry value

Disassembly:
sub esp, 0x628
mov eax, dword [0x61c948]
xor eax, esp
mov dword [esp + 0x624], eax
push ebx
push ebp
mov ebp, dword [esp + 0x634]
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor esi, esi
jmp 0x410e10
mov eax, dword [esi + 0x649450]
push 4
lea ebx, [esi + 0x649454]
push ebx
push 4
push eax
push str.SoftwareGNU_ffdshow
push reloc.WS2_32.dll_accept
call edi
mov ecx, dword [esi + 0x649450]
push 4
push ebx
push 4
push ecx
push str.SoftwareGNU_ffdshow
push reloc.OLEAUT32.dll_SysReAllocString
call edi
add esi, 8
cmp esi, 0x98
jb 0x410e10
xor esi, esi
jmp 0x410e60
mov edx, dword [esi + 0x6494e8]
push 4
lea ebx, [esi + 0x6494ec]
push ebx
push 4
push edx
push str.SoftwareGNU_ffdshow_audio
push reloc.WS2_32.dll_accept
call edi
mov eax, dword [esi + 0x6494e8]
push 4
push ebx
push 4
push eax
push str.SoftwareGNU_ffdshow_audio
push reloc.OLEAUT32.dll_SysReAllocString
call edi
add esi, 8
cmp esi, 0x48
jb 0x410e60
xor esi, esi
mov edx, dword [esi + 0x649a7c]
push 4
lea ecx, [esi + 0x649a80]
push ecx
push 4
push edx
push str.SoftwareGNU_ffdshow_audiodefault
push reloc.WS2_32.dll_accept
call edi
add esi, 8
cmp esi, 0x18
jb 0x410ea0
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push ebp
push 1
push 0x5ea500
push str.SoftwareGNU_ffdshow
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 0x104
lea eax, [esp + 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [esp + 0x10], str.msvcr71.dll
mov dword [esp + 0x14], str.xvidcore.dll
mov dword [esp + 0x18], str.msvcp60.dll
xor edi, edi
jmp 0x410f20
mov esi, dword [esp + edi*4 + 0x10]
push esi
lea ecx, [esp + 0x430]
push ecx
push str._s_s
lea edx, [esp + 0x28]
push 0x104
push edx
call fcn.00472f02
lea eax, [esp + 0x30]
push 0
push eax
call fcn.00474255
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x410f96
push esi
push ebp
push str._s_s
lea ecx, [esp + 0x230]
push 0x104
push ecx
call fcn.00472f02
lea edx, [esp + 0x238]
push 0
push edx
call fcn.00474255
add esp, 0x1c
cmp eax, 0xffffffff
je 0x410f96
push 1
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x22c]
push ecx
call ebx
add edi, 1
cmp edi, 3
jb 0x410f20
mov ecx, dword [esp + 0x634]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004721e8
add esp, 0x628
ret
Function at 0x410fc0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x61c948]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
mov dword [esp + 0xc], str.09571A4B_F1FE_4C60_9760_DE6D310C7C31
mov dword [esp + 0x10], str.345CAA15_4F12_4A28_AFE9_383625563A83
mov dword [esp + 0x14], str.F23B1F18_CB1A_47ED_A1FE_B60494A626D0
xor esi, esi
lea ecx, [ecx]
mov eax, dword [esp + esi*4 + 0xc]
push eax
push str.CLSID_sInprocServer32
lea ecx, [esp + 0x20]
push 0x104
push ecx
call fcn.00472f02
add esp, 0x10
push edi
call ebp
add eax, eax
push eax
push edi
push 1
lea edx, [esp + 0x24]
push edx
push SysReAllocString
call ebx
add esi, 1
cmp esi, 3
jb 0x411000
mov ecx, dword [esp + 0x220]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004721e8
add esp, 0x218
ret

