joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d6720
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
lea esi, [ebp + 0xc]
push esi
push 0x4d6a30
call sub.DSOUND.dll_DirectSoundEnumerateW
cmp dword [esi], 0
je 0x4d67a9
mov ebx, ebp
call fcn.004d6b50
test eax, eax
je 0x4d67a9
mov ebx, dword [esp + 0x18]
mov ecx, ebp
call fcn.004d67c0
test eax, eax
je 0x4d67a9
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
xor edi, edi
lea esi, [ebp + 0x48]
push 0
push 0
push 0
push 0
call ebx
test eax, eax
mov dword [esi], eax
je 0x4d67a9
add edi, 1
add esi, 4
cmp edi, 4
jl 0x4d6760
push 0
push 0
push 0
push 0
call ebx
test eax, eax
mov dword [ebp + 0x44], eax
je 0x4d67a9
lea eax, [ebp + 0x5c]
push eax
push 0
push ebp
push 0x4d6980
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [ebp + 0x58], eax
jne 0x4d67b2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8

Function at 0x4d8390
Capabilities:
Terminate thread

Disassembly:
push edi
xor edi, edi
cmp dword [esi + 0x30], edi
je 0x4d83d1
mov eax, dword [esi + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x30]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4d83c4
mov edx, dword [esi + 0x30]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [esi + 0x30], edi
mov eax, dword [esi + 0x38]
cmp eax, edi
je 0x4d83e2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x38], edi
mov dword [esi + 4], edi
pop edi
ret

Function at 0x4d83f0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [esi + 0x34], 0
jne 0x4d8408
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x34], eax
cmp dword [esi + 0x30], 0
jne 0x4d8437
cmp dword [esi + 0x34], 0
je 0x4d8437
lea eax, [esp]
push eax
push 0
push esi
push 0x4d8530
push 0
push 0
mov dword [esp + 0x18], 0
call fcn.0052342e
add esp, 0x18
mov dword [esi + 0x30], eax
xor eax, eax
cmp dword [esi + 0x30], eax
setne al
pop ecx
ret
Function at 0x4dd0f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x54c2c0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x20]
push edi
push ebp
lea eax, [esp + 0x28]
push eax
push esi
mov ebx, ecx
call fcn.004dd020
lea ecx, [esi + 0x30]
push eax
mov dword [esp + 0x1c], 0
call fcn.00404ff0
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4dd15f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
push ebp
lea ecx, [esp + 0x14]
push ecx
push esi
mov ebx, 0xc
call fcn.004dd020
lea ecx, [esi + 0xa4]
push eax
mov dword [esp + 0x1c], 1
call fcn.00404ff0
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4dd1ad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0x10
ret 4

Function at 0x4dd1d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x547c61
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
xor edi, edi
mov dword [esp + 0x18], edi
push str.SOFTWARESRS_LabsAPO
mov ecx, esi
mov dword [esp + 0x10], edi
call fcn.00404670
mov dword [esp + 0x18], edi
mov edi, 1
push edi
push 0x56497c
mov ecx, esi
mov dword [esp + 0x14], edi
call fcn.00404550
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.004dcd20
mov dword [esp + 0x18], edi
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov ecx, esi
call fcn.00404550
mov byte [esp + 0x18], 0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4dd272
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0xc
Function at 0x4dde10
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get file attributes

Disassembly:
mov eax, 0x2006c
call fcn.005259e0
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x20064], eax
push esi
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
xor edi, edi
push str.SRSEndpointIsInitialized
mov dword [esp + 0x10], edi
lea esi, [esp + 0x10]
call fcn.00404670
push ebx
mov ecx, esi
call fcn.004db260
mov esi, eax
cmp esi, edi
je 0x4dde6d
lea eax, [edi + 1]
pop edi
pop esi
mov ecx, dword [esp + 0x20064]
xor ecx, esp
call fcn.0052151a
add esp, 0x2006c
ret
push 0xfffc
lea eax, [esp + 0x6e]
push edi
push eax
mov word [esp + 0x74], di
call fcn.00523750
push 0xfffc
lea ecx, [esp + 0x1007a]
push edi
push ecx
mov word [esp + 0x10080], di
call fcn.00523750
add esp, 0x18
push 0x7fff
lea edx, [esp + 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4ddfac
lea eax, [esp + 0x68]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4ddec0
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x66], 0x5c
jne 0x4ddef4
lea eax, [esp + 0x68]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4ddee0
sub eax, edx
sar eax, 1
mov word [esp + eax*2 + 0x66], di
push 0x56497c
lea eax, [esp + 0x6c]
push 0x7fff
push eax
call fcn.005221e4
push str.SRSLabs
lea ecx, [esp + 0x78]
push 0x7fff
push ecx
call fcn.005221e4
push 0x56497c
lea edx, [esp + 0x84]
push 0x7fff
push edx
call fcn.005221e4
push str.176F4E15_8F7C_4833_ADED_81FAE8CCD186
lea eax, [esp + 0x90]
push 0x7fff
push eax
call fcn.005221e4
push str._slInit32.dll
lea ecx, [esp + 0x9c]
push 0x7fff
push ecx
call fcn.005221e4
push str._rundll32.exe_
lea edx, [esp + 0x100a8]
push 0x7fff
push edx
call fcn.005221e4
add esp, 0x48
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x1006c]
push 0x7fff
push ecx
call fcn.005221e4
push str._SRS_InitializeEndpoints_Rundll32
lea edx, [esp + 0x10078]
push 0x7fff
push edx
call fcn.005221e4
add esp, 0x18
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4de050
push 0x44
lea ecx, [esp + 0x24]
push edi
push ecx
call fcn.00523750
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x10088]
push ecx
push edi
mov dword [esp + 0x48], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4de024
pop edi
pop esi
mov ecx, dword [esp + 0x20064]
xor ecx, esp
call fcn.0052151a
add esp, 0x2006c
ret
mov edx, dword [esp + 0x10]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push str.SRSEndpointIsInitialized
lea esi, [esp + 0x10]
call fcn.00404670
push ebx
mov ecx, esi
call fcn.004db260
mov esi, eax
mov ecx, dword [esp + 0x2006c]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0052151a
add esp, 0x2006c
ret
Function at 0x4e47c0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x545008
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x34]
xor edi, edi
cmp ebp, edi
je 0x4e48b2
mov dword [esp + 0x1c], edi
mov esi, ecx
lea ebx, [esp + 0x34]
mov dword [esp + 0x28], edi
call fcn.00422d00
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x14]
push eax
push 1
push edi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x4e4892
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push edi
push ecx
mov ebx, 4
push esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x48], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x4e4863
cmp dword [esp + 0x14], ebx
je 0x4e48b6
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4e4883
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, edi
je 0x4e488e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4e48ed
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4e48b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x4e48ed
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov dword [ebp], ecx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4e48dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, edi
je 0x4e48e8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x4e4910
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x547188
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov esi, ecx
lea ebx, [esp + 0xc]
mov dword [esp + 0x20], 0
call fcn.00422d00
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x10]
push eax
push 2
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e49e0
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push 4
lea edx, [esp + 0x2c]
push edx
push 4
push eax
mov eax, dword [esp + 0x1c]
push eax
push esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x40], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
or edx, 0xffffffff
test eax, eax
mov eax, dword [esp + 0xc]
je 0x4e4a16
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4e49bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x4e49ca
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4e4a00
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret 8
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4e4a2f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x4e4a3a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret 8
Function at 0x4f4910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x54f04c
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov edi, dword [esp + 0x84]
xor ebx, ebx
push 0xa
lea ecx, [esp + 0x58]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call fcn.005032d0
mov dword [esp + 0x54], vtable.CTypedPtrList_class_CPtrList__class_CVolumeControlDlg__.0
mov dword [esp + 0x7c], ebx
mov eax, dword [edi + 0x7c]
mov ebp, dword [eax + 0x19bc]
cmp ebp, ebx
mov dword [esp + 0x24], ebx
je 0x4f4ac5
test ebp, ebp
mov eax, ebp
je 0x4f4b3a
mov ebp, dword [ebp]
mov esi, dword [eax + 8]
push 0x564f30
lea ecx, [esp + 0x1c]
call fcn.00404670
test esi, esi
mov byte [esp + 0x7c], 1
je 0x4f4a91
cmp dword [esi + 0x34], 1
jne 0x4f4a91
cmp dword [esi + 0x24], 0
je 0x4f4a91
cmp dword [esi + 0x88], 0
je 0x4f4a91
test ebx, ebx
jne 0x4f4a20
mov edx, dword [esi]
mov edx, dword [edx + 0x14]
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call edx
test eax, eax
je 0x4f4a91
lea edi, [esp + 0x18]
call fcn.00410630
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], ebx
jl 0x4f4a0e
push 0x5679a4
push eax
call fcn.00522186
add esp, 8
test eax, eax
je 0x4f4a0e
sub eax, dword [esp + 0x18]
sar eax, 1
jns 0x4f4a17
cmp dword [esi + 0x88], 1
jle 0x4f4a20
mov dword [esp + 0x24], esi
mov ebx, 1
mov ecx, dword [esi + 0x80]
mov edi, dword [ecx + 8]
test edi, edi
jne 0x4f4a48
mov byte [esp + 0x7c], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4f4aaa
push 0x4a4
call fcn.004fae94
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov byte [esp + 0x7c], 2
je 0x4f4a6c
push esi
push edi
push eax
call fcn.004f2500
jmp 0x4f4a6e
xor eax, eax
test eax, eax
mov byte [esp + 0x7c], 1
je 0x4f4a91
cmp dword [eax + 0x20], 0
jne 0x4f4a87
mov dword [eax + 0x108], 1
push eax
lea ecx, [esp + 0x58]
call fcn.00503381
mov byte [esp + 0x7c], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f4ab6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebp, ebp
jne 0x4f497c
mov edi, dword [esp + 0x84]
mov ecx, dword [edi + 0x7c]
test dword [ecx + 0xc], 0x800000
mov esi, dword [esp + 0x58]
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 8
mov dword [esp + 0x4c], 2
mov dword [esp + 0x50], 0xa
je 0x4f4b64
mov ebx, dword [esp + 0x84]
xor edi, edi
mov edi, edi
test esi, esi
je 0x4f4b87
test esi, esi
mov eax, esi
je 0x4f4b3a
mov eax, dword [eax + 8]
test eax, eax
mov esi, dword [esi]
je 0x4f4b83
push eax
lea ecx, [edi + 0x41c]
call fcn.00503381
test esi, esi
jne 0x4f4b68
Function at 0x4f6630
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
push 0x48
mov ebx, eax
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00523750
add esp, 0xc
call fcn.00503137
mov eax, dword [eax + 8]
push 0x57ed6c
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test ebx, ebx
mov esi, eax
je 0x4f6771
test esi, esi
je 0x4f6771
call fcn.00503137
mov eax, dword [eax + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
call fcn.00503137
mov eax, dword [eax + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
mov dword [esp + 0x34], eax
mov dword [esp + 0x20], 0x204d454d
mov dword [esp + 0x30], esi
call dword [sym.imp.WINMM.dll_mmioOpenW]
push 0x20
push 0
lea ebx, [edi + 0x84]
mov esi, eax
push ebx
push esi
mov dword [edi + 0x8c], 0x45564157
call dword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x4f6768
push 0x10
push ebx
lea ebp, [edi + 0x70]
push ebp
push esi
mov dword [ebp], 0x20746d66
call dword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
push 0
jne 0x4f676a
push ebp
push esi
call dword [sym.imp.WINMM.dll_mmioAscend]
push 0x10
push ebx
lea ebp, [edi + 0x5c]
push ebp
push esi
mov dword [ebp], 0x61746164
call dword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
push 0
jne 0x4f676a
push ebp
push esi
call dword [sym.imp.WINMM.dll_mmioAscend]
mov edx, dword [edi + 0x7c]
push 0
push edx
push esi
call dword [sym.imp.WINMM.dll_mmioSeek]
mov eax, dword [edi + 0x74]
push eax
lea ecx, [edi + 0x34]
push ecx
push esi
call dword [sym.imp.WINMM.dll_mmioRead]
cmp dword [edi + 0x74], eax
jne 0x4f6768
cmp word [edi + 0x36], 1
jne 0x4f6768
cmp word [edi + 0x42], 0x10
jne 0x4f6768
mov dword [edi + 0xc4], 0
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
push 0
push esi
call dword [sym.imp.WINMM.dll_mmioClose]
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret
Function at 0x4f70f0
Capabilities:
Get file size
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
test eax, eax
push ebx
push esi
jne 0x4f7104
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 3
push 0
push 1
mov dword [edi + 4], eax
mov eax, dword [0x5bbc4c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4f70fc
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp esi, 0xffffffff
setne al
test eax, eax
je 0x4f70fc
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004faec4
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4f70fc
mov word [ebx], 0
mov eax, dword [0x5bbc4c]
push eax
push esi
push ebx
push 0x564f30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0x5843ac
push str.DefLevel
mov ecx, 0x5b9548
call fcn.00507bbf
mov dword [edi + 8], eax
cmp word [ebx], 0
mov esi, ebx
je 0x4f71ca
mov edx, esi
mov ecx, edi
call fcn.004f7330
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4f71b0
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 + 2], cx
lea esi, [esi + eax*2 + 2]
jne 0x4f71a2
cmp dword [edi + 0x10], 0
je 0x4f71ec
add dword [edi + 8], 1
mov eax, dword [edi + 8]
push eax
push 0x5843ac
push str.DefLevel
mov ecx, 0x5b9548
call fcn.00507c28
cmp dword [edi + 0xc], 0
jne 0x4f7212
push 1
push str.Finished
push str.DefLevel
mov ecx, 0x5b9548
call fcn.00507c28
mov dword [0x5b708c], 1
push ebx
call fcn.004faebf
add esp, 4
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f7620
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x544b78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x18], eax
push ebp
push edi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebp, ebp
xor eax, eax
cmp esi, ebp
je 0x4f77f7
push ebp
lea edi, [ebx + 4]
push 0x564f30
mov ecx, edi
mov word [esp + 0x18], bp
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
mov word [ebx], bp
mov word [ebx + 2], bp
call fcn.00404a30
push ebp
lea ecx, [ebx + 8]
push 0x564f30
call fcn.00404a30
push 0x26
push esi
mov dword [ebx + 0xc], ebp
call fcn.0052246a
add esp, 8
test eax, eax
je 0x4f7710
push 0x26
push esi
call fcn.0052246a
sub eax, esi
sar eax, 1
add eax, 1
add esp, 8
cmp eax, 0x7ffffffe
jbe 0x4f76cd
mov word [esp + 0x10], bp
jmp 0x4f76d8
mov edx, esi
lea ecx, [esp + 0x10]
call fcn.004f7070
lea eax, [esp + 0x10]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x4f76e0
sub eax, edx
sar eax, 1
cmp eax, 8
jb 0x4f7710
push 0x10
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.005226b3
mov ecx, eax
add esp, 0xc
shr ecx, 0x10
mov word [ebx], cx
mov word [ebx + 2], ax
push 0x26
push esi
call fcn.0052246a
add esp, 8
test eax, eax
je 0x4f77b5
push 0x5f
push esi
call fcn.0052246a
add esp, 8
test eax, eax
je 0x4f77b5
push esi
mov ecx, edi
call fcn.004049b0
push 0x5f
push esi
call fcn.0052246a
push 0x26
push esi
mov ebp, eax
call fcn.0052246a
sub ebp, eax
add esp, 0x10
sar ebp, 1
sub ebp, 1
push ebp
push 0x26
push esi
call fcn.0052246a
sub eax, esi
sar eax, 1
add esp, 8
add eax, 1
push eax
lea edx, [esp + 0x14]
push edx
mov ecx, edi
call fcn.00410b50
xor ebp, ebp
push eax
mov ecx, edi
mov dword [esp + 0x34], ebp
call fcn.00404ff0
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f77b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.00410630
push 0x5f
push esi
call fcn.0052246a
add esp, 8
test eax, eax
je 0x4f77db
push 0x5f
push esi
call fcn.0052246a
add esp, 8
add eax, 2
push eax
lea ecx, [ebx + 8]
call fcn.004049b0
mov ecx, dword [0x5bbc4c]
push ecx
push ebp
push str.MasterVol
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebx + 0xc], eax
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0052151a
add esp, 0x28
ret
Function at 0x4f7c30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [0x5b708c], 0
jne 0x4f7c8e
push 0
push str.Finished
push str.DefLevel
mov ecx, 0x5b9548
call fcn.00507bbf
test eax, eax
mov dword [0x5b708c], eax
jne 0x4f7c8e
call fcn.004f7230
mov eax, dword [0x5bbc4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4f7c91
push 1
push str.Finished
push str.DefLevel
mov ecx, 0x5b9548
call fcn.00507c28
mov dword [0x5b708c], 1
xor eax, eax
ret
mov eax, 1
ret

Function at 0x4f7ca0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x11c], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jae 0x4f7ce7
call fcn.004f7da0
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0052151a
add esp, 0x120
ret
call fcn.004f9810
cmp eax, 6
ja case.default.0x4f7cf1
jmp dword [eax*4 + 0x4f7d78]
mov eax, 1
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0052151a
add esp, 0x120
ret
mov eax, 2
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0052151a
add esp, 0x120
ret
mov eax, 3
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0052151a
add esp, 0x120
ret
xor eax, eax
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0052151a
add esp, 0x120
ret
mov ecx, dword [esp + 0x11c]
xor ecx, esp
mov eax, DirectSoundEnumerateW
call fcn.0052151a
add esp, 0x120
ret

Function at 0x4f80c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x170
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
xor edi, edi
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jb 0x4f8140
call fcn.004f97a0
test eax, eax
je 0x4f81be
test byte [0x5bbc68], 3
jne 0x4f8123
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052151a
add esp, 0x170
ret
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052151a
add esp, 0x170
ret
push edi
push edi
push 3
push edi
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, 1
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
je 0x4f81be
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], edi
call fcn.004faaa0
test eax, eax
je 0x4f819a
cmp dword [esp + 0x2c], edi
jne 0x4f81b5
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], esi
call fcn.004faaa0
test eax, eax
je 0x4f81b7
cmp dword [esp + 0x2c], edi
je 0x4f81b7
mov edi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x174]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052151a
add esp, 0x170
ret