Function at 0x411060
Capabilities:
Set registry value

Disassembly:
sub esp, 0x38
mov eax, dword [0x61c948]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
mov dword [esp + 0x10], str.0_2__0000_4_4__66747970
mov dword [esp + 0x14], str.0_4__52494646_8_4__43445841_36_4__64617461_68_2__0000_72_4__66747970
mov dword [esp + 0x18], str.0_4__4f676753
xor esi, esi
jmp 0x4110a0
lea eax, [esi + 4]
push eax
push 0x5eaa1c
lea ecx, [esp + 0x24]
push 0x14
push ecx
call fcn.00472f02
mov edi, dword [esp + esi*4 + 0x20]
add esp, 0x10
push edi
call ebp
add eax, eax
push eax
push edi
push 1
lea edx, [esp + 0x28]
push edx
push str.Media_Typee436eb83_524f_11ce_9f53_0020af0ba77049952F4C_3EDC_4A9B_8906_1DE02A3D4BC2
push SysReAllocString
call ebx
add esi, 1
cmp esi, 3
jb 0x4110a0
mov dword [esp + 0x1c], str.mp4.1
mov dword [esp + 0x20], str.00000000ffffffff_0000000066747970_B3DE7EDC_0CD4_4d07_B1C5_92219CD475CC
mov dword [esp + 0x24], str.mp4.2
mov dword [esp + 0x28], str.00000000ffffffff_000000006d6f6f76_B3DE7EDC_0CD4_4d07_B1C5_92219CD475CC
mov dword [esp + 0x2c], str.mp4.3
mov dword [esp + 0x30], str.00000000ffffffff_000000006d646174_B3DE7EDC_0CD4_4d07_B1C5_92219CD475CC
mov dword [esp + 0x34], str.ogm.1
mov dword [esp + 0x38], str.ffffffff_4f676753_DB43B405_43AA_4f01_82D8_D84D47E6019C
xor esi, esi
mov edi, dword [esp + esi*8 + 0x20]
push edi
call ebp
add eax, eax
push eax
mov eax, dword [esp + esi*8 + 0x20]
push edi
push 1
push eax
push str.SOFTWAREHaaliMkxInput
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
add esi, 1
cmp esi, 4
jb 0x411120
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004721e8
add esp, 0x38
ret
Function at 0x413ab0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x61c948]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
push ebx
push esi
push edi
je 0x413c15
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x413c15
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x413c15
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
mov dword [edx], 0
mov dword [ecx], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0xc], edi
je 0x413c15
push 0x1000
call fcn.0044ff68
mov esi, eax
add esp, 4
test esi, esi
je 0x413c15
push 0x1000
push 0
push esi
mov dword [ebp - 8], 0
call fcn.004727f0
add esp, 0xc
push 0
lea eax, [ebp - 8]
push eax
push 0xfff
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x413be5
mov eax, dword [ebp - 8]
test eax, eax
je 0x413be5
mov byte [eax + esi], 0
call dword [0x61dd70]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
add edi, 1
cmp edi, 0x3fffffff
jle 0x413b8b
xor eax, eax
jmp 0x413b9e
lea eax, [edi + edi]
call fcn.00477f60
mov eax, esp
push ebx
push edi
push esi
push eax
call fcn.00419110
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call fcn.00412200
add esp, 8
test al, al
je 0x413be5
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
add dword [eax], edx
push 0x1000
push 0
push esi
call fcn.004727f0
mov ecx, dword [ebp - 0xc]
add esp, 0xc
push 0
lea eax, [ebp - 8]
push eax
push 0xfff
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x413b60
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0044ff63
mov eax, dword [ebp + 0x10]
add esp, 4
cmp dword [eax], 0
setne al
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004721e8
mov esp, ebp
pop ebp
ret
xor al, al
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004721e8
mov esp, ebp
pop ebp
ret
Function at 0x4191a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5889a1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
call fcn.0042ac90
xor ebx, ebx
mov dword [esp + 0x30], ebx
lea edi, [esi + 0x58]
mov ecx, edi
mov dword [esi], vtable.DSObjects::CShockwaveGraph.0
mov dword [esi + 0xc], vtable.DSObjects::CShockwaveGraph.1.0
mov dword [esi + 0x10], vtable.DSObjects::CShockwaveGraph.2.0
mov dword [esi + 0x14], vtable.DSObjects::CShockwaveGraph.3.0
mov dword [esi + 0x18], vtable.DSObjects::CShockwaveGraph.4.0
mov dword [esi + 0x1c], vtable.DSObjects::CShockwaveGraph.5.0
mov dword [esi + 0x20], vtable.DSObjects::CShockwaveGraph.6.0
mov dword [esi + 0x24], vtable.DSObjects::CShockwaveGraph.7.0
mov dword [esi + 0x28], vtable.DSObjects::CShockwaveGraph.8.0
mov dword [esi + 0x2c], vtable.DSObjects::CShockwaveGraph.9.0
call fcn.0045347f
mov dword [edi], vtable.CPlayerWindow.0
lea ebp, [esi + 0xac]
mov ecx, ebp
mov byte [esp + 0x30], 1
call fcn.0045347f
mov dword [ebp], vtable.CShockwaveFlash.0
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov byte [esp + 0x30], 2
push ebx
mov dword [esi + 0x100], ebx
mov dword [eax], ebx
mov ecx, dword [edi]
push ebx
push edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x20], ecx
call fcn.0045486d
mov edx, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
mov eax, dword [edx + 0x54]
push 0x56000000
push str.ActiveMovie_Window
push ebx
mov ecx, edi
call eax
test eax, eax
jne 0x4192a3
mov ecx, dword [esp + 0x40]
mov dword [ecx], 0x80004005
jmp 0x4192dd
push ebx
push ebx
push ebx
push ebx
push edi
lea edx, [esp + 0x2c]
push edx
push 0x56000000
push ebx
push 0x5eb10c
mov ecx, ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
call fcn.004638a5
test eax, eax
jne 0x4192dd
mov eax, dword [esp + 0x40]
mov dword [eax], 0x80004005
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
Function at 0x419e70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x588962
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
call fcn.0042ac90
xor ebx, ebx
mov dword [esp + 0x30], ebx
lea edi, [esi + 0x60]
mov ecx, edi
mov dword [esi], vtable.DSObjects::CQuicktimeGraph.0
mov dword [esi + 0xc], vtable.DSObjects::CQuicktimeGraph.1.0
mov dword [esi + 0x10], vtable.DSObjects::CQuicktimeGraph.2.0
mov dword [esi + 0x14], vtable.DSObjects::CQuicktimeGraph.3.0
mov dword [esi + 0x18], vtable.DSObjects::CQuicktimeGraph.4.0
mov dword [esi + 0x1c], vtable.DSObjects::CQuicktimeGraph.5.0
mov dword [esi + 0x20], vtable.DSObjects::CQuicktimeGraph.6.0
mov dword [esi + 0x24], vtable.DSObjects::CQuicktimeGraph.7.0
mov dword [esi + 0x28], vtable.DSObjects::CQuicktimeGraph.8.0
mov dword [esi + 0x2c], vtable.DSObjects::CQuicktimeGraph.9.0
mov dword [esi + 0x58], vtable.DSObjects::CQuicktimeGraph.10.0
mov byte [esi + 0x5c], bl
call fcn.0045347f
mov dword [edi], vtable.CPlayerWindow.0
push esi
lea ebp, [esi + 0xb4]
push ebp
mov byte [esp + 0x38], 1
call fcn.0041aa90
mov eax, dword [esp + 0x40]
mov byte [esp + 0x30], 2
mov dword [eax], ebx
push ebx
mov byte [esi + 0x5c], bl
call fcn.00490840
add esp, 4
test ax, ax
je 0x419f42
mov ecx, dword [esp + 0x40]
mov dword [ecx], 0x80004005
jmp 0x419fdc
call fcn.00490aa0
test ax, ax
je 0x419f5d
call fcn.004909f0
mov edx, dword [esp + 0x40]
mov dword [edx], 0x80004005
jmp 0x419fdc
mov ecx, dword [esp + 0x3c]
mov eax, dword [edi]
push ebx
push ebx
push ecx
mov byte [esi + 0x5c], 1
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x20], eax
call fcn.0045486d
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
mov edx, dword [eax + 0x58]
push 0x56000000
push str.ActiveMovie_Window
push ebx
push 4
mov ecx, edi
call edx
test eax, eax
je 0x419fd2
mov edx, dword [ebp]
mov edx, dword [edx + 0x54]
push ebx
push ebx
push edi
lea eax, [esp + 0x24]
push eax
push 0x56000000
push ebx
push ebx
mov ecx, ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call edx
test eax, eax
jne 0x419fdc
mov eax, dword [esp + 0x40]
mov dword [eax], 0x80004005
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
Function at 0x425180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x589a38
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x20], 0
mov edi, dword [esp + 0x28]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x30], esp
mov ebx, esp
push edi
call fcn.00409dc0
add esp, 4
add eax, 0x10
push 0x5e8c98
mov dword [ebx], eax
call fcn.0042c210
mov dword [esi], vtable.CFGFilterInternal_class_CShoutcastSource_.0
mov dword [esp + 0x18], 0xffffffff
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x425204
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc

Function at 0x425310
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x589a08
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x20], 0
mov edi, dword [esp + 0x28]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x30], esp
mov ebx, esp
push edi
call fcn.00409dc0
add esp, 4
add eax, 0x10
push 0x5ed1e0
mov dword [ebx], eax
call fcn.0042c210
mov dword [esi], vtable.CFGFilterInternal_class_CUDPReader_.0
mov dword [esp + 0x18], 0xffffffff
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x425394
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc

Function at 0x4254a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5899d8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x20], 0
mov edi, dword [esp + 0x28]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x30], esp
mov ebx, esp
push edi
call fcn.00409dc0
add esp, 4
add eax, 0x10
push 0x5ed1f0
mov dword [ebx], eax
call fcn.0042c210
mov dword [esi], vtable.CFGFilterInternal_class_CAviSourceFilter_.0
mov dword [esp + 0x18], 0xffffffff
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x425524
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
Function at 0x425630
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5899a8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x20], 0
mov edi, dword [esp + 0x28]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x30], esp
mov ebx, esp
push edi
call fcn.00409dc0
add esp, 4
add eax, 0x10
push 0x5ed200
mov dword [ebx], eax
call fcn.0042c210
mov dword [esi], vtable.CFGFilterInternal_class_CFLVSourceFilter_.0
mov dword [esp + 0x18], 0xffffffff
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4256b4
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc

Function at 0x4257c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x589978
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x20], 0
mov edi, dword [esp + 0x28]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x30], esp
mov ebx, esp
push edi
call fcn.00409dc0
add esp, 4
add eax, 0x10
push 0x5ed210
mov dword [ebx], eax
call fcn.0042c210
mov dword [esi], vtable.CFGFilterInternal_class_CMatroskaSourceFilter_.0
mov dword [esp + 0x18], 0xffffffff
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x425844
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc

Function at 0x425950
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x589948
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x20], 0
mov edi, dword [esp + 0x28]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x30], esp
mov ebx, esp
push edi
call fcn.00409dc0
add esp, 4
add eax, 0x10
push 0x5ed220
mov dword [ebx], eax
call fcn.0042c210
mov dword [esi], vtable.CFGFilterInternal_class_CRealMediaSourceFilter_.0
mov dword [esp + 0x18], 0xffffffff
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4259d4
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
Function at 0x425ae0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x589918
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x20], 0
mov edi, dword [esp + 0x28]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x30], esp
mov ebx, esp
push edi
call fcn.00409dc0
add esp, 4
add eax, 0x10
push 0x5ed230
mov dword [ebx], eax
call fcn.0042c210
mov dword [esi], vtable.CFGFilterInternal_class_CDSMSourceFilter_.0
mov dword [esp + 0x18], 0xffffffff
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x425b64
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc

Function at 0x425c70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5898e8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x20], 0
mov edi, dword [esp + 0x28]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x30], esp
mov ebx, esp
push edi
call fcn.00409dc0
add esp, 4
add eax, 0x10
push 0x5ed240
mov dword [ebx], eax
call fcn.0042c210
mov dword [esi], vtable.CFGFilterInternal_class_CFLICSource_.0
mov dword [esp + 0x18], 0xffffffff
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x425cf4
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc

Function at 0x425e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5898b8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x20], 0
mov edi, dword [esp + 0x28]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x30], esp
mov ebx, esp
push edi
call fcn.00409dc0
add esp, 4
add eax, 0x10
push 0x5ed250
mov dword [ebx], eax
call fcn.0042c210
mov dword [esi], vtable.CFGFilterInternal_class_CCDDAReader_.0
mov dword [esp + 0x18], 0xffffffff
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x425e84
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
Function at 0x425f90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x589888
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x20], 0
mov edi, dword [esp + 0x28]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x30], esp
mov ebx, esp
push edi
call fcn.00409dc0
add esp, 4
add eax, 0x10
push 0x5ed260
mov dword [ebx], eax
call fcn.0042c210
mov dword [esi], vtable.CFGFilterInternal_class_CCDXAReader_.0
mov dword [esp + 0x18], 0xffffffff
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x426014
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc

Function at 0x426120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x589858
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x20], 0
mov edi, dword [esp + 0x28]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x30], esp
mov ebx, esp
push edi
call fcn.00409dc0
add esp, 4
add eax, 0x10
push 0x5ed270
mov dword [ebx], eax
call fcn.0042c210
mov dword [esi], vtable.CFGFilterInternal_class_CVTSReader_.0
mov dword [esp + 0x18], 0xffffffff
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4261a4
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc

Function at 0x4262b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x589828
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x20], 0
mov edi, dword [esp + 0x28]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x30], esp
mov ebx, esp
push edi
call fcn.00409dc0
add esp, 4
add eax, 0x10
push 0x5ed280
mov dword [ebx], eax
call fcn.0042c210
mov dword [esi], vtable.CFGFilterInternal_class_CD2VSource_.0
mov dword [esp + 0x18], 0xffffffff
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x426334
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc